From nobody Fri Mar 1 13:13:29 2019 Return-Path: X-Original-To: doh@ietf.org Delivered-To: doh@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1FBD0130F08; Fri, 1 Mar 2019 13:10:03 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: doh@ietf.org, adam@nostrum.com X-Test-IDTracker: no X-IETF-IDTracker: 6.92.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <155147460312.6101.11204984133979391977.idtracker@ietfa.amsl.com> Date: Fri, 01 Mar 2019 13:10:03 -0800 Archived-At: Subject: [Doh] doh - Requested session has been scheduled for IETF 104 X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Mar 2019 21:10:14 -0000 Dear David Lawrence, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. doh Session 1 (1:00 requested) Tuesday, 26 March 2019, Morning Session II 1120-1220 Room Name: Grand Ballroom size: 250 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/104/sessions/doh.ics Request Information: --------------------------------------------------------- Working Group Name: DNS Over HTTPS Area Name: Applications and Real-Time Area Session Requester: David Lawrence Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 100 Conflicts to Avoid: First Priority: dprive dnsop httpbis Second Priority: dispatch dnssd teep hrpc People who must be present: Adam Roach Benjamin M. Schwartz David C Lawrence Resources Requested: Special Requests: --------------------------------------------------------- From nobody Wed Mar 6 16:18:13 2019 Return-Path: X-Original-To: doh@ietf.org Delivered-To: doh@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id A10AA12008A; Wed, 6 Mar 2019 16:18:06 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: doh@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.93.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: doh@ietf.org Message-ID: <155191788661.13814.10114885708675661998@ietfa.amsl.com> Date: Wed, 06 Mar 2019 16:18:06 -0800 Archived-At: Subject: [Doh] I-D Action: draft-ietf-doh-resolver-associated-doh-01.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 00:18:07 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Over HTTPS WG of the IETF. Title : Associating a DoH Server with a Resolver Author : Paul Hoffman Filename : draft-ietf-doh-resolver-associated-doh-01.txt Pages : 10 Date : 2019-03-06 Abstract: Browsers and web applications may want to know if there are one or more DoH servers associated with the DNS recursive resolver that the operating system is already using. This would allow them to get DNS responses from a resolver that the user (or, more likely, the user's network administrator) has already chosen. This document describes two protocols for a resolver to tell a client what its associated DoH servers are. It also describes a protocol for a client to find out the address of the resolver it is using, if it cannot find that address by an operating system API or some other means. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-doh-resolver-associated-doh/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-doh-resolver-associated-doh-01 https://datatracker.ietf.org/doc/html/draft-ietf-doh-resolver-associated-doh-01 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-doh-resolver-associated-doh-01 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Mar 6 16:19:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 74FA31310F7 for ; Wed, 6 Mar 2019 16:19:00 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6KoF4j0LOC8G for ; Wed, 6 Mar 2019 16:18:59 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 62904126F72 for ; Wed, 6 Mar 2019 16:18:59 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Wed, 6 Mar 2019 16:18:57 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Wed, 6 Mar 2019 16:18:57 -0800 From: Paul Hoffman To: DoH WG Thread-Topic: Changes in draft-ietf-doh-resolver-associated-doh-01 Thread-Index: AQHU1HtaKW7Yd31zOk+Dlru9pnF9OA== Date: Thu, 7 Mar 2019 00:18:56 +0000 Message-ID: <784FED62-3169-4919-8756-FD48DEA9EA45@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.236] Content-Type: text/plain; charset="us-ascii" Content-ID: <1F581DC099D3874D8E16FF2EFA9DA99A@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Doh] Changes in draft-ietf-doh-resolver-associated-doh-01 X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 00:19:00 -0000 If you looked at the diff, you'll know: it's pretty much a complete reorgan= ization based on comments that I got that the order and style of the three = protocols defined in the document made it hard to determine which protocol = did what. The discussion about web applications was reduced to a minimum. A= lso, the details for "DoH Servers from HTTPS" were filled in; it is now def= initely JSON returned. Feel free to comment. There is still more to do here. --Paul Hoffman From nobody Wed Mar 6 16:36:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33AAE13127C for ; Wed, 6 Mar 2019 16:36:42 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.233 X-Spam-Level: X-Spam-Status: No, score=-1.233 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, KHOP_DYNAMIC=1.468, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4BJehsb3-MD7 for ; Wed, 6 Mar 2019 16:36:40 -0800 (PST) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9ED9C131146 for ; Wed, 6 Mar 2019 16:36:40 -0800 (PST) Received: from pps.filterd (m0122331.ppops.net [127.0.0.1]) by mx0b-00190b01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x270WGHC018464 for ; Thu, 7 Mar 2019 00:36:39 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=jan2016.eng; bh=KVo7B/t1FvobRRbiSuvdpuQs78gDik5E5kjikKkNJis=; b=Ki987ZnB9ogOe2MDldxKRyPFjzN7+ifs75+uB7IMDN4+ZqEZInZ8+bX6a/SrrBqfNKCP l+d+8xyzeVi5OiD+HUyVVJJUvY+w9QkfsQm3pLpVdrJx8Lr3hHm+SEE5Yc5BaSiBhkW4 5LJpBO5e1W7af+1iyp+o1vXmZz/moU6Wm/kztKgYIlYuFJvj6AjrR11ovzOvylEoZTtc I2YwT3gHn4Dftlr7vu2V3n+IqbHHx8TC8tVr8XaSN41Rm9KFtBsmgi8dRgD0XOiWV9Su OcWA/QK/gxwly2cxIa7OeaEqpBNo3dZ1C4+0Bcy9XUlGLK+MqTmJyW7CHOJHLIjyfJPc tw== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by mx0b-00190b01.pphosted.com with ESMTP id 2r2nrk8kc8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 07 Mar 2019 00:36:39 +0000 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x270ZZnb012697 for ; Wed, 6 Mar 2019 19:36:39 -0500 Received: from email.msg.corp.akamai.com ([172.27.123.31]) by prod-mail-ppoint1.akamai.com with ESMTP id 2qyp20uypg-2 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Wed, 06 Mar 2019 19:36:37 -0500 Received: from USMA1EX-DAG1MB5.msg.corp.akamai.com (172.27.123.105) by usma1ex-dag3mb1.msg.corp.akamai.com (172.27.123.60) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 6 Mar 2019 19:36:35 -0500 Received: from USMA1EX-DAG1MB3.msg.corp.akamai.com (172.27.123.103) by usma1ex-dag1mb5.msg.corp.akamai.com (172.27.123.105) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 6 Mar 2019 19:36:35 -0500 Received: from USMA1EX-DAG1MB3.msg.corp.akamai.com ([172.27.123.103]) by usma1ex-dag1mb3.msg.corp.akamai.com ([172.27.123.103]) with mapi id 15.00.1473.003; Wed, 6 Mar 2019 19:36:34 -0500 From: "Hewitt, Rory" To: DoH WG Thread-Topic: Changes in draft-ietf-doh-resolver-associated-doh-01 Thread-Index: AQHU1HtaKW7Yd31zOk+Dlru9pnF9OKX/T7aw Date: Thu, 7 Mar 2019 00:36:34 +0000 Message-ID: <69e135a6a4bf43dc956fa50c30624a8b@usma1ex-dag1mb3.msg.corp.akamai.com> References: <784FED62-3169-4919-8756-FD48DEA9EA45@icann.org> In-Reply-To: <784FED62-3169-4919-8756-FD48DEA9EA45@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.19.112.243] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-06_16:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903070001 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-06_16:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903070001 Archived-At: Subject: Re: [Doh] Changes in draft-ietf-doh-resolver-associated-doh-01 X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 00:36:42 -0000 Paul, In Sec 2.1, could we see an example TXT record? If multiple TXT records are returned, in addition to the URI template itsel= f, can each contain some indication of priority (similar to MX records) and= /or re-resolving strategies (round-robin, etc.) to apply across the set of = TXT records? In Sec 2.2, for [[ Need to talk about what a response with an empty list m= eans ]], it would be simplest to return a 501 Not Implemented, no? Rory -----Original Message----- From: Paul Hoffman =20 Sent: Wednesday, March 6, 2019 4:19 PM To: DoH WG Subject: [Doh] Changes in draft-ietf-doh-resolver-associated-doh-01 If you looked at the diff, you'll know: it's pretty much a complete reorgan= ization based on comments that I got that the order and style of the three = protocols defined in the document made it hard to determine which protocol = did what. The discussion about web applications was reduced to a minimum. A= lso, the details for "DoH Servers from HTTPS" were filled in; it is now def= initely JSON returned. Feel free to comment. There is still more to do here. --Paul Hoffman _______________________________________________ Doh mailing list Doh@ietf.org https://www.ietf.org/mailman/listinfo/doh From nobody Wed Mar 6 20:56:47 2019 Return-Path: X-Original-To: doh@ietf.org Delivered-To: doh@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D191E130EA5; Wed, 6 Mar 2019 20:56:39 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: doh@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.93.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: doh@ietf.org Message-ID: <155193459983.13781.2706398894776032431@ietfa.amsl.com> Date: Wed, 06 Mar 2019 20:56:39 -0800 Archived-At: Subject: [Doh] I-D Action: draft-ietf-doh-resolver-associated-doh-02.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 04:56:40 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Over HTTPS WG of the IETF. Title : Associating a DoH Server with a Resolver Author : Paul Hoffman Filename : draft-ietf-doh-resolver-associated-doh-02.txt Pages : 9 Date : 2019-03-06 Abstract: Browsers and web applications may want to know if there are one or more DoH servers associated with the DNS recursive resolver that the operating system is already using. This would allow them to get DNS responses from a resolver that the user (or, more likely, the user's network administrator) has already chosen. This document describes two protocols for a resolver to tell a client what its associated DoH servers are. It also describes a protocol for a client to find out the address of the resolver it is using, if it cannot find that address by an operating system API or some other means. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-doh-resolver-associated-doh/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-doh-resolver-associated-doh-02 https://datatracker.ietf.org/doc/html/draft-ietf-doh-resolver-associated-doh-02 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-doh-resolver-associated-doh-02 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Wed Mar 6 20:58:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F247130EA5 for ; Wed, 6 Mar 2019 20:58:08 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SCWUo4aW6oaR for ; Wed, 6 Mar 2019 20:58:06 -0800 (PST) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69E59130EA0 for ; Wed, 6 Mar 2019 20:58:06 -0800 (PST) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Wed, 6 Mar 2019 20:58:04 -0800 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Wed, 6 Mar 2019 20:58:04 -0800 From: Paul Hoffman To: DoH WG Thread-Topic: Changes in draft-ietf-doh-resolver-associated-doh-02 Thread-Index: AQHU1KJYtCmHlqakTU2FU0CGaw/sOg== Date: Thu, 7 Mar 2019 04:58:04 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Doh] Changes in draft-ietf-doh-resolver-associated-doh-02 X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 07 Mar 2019 04:58:08 -0000 [[ There was a massive failure of my git usage in the -01. The updates that= were supposed to be there are now in the -02. My apologies! ]] If you looked at the diff, you'll know: it's pretty much a complete reorgan= ization based on comments that I got that the order and style of the three = protocols defined in the document made it hard to determine which protocol = did what. The discussion about web applications was reduced to a minimum. A= lso, the details for "DoH Servers from HTTPS" were filled in; it is now def= initely JSON returned. Feel free to comment. There is still more to do here. --Paul Hoffman From nobody Fri Mar 8 17:24:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F8F3128678 for ; Fri, 8 Mar 2019 17:24:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lxibitA_XJLp for ; Fri, 8 Mar 2019 17:24:00 -0800 (PST) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1AE7D124B0C for ; Fri, 8 Mar 2019 17:24:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552094639; x=2416008239; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=awVn62Qrm+4DtcSbYq2B+PKW22lYQxdA7i7pzey4o38=; b=npMwcbFl79hGqvapNp3fobAS+1Lg+sw96Vg9rSwL6QSCLIFXTjwLArCON89pnc8B pNtj7LYHQ8S4x+TOlswgYO5ADsNeSYm5btdpzySmJtLyfrQyoVODU7TXSkC1Q1mo JcQkACUs8H/et9XlC145K8J34Ac7d9xHzliwLximvOlDadas0DG3CW0vAzXH0GZb nnYQlor63JB4Nm6FqIpKfpeoCBW3lN1KgflRSos6A4X13I0QcuAL+VNLs6JMAw2r 5xfoQwipGxT+9ZMbQKnP62Rg0JGd7bcYNoqvggdludv4lYujiqcoSACYFa03rzE+ pjzCznwUt358o7uYXEXU3mHRlzIqH2/3fVHUE/1ATBA1AH/R4plQr+g27Sn7cPc5 eS7kOUR140xoG/6dTMnyblJLgmd/HEmO5xsHckaTqNWB9QiFuE70Kd8sQlPPgzKM nWeyZ3ODdb6n8OUrN7tQ23FX0VLkotYuGtvs1ioqmqGuFij5QEthetWGm270ilxI Sowb0uKBmEK6weXPmx3x4mTpWJ03n8aLx7dz9Ag8wUG++afNDcaNdSxdV3XlqMvr uIU9lhPrF6LBSeGfsjiRDsVnyWh3xgIZrM9wC79D3kW60fPYr5L78uV43yoec4Q+ deo002Pj5SokR4HKCfkGe9bpEg2Z1caaJBuk/wEPV9M=; X-AuditID: 60729ed4-2cdff700000044dc-5d-5c8315add603 Received: from COPDCEXC37.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id D7.B8.17628.EA5138C5; Fri, 8 Mar 2019 18:23:59 -0700 (MST) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC37.cable.comcast.com (147.191.125.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 8 Mar 2019 20:23:56 -0500 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Fri, 8 Mar 2019 20:23:56 -0500 From: "Livingood, Jason" To: DoH WG Thread-Topic: draft-livingood-doh-implementation-risks-issues Thread-Index: AQHU1hbDDNj2GhBc2k6lTCYNWHxRBQ== Date: Sat, 9 Mar 2019 01:23:56 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190115 x-originating-ip: [68.87.29.11] Content-Type: multipart/mixed; boundary="_002_EA2A119D06CF4B0B899486A99CD8AC0Bcablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrCKsWRmVeSWpSXmKPExsWSUDRnsu560eYYg10npSyu3b3I5sDosWTJ T6YAxqgGRpuSjKLUxBKX1LTUvOJUOy4FDGCTlJqWX5TqmliUUxmUmpOaiF0ZSGVKak5mWWqR PlZj9LGak9DFlDHzzhOmgtblHBXXPxxjb2Dc2c3RxcjJISFgIvGvbQNrFyMXh5DALiaJp3e3 skM4zUwSd/7PYAKpEhI4xSgx/1Q2iM0mYCZxd+EVZhBbREBS4uLUdyxdjBwcwgK2Ervu+ICY IkDmjEYxiAo9iTfHNzCChFkEVCR+zDUHCfMKuEjsnf6SDcRmFBCT+H5qDdgiZgFxiVtP5jNB nCYi8fDiaTYIW1Ti5eN/rCC2qIC+ROv3H6wgIyUE5CU+zoVqTZQ4duE1C8R4QYmTM5+wQLSK Sxw+soN1AqPILCQbZiFpmYWkZRbQVGYBTYn1u/QhSqwkVnxbAVWuKDGl+yE7REmcxKTz9RBh b4kfs6azQ9jXGCUerJWGaV164TMjstYFjNyrGPkszfQMDU30DE0t9IwMjTYxgtPPvCs7GC9P 9zjEKMDBqMTDu/5XU4wQa2JZcWXuIUYVoAGPNqy+wCjFkpefl6okwpsn3BwjxJuSWFmVWpQf X1Sak1p8iFGag0VJnPd6fWOMkEB6YklqdmpqQWoRTJaJg1OqgVFsDa+L2fF/878+y0vV5fHR NavbEGP20Uh0Ms/WzFaJphDTTtcojw82h4+aMrpuCguUePhyy5c+WVfJK5c+tijqf8zyYP9W /3PCymflczIXJqx+uWve7xUnfcRCRTY9cvVM2nNn0w/vq3s2/CrYyXpi+c/v3/apvjo60zDi 17JZKfNyGb6ULMhVYinOSDTUYi4qTgQAKXFm+kcDAAA= Archived-At: Subject: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 01:24:02 -0000 --_002_EA2A119D06CF4B0B899486A99CD8AC0Bcablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-ID: <6F20AA4DA2D37D429D9F49D0AC96242B@comcast.com> Content-Transfer-Encoding: base64 RllJIHRoYXQgdGhpcyBkb2N1bWVudCBoYXMgcG9zdGVkLiBJIGhhdmUgcmVxdWVzdGVkIDEwIG1p bnMgb2YgYWdlbmRhIHRpbWUgaW4gdGhlIERPSCBXRyBhdCBJRVRGIDEwNC4gDQoNClRoYW5rcyBh bmQgaGF2ZSBhIG5pY2Ugd2Vla2VuZCwNCkphc29uDQogICAgICAgIA0KT24gMy84LzE5LCA3OjUw IFBNLCAiaW50ZXJuZXQtZHJhZnRzQGlldGYub3JnIiA8aW50ZXJuZXQtZHJhZnRzQGlldGYub3Jn PiB3cm90ZToNCiAgICAgICAgDQogICAgICAgICAgICANCiAgICAgICAgICAgIEEgbmV3IHZlcnNp b24gb2YgSS1ELCBkcmFmdC1saXZpbmdvb2QtZG9oLWltcGxlbWVudGF0aW9uLXJpc2tzLWlzc3Vl cy0wMS50eHQNCiAgICAgICAgICAgIGhhcyBiZWVuIHN1Y2Nlc3NmdWxseSBzdWJtaXR0ZWQgYnkg SmFzb24gTGl2aW5nb29kIGFuZCBwb3N0ZWQgdG8gdGhlDQogICAgICAgICAgICBJRVRGIHJlcG9z aXRvcnkuDQogICAgICAgICAgICANCiAgICAgICAgICAgIE5hbWU6CQlkcmFmdC1saXZpbmdvb2Qt ZG9oLWltcGxlbWVudGF0aW9uLXJpc2tzLWlzc3Vlcw0KICAgICAgICAgICAgUmV2aXNpb246CTAx DQogICAgICAgICAgICBUaXRsZToJCUNlbnRyYWxpemVkIEROUyBvdmVyIEhUVFBTIChEb0gpIElt cGxlbWVudGF0aW9uIElzc3VlcyBhbmQgUmlza3MNCiAgICAgICAgICAgIERvY3VtZW50IGRhdGU6 CTIwMTktMDMtMDgNCiAgICAgICAgICAgIEdyb3VwOgkJSW5kaXZpZHVhbCBTdWJtaXNzaW9uDQog ICAgICAgICAgICBQYWdlczoJCTI0DQogICAgICAgICAgICBVUkw6ICAgICAgICAgICAgaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJhZnRzL2RyYWZ0LWxpdmluZ29vZC1kb2gtaW1wbGVt ZW50YXRpb24tcmlza3MtaXNzdWVzLTAxLnR4dA0KICAgICAgICAgICAgU3RhdHVzOiAgICAgICAg IGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LWxpdmluZ29vZC1kb2gtaW1w bGVtZW50YXRpb24tcmlza3MtaXNzdWVzLw0KICAgICAgICAgICAgSHRtbGl6ZWQ6ICAgICAgIGh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC1saXZpbmdvb2QtZG9oLWltcGxlbWVudGF0 aW9uLXJpc2tzLWlzc3Vlcy0wMQ0KICAgICAgICAgICAgSHRtbGl6ZWQ6ICAgICAgIGh0dHBzOi8v ZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2h0bWwvZHJhZnQtbGl2aW5nb29kLWRvaC1pbXBsZW1l bnRhdGlvbi1yaXNrcy1pc3N1ZXMNCiAgICAgICAgICAgIERpZmY6ICAgICAgICAgICBodHRwczov L3d3dy5pZXRmLm9yZy9yZmNkaWZmP3VybDI9ZHJhZnQtbGl2aW5nb29kLWRvaC1pbXBsZW1lbnRh dGlvbi1yaXNrcy1pc3N1ZXMtMDENCiAgICAgICAgICAgIA0KICAgICAgICAgICAgQWJzdHJhY3Q6 DQogICAgICAgICAgICAgICBUaGUgRE5TIG92ZXIgSFRUUFMgKERvSCkgcHJvdG9jb2wgaXMgc3Bl Y2lmaWVkIGluIFJGQzg0ODQuICBUaGlzDQogICAgICAgICAgICAgICBkb2N1bWVudCBjb25zaWRl cnMgQ2VudHJhbGl6ZWQgRG9IIGRlcGxveW1lbnQsIHdoaWNoIHNlZW1zIG9uZSBsaWtlbHkNCiAg ICAgICAgICAgICAgIHdheSB0aGF0IERvSCBtYXkgYmUgaW1wbGVtZW50ZWQsIGJhc2VkIG9uIHJl Y2VudCBpbmR1c3RyeSBkaXNjdXNzaW9ucw0KICAgICAgICAgICAgICAgYW5kIHRlc3RpbmcuICBU aGlzIGRlc2NyaWJlcyB0aGF0IGltcGxlbWVudGF0aW9uIG1vZGVsLCBhcyB3ZWxsIHRoZQ0KICAg ICAgICAgICAgICAgcG90ZW50aWFsIGFzc29jaWF0ZWQgcmlza3MgYW5kIGlzc3Vlcy4gIFRoZSBk b2N1bWVudCBhbHNvIG1ha2VzDQogICAgICAgICAgICAgICByZWNvbW1lbmRhdGlvbnMgcGVydGFp bmluZyB0byB0aGUgaW1wbGVtZW50YXRpb24gb2YgRG9ILCBhcyB3ZWxsIGFzDQogICAgICAgICAg ICAgICByZWNvbW1lbmRhdGlvbnMgZm9yIGZ1cnRoZXIgc3R1ZHkgcHJpb3IgdG8gd2lkZXNwcmVh ZCBhZG9wdGlvbi4NCiAgICAgICAgICAgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIA0KICAgICAgICAgICAgDQogICAgICAgICAgICANCiAgICAgICAgICAgIFBsZWFzZSBu b3RlIHRoYXQgaXQgbWF5IHRha2UgYSBjb3VwbGUgb2YgbWludXRlcyBmcm9tIHRoZSB0aW1lIG9m IHN1Ym1pc3Npb24NCiAgICAgICAgICAgIHVudGlsIHRoZSBodG1saXplZCB2ZXJzaW9uIGFuZCBk aWZmIGFyZSBhdmFpbGFibGUgYXQgdG9vbHMuaWV0Zi5vcmcuDQogICAgICAgICAgICANCiAgICAg ICAgICAgIFRoZSBJRVRGIFNlY3JldGFyaWF0DQogICAgICAgICAgICANCiAgICAgICAgDQogICAg ICAgIA0KICAgIA0KICAgIA0KDQo= --_002_EA2A119D06CF4B0B899486A99CD8AC0Bcablecomcastcom_ Content-Type: application/pdf; name="draft-livingood-doh-implementation-risks-issues-01.pdf" Content-Description: draft-livingood-doh-implementation-risks-issues-01.pdf Content-Disposition: attachment; filename="draft-livingood-doh-implementation-risks-issues-01.pdf"; size=96489; creation-date="Sat, 09 Mar 2019 01:23:56 GMT"; modification-date="Sat, 09 Mar 2019 01:23:56 GMT" Content-ID: Content-Transfer-Encoding: base64 JVBERi0xLjQKJcfsj6IKNSAwIG9iago8PC9MZW5ndGggNiAwIFIvRmlsdGVyIC9GbGF0ZURlY29k ZT4+CnN0cmVhbQp4nK1XTVPjOBC9+1d0zWWYKqLEThzHc+NrBrZgliWu2sPWHhS7k2hiWx5JBjI3 +OXbkp2QBGZ3IThQ+bD0utXv9ZP8A3rMh559te9p4XVvIphpzwf7UjMvDIcw6NH/aDCCKIxHoNCb em6Wvf/D85vP7VtawHFCKDHELIZk6jXIPkT0F/WZH0BSeAenv5/DW6/fGFyKW1HOpMw+Jd8932ej Uc+H5NI7uCgNqhJN51TxqXkD+IksUq7Np48NVplhBtpwU+vPcFFOpSq4EbLk+b+BXDE4Kg2NWvCF 0Bbr7L4SCgljjJXBYoIK4kMIen68M/UrSjUTnGJpI0xtEOQUEkznpczlbGmx3rCqzeuYwThHMZu/ A5aFS+A6T/fGOmLwpyinAvPsffKia7zYt15XXKVzGDVMEVY/ZMM+9YCVmr1/gqVRPBc/SSWn38Yg b4nY8yS5HsPDqTx/hIuiyrGgUU41cKF1jRp4mcGN0AsrjU31bkTOrH47+UrnnUzOO2ILrKMsQkc4 yE7PJ6ygz6JhL3BYRxNNqaWmrUAyx5czrJQ0MpU5CA26wlQQBxmIEmjiWeL94TXt+5pW749CNgog HPVZrx+7fr/5ckIGMrDtugZ9nX8MgogNtjCZXRW1F2F2+uGQ7nbWxczcojOZ1rZekMpSiwyV3mZM nkOGVS6XdtAh3M0Fsa0RCw2yRMjFAvPlrsUQ7h1fgplz4xAK+jJBWJOD2SFMuCZ8IlxhauOLMquJ jiVkQqe11kSfbomxWjBIzV7O2gVRTjpVYkJCcUG2aYdCZpgfAtdwh3lOQ7BFqiT5lRFkTVxrmQpO qYATiQvSCIU1UlhXhuda0hIWuMqHMpYF3cpcNA0VKsNFSemBkTbabj7kT1SGp4T4r5DIPGFaK4JQ ZKl1tiTtCfqNYO+IHF0p5BnwTFZ2PNvR89iZsHNDW6MrLORa2vR9x/itmOtJIYxpxDytKTNSgTPw MkWKaOZt7XbIpYa4FY4hG+ztXeBHPiOrGIQB64cjp9jjk2uIRns0QdCL2DDYwnTcbkG+Ls2gH7F+ 8DzNeJ80o4DFwy1M5tqUbNTe6KyJbfp0mzySqyKCpFpY0a2U6tiw8lsNhrNyJkpERaNe6NGE6wV8 kYq4frg4S748kvK/UYc0PSWdCmdK1pV2Hez6gLrTUOPRrttK63kSfFdqq47Kaa5NMa2Vso21HtVC tUsjYVL4PVQ1HLLeAPoxVbgt7dyYSn/udqnPuLX8BSom0EwZnSS6bh/R3Tar7t4GvBmYbVrv/6DU 5bJRy1vy4czZAicO7kVRF7aCWtyTyZVmrl+g1aq9ddy6yrhzW0UezlP7iaDkRMscbdtPli3NG+yR 4ZWrQ4ERBRJ5F84tRMkr6nxyJG41IqHW+HwRmmJNkSqZrhRCx0FSIHluY2SpcArDog1NYivttA9W SdaIKMaMDoKafdjxt18Y2Z0g40J3erT7ybPjo7XJgxNZLRWd6IxVuFjn9vTzQ/rYHDZtJ0CiaDNq Nh4SLhm8tmZHFky7h9v9uX7ZGp92jdrMpbLSP6L0XAxbGo3qFrNd516tbD27MefvmBpbsrf3QhCG zB9AEAzpVBa9k8PGPRaNtjDXlXoq3kcNlzjjeWNqxAJN2T18XD/tIzeYc9PuoA7kdKVICzCIWOjH savV+sHmENBuzqw9DrbPD//5+PDXNZ8h+H+vikqrgLu2DDdfvYiW74ehz2hphRcG4dPX3BvT+H8A YJmvYmVuZHN0cmVhbQplbmRvYmoKNiAwIG9iagoxMzA0CmVuZG9iagoxOCAwIG9iago8PC9MZW5n dGggMTkgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJy9mk1z47gRhu/6FX3KZqts WPwm96YZTzKu8s46snLa2gNMghZikuAApDTKbfeXp5ukbMh2PjxgbI1HlkS96H7QQANofoUl82BJ j+k5rxcX6wTuzcIDeuj7RRTFEC7xNw1TSKIsBS0W5YKuHj7/uvAGBZie8ho+bFAlg4xlsCkXo7IH Cf5LAub5sKkXf4YfN/9YfNos/rYYv/ZWpdhjfjgoXTWd0I3ozi81LzsYfz6KptO8kv8UBVyqz3Bl TC8M/AnW0jwYePr5met8C/7Sy8igIGJxgC5urtFCgN9//OHJxrd5m4UsiZc+JD5KDnZuu641P11c dLo3nRBMiq5kSt9fVDIXjRHnsimVA5XAC1kUWg3+AbIBUZYi70A10G0FFLwToEpq5dwPA7r+3PNY mi492BSDz21/hwbxTuJXVInfkgYKlfc1EmUAN5XgRmAM7KTYkya+OH5sSPdRbkSYcy3KvqoOZ8AN XX+AQphcyzsBB9Vr0PJ+2xngTYGiptMyp6YN7GW3pXdaNB+7gbQ69cKcj6oQ+F/dqoYMAPENuz3v sNdLrerTy6FG8JOUbPKqx6/eyrqtZCnxCx9uL+F67AroUIfsPZpaEMpbMZgGIRsYTjYh1Q31KFyL e17BjVY7aQYPyCX0Hlp6q0ANckn1Hey51rzpDtjCpHLSDkm+bhfDy/1gDCziu+F3FdmCBHAQUAeM ct8ftmnKUi/LIF7GLMFniiPPIShpGNCcYetht+GY1aroR57A3viA08njbR6Gmc+S8MQg320uitDJ zBul3Gw70rcVXYw70rf1EN+taLnGEd7cD7GGIdupXFXjkLnCwBM0XMYpYJo4Z6Y/l4NEPw3YMpiV vqUYzEHf0kN8X0S3V/oBfmkFdoLSBlY4SQxZDOe/cQq4FG2lDtRBlLzmjv25HCT6ice8aFb6lmI4 B31Lj71cGFyKUjb49/vNPLZBrvSjjPnJrPQtxWgO+paeTX+cXHaGYQecP3sX89mt0DtMeQbmp28Z 5BJeRD9MWJA90o9fia4Vzp51S179BJ8aytbFhX3N3YECkPdVB4N/0SsrKPdkHuGyNppm22SOTrX0 aEmoaO0hcfFTKg1r3sriJYhCta8n+1k61TLIJWqpU3F9Fc+bTizFdA76lt4J/Y3Itw0u3atpk/Nu E5plUOxIH2M/mTedWIrZHPQtvRP6H3qDicSY4w7zf6LvAj+N2ak5nuN8FmYZS2fNJrait3Swzlsu WXIix2AtclXjQrXg44bxjXsIZ/QnzjnOOmGasIzOHeZDbyl6Lju4Cb0lhzn7uKNeD8cAQsMqf2jU vhL3ohhOAv5T/M+A3nbOZVQT+iRmnjcrekvRc9ndTOgtOQZXqy8r2u4bWdD24Y2RPwN62zlX9HHI /GBW9Jai57K4ntBbcozOf3otu8P34Z8Bve2cK/rIZ0E0K3pL0SkTTegtOQY3Wu54/oL8+6G3nXNF Hy5ZmMyK3lJ0ykQTekuO0mwptGhebMbeDb1lje+yhiD0fsqipzTrZN3EylL0IuaUaP2QhfGJ4nBS ipuqGuN9J+yueBfyliXO5L2YJd6s5C1FJO+UZyfyliLy+/v66q2LytnIW5b4LjFF5JchS+dNspbi qm1xBS6/wcqFf5gy3z/RpbOULW/uBVyr+/dlb1nhO57PBbhBzmbNsrbiI/sP7uxtXaT4Cyq/cvT/ /2ZvW+E77maD1GPLpzS76rut0uYHWBWFxm3629PZDO5ZJo3unYc4daVw/ljUK9zKbbg4z6h+HUQJ CzwriTyV24Zmo+Gy8LRhpLTZCrj8cgtqh3u6z5vNzS38fqk+/0E1zLFGJA1QSXYsTcoGfnWgEmQe tg5BELAoSgZj13/5mIapS9eHqBaEJ6K/MfJMDuXp8yD26fPnZe/HInE+LTHNizPMYijK0EVnsN/K fAtGiNqAagRU8kFUh1dOb/f8AN2Wd4NCjS/uBMhjiU0UZ3DHDeqrBrTIqX3ZFL3p9AEKafLeDKXk qaxLBeVOGCrcTR49Fo7N2Ig8Ld7VqhDVUHjfi6qiYt+k1D4eW3FjVC451Z30cHBFjchh5LMxHh7J 8MoodOFBHO3Rz05gWqE7LpuhrqiG0uIze1RJGJ4M4v9OiQ6Sy16jhAbT9cUBA1Dieyi7x84xrRa8 AD4dKrPvPyLHiQK3VCzyEvda5DT2bL3vKrb+lxFq39GAfzeKYga7k+4wQLAcMCA6+bUX4+0bYoi8 4/h9JUJlZ0RVHkM65w2FKIcdr3pSLAo52Db16PFum/HuBsxAHEdKp6Z+3HJcpta8OcBWVG3ZV9Cb IZDWnPry7NkNGSX+QTOxURWOHhoEW7WfpMjqwb092kP0rFFDjV9gONR078izETVEbW/OEAoqRRkL B0ev5Q5FlMIRR8ZXbLr/59O3VmI+oG7qRH2H8ZadDbcDwenPrzccFyP+b8dQi1kM+ylK1n9dJB4F CJ2NxFAvIj96elktbvH6fwEJaH+SZW5kc3RyZWFtCmVuZG9iagoxOSAwIG9iagoxODYzCmVuZG9i ago2NSAwIG9iago8PC9MZW5ndGggNjYgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0K eJylV01z4zYWvOtXvNNmUyVzTEqipOOslZm4apJ4be0pNQeIhCRkQIIDgFaUm/3L0w8gacv2VGpW /ihbEtl4H939Hr/SZZLSJX93f4tq9O52Tjs3Som/7W40m+U0vcTvYrqg+Wy5ICtH2xFfHT7/OkoD AnV/ior+swbKkpbJktbbUUROaY6f+SRJM1pXo3/Tj+s/Rj+tR/8dxdu+FylPk2wakK5rL20t/cXK iq2n+HUla2+FVn/JklbmZ7p2rpWO/kW3yn1x9PT1i7DFnrLLdMkBTWZJPkGK60+IkKg2dBBHcnvT 6pL8XjkqTdFWAKeNRCFEScJRYZVXhdBktrhIhgMba7wpjP7xh1GaJovFZdqDKu+k3o7psFc4uRA1 bayqd9QYB5h7CeRabnEVeUOyLql10gJP3YvimAAvmyTz/DLr8a5rEmWJW009psLU94gO/yOc1a93 tAMYCqGPDOPof6sbHGQ9zSZjxGra3Z5U/TpIZyqJ2PiW9dUNIXHcXiYUcsMr55WOB2xaj5QiOnLh w63UR0AyTqm2W2m5Xn1BOCvHaQn8WllITvlrK62SDvjrkyKXRroOqTZ4KTUuVjUguM6NsKh7q4V1 b5UeaB+M5Syd7MORXijtxtRoieRwPqLjiH7HBQMbv4/X2XSSZDnl0yyZTpaBkrcfrqCW6RkUzxbT ZDE9Af2cnOB9t/jydJHk84g1OUd9ebJkjTzHQ6l/lf5g7Bf6rQHfvEFL3ltJQZzSechQ1bSSjTZH Jjv6xCFczALWlC4GUpehUT2a6dHGZEW941u31lR0fXfT6QP40AbYNyZX7I3h7oJajP6C0wYEQVgB dy9syfeDK/eqlGRa7zxuC7GB1UzOuosBIWyNrURdyHHHI4j+ICEA4ToQLwsfCOhk0cIOjgGhEy2T k0XM/L6ue4hBs5VxnoR2T9EggosN+FkCzt6rAtJyLcwCx5nGX6geAwJAAaB0yN5bpE4IlF84yIdF YakS+oCr3g1xdcHiZBpwTqrIWKy9rdJ4lwuCzg2llb4IKpVQz9Acwgl9WpyHOuk6ZwoU1zbBeThE lunDsyJyyc09pLj+dNfXeGXWjzjqZ3OQ+GQcqoscgpm8tHdVQdDsGCIkVhk4xUvzEE0jRRB7Jb5I 9iw4rlMbLUNI/kVKuI4roepW4v++4BrjQNC90HgXeeF4lJ0tKYSHU+FmNjS8Z0/fwTF3YwB6Bn3S dVin8M/6HriMgI+EItRwZPCIb0DUVZ/cRh5NzeNJ+H8aD71FojkGVspp4q4h1qfsK7Xb+z6y1+Ph EAaiVl/g9KG4m1C6mg29tY4t/ekInhDxBlWDE5iZlbLW2C78532NjTtAp3JzDJ/0MFBsmC+iQFVc T3iE4HyH8/D+6tMjBldMKWrRhgBMjSgB1IQyoa9a4TB+/yT9nnhxMO+lbgILrCzbAt3ecOkfnJQB +zfO9rYP7saaPyCqx3PmyHSWJmlOk2WWLGeLYKvpGTY9nc2x1D1HiwPkYrLI8cHF0NFouN3chdOc agWNLUzVQFcslIPy+28J8Q3H/aY0Q9njIaHGwrFjxbdP+Nm7io38Qh8jAaJseRKI+tg38A32f1A1 Lz/jNygenMofG97cgLsXIK3AwgIKeyjFtuxfr6kfFIpM3F41sR7B2iHvLWyTNqYFyUBeLXcwZrGz MmTvQP5Ct+yEXU5raauwt9xFrQelC1ApzowboxX2PeKhKeNgahtTv1h8Bjtp0YfjOyt3Kl6DgnHR tDi4btPatV3g42GYMNbHuCD2pis8hzCMiNvhNnr4uLq5fRzHJrEjhQLu2Lbrkx2111HJWNjDdMSK Vhbe3OM/jYyQ3Xvdrc1Y0njDrneuMwvQY1gjQZGXDQw8GcZjTOYIBnfGfbIFdyj91cn/L1LsUVmW 4yFhHiR1zorX71HP8ZLXTy4rPAvUUV3f3Jb4ut7UAo83ElQclNeNYarbaoM2odyYY553GnDhiZav 9duNtV/MX9j2BcSEfdn8iam9wTOLOXDPgyH2F2y02Z3ngeksmWWULi+T5TIPJcnO8cAsTab5Cdzn SMOPxuy0jH44u+SLXhri1d7yM9BD+Kva6vF12hGEbtoNpBp2mBWmtGaG8sVvFBRPePKsAqUTBEtp Pk+ySX72Kp9O8mRyCvc57KjYZHhTj8bl9y0WS4EVrO8zz+JSbkWrmVtYariO+SyZMJ8vpvNkli6X oZCf1D2oZUzJmyMcI+keu3/6swGZHLyv8TKwcjkOT+F0+vX7jdhJmnwekoRW6NClevtxNE85S0gJ k7MazbLZ00s9usP1fwMTfvXRZW5kc3RyZWFtCmVuZG9iago2NiAwIG9iagoxNzI4CmVuZG9iago3 NyAwIG9iago8PC9MZW5ndGggNzggMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJyt WF1z27YSfdevwGQm7e2MxIofEsXH+KOJp0kmjTW9c6fjB4iEKFyThAKAcpS3+Jf3LEDKkuyXlJXj 2JaAxe7Zs2cX/MKmQcim9NX9zOvRr59TVppRyOhLl6PZbM6SKb4XyYKls2zBtBitR7Taff5lFDoL rPuR1+xiCSsZy4KMLdcjbzlkKf6lcRBGbFmP/sN+Wf5/dL0c/THy237U0jwMosRZumms0I2wkyvN 15b516VorOaV/CYKdqXesRtjWmHYT+yzNPeGPb0+cJ1vWDQNM3IongXzGCEu38NDWKlUW6wrrgX7 boRgH9Q3WVWcrSpVPrK/fvn5KYIfwyJKoyCbszTCeS6IZAAcUbrAG0+27saMNwV7q1RZiZ8Nu9xo VQu20urBCM02fCfotEk0TbFvEobBYjEN2bJwMbdG9HvZp3ZVyZxdfbz18T9/+0rsRKW2MPsgVsxI Kx7J9sGmx3EAUlkSpPNpxNIpTPqEzwZgFU6nQXps7C7wWGR4exLF/rAOilvZ5IIVUovcyqYkIk1W nPCh0MGv9RowWMU4MzWvKta09QpQqDXLVV0LnUtevQAH7d5qtZOF0AbltNXCgK8Gdjay3LBClBpo OzPwgJhspWooqwCSLOQ9vf0HWEk5OKyifVaraszsRhpWqLytsQOGTa7lCoVA73e2tsriM3jKZL2t BC30hmpViIpxw16dVdOr4J/nE7U7DxfBPM0G5zKdBxkV67G94Kj0fRQ7E4Clk8tniN0KvZO5MC7/ M2cqeUYBSpUkuATgMNblp9qDE8YCyNYCkLJSK4BXcMuJHAzWaXkvS+MXCPAg7YbVkBK4YsiXrVCA 3qVO6ZI3nZuGyaYQW4H/Gotj8w1vSmLiExN4UdAbIKFPde+FBBFYpZQRtE+1MF8wszdW1MBoCQep YL+/Wy4//dqZot9vHylcXhn1Qqhj7ziswRthDNtybSXYlGvBqUJ6nxDGljTCbMg3IiOxrwMG58KD CwVL9CchTBvodKoKq3JV9dwsRA0UiP/CLb4Xe0aCDZ3JbYt8MlgW1mF4AjozLWSd93YcEB4G8mgl 7IMQTYeHcedXfI9qHB+WKg1gPVm65b1Pcr0WmgKisnHx2w23JJyA3EGSt+gZh2C8HEN+eUF4isl5 ESMzB5Q7clIw/X63nRujICf2kEVDRXhgq+fVRQuUd1Agt50bqvicF4J0AC5D+g2CEUQNiwgKOsnR mrjQ6RmsnrEVWVxbT7IHrgvzgtzhzD0Q1KWn1bbidq00fGTsN6W7eMVXTgJD1Iym02zMLjWXJXvP V5BC++2gToVzX0sjeiSMmuQ4UPSk3+yhdpNSchJN15ne6JXS7CMSpfS901Sl7aAWHceLIGZJMg2S dOG0ZT5Aq+IkoXnl2NxdV07xlLrFFkUvKDtURq4jYVbCjvP2jFaxRUnIFYAExNj9mlDqRKjLIWB/ gwpYGfGlJaJuOXXoNcaAF8ToHdc7pBWDwoXQ9zVvnIJi/ZD5JoHzmBnDeZCGPtx0yISTZEF0Yu3O yxO+bccXI/JWS7sfH2umQzLEfBQ9A7IWheS+NDctRa3JmHFNUOad/Dr+kaz6Mcc1UU4FgDS0lX0B Tezg1vIcJOQllxAvrw7nFUNKdigTuAGdK5miMu04Lt3EGtCE2uz9J8bNbvCcm1aTHBvbFpJ+oSgK seIeDGpYVN6dJePGGCo5xwtMMxTGLfbsZCM6cgyplDAJZgmL51kQZj49iyGlEqFGFifm7lijfGhA 8jDX/k+1y3bVzbJgCDadJ5kKi4SkYPHstVe7laye+kRfMB5ByMdafj3aFEJeZ69fznJXceeWvBwd wB18U4ghAxnATWZBEns0siHgphkCOTHXTcDxdEGfnA9AywObDvJ/Pnw2L07Arhu8AN2B9K4blXIn Gq/1sCLW+AQ1iF9faTEpxFOL7EcHN3uSnU9aQQjd2Nx1Cb+bNqM60U9dTjUqVxu/fd3qowJ7PkN3 R7h9x9MEWIPmWWLSwHq0cNRT1RbIsuxtLWVN6okFZvJeiL4nGbYU+aaBnDA3FoB5Q6jge0iUJkE4 S13uwukQLszmdBs/toee9FZ+w+Cvjhw+PuHHPE5gOjs9IQwHeJws5sHizGFH3iScBc+r/6N4gEjo e0oPeuu/EVEUhwHqJppHQZR2EUWDOptrlMf27h7H7E8Jhb4Uet0zCSPvTgS4GzhFGZaUeRxMk9MQ 4iFJ6ZJ8GoJPyzSmj87zcqHFg6EJ43e+qbpiubm+vma3W4z1uq3/lVT15TKbBnHWxTnkMUtfLkf2 KFUfbpboRVeylNZf9ifRYkYLz6O+bDVkNN9DVnBrgOjsBlIR3WkG6mBOnYVdfEOu01GEnpCc2IMc +PuM3LpRW/ob3JU4vrr8V6z8mDVLaP952Kata2kHRRrG8yCGZ9E8mMddpEOG8TDBQBid2Ouemfkx yzfENA2iMMuedcSbxl26qWmMQdvlb/5pC13elCaVEf7+nNOYXgjtbk5ADZd3XGGa0j9xOO+KiuaN 1d7tUpUsuLf/sJG4x/a4q3f+Mv3Vult6w6EFqqV+2fWhswc1/vrVX7zGp03tzdM9WuA6jtbOvt+8 uXg8PBYyNHJxVrjHqu6uS88QXl12cfUjcvNk8vLY+e4hRZKCToCRAn0vMRSVSmFixWpeBd1D2Ouv W4mezW7FFjdbGiBwO6Rnsuz09dcnjhtmctf3UOSPPXQE+Px2lIaU+xRlOmf1aIZKPfxZjW6x/m9i UzwEZW5kc3RyZWFtCmVuZG9iago3OCAwIG9iagoyMDU4CmVuZG9iago5NyAwIG9iago8PC9MZW5n dGggOTggMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJylWF1v47YSffevGNyHuy3g qJZky3bftt20N0Ba7E0M7EORB1qibTYSqZJSvL5vzS+/Z0jJXwkKLJSPzcomhzOHZ87M+C+aRDFN +Lv7m1ejHx7mtHWjmPjbbkezWUbTCX4X0wXNZ8sFWTnajHi1f/+vUewtUPcnr+inFawsaRktabUZ BcsxzfEzT6M4oVU1+o6+X/05ul2N/jsK277VUhZHydRbutONtFo2N5+s2DQUvn6WurGiVP+TBX0y /6E751rp6N/0oNyzo9PXb8LmO0om8ZIdSmdRliLE1T08JGp2knrz9BELVSPzprXyX/TH9x9O7n8b EMlsFsVTmic4zEcQzweAkWTzaJKcWXuC26KhQpYviFjpxnAcTpLyGIxJOD7uJl5mvPEmjqPFYhLT qvAxi9IZ0qYBcEYHBG5Xv9C6NFsEfe7nN0aNG5uAQXEazQMF4sWQsOdJtMzOzT1FRKvzC3s0uZLN wUfkI8Yt857riOt2XSq3Q8CIVllPBvq1NGtRnow9yNrYpofkl5ZZQGbDT2z7aDIQ57htAE3i6SJK EsoWS3baA7YcAFiccZKfWet4ohzVVlXCqvJAG5O3Ltx8brQzpSpEo4yOPH7YG9NNAsQzEKdD78tO lZKQbJuNyglky6VthNIgoGuU9tsdn6J0bqVwSm9xEKznPkXBs/E7AMIxxtmJCrYV/4OnendwKset XJj+W0bbiJy0L9K6VxL+XhqpgTxb2qntDgcWyjVWrVvm9frQZURdimZjbMXOkbGFtBwAMkfBFm2N KTojtbS8TsBpXgGMrMNJptWeNLQ3tizAv5/ahvYeEFlsZe8UVeLQGbKyYmysxMk4BI71QV36OO64 CJwaa8pxt10UldK8yseOVMb5Bs75RwYZuJQl5Sf165ySLxLvb0h0hq71sbbmRSH+D+6Ecu89I/oO iqrpbIUz96YtCxYO+Iz7ykvjPFZ7mD3tYzeRNQgLDvETzvn0+2NnqTGFOIwZQWgyomkO9VtoqDB7 TUHVCDkG7J+pRIBHlKzQW9CMNtZUJKg0HI2V2+5woenu8TMi7TcHBlUSSNegfCN67twbXWAPABCv fKIgV8EdWregsXTuQ2ebF5ys3X/8/bV3RbIQIL/c0dUxuXxnTElYNibZ5BGWHnMqsB8yBswZd1AO FIEaAywcpKq6BCKB+HCoyymAcrzyQAUQA2avkuoipTvxYvSDcMLFHNDAZNniylDpdprRHx/DHXdm 2ZbBXnvpD5PR+vLqhYXdl1/r0li4B7rzclZP3GsBmangcGcLLw+QyUkWZVOazrMojhde2R5RpDnC IfUlyOW5VR/fgAIYQz4X7/o5RNaTaRol2YXZaICTaK2msyRKZ8FUNqRLy6Il91Ln9qK3yvMRXUlV Mw4/0q0W61IWP5yvgVh/khvRlo2vQTNvdPqmDK3OeYUWB0bR/Yiz3Lk+WOoXZY326/ch4d4pRBu5 B3ktizlyQXrGy8qntaOdeAHHg9PeJpwtgrNR51IlhXa9vO1CWetyOzhZcB6v5VFbdFutkSrIziuH +1LUKTWyEbLPSQizmmXOe3nafi6Z7JuVSH4I+rUdz2ukoGsE1MsXHOGaXmDfEX4U3tD8HMPyKhLU u48bP8fk37Q2qMWQPE9nSMgFpRmakOVl/swGsHQ6SVk+zs1GfVMjRb7zpEvThBddN45nXAAVUHwN bYSv2Ru1bW2Hu9lszngRanZoICC37zDO1M2N0r4BIFHXYIrmbt6pLdST77jh23VcZI0lpsyzPJx8 CWLcK6uvEoGhbxLg5BS3W95gbTAvBJmWuDa+587S306+01p3U8HQUShN4iibzz36yWT4MHRuL4wF rQuA5q31eAaQqTJo9oDSPw5EF2nayAqDgLCHgSqbLHBYGlwcMv71KntuDxF/Psoe+lZ6ELUq3ipv Ybzu/qOu3l3w6sg8DVmEgjQmNyWgdS0aNmTA3eeXLFDlC3fE/vkdit+LVmODwzg9aELKEPMUJJpE 6bJjTzyk5s/n0TK5sPc0pi/qWdWyUAKi3ai8lIPG4HSywJx+4XIywOU0mUTTxbXL90o/y+JOD5/a p8k8ukI4HaK26TJKrtx9hYwFlc0W/OZ1/qG0PN7+HFjV/b+QqCwHX7lRaxpjD8PupAMxXUSzuIty OuRSUC7S7MLe0+uYvZa6QPK1NTJpbY0owscSWczLr+PGGFW1WkFlj604XsOU2k2+GB6+Iskdxkie ATW3Gg6CzbC8N1KfVp/soaxj4He+fTc88zrMUdAIOkhhQ79PWyuKVpTHCTSIRjdX9o8sDD75eUd3 S1sLkTB2K3Q3xPkTeJo/9f0obyhurezbDT8tvggbPrjxp0sUp1NXwxuUDCNGZ0ZLWQR9VrrDWDc4 rhHPqKChReDhjV3FPp5Lj9IV8Wc1nZ2+9Rmf9Whcz9EC4uxK/Akl3cs139ze9Y1TN33rLYxM57jv 5dIDfq9e8KIxBc94qNJR93nj7ddaoROjR1mjlHBQy3H4xOny64/PAt3c7KlXRww5tO+4+PDraB4z Dbnpz6gazZBQx8dy9Ij1/wfYMgT2ZW5kc3RyZWFtCmVuZG9iago5OCAwIG9iagoxOTIwCmVuZG9i agoxMTYgMCBvYmoKPDwvTGVuZ3RoIDExNyAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVh bQp4nKVXy3LbOBC86yumcthNqmSuKet5zHtdlWxlY91SOUAkRMIGAQYALStfvz3gQ3SsrdpsZMuW RGIw09PdA32jyySlS/7p/mfV5I/PKyr8JCX+ccVksVjS/BLP9XxNq8VmTU5O9hO+O17/NkljBOr+ ZRW92iLKhjbJhrb7SRs5pRV+V1dJOqNtNXlOL7a3k7fbyd+TdtnPRlqmyWweI12bIJ2R4eKNE/tA 7eO1NMEJrb7LnN7YP+na+0Z6+o0+K3/n6fT4KFxW0uwy3XBCV4tkeYUStx+QIZE/+iArT6EUhrDF wbo7srV0Iljnp3SQO6+CxCvRhNI6FURQ95JyWwmFFaKSL36fpGmyXl+mQ1Dp7qUbhxEmJ2/JmgR3 z66S1fJy1t+9LSUA940OZPdIRHnKbFULF3fSRyqcFAAAn5osFh2UNaRi0oHU/mkCt40PhFrIukIY 9T2u8KSqWssKIRiwKZZLw39I5LaOMS3Hen4G3Mw2OidlMqTiJX1rgAk5UatcH9vq8FF2h2QtKg/i TnaB+FKufK1FJrmAewTGTkKTseaCQ7/56waLpTsSdtzvVZYQXQcSdS2FQ422i7ST1JjayUzmiIG8 YvUCTTtQ7WywmdVdnrgVYHfpUS5rbY9YgFy6WKFs/CktdF4+KB+UKaakrSkufMC98W2pipJj4LJT u4b37Tfr8wIgOXFDenTb/uyOpzYMl6TzZxmAZsoH1G8dthXAoraBkQJOe+vaUp40pS2Mwz5lgEAd QKEpCumDj102Eus4mohVYTmIJSPnZFc8yswa75H+dIQW2ual8YBMtXwptN0hs16WTNeqMSocO0Z6 2jkrclA2ygpLukhVAyVW1knSqlIM5im2QWe959pjjidKMuC1ZZCv327fdZFih4TLz8IJwLUG9lCK jAn/BzSnENLQsKd4PhLSlN5bW2gZ2f3Rfsdugq0CdYVRs3/coksdIL40ubMqn9Lr0tlKtgp6p5zc 24dOlx3GYxwGIXaBbJY1bqA5h3ASAvG8NVddiVs2rGNc26lMwSLtuCV9E8/g+FLr1h52EDVEBYqQ F5y2ik1GoRZa590s5ByxFqF1MPzik6c49l1WnDFlSE9lylet8yFlC8/r3Kr7aOjdv1gT2HGvwDUf EYgZ+Ex0zamEuwNBfSnQG34aqRDU9QjubmXWu6y1kLGDnuEUoVO7ZzMyOZSDHvlIQMpKoRzAUaij z8my10cM2CXZURTjeq9gToCvCZHoVqu8NYcDsojV9fB3gW5spiQ69gXvh9H5c0M4nc+S2ZquNrNk s1jH+Tlb/MIoThfzJF0+ivd1Ss+uDTy2gqfD/jxp4QoAwI0KTLEMCJQCrNkLzFc35f0v1jgaML0u Bk7krYO2ZjFFqzFrebqCWSILkakSXWw8+yYLOxfHKFQ2t+hkvhJac/QfeAbfyfeN7kkU84O2Mc6j nWBGKR7q6AqzC16osS+8pzsC4JLtSSIx6XWc6QrD4kS3rLSWawf5WyfuhpGXkGU0Q5mVxmpbHHu6 uZE5CEIWsKNKYKpfSIOMM1bYHsO+cZJtAOF5AXaMSyKswzQ0cg8ZVvCeVi1g7vB630LG+HkcWnCw cEg5eXZu9DRca+vrjGoZfSQ65Nh7HhXWT8C2z7szJ6AoJo40xGjvRHjwwUAlu2PrLdkgdoHSD3Qn e7QwnI9t319BP2csR2hMeZHdGXvQMi/G9lOJPopXFU5WwkjbeKgcKfAQw8gZZGjZEJAxwsXxwGnl 0qvCjGZge5brwBgLdwrTxdnHcevQsaYoA/OO5c40Ga/p63K29Sq+J77A6OeE+Fg5DOB+1p4Zsqes pPbygOxl8v/9AkftWTpPVotV1Pb6V07ty2TDZ+txPLTv0zB9t6wIBXduD+nRFRZxzZwuBmbm/bG4 82xB9xgYsh1kwzhAM7lHCidG5oOLp36wgkHrmTo94ww4OUAofDFiPxLhj61lxxejo/lo8gDuxSaZ x5gf1D2aD8JPidfopPve8fahxkT3dCNrfMXYgWObafwaQo8fXz4JcHf5tW/hMlnSoUP/8/vJKmXg AS1MuJosZovTWz25wf3/AH/AUnZlbmRzdHJlYW0KZW5kb2JqCjExNyAwIG9iagoxNTU3CmVuZG9i agoxMjQgMCBvYmoKPDwvTGVuZ3RoIDEyNSAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0cmVh bQp4nKVXXXPaOBR951fc6cN+zBBvDAFCH5tk2s70Yzew05nt9EHYMqiRJUeyoOxb+8v3XNkQmzaz 0wmEALZ0dD/OvedyT+dJSuf8bN+zcvDH7YzWfpASP916MJlM6eIcr8uLS5pN5pfk5KAY8Op4/36Q RgRq37KSXiyBMqd5MqdlMWiQU5rhbzZO0hEty8Fv9Pvy8+BmOfhr0Gz7WaRpmowuItJrU0tnZH12 7URRU/O4kqZ2Qqt/ZU7X9hW99j5IT7/QrfJ3nh4eb4XLNjQ6T+ds0HiSTMdwcfkGFlLcqcpKyxJw olbWDEmYHBHwQdfKrCmzxlut8niTbEHX7xZkK+niBZ/8/usgTZPLy/P0gLncSC9JmUyHXFK9kVRY re2O0Spb4yAldDzFVzILGkBbSY7Nfg600TiZTc9HB7Q0wb+FWhtVqEyYmt4fzgbIYqMQEBj1UtsV vh8ihQ+FE752IauDk8+/NzI+4nY2q3C2JEFauLWk+4BjVL1n3I1ab/SecgUstQo1B/vdAnBHDETK 6q10nmoLiELuKOukxhokZae0Jq3uJKA2As76B3+6WMiEyGqPTbSxuxi6o0dNyKUfkvIk8lIZ2CSd zJuEYX3PKhvgGKKPDyst/cba6Cj2AqewrpR5ElNFRYBxzAGYE1MKv7tQPoA+omtyPPCYSfjkQ55L Q9lGGMTPyfugnKRcyqoHVId8T6s9wFxciPjCXYvQicxZ7/sOy8z6PVwsmWIntB0xKa5l5qTwCPKi FiulkbJHE90x/pidhtG4xlyNSA1ZnVhHsGhf14FaZhsDEE2NYUNayUyEZh8cFngh/9IhOMpwHgsq hNKB75m8B7UJjbtNyuNRZg9DcrVVecARh41s34pJqWoZ6Zh0cTiBMVhFIQHjw3otfc3QoiZ1Wqxs ry1lLykPkUEiu8wVnhMV+0Ase/tqyBabaLY/RLyLhVV8j88Ez1q+oypWbOM6ljkuNB5H+n3YKI17 tlcEObiTsTFOojXAECAcDm+DLL8I7lkxwDuVS18hfb34PpRNqMWaS5Atb+ob9p0dsCu8cTV4YCJM SppM/jjlhUAgcKIjUdciu0MhNpXh6UrbkBeaLfvqpex870KttF3TR1w5asLPqUs6uUhSqNT0IhmN 51EYRtMnaEw6nSbnFz28T9+GdL03nMDoCD4fzO6e83N2j0fnCYS1Z/fsCXaPx6NkPP3Obu5JJdeQ ZZ5Al3DC2QgiirVnR03JH/JxswUjdqregCKRtyLHlcj1E20dgj2KU11VUjSNfiUZ/0etRvQ7Y7fx WNPUF1reQUjxrcDtYSw1vttlTCVAyUabXgm3FS6nv41ireHu9JU4Rf+oGhjKkKwTEjoZ0rMbdJBT HvNxTbtkFThWxw3MsdV+GPvIG7CaF97KPJhcmIz70anc3bLchdg50cnfis/w5YNcwSIUGedgId1W ZdI/ewrXx7M5Ikvj+SiZTy4bzlw+hTPzFATo4X36BhVSHlbHvDjjI2OYrVh5dkxt3m3aaKqlAMUM UruDcLUMYpI0aorLDqFAFj5AC9DOEZPHmNKqTjtktdToDFm+jSRnAfpbglBkQrmS7kShc4tpIDKM G8/DPvT6ShglPWy7sgEdM2/MxQZQxncxwG30K2CAu8yePbdlZrpEp7X7vkGRkiUPiMA8ZUjlLBPQ ee7Yyp/4ltmgeXiAaGJYYp7FyVNjLYLBJ/ZlUvZmL8gRVIfJfRCbA5Xh4vvgWr0CE7W3/SEmCiPt xD7Wb6lqBUWKys3DahyekySJhcBtr2nyB2f6oaItizRhqAu+kzMe2aL29WZP2gZtIMBRLpELOuth mbwJLTRRnoTqLGr/DmG546nRZjwX/p/4HuPx7PupaZxEZTxOTRi+HXeSZQy9f2x4uuoPTHmQrSS3 ySylYILmTpRYkSEHOVznpSra27XyyF9udwGNbCs7MwoqKpYRWIPeVnZnCA2BPyHHY6MWDm77dcwh j+YcyMJmwQ97TO00aqERNy5FDqKTyJyh6MEWtGGK0tfb96+/YZBBAXjherEveCpopwuPYUG2Rw9j CaJY0GeGPDqAyy5UMTbwCfNDJjEIdaEWPFM0teBjr+n+joJS+ShK7bgHp19Yh1qjl+AyuA2ki1ky SefzmME34KlZW4vfCGj2UIeD9H2pMGR5MKDCGMsJmQ/jL0TqPz7+idmJZp8OjXyaTGnXtt/bl4NZ yp13Nk3SGZWDyWjy8FUPFlj/H4mFnFNlbmRzdHJlYW0KZW5kb2JqCjEyNSAwIG9iagoxNjc0CmVu ZG9iagoxMzMgMCBvYmoKPDwvTGVuZ3RoIDEzNCAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+CnN0 cmVhbQp4nK1YTXPTSBC9+1f0aT+qHGHJ33sDDGyqIAnEtbu1FIexNLaHSDNiRrLx3uCX7+uRZEsm HFivQ3CikV73e/26Z5xPNAhCGvBX/R5nvSfvprRxvZD4y2564/GERgN8z0Yzmo7nM7Kyt+7x3X79 Uy/0CFS/xRk9WwJlTvNgTst1r0IOaYp/02EQRrTMer/Qr8uPvRfL3tte9diPIk3CIBp5pGtdSKtl cbWwYl1Q9XoudWFFqv6RCS3M73TtXCkd/UTvlHtwdHq9ETbeUjQI55zQcBxMhqC4fI0M69edNYWJ TUpfnr26+0pb9VHEgPjipKQmNt2bWMniQKvUbOj9rz+fqP2YSKMoDEYTmkZIxLOL5hcINRoOg+Go hfahTy+tlInJGPVqOIl4/SoMg9lsENIyOdEuDC2VfpC24dRO48dIReEwgIumeJtW1R8OLmAVgc5o 1IYDref3t3SrU6UlCVuoOJUXpczKDLophxekPITx5+cp/724gXPqbKt6DCK+7dF6XMImjEbeVQPg Vk0zjC5gEw4n3lYnOLB5ah0tZbzVKhb/Swmi2Yjh20kPL3HNfMLad5N+ZcwGae63qpC5yGH2SzIe RdOgm/DoouadB9Gsm3DdtTNeeNQlC+UKq1ZlwXNPaiVSMmu6l3anYklfFgtz/5VEUZxG2OKgfYcz 9BHxddt3/3mY1babTGfBYFYJMr7cdi24D1/7ZCw2pE2ZCvso4TbfTCSYDhuhtEPfeS0nY0AOosfF dJlIU9JltoIxgOoOrpCZCx7ZKUYB/nttnKuix6VV2A2WWytFQX8op1YqxZXfIOZjIt+bTFLpJHpo rxAzNU4ys63YIWNK5MYi94REBcPDGXfT4uYegEcUlDF+SOEA12dLY18TFjAYiUiq2ErKrcqEPZDQ CWUGIsj1WsaFQpC9OLg2FiLk2PiwivjY4fbGPvjnVOHqTBslodIegfqUb5XbKr3pt4FcLrI+sfGa OvRJFnGAeyJMwwnEbyuxBAbh30rGgikibXDYCgdN9AaXpeaETKGMxiLUxdIxw+/IGxutwcQxK9ah 2bb7FQJfaijGQpP8LG2sENyhLG0uXAfp1YTScFpuUhUfGL6wJm1EtzJjYep7fEhRtGHaciYGxxLQ YbVzKFpIcDwYrHBWK1PqhCtWFVDZNoxIMqW534WvIDZ1hA0aCXWclgmwM6NVYSzK4uPVRcWvnWoj lmtcW5ulk6XkdoK5a83rNQS73clOUoXK4ISO5wTC8cP+Sa6k3Jl0x24GMup8JvJeIe0cjZOwDxiC fVCjwfGsaE2K1sb2WW+ZKCjXZ8QnbSzcAqQdDoONSyGMtzyYYNGwvU7MIc4q5Q6vRGwjrUvtnxK+ /5BYIvPUHMBCaWBr9OQhl779a3Hg87U1GV3f3513VnMHM4MEB5JsSHSnk3iqGjur0uEw4/yVjYHK OsNdHXLrNeuKB+KtMSl+iLclTrN8KVUrK6ziH1llz5NpXetvTB0LJ91RXHQ2YoHRAbo6lAL8/FvL Et7oKa900vFaVmiq8AgriV7iVkMffBEPguLUlMnVCvckSLvkCdXR5jaXGll85QIYwiQsvb05ugIV r/NRvMYEnNnLt4sb1xXH0/lUSlaBjYKnCxbnOLf8pOQb9zJNrx602evGJR19TJaxhvxddzptMTxb ctas91upj1FMDFP1z5usaiRCKN5SbD0jjq126mhjGwV51q2VTM7YCUyfAo7gHe8bb1eptSrSPxa4 a2sQWqtNaWFD+NLKqz0aoSo2yp8bjdZj7YRX8lAFrsNddYaRc/gIJPjcwbXocy/tVFKNHRBLAFeP gNwoXQkvart1gFJpeTz5HCQ0582mE5fQJw+dAHTz1+L2zdPrmzbQMX8QO+4lXoLUmIcy95NZWijO BkMXr4VKS97HjP3W1w1aM1+788Bv2vw8qY7vOrvzIRfO1aOWWTdySAuFM2/xIywnd/YZ9owbj1Bb TaoS5T3/wMv7WMynD2wi+FSUYB82BW8LPk7HAqi4YhdCWuGPOc04LKrjy+54fOFN++zgM24ffO4A oQtAPa/6xJ1mLF/hMdysfPckpDLFZzl/wmlswIpCk06zuLN9gPuzTauZ+0c2yv8JoN0ISBk5VUMY YCrLMfzPhmwVM66zjxte9eyivGHcrECOP1Wx5SjubIzUj4r6oapETf/VveCHg672ekyZTLZONqNp MA7ncy/Xa7WDOMYkfJhCzwR1lBefcwVz4Aia46jK59Z53/91g7qv93diI2n2oTncT4IJ7esz+btX vWnIx/HpJAinlPXG0fj0a9q7x/3/Au1KJFFlbmRzdHJlYW0KZW5kb2JqCjEzNCAwIG9iagoxNzMx CmVuZG9iagoxNDYgMCBvYmoKPDwvTGVuZ3RoIDE0NyAwIFIvRmlsdGVyIC9GbGF0ZURlY29kZT4+ CnN0cmVhbQp4nKVX227bRhB911cM8tA2gMyYsq59c5MmDdCkaSygBYo+rMiVtDW5y+wurShvzZf3 zCwlk25coIh8k8jlmduZM+MPdJnldMlf3d+iHj17v6BdGOXEX343ms3mNL3Ez3K6pMVstSSvR9sR n5b7H0a5IFD3p6jphzVQVrTKVrTejhJyTgt8L66yfELrevQdPV3/NfpxPfp1lB77v0jzPJtMBem1 jdpbHS9eeLWNlF7PtY1eVeaTLumF+4leh9DqQN/QexNuA92/3ihf7Glyma/YoatZNr9CiOuf4WH3 io4ar+8ASMXeVKXXlrbe1aSKQodg7I6MVU3jXeONipqcJxf32j/9dpTn2XJ5mQ/wShNUVbkDPCsc fLcxI3qJh/RHVTeVHpOiRnm2V6sjn9maXes14M4YjatMYRAQnNsoTzBn8Pvgzi4CZQcLM1K2pAUd tfJhLH73ce5DUPZIwURAqhBcwYGUdDBxT/KpolqXRo1pp+pNhQfGfRhTVXqHM6Vvd9QGhNA4b93O q2Z/HIsLwZGzCPSmRbpdEy+MpaD9nYEDA4+8pr3Z7asjMJq2Un5MOjSafcC1jS4UDHDASI2ydHD+ FmF4FwYwpWZkiscGEf2tsx1Mv3suntRuYyr9Wd53x3ThwjFEXXdn+0jXtvTOlHL8ukF9Po8RzDYe 2NMO+Y0q5P5vxpbuED5LyIN6VSpuna//ZYnolXM7Lrpgp1xd1+qTs5/ZjclVtphfTgYEujG1qbjo jtMAklTiy5k+cW8C4bsNreTM8OUafEJF74x6hJYv3t6gs0PjbGDMCCIJLUpcvTh4E7noiRFsVeMG CuEHUeL5ZEaOacNdADZ7UMfrIhpn2Wl14j1tKlfcguw7bpo+Ek5rc5ccoLe/v/jlzfXrt2f3kLU1 x7htrYCiz+MRNquKtspUZLZ9LA7sQ6s9t8vm2IDeEgCTT3t+ryI12kt5Yh8WvvZxHkoKvHEVQ2RC Ejqg8xCHBXS72+kgENzBGy1G+ljswEM8CMidKZEwt93id+BGOXXIfVGti6T6UMXeMYW5FkG6Z6M5 b4ioNpFrgYzX6jYlDU3TecQRoyTVsY8VVDRha04FTKpStF7ECNG2HNNYfDgoXGIGAlrCiaYeSBTu BR3bBuW2+nCKZMzq2H++a+aH2RjSqksMSjSsEGJ6bUmVpUmOgbYQSiFt0pBBotoQXW0+qQ3KlAQW ksVU9K6SZ060PF07derD6tVaR3Haal0G1IuY9R7yH7hUASVxFd4kIyE1tYyEQOWAU1LNptGpm1EW qT1SsDk+yg/m21pav4+kP4rrwubQCcSpYgHZ1zVb0B9NiOOknn27fSRQGgxRwRTJ8UoVt2nISczn NAq/+cCgDYcshzN7FVhmdeUaBCIgqGCt/K2OkEVQ18GiQFcqRIziNKweU79Bwc22I/7BhD2Hcp6W HXndwcJmqRvoFfLz39on7dwJQko2qKaFUyH1I2J5yJwwmISKQ8MoLVEgV6rj+BSujC5XQ1odnMO7 BhNchiyn8E5BngYTQxrwIQU6xR/UmjHP86gyt4NabjzGEefntJNw1cWw0IIf4exfeFNyiU/ZS7cH ygDGg5Mp2YkJnF2oiOLB0LUK1+zBCjUHW+kGNqNk+Z13aL86fP9IJe5P/oET5/3w/22a+fIqW85p spxnl1dLWRLfv3y+nK5WX7F0TiazbDodgP7JgowBdR6wqSeQHswCUW+QhTdCxMOWL/LZlDEuzpGX /QynecQ16dhXiuIZ2W9VkiguvXzAwsurD69rmAcA/1I2a62s6FPQUHEekowBnbpTBU8Ci8lbpwV0 3c2X2qEHQSdt++VH3aV373UOW1nZJh4lmdgxkSyjnX0TeR4quYJS8F4mTSHeCYuZmlpCt6rW3UVn sbx0bUmiNYOd0w4zIZNFnjs9whMoLY73h/cIL3Ba/wvqNEw5Vy223QJ+dJsyz44zRjrXR3JtDCgc pzzNB8H7137fT6Row17d6cfi6yanZKakJ9dF4VrLTXdxI033BAGrYi9jzSWNPujNQNGNoq/opukk mywpX6yyPF8I8fcxNuH7Z8/UvS9JAL6mv1aX2WJohiv6BVPSSpN8xce/3EpJjLp8ZxDb8Wm+W+w8 aSfipJxyzCuNvfCoHmeR8aeLbJavVtJNP8sm6lwJzmNcV1ln5sePjeHJcKMbmNtAXFdj+U+Shq8/ 3vGCu/rzVIJ5NqdDl6H3r0aLnJOzmGeIuh7NJrP7j9XoBuf/Ac4AvGVlbmRzdHJlYW0KZW5kb2Jq CjE0NyAwIG9iagoxNjg2CmVuZG9iagoxNTQgMCBvYmoKPDwvTGVuZ3RoIDE1NSAwIFIvRmlsdGVy IC9GbGF0ZURlY29kZT4+CnN0cmVhbQp4nKVXTXPbNhC961fs+NC0MzIj6lu5JbHTaiZxE1uddibj A0RCEiqSYABQinKzf3nfgqREKs4hNWWNLBF42I+3u49fqBeE1ONX9RmlnZe3E1rbTkj8MuvOaDSm YQ/v6XBKk9FsSkZ2Vh1e7e9/6YQegaqPKKU3C6DMaBbMaLHqlMghTfA3GQRhnxZp51f6bfFv53rR +dQpt/0s0jgM+kOPNM+cNJl0l1dGrByV11uZOSMS9U3GdKX/oLm1hbT0C90qu7V0uj4IE22o3wtn bNBgFIwHcHHxHhZW128vTnb+nMdhOA1GfZr0gepNvX33NpyF02e4Ho45VSdEmn/cDUnEsZHWwkFb wBthKZz1g3A8DcJgMgmIFhtpJcU6FSqzpA1bcDmdAeoyDIPptBfSIj65vCqS5EBfCgRwpRDBciNl IsURD+8+Xd3YRxJGEv/s8MYanWGLzkgw9hG0EUekaK/N9oWlREcioaubO1DJ6mQnje2SyGIPmWlX /SyWiaTCqmxNbiORhiNUnXJgicJttFFOOLWTHlNlKyOsM0XkCiOPzpfG71WSNJEyDWuytTS0lM1j l8J6n/hkkl9zGTl8V2meyBTUwmm4p1dNKKbZUkaiwGG8q/Ty6CF+E44ikVFu9E7FkgTtEOC4iYHV uc4AsNKGQY52K9swVZVmeejCW5ILt+E9TSxvOYIKe0zpCc6vkkCXfPvgA263Ks85yDmidrL8zCzv BDkNq6NGbR3vVKGqM4Owzx2sbqJE0jBXQJNcW6s4zMCLkDwVAczv5+DpFdk8UY6z2aVEbVu5v6k8 eF1ynhZGZDYpE/Jw83rx2KVl4Wi/kcBDrNgKkLKBYIscBsgYhqy1jpEPEcEEHGyYfV3eY6VMsY1y aXbCMrXqVW32ZHxKwnYwf+1GF0nMVIqQReTYIETLA6K+99RE5p2OdCu2bU7ZAPfOuhAXMF1zYHOj EJ8r4QS9l2JrX2HxU6X290ZmpxhWFOJcI7xxl/sD/GQ+l0kTS71jlgs25ZxG4kggUFeerKiZJJyT ae58lWr2O0OtlETZaOtaUI42zuX21cuXIop0kfGuS3uwQAiq44NIp92KhXpb5KhYUFu0edTu7UcO cnGTO+QK9EVyV0IloMQ/V39+eD2/eUQU3xQte5rVqjxxUbAcLNojRBbHsB989+zIp2qjWxYYgrMT rixb2gDmIkGmZHxBunBMCab3qT28bEJ9H13YfKdSlQiTHLpVRCwjGMk9RZ7S28R5UNklj4RAmFw8 lmFhK47GzT82RgZs3MskKRulX9fEwlmn1RQz9SJPch1FhYEda2FiXwBYWRddWUitmjuSEdXILHyC 51Pm+UcQE7zwCbyVcREh4nd65fZM3yvFXit3+BHx36KCNHpq3Z9hH6y09WhYFVnkq6zk5wpl2RAK 58286tOGp+p6La2reji7KMuootIBwo3xkEsfAhzT8hv9A7dt7YH2XVSlsstBAhji7bsu/sU8kOZA NoXzlBXpUpqzTLAP54i5iLZiXY02quqqnh+t/diGBCUpl+oOkyOVNSYisFqpyFMA+YFNsQ+Rz2t9 UhMrrhPRdGi/URAf2I+2YjXQI8H8arTCVhlnoI4f2r4LYZuRIknpAa2X5tfX13T9NU+09xBdmD7/ fx027A2C8ZD6s0kA9eV102D8DBE2DEes65p49116Z6SEUELcvLoaDIe86El9tVDZliVHotfwq2nI TwrM2SiYwLHpOOgNKscmz3Cs35sE434L7/6xZkUqoBcSqzHlFHR2iubeJA+JvTh4z8PBmFGeVpYG EcoxrkHQ1FbqTuc8rnRhMIOPvAb9UIDoWNIJc/iRqKyXs97IuE0pru9ygGCyYmQzx0V2KGunBpdM LeXaXbPWzrz3zfzmii64tqRHiCUU1sVzSDgYTIMB9Ue9wLc8TtVzHgQGAAL3mnj30ORrFvilijvW LeekP5nx8idzwu2YVQpv4pa4hTA8f35CioxwmnuhV0asytChS64/lZiNQGVDMfip963Uzj4bpeRY J3qJ8XeUi99Pg1lrGviGNs8i9Ai29q1OU2kivvGXPbYxFkY/mgyvWc1hhhWJqyfwRq038CFWeFhQ 0IzAzQQ/M9QLPLt1LA7dloqB0PtuspTx8aPF4mEBj01eg3SrYVG2z+EkGIWzmbfrvdqB+pCfXQLD BI9ff6HpKZhJdzKHKsIIoFnXP55S6/r8ET0fJLmvCYmSo33Fo9vfO5OQKTQZc9LTzgg0OX5NOndY /x8ZnJxVZW5kc3RyZWFtCmVuZG9iagoxNTUgMCBvYmoKMTY5MwplbmRvYmoKMTY0IDAgb2JqCjw8 L0xlbmd0aCAxNjUgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJylWE1z2zYQvetX 7OTQjxmJFfWt3lo7aT1N3dT2LeMDRK4k1CTAAKQU5db+8r4FKYlUk+lkJCexRAEPb7/eLvKBhlFM Q/lpfid574eHOW18Lyb5cZvedDqjyRB/F5MFzafLBTnurXuyOnz/oRcHBGp+JTn9/ASUJS2jJT2t ezVyTHP8mY+jeERPee87+v7pr97rp96fvXrb1yLN4mg0CUh3pmRnuBzcOrUuqX7dsCmdyvQnTunW /kp33lfs6Rt60P7F0/n1u3LJlkbDeCmExtNoNoaJT2/BsHmx9wDTKssOZCwNyDpSJWWsfElr3uPJ JrMrlVGqSkWeS092TWxSqjy777/txXG0WAzjDurt/SN9qNhp9hHR05apsN7rVcbEHxMuSm0NlZbK Lc7SntY4NVNug3XVKtMJYDtYtmCnSut8vcNxwnrHtK1M6jgNjFY6y4Aa3jdHUxEInpBSdQCbn6uS lP+PDwtbnhwB6wEKfgkAbaZhOqDbUNbgWxUc1PDOVAkrct+nHbtD8/Toh0PwXnDeHjzbSJwzVvZp v9UIVaJcYF7CZQ7BrO21bqOM/hRY1Ai04jZIyXlRwhCQgifXGtHR2AYUt9eeycBh3ivwkPCmO2VK tWFbiZFtnFy9MIzOwSmBKyTE4s9AQiwIwUS8cr3ZlsidgpPaYysWym2oRB33WnnTDaBdr9kF7yCH dhrkQgq8WjvmV1Eb5k3lxIrcOviId2xIr1upqByTNuRtziBvDFBfKWPNIZfAvuq3oeARz5x7yvQL g3NgEnZ+xr+Sr3AZEt1Wm20n9MLnHM+AIuGC21baBIzabrhkb8EKJzm9C37qBN4oqYeUB0fCYS9c /MhM77H0JCBfJ0Xj4SiazWi6GEfD8TKoyL1y6qCMMoPHbY5jXuxuEF+hUZPRPJp0TnjuC9xgPJ3h i8FJE9Kzve87532dSfFoEk1g0jyO4umXTRpdYdJosoxGnROe+6RQSNfwHi1n0Xz0v7zHV4UivnTN M3LozjTxGMq3nw2ISlMtGQczg5aHVEUhVwapjHIsQ37udbkV1ajMVhXFIXwW6M/J/lbttNlI6uu6 uqGw67VOSHoMBcUsHA+gqmu9qaDcbRXuaD4EORy839pc8A6CzdKhHGd1nW51ATt/8ngo0sfKZRpG 6I5OSxWmNqlynNPHJ2hXooxYWShX6qSCTkMKCmdhq4QjETnJgrzZ9SXSL7fvHkJO1BqQqb0PHx1v qoYVFMmiK4Xle+uyVNTsovHGQxB/1+o397zBbth3lxcqwcmGbtBhxGm3nOnQUO4ZauJe6O+b2/t/ vtB239pEfBmY/Ngmf3eUPuHN0nGD7p07TPgIZH9MgkzELyRAt0PAUzudMm2sTaU9BpJZ69w6bhfd taPD/KHSO5U1KSGO6uw/CurhdFZp684dWo/2bawVJ0qaFKhfoMgeiGuBScVTVeCRSpIKTYgvZNiX WgJf5y05kfsAFWDWDvnXtGakFyg3s0WnIzi9EeUPXZzr9oBFO9ge9r9GKQxuwvbBY7XCNEd/y7Ph P22UKxS/kcfxIo6G80XQgIc3N7PF8hqNj2ezaDjpgD5fJ+JoF4v/sJwv5tewHI2m0eSSJeSq7ush FjlCgmTFiJTZA2KyOkCHkDBRUMh4OhGAzypkSLhTLmgjA17zPpSSEd0MU1d6MCrXSajmDRsZdvhL Kqkq8HG6rEteZNJhkoJ2cDNNHPM+1TImSdKdFnRyX8nhx4pp0vPIthm7NxZTXDONSI3oy4nveNYW kieTb11DnJ6P7JOvkP4YmVONwTtUimqO6wikPelBopItILRpWkFApUSXYf6EWooL4SKJDsjXFrSx 6oqTi0E9/pHaq8OZiEqcFXnCoJWw/OuOjzADdqrb1KrpRYVH42g+G446sRAflZxsjcSOdJDfcIVA c6oSaVCXwlKPvtokWZXyF3TYZ3YvpBOZusUxx1vcyUMy7R7vUHUPkQn32C87bnVofM6L11cqeVlZ w2G9r1YDW4h2YVhlyA0WFFYbGYphQYEBNqRmG+sc3WYlDK2DCoPAEOyMRNhKhyz3jAQ/OVCaSGea 9iE/pYUGHW90FF0PsezLlI5Q9EPi1W5FO6wyVB/Xd7AOL7ksDTzIYYrHzROjgTTs86XqFHmBe1T5 b8ai9fqDx8Wn26Tr+2QoS9S5pMOxO8vl47I5n3D/eHPzx+9tJNUse3Nzc5qLPK+rrA7dR2iJq3vG OUv7ghSmkY6jDF2h7ONZNJ5QPF9GcTwP8vbYRCgeXiPuy2k07+I2cohWgi8G0yXmeNHCt1pmOnR7 XL9wcc6ixqzXHwtkjsdlBTfPfIV0X/bD/zRQ5/X+HS6aFMfPJ7KzaEb7hvLDL715LGznswg08t50 ND1/zHqPWP8vz/wWhGVuZHN0cmVhbQplbmRvYmoKMTY1IDAgb2JqCjE3OTIKZW5kb2JqCjE3NiAw IG9iago8PC9MZW5ndGggMTc3IDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnicpVfL chs3ELzzK3DJwy5yzfcjOdmSkqhiK45FVw4uH0DskISFBdYAVjR9S748PdglxaWtVKVMWaZI7jZm unse/Cj62UD0+ad5VkXn2ZuZ2ITOQPCP33Qmk6kY9/E7H8/FbLKYC0+ddYevTp9/7AwSgmieVCFe LIGyEItsIZbrTo08EDP8m42ywVAsi86P4snyQ+dq2fmzU9/2f5Gmg2w4TkjXNpK3FHuXXq6jqB8X ZKOXRn+mXFy638R1CBUF8b14o8NdEA+PV9KrrRj2BwsOaDTJpiOkuHyJCIUYDDIh3gYSbp1Q1s7j BrOTnsSFKwppc8G/Fw6nOfPTkx86uGU+7w8OCOnxhoyMCCQ6EbckjAuBEQOpyuu4x5ueZBT3OuiV NninK3TEx1QEIB5hlCHpcTEu5WB0ENIEJ6zbiRVpuxFVwCESbwtLuxRYZXOKpKJcGTqFKpok1EkS qk5CqK20lgwy/8OSoE+yKA3xaTj0Iv03PIV6hxdHHf+fIwbDcTaeiulsnvXnScvR4htsMRhNs9H4 FO49knjOfHgKlYldsfauSBqU5EMJYvR9EleKe+k1QQu35gh60wmg+kPRO+qZP6QMs+2cvwvdgw7B FRR1AYOBxKBz8izEFwJvcJpl+K+ZREcEmrsyamdrEZW7Jx//S6uWO/BxZbWSDBAOKqar47YKgNnD Ju0Ak00QU9UyB7tcrmCmDO+eV8QQlF7q4Ks6UHD3kjbSmH3vFY5KNr9JIUjTe0n3iODy5la8ME7d hcfq4xoJW6GtAkuBjWyrYkWewZWrkKkmcN2wLhy0k9F5UORbcXv6WGlObLUXRu643DR7t0Av4Ch6 K8kFsuJY+BTAWwnRkNEtBDyFyqlwCqdo9RCB2IIqfIKcEELOR4REr6dNZRratQXbulW2iFJ2OTtT 5Xws2+/t711xu6OcLD/r+Jm8AVRX/OKlVdQV11GaffcU5oWXn7XpphMdMJD/u4vr5fPl9R8g+Obq 6vLq8gu/n7TBUyy2LS5x5p5hZFlyY6ms0Xdk9swbzFTiL0S25XgDNy0lTcq5lRuCQQsyjQWKgwVs Y4EkfiI8AMwYOFCdUa0trdd1JSL6g3cOpLLM7Nwo7wh55bpAm4Rrod0XPCcpkgXqJnk+Ax4yPkmv hVCWBgWEXvmQQFK5zovFO+aDFwj3ry2xFAIVY108xToA9MyxCI7GQ8cgne7bOAfRjwR0GYhrwOxb pa29qgrUKVNbyBg5B8yJaOhn3LGRVn9u/FcXBx/CycGN8hQoNaDG0Xs2poj7EhlDOzR67of1lDqV P1TqMZKOFQALPE520t1SQm7XGPIoIL/Yut3DqWD17yWkFaXTqFv8AWb547p5rdOQO1eOayo4H9Nc bfyWPJBqFmgwUpPnikAB+oJjHHSwQn5wvt1IwTNOzimAyIZXtBRPJZIKPDFKB/YZj22a+j5YeNaG iVucUFNInwCYblR4hqW3uuROURqpiFMzusDAh/Zf6esYU6S22T9NL+ahdOjFI3D12nGwOqV2gzJM E+26KKWKnN0V1MEC49E+nMxXLNZr8ujwBfeZxxry80Q6j4iVY1cethEkDgJY+kQus55yizw2T2JO zaLxJCtycXnTNN8DuVzTOSnD8vP03AGP+/DWVSZv04iDVpTOUoDoproXBUkbHqIoH3JiGpmz/Cwm qRTVe9eX0SSLNuFwFJpxChfwCa2+5g1EcERpIgrVZgPHhDqexFPa5Y5BtgqRLOrUCOIdjeVpJbBO GIe99jy657bdPjWrL0Ks8j3b9JXDmDDyW/ay4WyYLaZiOOlno8UsbVLj/jcsZsP5OJuPW3jvUZlH zrg1HJX0LjqFEuAtbAiL48avLmHYl8isxd/cbO4xw99evn42GXGj/Yfl8a7abFETk+9EMG5HHsy9 qGI66LEVLJUhgqm5dBa3H9alkJrUWsISKAaeRoELdwN5nkr7tD2HAo7rprbFNz1N1fCUfcntvk61 vogDTSsp1p+DFU6hTrZUhP/KoWHD+KHy9U6DuxU2RKk5Ukvsb4m+jsFCrdVht9X4jqOkPaaTAqtH OpNeR5MWqtTPd8fqtnmvVY2ux3GeuRVFclZQnBfy5XzCWR2qs0HB2llne+la3jjHs2wyWCySMi/1 PWZZPSRBGn8pSY+rTyXGfBC3VEZKu+Kim77Eidbj3Wu5Ieys7w+1MM2mYtc4+M2vndmAzTubZoOZ KDoTGPT40nRucf2/7QiGrWVuZHN0cmVhbQplbmRvYmoKMTc3IDAgb2JqCjE2NzQKZW5kb2JqCjE4 NCAwIG9iago8PC9MZW5ndGggMTg1IDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnic pVdNb9tGEL3rVwxy6AcgMaasDyuXInXS1EDaurGCHoIc1uRI3JrcVXaXUpRb8sv7ZklJpJoECCLb sC2Sb968ffOhd3SRpHQhX+3vrBo8fjWntR+kJF9uPZhOZzS5wM/V5Irm08UVOR6sBnJ3vP5ukEYE an9lFf26BMqCFsmClqtBg5zSHN/zyyQd07Ia/EQ/L/8dPF8O/h40j30r0ixNxpOIdGMCO8Nh9Myp VaDmdc0mOFXqD5zTM/s73Xhfs6cf6JX2D55Orz+UywoaX6QLIXQ5TWaXSHH5EgyJ0klC9No8GLsz dMduy250p3OmW3Yr6yplMiZlcrrLEMusn/z84yBNk6uri/QA0QYxezK8o42zwWa29KQck642JVdg CpLWrZXRgCn3Q9oVGqQqVsZTKBioR6i1s7tQ4HZSud0EbQ3Zldx0xCbtcUSlCnrL5R4PqLxWJRJ5 iqhdKMe+LsOQvF2FnfDJGU/YDTsfk/J7H7hCnEob7SFnsLhSqC33cUpr1uwIz2mbRza6YgqWSlbO kLq3dZCrR8VCbSCWxOjC+EbDYYyNpysOhc0bSSiwD/FCzpvS7kU6Z7dRPD/somS22iCXiKDo0apU vhhldXiENF0QdpWGJFG4XcHIWpHXa6NXiGRCj1Ch4Sfg9NSF8q0wNstqCKKNQBSC3kgAqW9MF0ie z5Tnw0mV+kFORnx5tEDDKJKSsw8FTjG3WS3XeqQ2nNU4XPZD0oE8c4XTIqc2Om8Z48nKukMYsFkK mFPasz+n5VAOQksbH9S9LnXYR5mhYJ1xdB8d3hf2nBXRpV0cMYw1huE8s7XlFuJDk9ZMwr9zcPHf kzX6DqjUA59CUFYoGMsfHFw2zHYa9u/4W8xZ9QlBVJUFEbM5qcbOtRdj53W0Zgeg0OsCfPC3R4pd nNqrNarUiE1AOx50NBTBUGKERvWToXzGRsECCVDOW8k02iJzLEYA1PP30EMHT0vl1hykIG5Mrrda cqVnf97Rc7PWhttq/EJnedorzidd9i+Qnun6LbPG21Ln6tA1Kouiciwuxr0xJoBWqARI1IVShM63 Jw+dSzJ1dY9yx/PSKmLcjhVLu46HB40RLyvrnPueU7BDCCp7kMR2GoCQRBp1e41WSrvy/8HArgvE rThtI2m5IDH/uNOwJNGTPT+W7MXSql+dO4tK+8Dml08NH/AODpWu6IH3tKpN1m2zh3HzlYZ6EqMR vk3Mq+12f0yedrYu0abi6fcyOxjD12gEykvJKzfaoIgLyfYNbj4Ozm8bwZcYaNMJTcZXiQxymZ6T 9DsG8eV4lkzGPby3zWjaSqPPo/Y4CelhiDIaT6dy/+jo5LzrDPgAWX98erv8hCS7rL4ty/HFPJmB VTpL5mmb5fg7shyni2Tag3tLaq2kZTZ9+tyqG7bo6lLk1uXsYurpBBp9IXNLgkYqy6I/7bFtNcZp 7SzY7mjOY9kK+uc6g1Tzwbv+cw1p1mlIOV1bmUTvD/3/WloDUnmOv1+jcdLS2foe9VNYG76y6Sxt rrDA3NzdNk3XomQcVh8UmXs4NQyMQ0PrWlappi3j9G29Lnp12Y8ouuQMFaAGD8ENrqKtVnF+C3cZ /ZXExBbR6zlaKnalMpbFCoKKMj4uc3G+7ZuV5p6Bp7zsApAjThrcfFbeG2jJ7VOyMeEUGC0b7FbO VnjfennTyxR0Pgp8vsCdb6aVzbkcHlMTrIYlrh1YSqh7xqX+dGp5ym4kj534dcgcIPoNyQKun9pp nsrqIFtUiT4e2hBbTDXOD6tEFjuXPgyzswSzvpOy1kk4TbBkNO5mFJ+f7+csOkfEZ9q7+rjowlj0 D6oNvF4oFJeh3w4ej9H+in67VhvJ5gsevcWqpsr+sIwbuoC3VvUEtnEqKfHL6D4Wya6JvG4iY5/t 5V37YKtoKivr4lZ7IS1rvxyCFv/JUgq2WwgLYLmENam90j+PEctCVqLnIy/MBN2ccYtE+KQjdWXN aKPiUtWszd5i60m6SDdoIBsZIG03Obdf3sgbPY2z3KEkYQLxFlAm82SaLhZRvZfR59bmQ2JgygeK +MIeo+E8fDzaoGdJB1wM4+cp6r3e3MoulV6+PUyvWTKjXduNX70YzFNpxPNZghZbDabj6enfcnCH +/8DN4lvn2VuZHN0cmVhbQplbmRvYmoKMTg1IDAgb2JqCjE2MDUKZW5kb2JqCjE5MiAwIG9iago8 PC9MZW5ndGggMTkzIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnicpVddb9s4EHz3 r1gUuOsVsNUo/or71qYfFyBNc4mBAlf0gZYomw1FKiRl1324336zlGzLSQu0qJPGsEwOd3ZnZ9l7 OklSOuGf9j0re89vprT0vZT4xy174/GERif4dzY6o+l4dkZO9ooer47f3/fSiEDtW1bSqzlQZjRL ZjQveg1ySlP8TodJekrzsvcXPZt/6b2Z9/7pNdt+FWmSJqejiHRhgnRGhsFrJ4pAzetcmuCEVt9k Tq/t33ThfS09/Uk3yt95OrzeC5et6PQknXFAw3EyGYLi/BIRtq+iNllQ1vg+LWQmai8prCQtnN14 6Uh5smvpBk7lyizjV76SmRJab5897aVpcnZ2kh4hCu/V0iCyDRbJfLAULpeGXl/dEhABRiLPnfQe EQuT8xHK+CBFDsADSgiyrEI81BKHJR7RBojVAEyIblWptHB62yeLIF0XKhPAWUuqrAtCe5AQgUqx BWESRSGzADxlMl3nTN5yCiyJLEOMXZyP6q0ilGJjHZJsDYDLCpEhdcqQUK7SwrSkMgtg5GplK3zN T7ztYlmDoD+ulJZA3JAPWII8cSpiki/ezN8+9XT+8vr6w82cPuJITsU7Z+uqi/MJH/Y6+zXFpqej ZDShyXiUDBvVjoa/Idt0OEmGoy7c55hksbYqBye151bUoXayvyd3IC8cUhaU1hzHYDIG4MkpDfYq yw/Ec7mW2lacFOx+bl3cbGygjcql3mJBpe1W5skRp19u6snJJDmLdGa/09OTZMadd0BD+a9tgKDR SvSq9grK8U3/RvLjuGFEg9NhMp0gCy35K6iFxfEga0xcoTtsXmdRzWiXtcjqusRBN4Jboh/3MfiD rj0grQTaxEmhB9C4BkxZiSxErQeZrYzVdqlY76VwdzI0ym7l6G2mZMC3OPAlguLurHXoo+1amiiK ExXE4FeqCFEOIrcVuw/ZooVBpF52QiqlMG3LOqnlWpjQ8N+0LbHklvDoRRNzsDTWyRZrf3KHU79h ojI85bY01gwOT1rCCQD2eW+SdFE8sh9WdFlpWeI5Ht3XKrsDx4Xw+GQbrS/ayj72yhwu6tl4wR2r JUHCsBa8LYVR30Q0ZYg5rIj9VBUIENxtJZ1gW9ylfQvrLHc9sJGLvXU3NUKyBTdbBOKImrJw5mT0 vkPql8gShg1lO54xhj7vahvXam03vPWQ2WhtmAi1FmyyLdSONrk4kFihyD4iyEAK/ekA8uJxklN2 8pLHhovz4tYWYcOb30cu8NdMvvj+2JkjvpZxYV132vgdSGv5ufKurlAxqNejDIVAPjqe2p0slK2s whyIQxAzEJNhW0WlNAcETmQrz1w5pLMLhCVIZIHKYaDkYvuwMzinpi4XOAcaOITcwdgH3/qddD7y yFGGXMuEibMO/X56q4L+m578wYjA70BF+WOm8Dn3NUoAWrEfodkS/DxPPVbgj8ZsB6tRoXX+oA7E qJhcjklslF9hs5H4w9VA1desF2uazH0PiU/HOiS0jvO3FPAz0YwM1RRUmcIJH1yd8QBpuXewMlvv Teu7CugkEcALGwVZltLxhaYDxKLGMoOdtcvkwe58jesUVPPyTiA+jDDlM4u3f5Ori3MYrCnsQtuv /Q7Wtd1Ih2D6dHWJywNdigWAZMjYZB7cyE7B6a3EerquFxqyYRIf2gzReaPFn2uA6gAQ61dHm91g tpJWdzwgH7ZCJ+a2KX6ohMdtIU0+gPrc4KgcplBLVCo/6hbmiADlV8HmySOEd/MVz0Vp77d1oBoN 7L1v53r7m+GThu6TfdURXezKDsbeqz1VEAPEpaPgnNWHWzCCe1XjDsGiZg9btkfDWDtQrcX2j67K Hiygq3DcYQNgKRYN5Ncm/rgto+uC+BfrVNhy2+62Fs6W8YSYmqOxUjlMQi1N1kVqOj7OAMG3UBJV haREF0ccfKf9md5uL+NsVgWPA8bszOl2Qnf01eb7WECZ5gFAuUOjBHZMvpo3W48nHJece3q51Nz3 ABlNk3E6m0VxX6o1imBtzi1DQiftAW++VrBbT7cS8o0OOuvH/+fQ0evTtVhKSkefd9fkSTKhTXuB u3nXm6Z8d8PtLJ1S2Rufjg8fde8W6/8HQHZSvmVuZHN0cmVhbQplbmRvYmoKMTkzIDAgb2JqCjE1 NzgKZW5kb2JqCjIwMCAwIG9iago8PC9MZW5ndGggMjAxIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2Rl Pj4Kc3RyZWFtCnicpVdNc9s2EL3zV+ypaWYsVtS3cqydpplx08RWp4dMDhC5lBCThAKAUtRb88v7 FiRlynE6k1iOQ0skHnbfe7sLfaJhnNBQftprWka/3Mxp46KE5Mduoul0RpMhfheTBc2nywVZjvJI ng73P0VJQKD2kpb06wooS1rGS1rlUYOc0Bz/5uM4GdGqjH6m56uP0ctV9C5qln0v0iyJR5OA9Lry bCv2gyurck/N65Irb1Wh/+GMrszv9Nq5mh39RDfa3Tm6f/2hbLql0TBZSkDjaTwbI8XVNSJsXqmp vK5qJm/oY+28zo/ktwwWnKltCtCK8b9T9iiPlEpXHr/yzPNnUZLEi8Uw6QM6tnudcky02moH/LrI SJc7lXpSRYGFxjHt6nWhU7p6cxt2KvZsHW4pD9AOSVmmyvgQTsa5qgtPO2V9xZZMTuorFrBLwSUL YT2YfzneIJrLwtRZXgD0CxnbBy8dY3/3EMI1K3tIr4zZFPzlglwNUpWjS+1S88zRnzuuJBVVZfSu VtlSVj0ge4wYbjirUwR7efWGrk0qoSuvTRUWXppyx17L+xePU7sCEbK0VPaOPS5HWoMa7Wy985xd SEjICRuotdkz4twG9p0pGTn3MimN88SfNfSuNoLpBKmAzlhaBDPsrNnrjGljTBZcAlJ6CEUv/E5r LSipqqFvu+DsMblvKhbtGvd0WHd8hAuUMxW2rxDpRlXdmkPIYAcrbhVwlQQLxluXOWx9a3pQWrCx zz0kEoC26gCyILsWP28Avefi2NpSmENAMAQY7WF1jGRcij45lgv73dYCJ9bcWbxrkhJnd7f7bGPv jNNCI3lIpMTyYmassa0j1lxxrr0T5lOUIRSzruX1AZIqnCGV54yCSu89I6kHoVvh4F8I3FRPa5gz C6gCHpe72nb317xVey3FcR/kI06eCOklahnrxfXXcJuVTgOM/3FuER5rtxIyZS1XG7DCVmwoJJsd 2yC8RI+/vXYPZQn5933fs1+h70TXrOlnjahrFvCcD2ddQVcZo2ozMWnGcIPs7EQSCcuZ3B/QIkJJ HRhtC9eHEJbT2jo4KSxpIjfWXdBhq9EfUlgZYUoa4jEJqFE7SIKksx5Wx4fndFtp1EyvAaOUIZQu WbQ4zZTvnk6T4SRejJdhqCTDJ8ynxajRtw8YmhvciNaZNfrJBoPOCoPROJ7PhpiNWUg56JWZtJZW C33v2AVWclMU5iB62XO0FwJ3AmmMlWBTumq0g19vPQykbHYaBzftYKEradP44xgsdssFBAHo41al PyAB+o8rX/T0ofc/zn0ymsSTGY3H43g6bei6+e0S543JE0RIZrN4ODkD/QBGOUwAcvCcTHJFZZeN +C9riYBDWYoD90FUUGo5BRy4PUnWKnWa6Ryap9orXYQRgYKQYdx286bRw9X+YOydtP9cb+qmlAX/ MaJFjLMHO6y/bl6jEDCJlWfCNMnCp3jUeVunvn3mui+P1E84SNTdpEHd4YShPdqB8yoMRdf2AlOH sNehq1tT9oEEW8yDLupNagp47G+Nzo4lzdQ/kXi857abH2e9Gs3IexCVbo0MiFDhAMYYgOdDo5dB qSrMpaBFTylc+0A7y4OOqNbbjSKnXrMOswz59ocmmo8qZNL3sVL0VJzfinB0QFZOZnzLe6de+/b1 7VuZcU107b0+VNfxLgg1WDWjF2PXYDRJmOoUqBwHsfBB+XaDAbzJYYxzMAReavRkK9O671dRStWY isgPPiuO36hd5ZxJtdhG9WiiAxRsJlpoCBdBDP6s5LBHP17Yk9E8nuBwjX44X4QSzOSMPtDs88HT vgAky2G8XDagXXJniN/ZgpJFPB2doWZmO+gIGZx4ywb4/Amhj+YLfHAW/fsnxD0CEKjt402e0jXH 0Go2O8P7IKcZqeyvehaGViJPP9oST9WKGoTzVWbkKCKF2Cvyi+74auQwrINxv9UMSy5w9BLrlqEn NDWomy92wcACjENLYY5haqLBQT/pjlq6xWQeT5PlMoBe6z36HA7uKE351hW3m7z8vNNYgxGIYMs1 KmN5Eb4c0tnr/Vu1YUqmH7rSmMUzOrR037yK5okwPZ/FyYLKaDqa3r8tols8/x81G2n9ZW5kc3Ry ZWFtCmVuZG9iagoyMDEgMCBvYmoKMTU4MAplbmRvYmoKMjExIDAgb2JqCjw8L0xlbmd0aCAyMTIg MCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJylV01z2kgQvetX9GmzqQKFb0xuxE5l XWWzXkPVHlI5DNIIZj3SkJkRhNziX76vRwIEsQ+pYLsASfPm9evXPe2v1Im71OGf+j3Jo3ePY1q5 qEv8Y1fRcDiiQQd/V4MrGg8nV2RllEX8dLj/NeoGBKrfkpw+LIAyoUk8oUUWVchdGuN33I+7PVrk 0Z/0dvFf9HER/RNVy34VadSNe4OAdFt4aQvp2zdWZJ6q17UsvBVafZcp3Zi/6Na5Ujr6gx6Ve3J0 et0Lm6yp1+lOmFB/GI/6CHFxB4b1y6+Vo9QkZQ7MFjlVJJKUp50pdUoba7YqlSRoJ/aUGUuySNul k9aRN4QPb99E3W58ddXpXsDKwAxPbqU94KS03Idb2iRCE8LaGftEZiOt8MbGALvg2Is5XFNswU6Z AotuZnN6qOBAYr4OPD/IlSpoIZ1XxYo3fv8Kr9v5gyNRpGRAw/7EwLVIONpJrfldFPvqOYAdEZJL MpsjGVeRWQYykMeDT1CBsbDXromDZd4kRkMPAbkVtlxC6JRV4rVrqaD2N1WHhI1YS5VIB0luizMo Yb1KSi1si1PnpMwdJVbhIjgCLJVbqc2GxAa7bqwSXiLVuCmWWraaUFZqFS4GkRKDAGSWycSrrQTM Rps9GwUfnVoVFfdEFPiu8cSZUEzZSmd0yWJBAU9aCgDiQ/AAkyKTEbSHs3LBzguAwV9NKPltAwr8 7KX6L1imz5a5N1bSPbYrrQyE4fKZlBD3NWfcqVx5aJ+fFkFEozV25pSsS0eZsLQWUGIpZUFIsjO5 RPxOntF1a2GxZFMutUr0vkXLsgq5LOATveeEpsJjGbbAVgJICCyDixCa0E0sTgMytkXKQt4DTlZ6 UORqXRUqQ5YLr/eUc8wN+mGPJlYBAULdHsNq/cyVN0zlUnDQqtru0IOaWF4m6yL4KzF5XhbK78Hv gfN7sonjlMH3R7O7YBb2eRNrVXKPQZ1xSCUaFurlLA1BNy+eatHLzcbYYAewawI1DIqbtw/b0Qnw X2NRm3yNbtDLOMw7URa4+RkQx179a11/MBjGvR4NxqO4252Ehj0Y/kbvHwzHOKuacF9ihmv3r3CJ 2kerpyHoAVv9Rmai1FDpXnjkidrcLx13JFqsZU7XSHBWar1/z0gvWf8eyqIF+jbERYNOK0BKS8tO VcgtTNkQF7v+nWV49Fz7ahUKTUsHX+Moqo6MFwEWXOhVw2yiaPUkYeW6KByOGFQE90iYA6Xnqsr7 2fcvW9NXB0KLVtos8b1hqsroB2efTHzR6p0sXOnay1LpFEiHdjPo9A4KDjkHR5xrY+FNwQ0qxD51 zBWlNBO5rE6eWZkv+bT4cXs9nc2eX2lHj3Kr5M69b/IJC8DKWHBBgQa8d9hFpDlEdp5hn+T+RCeD wUP3PWvyh5Jo1naDac1vWvq1wSGyB9PpbPocyF8UXK3rjQnp4hhpvgePnH6gOT9Dmin6PTG7vMxb VfNC8zE7iHl5hIVuUcVYn6RIQFomjGCDHHXJw2Nh3mFCbDPHaen14/HolJbwatdwc5mUIRJeMfdi qTR/m6Zb5YzdI2s5mr+Xkn7M59Pr51enh4DGsXr88aG+sqbcBFpH0/FhxcHUzZMBf6vFjPpxZ0C9 YScOlc8tZvQ7LWY8iCe9M7wvocUMOn2+0T4GnjbHOVSrYLlkbZugxAcjbFpPCnX9kKnCdg3JX+s7 kFGuwkN1Xg9mfOOoEDk3H8bGTGS5owjNYyPb+czMwW8Y3DC56jINZ2tlx4LtWE12oQSOZVJdCB3g fPZZHW/CuZ8w0NQTTshhhiHZoT5CgFayIA5yuOqIusQKgzimqXCOVvMcuaPzOKyjQnXwKJhQIGct iGe50BSxrWzOb6Fi9oxcsahGkRqq2p2pA2s4iQdB9ju1hTrG4NRHvQsd13t8/LZREBhVsoGSqH2a tML/DHT2+vwgVpK6oy8HL4/iEe1qBz5+isZdNh8fXVeUR0MY7PhVR3M8/z8wTQGNZW5kc3RyZWFt CmVuZG9iagoyMTIgMCBvYmoKMTQ5NwplbmRvYmoKMjE5IDAgb2JqCjw8L0xlbmd0aCAyMjAgMCBS L0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJylV01z2kgQvfMr+rS7qQIF8SXITcEux1U2 9gJbOaRyGKQGZiNpyMwIh9zwL9/uGQHCsbObNbbLxvS86Y/Xr1tfoR2E0Oav6neSN95OI1iZRgj8 pVeNfn8AvTb9DHtDiPqjIWhsLBts7T7/2ggdAlS/khzezwllBKNgBPNlwyOHENF31A3CDszzxh/w Zv5343Le+LPhj/0q0iAMOj2HdF1Y1AXa1oUWSwv+NcbCapHJ75jChfoA18aUaOA3mErzxcDpdSt0 soZOOxyxQ91+MOhSiPMb8rB6rcUWYYFYwEJLXGY7wG+bTGlClgXYtTSQqqTM6UZQGpRdo+Y73/ze CMNgOGyHZ3Ay32TIxsJKVbQ0ZsISlHZ+iYJAnasBHe90g2jQ7pwdb8H1OJ5MYKqUhRnqLV022xmL OcTpVhqldzBWeS6tRYT9dDaLx4/vXvDFQ+VCkjeyMD6YlVblBtQSLCbrQiYi44BRW+PjRXCgBHnE +URvjrX8NVaEnV7QG8BgMAg8MXrRK5gRdgdBt1dD+0wOCwuCU4PGee+Dfq+ETl2+E8pWWUi7A1VQ Lihv2rALrUGfsCj9rWPq0lPIrm6yWIFVDlVRhlxFm3RZLgtp7OG9waTUhN/k6xj5WVoQi1faebF0 gJoLbHyBjStwAHAlt1j4kJjVe8VMmz/Wa5GLHWy02soUocCHWhU1fi2ldtwz7Hb9Bu++0qZZx+L0 eD4/pae7RiyXmFhyRxk8IYAw8IBZdoZEIIXnDd2IuYFMfkHC8+hiQx5vtKROgI3Qdvdv7M9wRQGl yMau8YSh8hr+8+dcp0poMqImrrKRwhUWqGUCc7WBG9xiRinlloD9an5zcZbbU4yUvhzRQkJ9wban LCdURMITTc4Dxedkog4y22Ail2TL7IBBE+4pCAhJgX3lpYYprpg/O4hXGl3BXtNivV4/6HSg34uC 7mjkm2z4iibr9SNytg73OXAN0x0O6INn2+WgNDviJGWE0peowhBHNTys0ZHA0+hiMqul2axVmREH 9Uttk5eGuzsFU242ivK49C3BVH3r/vxwUK1laUuNrgkPd57Vlv9BN5Y0Dqhyrjl+cCRVYNSB4NSP cxZMiqoORKxEuqLcUHUd4StXPPtPRGWOUw77ISfRhzQgSJLxVDI1iEuXTneJDluJD+ZFZhecAXfm oEY+3Xwhyw81OIH5VlN6JQr5XRysF3jW8E8aUTrNZAHV6GIGI23pBpZVVSwnbagjVTIhnOaSIh36 RB3kouaH4bnpmZ9jvqAyvK1DOUcSuRGkWy7nhCeLJCtTquai9M5Rp5Gm0Nhzrr2rn285Ut0dBNpA TLndGen1bIoG3Q7AKwMlaE/Grbt4On48x7ilUMWKFf9WZA985a1ayAwJzcpWvCgpqI9Kf2GLKzdC 97fdOP549QRngvaBzCp/KHBnbGA/ubsyj80jAbmM8ZKESRSHM3WguyM1q8viJQHQ+bg0bvM5HXtq W4fZx3/N/Lmx0HKxwJePwd6ZeOsbHn51oDhH7yvn9ITFSqZ+AnkTjx1gHWpCfbw+Ab54dhJ7X+6F 09P/lKX76j5f9vIbXN/DZUmcp/3OPIcwVkqnsvD94rZK3qqu7y9hMh4TzixTNJKfzXYdprp+Jv3t aJPgR4pqL/vcdKq0rI48Elwvn3gxVmWRyIw/8Y6LszpMRKUdNM5aZ+NsekLfjy8n8+njMwoUsQJd IPVqRo00Pq5G8VG2+OLpcRvwe/VLyhRn2XGdcUfIjf8/xzpdmjgd2tU7wTCK3OCZ0f7BhXnNOOuM 2kE0PIN1oZ1B/pqn3U476A2f9XT0Ck+79Pg06p17Wg2mBVZqjGk1i8mIbJ8fxqeB0eRRSG8hWYti hW46u+1mTaMAnV4LXietSlTGMi1emsR+R22CtNWGRw861Mgk2gyS4oJnioAlraR+En0hGacHjmLl h+7ZGHKMqlPzRm7JUqmUewcEz173oglJS5yhJ6GNdaMDRk33NAdnr0/3goILo88H9g2CATxUJZhe NaKQsx/R+hJB3uh3+qe3WWNG9v8AtYJN1WVuZHN0cmVhbQplbmRvYmoKMjIwIDAgb2JqCjE1MzQK ZW5kb2JqCjIyOSAwIG9iago8PC9MZW5ndGggMjMwIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4K c3RyZWFtCnicpVZNb9tGEL3rV8ypbQCJEa3vXArHdlsDqZFaAnoIcliRS2nj5S7DXUpRb8kv75sl KZNKUyCIbMGWuPvm682b+UjjKKYx/zR/k3zw8nFBOzeIiX/K3WA2m9N0jPdyuqTFbLWkUg6yAZ8O zz8O4oBAzZ8kp9cboKxoFa1okw1q5JgW+F1MoviKNvngF3qx+TC42wz+GtTXvhdpHkdX04B0b7ws jfSj21JknurXjTS+FFr9I1O6tX/QvXOVdPQTPSr35Oj59acokz1djeMVOzSZRfMJQty8gYfNa0R/ 74Un5cjvJd6lxKfcplLjA/8rniQ/w4FkL8xOksoLW3ph/IufB3EcLZfjuIcoja12e/KWPlTOq+z0 Kw5e2hOlDAadTKpS+RMJk1JRqoNITmxBq0R4ZY0jm3Wt/x9W71pmS3JebJUG+pBsIcv6yZCQzaMt n7pIbN2dnJe5I5Hmyijn6/NDcjbzR7aRyoPUtsiR/HAhVQdZOoa/hLJwp6QniVBCZS68vrXB3600 MlMeIVb+KBXnDN+mpThuRfJ0eakOVTMb4NgBRXF7W+kUMJQgLpXKEnRA2I2fMmWE6SKaxatVW6Fl xPSxxitTSa7Rbzap4IGh24f1+u6GrlNbcNyvvlHdTe27/OQ5DYEi1si6SpIqAy/0SZkd+5TAVwcy wV24jO/A1V6qGluE4nihcBYOgXsqa8rIsPALPekKhIiYD0qAkoaU6QKx6VylqZYkvOfkDUl5kIvr GXxsonNqZ9gR4KY2h0kyIpfusn7N6QNaLK0d+axMoquU7+JSohWid1/gyonzL7aak9mFyZVXO+Fl bT7QAKlvgEuZh3DPrQSQRFROcoZ6bDruZeBS0ul4LjHzU20rL1Nw2+gTesceQAH33FHogMscAcK4 HM50cvuxkqWS7uVzji1oHY4fFVj/+SLVDKH8kL3gljQQitbkl2HdFxYgxvrWJxKIHtcS2fdH+GCl NYyKOakzlqIAKANYZWpCIO7PoBSzrotyNo3kblgmQqYZQ34qtOWOQL1yG9oXHNP8Efy5fvtwf9MF 2mq7o3f45qza36f/8WwaxZgj82l0NVkF6Z6ufmAKxPN5NJ728N6HhMD5+5vrhwdkVzpko+bnu56p 73N9MllGk56l2fgHPJ/MMG+Xfc8jxhtdLVb8ZHTWpDTkf9VoUlolnu543mEQODmkO3zTiDBH/jsT 0wT5faglnDbSsbC8Yvj/VCumRAqJ41vMKyAI3agymKfRoSmrDogIBhprRvfrt+RPBfdB1iVIMzUc nL1OU8VuAcnXDvS1mAMB7PZUw3ZR4AauAhw0tGXKjWbPDpJIfAVQBPsS7VVYZrs6+9sThmc96sgx zzwOkds/KLLltqovNxM2dORXfZhJmfLQYW9EgVOoAIsXJqhJRZm6cFshMujOiXalrQoXfT1e4jGL HDaSm6CQtG5n520zk0pH6zpV9+bAuQsa+Sh3SOfoGyNnXciERwLdqizDkIOQuFfdENhgwkMh5/gw hRzy2iwTQ4K84L7QEEmW7nrUoEwVFJWFr4tUBkcclM/v6cnYoyFI10EqrVm/2spgAqmi0t0Z1UVp JLWzCmCKiCHEXGEbY08LLsy+4klWYvCDmmXY3L4aaziG9Alm3euKtzFzaiCfA2id3gvEzlLXxWjS MEJmvEx4cWBlxH/tNlRWmtkBkCaghipaHEOFz0j3vh136AO/RzAYerxmhfTX9b7clbje/bnYrirt CWYwGNcubgQZRqUDKaXhueq62+5l1VFIpv+elyfOYJ2skGktwwzSoeV3zfZB/ZnYeSi6M7XuAZGE LbZjR9tjxwxnZ4FFveXrG3UAkrUYyZJXtaixcvepwCAF8WWBBXOL2FfDsJNT7/XurcB2HS/ft0No Hs3p2Ajw4+8wxdq7mLOE5oPZ1ez5ox6scf5fSEDcl2VuZHN0cmVhbQplbmRvYmoKMjMwIDAgb2Jq CjE0NDkKZW5kb2JqCjIzNyAwIG9iago8PC9MZW5ndGggMjM4IDAgUi9GaWx0ZXIgL0ZsYXRlRGVj b2RlPj4Kc3RyZWFtCnic1VdNb9tGEL3rV8ypbQCZNvWtXArHjp0EbuDYAooiyGFFjqSNSa68u5Si 3tpf3jdLUqbioG3ioEBlG5RM7tuZ997Mju7pJIrpRH7qa5J3jm/GtHSdmOTHLjvD4YgGJ/ibDCY0 Hk4nZLmz6MjT4f59Jw4IVF+SnF7MgDKlaTSl2aJTIcc0xu+4H8U9muWdn+jZ7GPn5azzrlMt+1qk URz1BgHpdeHZFuyPzq1aeKpeZ1x4qzL9O6d0bl7Ra+dKdvQD3Wh35+jh9YuyyYp6J/FUAuoPo1Ef Kc6uECFRHEdE57zhzKwfQZ4rr+ja6o1KdnRZ6pQzXbA7vrAq562xd+75sx87gJhMTuIGMbxOEUyu i+UjSO1I0UarecaUGwDSwljS+TrjHI8qr01BZgHYPRaWdWm7Up6csR43KWflSotklWUqmFOAe0OZ zrUnv2JaGw8wrQJ6G2ttDXbOsU1Cc16pjcbu892jMPHcBula9zPR7cqUWSq4lttYc0YqCXKQkBJT pGXi6Q/g8X0JyjJA/kmqSLukFwhdcjC01VnWBkkr6o9zpZG9LrCN8tj0St9xtkNWa524wJEzOdNy LwIdJrZoJKFcL1eedJFkJUJbmW1IKMk04qFUFM3VToJPTJZx4jnttoEsSxj4p3CQsHPy1q3ANK65 gQuFpK4kdoyoEpPP5XEk5ldtHCN8Vfs59q5L7JNIOOBwA8srTYNormK3icwUbaQlF2yhGNxUFvq+ 5KM126MSgdHFu/O37h9A21B7fNry/MhyppA+cjB3GraGA5I72SbnZKUK7XJgp+xB0hddicTsBh4J mglxpS1obpaliENzlR4vVOY4kAA6TaaTXRvCwe7B9RDYmvzQeBKkiNcWDsUjaR/ota8FFAAX8vaR 3ljmSu1RcztQZIpdHnzuzQGOLrT8P9SPRQsRV1s+QjCopIVOmtKEtVKNGEvkhtJpY1RmEAYlhLC3 2OLAC6a0cFVlB6zd98ev7rSD6TSajKehQcbxE3rtpFf1rzagNEWTlCIO3fBG8xYJnCZ3hdlmvOQ0 qCZ7HjXd76jXj8ajE7T+NBAyA42q9CtT+aO4C8Q6lDv6zAGHUtxwNC6hYyqxnNIZp4L/WXO1IRZR wa8ga1rH2KXChAIJTgy3VB1sugwWExPgmVot9Bou6q4pvXfXLOQdTJQi5soHDT7o+BXBrzkJTsiy RvatdisBCRk+p0vLSzpV1hRdujFzOs1g5QXbLr1A36OzFSd3XXrLGu9RdF16Y5r6PLNmy126RNss cCAxEE6LdEcXOs0E4Bp1aOmVWqIjKty8VmVGr8xikcun33RZ41wxUN7oHLLpqk3RjcoWiH/O9mmO 60970XQ4qRzX+w6OawOC4tenb0/BS+GkAYRy+3uL3Vyc0ctUe2Of03WGPoDC5dxsuHKAq/vWnGEt nInlPKurOBLYPdhV7VcsybG8OTrEL8BDv3U+dBfYVAXEyrIS7RP57MXRaFzz2f8efLYAwectJ6XV fvc1nM7aZYU3gQY5Tr01OOBR08UOI8dW2K3AkwPw6AtF+wrO3oiHdY24whGdhWNaUVHmMKZU9MPQ 0mDXlj7cgZpjC5LIAfH+2zXojeG/ES6DKB6OA23wFKbgwRPE6MeDaDg4AP1QDyU4eveTHhII0w4H OXqDvizay1KrsShxpqKeObQe6TufT2qQ+UJGrk9KgKXeSXmP5scym2Bu+4Ierpzj6A1UAzDVzpbr am5cZmYO/pt5WyZDr+ySQ2/F7CM14LfNuZmrj9K6oYb07oejO1iP6em69CfRMK4ovK2LefIUZXqj aNA7gA2VnEt70IUk8dAevr2sezDAuFY+foqTmrJuA4Lb5gvJ/62q11Xc/1FRx6Nx1Ot/56Jug/77 oh6M4bfpNIhxhbGnWBqTygRIKovq0fHlp7WWKfaW15iJhbtpN3xnpYPX+2u1ZIqnH/a5jKIRbeuM bi4741iSGY8iGDzvDHvDh49Z5xbP/wUcwoh+ZW5kc3RyZWFtCmVuZG9iagoyMzggMCBvYmoKMTQ5 NgplbmRvYmoKMjUwIDAgb2JqCjw8L0xlbmd0aCAyNTEgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+ PgpzdHJlYW0KeJy1l99z2jgQx9/9V+zk4e46YxTLNv5x07mZFmibNrRpYNqHTh6ELYNa/6CSDaVv 7V/ele0QHHpcMp4zJGBsfbW7+uyu/BUsQsHSr/Yzyozzax+WyqCgX3JpDIceuBb+BW4A/jAMQHIj MfTd9fWvBq0VoP2IMng+R5UQQhLCPDEaZQo+vn2HUBvmmfEXPJl/NiZz473RDHuskkeJ7dZKF3nJ Zc7LwViypITmGPG8lCwV33kM4+IVXChVcQV/wLVQXxTcHVMmoxXYFg21Qc6QeA66OL9ECwGSqqwk N4GrNY8ES9PdfWEC8KKQwL+xbJ3inVtRrg7vefKnQSkJAoveampryhWXHO9NU1hwYKAy1Ia8yhZc QpFAyuSSQ1RkGZd6XlinrEwKmSkcykoU1UortsHBOU5e8lwJPFlUSuRcKRyapjwqRb7EG2JI+YZL ttSnleJyIDnq1cZpnZiVrNbFYVUaN3pxPZBVywyd0QYr3tyoeKmA4Rs5UFVaanvxcleL7yBCy1oz YLFDY/M41QbgRcjY50KKcqfHLtNigR6O384Ag5YkIiKt1oxzwK97SB6HG6U2GQbgeR5piJvpgBQ5 hD3Io6hmuQeigKsCWYGrKXK9QExPQTozPDpLPNcmrhPW+nTYw9rAbsg7FERgr3mC+OURVz3tpAHx /Fs7Ce1haegS37PsjiRaenEbU2S7a/XAdpoR+y/zuIbm01sm2Y7lLB/MVnrol2IzoDd6zL1EPDj2 Y0x4RmrwPxDYDzfh7LrA1Coh5gOWF/kuE9/rhW5BPTj2yavWTLYpozPmzISLyWSCTEdVTb6e5EqK DYt2WH2swDzW0j/rXNh7ePnvHto3x5XmMQ6O7zzTSaoKXXaOTcIyuy3kF+0OWheCY2G5axzbZetC iSoDTLFDL49FDtwOG52Heun09HK6K1eqvpBgwWWRwJZQJMcWrrlURV7XexFj/ROJYIu0k+MYgRHW 5yoXUX3+eyFd7J6NpjB0iKddpdbvXL1+MfKCkN5gc2AZUya8Jia81MXQhCl+rVkh8EF8E9hiziZN vcc4T3mEdVWoTJ2Mi65Rur7+mOD/H9bPn2j8bD7Gbm72KLCObRHcEriWSwInqFMWHQHtSY9K4Hhd SbPJ9tCHwd7B+L6D43cXKEyo7wb+eRtNZGAtRaqD7pin0/9pjy7j6a2TE1Bi+Y3Bq7Jcq7/Pz7fb LZFJNOCxKAtJCrk81/ic4299QxRS5Kcz6T91yxnoJcErRzURQ+IHvgZsVOQl2yDZAvlFtDbYpWPc dLxkTJUmfMSfLtm2rrMmjFv2PpLT8XtTZUyi4NkoFXq3MKsWWCgwW2rq3ldcYqKd9WKtddkdYiO7 Y0071SOQ2BOJHXRUG9wQQn3hEcRpSzBZma5q1PvfebMptkn/obz1DNNt8A8m/W/e8GnBRd5eFUmS 6YJ8RW7L2DSasrxSuunc0QEF7lDh1Xx+NTsdux+4f/7ZiyVcIIJFxg5wK+f4e5a0wT2CZLvIUkfU PIJET2HCu6gs9D4f7Qga3KiPuJ2i7WmPjVpDjO27hA4fTEzPYLTEHE76EGLCsEsMdqkKK9WmaehN LXpD4EX1WWyx1TcEncZlzmUm8iItlrt+0Dg+cXB9nYAMaePR89EV2LTP04SN6x52NE3osdJ2iLEN OnoN2GEfIx2Uc+4ZeQx2GLaN2sM4nUL5NeY+k3WZxM1fH7Bt1yE2QmZ7+Mz+CLJ7RcNFpEO7M2lL tms5+sqAWp7+1J5fig1uposiNgHbIUtJG4PJt7XAh2fcJq9LXj/z1/tgGnZD9emK4YOEbd3s7cVJ Ydtaff3S8Kk22PdwISAzhvbw7jQ1Znj/L5KHQ75lbmRzdHJlYW0KZW5kb2JqCjI1MSAwIG9iagox Mzg4CmVuZG9iagoyNjggMCBvYmoKPDwvTGVuZ3RoIDI2OSAwIFIvRmlsdGVyIC9GbGF0ZURlY29k ZT4+CnN0cmVhbQp4nMVZW4+cNhh951f4qRcpNpg7fWu7URMpkdLN9mkVrRgwjLOAie0ZdvLr+xlm Bk9bVUqNVGZ3brCH7/h8V+8XFBCKAvM4v1a9599nqFUeReYhWy9JUhQH8JvHOcqSIkeSeY1nrp7P f/HojIDOL1WPfnkAlAIVpEAPjbcgU5TBTxYRGqKH3vsB/fjw2Xv94P3uLX/2rUgpJWE8I70dNJMD 0/hOlo1Gy/ErG7QsO/6V1ehOvEFvlTowhb5D91w9K7Qe70tZ7VEY0OLGoG+nFiYkne2hCQkdyBUx ydIgtAAJQn/cv1UGE4fRcvb65qGGtUTokX5CDgQoDUkC8gaU5Muq7rUef/J9MbJBMiW6I5OjFJ9Z pYmQre+mXprlJMgXPwDbwy1stzCN7QqM33WiJQNv97o7kV585V1XztaD3LkfpH5Afd4DrSMfWlwP CjvSSlMSXliZYwNWV8hR8mNZnTAfcMMla8SLqwhxSOKouKoQbaKCBXqRoWZH1oEjSUVaIdqOkUr0 vhoZq/3xsOt4Zdber0UFTyCCAF9zVSIKSJIUG2thgc7cHG0MUpIV6/rHm6y/BXoTBrb7Nwd9kEyy jpWKqSUaKPXDzB/Yi8ZKs1EZP3Pjl0AmK+jGGtigV1+ZiWLNlIY4doyKJKOErp7zmGyhig36P0YF OC8Js60VsUA3iIokSkiyes1jusn6W6CX9X+pxCD607zqO6G0GCAQgsKnAbz6pdwJiaGrmIR8Vliy UUgNIjgHBdTtNNpaAgtU7xmWXDEsGmze80t3tD+Br+GWl4NWjjESFwXJVz96zLbQyAa9aFSddkyS fSmPpawJqw++4hDm5++7cro550gqz0hR5NsqY4M2vFuSbfB0dyc+Pv2sdVk9q6c3h74cnu5Nm6Ke yqF+es9qXpKxbhwJpTEJo7XLyjdRyQK9qDRNE1FgOHRRSxIzBcc/CagyO3DGA9DGvdgBfWz67Mt7 R3ZJSKJka7ks0GvgjHsGiYIN5TkL4HPhrB0JhDlJVn97LDaRxwL9d3naTuzKDv8DS0daFBoQurUu Figk5K6eeM0wcAItWi4GIKKFtunA8Nc0UEIVJAiGj3C5mK93JBfEJI9uyJmonu9iRghzLy2WEngd 0N6dB7QABP7+vy8ECBuiKKckyG71LSU0bNV+4FU5y2s+4FFAA3Ey2Sb2g9DXvMc7szJS4Y4xPLmG X5QWhN5mSzedF3oW6gCNECwmKIxrVl3H+bmoTWznmO2jOIE5ZY0+6jo/L/ZbqBd5Wv61F7VYpFls xwpXkpXadBhiwpMpyYbqYWgO1bOrMlEEU0q2tTIWKteYZjkN0wB6P0djgwLGlWyVwXUrYDHWQrWz 4HCCOGBqlgIiI523API5YAYBSfF0EWjVx41eWED5p1trYaN2QjyrJUz4cIQowVyTve47R8OzGAYW SxfXzYHFcAv1Zjg1e3D8yC57M7Mw8GzHfb0EzqHvwf0cyaUhTCybq2KhTlzv8V9zLtRfjSsmm7kQ QYI+Qe3oHPMY9GIw2VhCue4iLFws1ItQMJlWWh56whlblDpyNuFGin7Oycey6xhEEDRHJr4uldiV X5jCaLO5VhbqTrIJCqjEz+UeSjlMeNO+hHw8b4U0kAIMub97Yg/zOLRL2pFeEMLQY8nnut2w0LNQ r9sNFScQOvOgdMPGvZbSDKo2TVcSrjP7TMJGXfdMbg0n7g5GKdSK823ecbMRLET9CjGNyo6cHe71 y8glU+gjGzXrIaZR8Wr+lwG6OR4/lC1DIf10tQi8DE1nu+5/8zJqTMpSAvfrvSRM1o+d9xGu/xNE mvpzZW5kc3RyZWFtCmVuZG9iagoyNjkgMCBvYmoKMTM2MAplbmRvYmoKMzA0IDAgb2JqCjw8L0xl bmd0aCAzMDUgMCBSL0ZpbHRlciAvRmxhdGVEZWNvZGU+PgpzdHJlYW0KeJytWduO2zYUfNdX8Klt gJASdbUKFAXaBG2AFEiTBfoQBAYtUTJjSVRIyo7363sk+UI/NSkpreGLvLNnNGeOhtovKCIURfN+ ea76IHxfoFYHFM27aoMsy1EawWOTblCRlRukeNAE87eX418CuiCgy1PVo9+eAKVEJSnRUxOsyBQV 8FMkhMboqQ9+Qi+ePgevn4K/g/XXvhcppyROF6Q3g+Fq4Aa/UqwxaN1+54NRrBPPvEav5J/ojdYT 1+gH9F7og0b37S+mqj2KI1rOBSUZyROg+PQWKkToIy0+oRc/3uv8PsaUbkgWoyIG1KXUvTGj/jkM jZSdJoKbhkjVhnvTd2E9V4+ZOhwkFmyHxZWW44miCSkup/yyPQD+P0Z30EoOWnaiZkbIAUeRW7X5 Bj7Lr9V+pJtPHqq1QK8CnE6n++nfdbINH3iEjizynMR3EqUXEjfMBw6XJtGyAjrnhU7byR10/uWI 4qNUJoQG37iyylKS+O4kCxQUqPho8CANdy01iUiWlTcJ4siLBBbqf4mw9NRy0mkc1oPGoxJHVp0d 3ZxDJXlR+hbBQtXTODcMjB/cy2fRdQw3QvFGfnXUJCtTUlJLE+pDExvV1uQkVVeL8Zh3bBqq/aKJ Y/0FJdTuqdhL/RbqtX4+kJM4iJHXgi2Fz+9cq89KEntvHBv1n/mMb9+8O+bbV+y8ZUO9tT56u8gw H3HkAVfozO6ixIsKFupdhVYMnCsxtASm6QHUGEgle8vaUR5WvOM7BReNocVzuzn6O4uTOYD4lslC Xf2Aa1ch0rIkm8ISIvUhhI06C3FxMwxQzStc87GT5x6i3RqbhDZSnR2dkRY5gb9+J5J5IWKhfuu1 ogyjOGwmMymOzR5abm4qR3J5SuJk47mfbFRIGlozXEk5coUNr/aDqFiHRT+yytxTrM98laYRSQtL styLZBbqVbJZGlJ1cqqbjim++N9IMA8+cdwLI1pmeI3purvSojkp7E4svNCyUK+06rM1yuAN1gZ4 zMbCEOJpFFNoxxzXtdSYGcOqgyO1pIxJmVnUvAR7G9U22X6nCa+nsGHV1Jlz+I61XIcCGBKmx6+/ DlP/S5ZsEsfFSpKXhJYWKS9B30b99pQZZeFpz8BvGu/a0XFqJFlBEup7atioe/EZmmqeb2w4n5jr DE+SBJJ5cVMi8ZL3bdSrEo3ivJY9NhKbORSoxUerBGlIaajktISB1TZ69pMjt5hCOC98i2Gh3ma0 5uooKrCKW8VxWUAmt9TwkvRtVNsXlZZygIC2DmemjKg6HiZJHJVlHo5Sa7HruAdXxJucRIlvIWzU uysMO3CNWylbKL2Wp4HM94gc689jCOuWLF4WMDaqLctzDR31IAnkAy3Ycq3pwDi4VQysP2cdplqY a67yZBFJSu/yWKgGsj4U3UOoAQ7Lqwks42yXOId0buniZUljo151YUpfA9qijBgaqfr1zt1yQML1 5HybZo60aEqKzLseFqqe9CgqISeN+XHOLqt/ILL07HmmpFjTiAoDSRzjvZyUhubjrHNutSiGVcoj tUqdRyOrSSk+VOv1DFZdRR7Ft5vJSerhZjItIB7Qx7uZ17lN1oGxaNvsw0Z0zrOc5gVE/dyzijbq nGF0mBz5dq1+e9pDUpOjXl+MDObGthED67aDPG7n5iRj3TjSoiWE4rWAt+III1fK+iXiBrGOXGi+ /joKxTX6wEdIjjuuUPly+UcBetg+zukS7PbpVhEYD50udb3/IyjoXNK8HsxRH2QwUW5vu+ADfP9f ktH2hmVuZHN0cmVhbQplbmRvYmoKMzA1IDAgb2JqCjEzMzAKZW5kb2JqCjM0MCAwIG9iago8PC9M ZW5ndGggMzQxIDAgUi9GaWx0ZXIgL0ZsYXRlRGVjb2RlPj4Kc3RyZWFtCnicrVhdb5w4FH3nV9yn bSvVBvNN37ppu1splbpJ3qqq8oBncAOY2p5M0l+/15AJjrSq1AUmyQwTc7jH517fY35ARBlE7vX4 XvdBeFXAwQQM3EsfgizLIY3wt0xLKLKqBC2CfeBGT///EbAJAR7f6h7+vEGUCipawc0+mJEZFPhT JJTFcNMHL+HVzffg/U3wTzBf9rtIOaNxOiF9HKzQg7DkneZ7C/NxIQareSd/igbeqb/hozFHYeAP uJLm1sByfOK6biGOWOUCSjKaJ0jx5hIjBPiSZF/h1Yslzt9jzFhJsxiKGFGnUFtrR/MmDJuHgdaq D3edOrgTYiy3oseYiRoIi2KGAeWkaZQh3Fpe34YrpytitJyna6KVf30+//+P1wJ6JiaFEPdjp7Sg 7iNVGvmp+uiohWmRl3larmOSFyWNyoVJsQUTD/TMZK+FaFRPrCJWDrdCT4LFUZSGURyyKuzVgMQ6 e9RipTh5ltIkXiiVm1BaQM+UTqcTHVQvsVbo8Ta0rSAjphZWjtqTRnDbriWSRDTLqoVJtQkTD/VM 5SBte9xNklyPshH6ku9MiIV+Ea+kEOW0qBYKabQJBQ/1TMHVPh3kobXdA+3VT9l1fKoXLP0yjMow LsO91GKv7snjMLKOW1altGJP3KZjPTcf1Ygay4E0gyG4DAgtXd3zjmhhsFLMyvTKCkaZl14p20Ib H/WszfEWC0VbNa/S80cyLdZuXQ5ZvJZJVtG42FwJD/XUcvtNmm9mFFx/G1tpWklb23crA8cGmTFP gngTCTxUf7Fy6S8exCQCJpZ2/dG2GlcqE/KBW9U/uKWLk/phJ/Ta6ogT1/u31sRDnTv5BiqkVUXL wlMh2UIFH/XJqHA0Jto1CY0N3e6nBep0CGs+jlgVId+po11ZDGgLKIawsEk3YeOh/pIN2pOwcc6R uK9Io1q3XKnubnVGpXlK46TcOKN8VG6MqiVax8bFvVaHNKJp4emQbaKDh+rX9knprpHjXd7x41C3 kxS94Ab7h2saa3tFyrDj+km1ieP1UX0ysubDMFE4aHUcTWgMr9cRSKqYVplHYBOj66P+koDegEFe UVZ5DDbxtT7qmcEgTgfbNcajYaQVJmzEnqPxQB/V4Rk/YDvZIrmSrKAJ27qwfdSnUAkutFrdYYEn 7PuxYwURAx2b/UoCSYKWulik2cSo+6jPXC4fB1lT3HY8eVtWhOY4aGlms6jcYms7Q/BLg/uRlexi RvOi2FoeDxVjRqu7MoviqkDjvIiQbbLV8FH/u8LFEJoHY0X/WBbz3xGbnjPrVqLVXUmszGmUbD3/ PqqfO17azLIQlrhKKb1KIWnhDGYFBO1YkUe4L26Cl2/HUQyNvIe3K/gy3J2mEOcxWu85OApw0fLh IOBSHaa7oy9Pn98aZ+TqwwW8b6RV+g187rDzCcDWh5UAFt068HNwO9wBagHjcdehhk4e6kCf0OYn VQqARNEb+CC1sYDlZHDgfJFpRfPqxTKKuVH3ogHE7dGTyuEA0j0egxPuqsFK2wngFqwaQe1B8LqF kR8EYuBWKS4jNt30Ut7hlUo1r0FY4B19VPr9/Yi23cC1GDHH0JdD9Xp6vgbPji+fERLi5Ov58VpO czg9CnD1F97Kzb0zcTn0QRZny2kXXOP4fwFFe+A0ZW5kc3RyZWFtCmVuZG9iagozNDEgMCBvYmoK MTI0MQplbmRvYmoKMzcwIDAgb2JqCjw8L0xlbmd0aCAzNzEgMCBSL0ZpbHRlciAvRmxhdGVEZWNv ZGU+PgpzdHJlYW0KeJylk11v0zAUhu/zK84VY9Jqkn6Hq7ZbBUUbbGskLhBCTnKSeHHsNna2ll/P yUcHo/RiwklkKT7vc855bW/BZR649dPNUeG8u59AahwP6qdMndFoDEOXvulwCpORP4USncSpo5v1 reM1BOimqIBFQBQffOZDkDgt2YMJvZMB8/oQFM5bOA8enGXg3Dmt7LWkscf6w4a0UhZLhbZ3VfLE QjsuUdmSS/ETY7jSH2FlTIUG3sC9MLmB3+OGl1EGfdfzXxT0+tb6IzZu6plvNqhisYPFf7ToDVw2 /APKAL4QtuujBvdGPkX0+gM2GbvkaUyeAqwxskIreBJSQoi0V4V+JA9CTHSJkAjFJWyqUIqI14E1 6Rlx3SA0uSdss2qAk0ghxoQQCmyGIDHlUu57BVcxt7W9n9cQSh3lQqVg2vzs/OzAWhWbkkpotFRD wa2tA3UCuLNkFBG2le7yNbp5ZTNdmjOYx3GJxlC/Le0TN9TatXgkgNYx/fU8Np263qH0S11E3Fha +KunZcGFfA8PNeCHPABmURvPaCbNgMwe0PnuNDdcaQNzZbXiOc+FOc73AXWZCg4rZaywlcW6rQCj TGmp0/3JOooaPUvJvihjGFfHyRc6hLVEkWbHWRcB3MroJDzUITONdBaeaG0uhaFLA1+FSgTKfzi5 zk9X36nZQT0z+Z5VeRM/qc8rRT9v0gWgBS5Zd92Wu42gPaVzurFYhFSDf9HcPngxvt3yFKE//E7Q 5gbdOb8ATks7JGVuZHN0cmVhbQplbmRvYmoKMzcxIDAgb2JqCjU2OAplbmRvYmoKNCAwIG9iago8 PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBS Ci9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMTUgMCBSCi9Gb250 IDE2IDAgUgo+PgovQW5ub3RzWzEwIDAgUgoxMSAwIFIKMTIgMCBSCjEzIDAgUgoxNCAwIFJdL0Nv bnRlbnRzIDUgMCBSCj4+CmVuZG9iagoxNyAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAg MCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9Q REYgL1RleHRdCi9FeHRHU3RhdGUgNjIgMCBSCi9Gb250IDYzIDAgUgo+PgovQW5ub3RzWzIwIDAg UgoyMSAwIFIKMjIgMCBSCjIzIDAgUgoyNCAwIFIKMjUgMCBSCjI2IDAgUgoyNyAwIFIKMjggMCBS CjI5IDAgUgozMCAwIFIKMzEgMCBSCjMyIDAgUgozMyAwIFIKMzQgMCBSCjM1IDAgUgozNiAwIFIK MzcgMCBSCjM4IDAgUgozOSAwIFIKNDAgMCBSCjQxIDAgUgo0MiAwIFIKNDMgMCBSCjQ0IDAgUgo0 NSAwIFIKNDYgMCBSCjQ3IDAgUgo0OCAwIFIKNDkgMCBSCjUwIDAgUgo1MSAwIFIKNTIgMCBSCjUz IDAgUgo1NCAwIFIKNTUgMCBSCjU2IDAgUgo1NyAwIFIKNTggMCBSCjU5IDAgUgo2MCAwIFIKNjEg MCBSXS9Db250ZW50cyAxOCAwIFIKPj4KZW5kb2JqCjY0IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRp YUJveCBbMCAwIDU5NSA4NDJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1By b2NTZXRbL1BERiAvVGV4dF0KL0V4dEdTdGF0ZSA3NCAwIFIKL0ZvbnQgNzUgMCBSCj4+Ci9Bbm5v dHNbNjcgMCBSCjY4IDAgUgo2OSAwIFIKNzAgMCBSCjcxIDAgUgo3MiAwIFIKNzMgMCBSXS9Db250 ZW50cyA2NSAwIFIKPj4KZW5kb2JqCjc2IDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAw IDU5NSA4NDJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BE RiAvVGV4dF0KL0V4dEdTdGF0ZSA5NCAwIFIKL0ZvbnQgOTUgMCBSCj4+Ci9Bbm5vdHNbNzkgMCBS CjgwIDAgUgo4MSAwIFIKODIgMCBSCjgzIDAgUgo4NCAwIFIKODUgMCBSCjg2IDAgUgo4NyAwIFIK ODggMCBSCjg5IDAgUgo5MCAwIFIKOTEgMCBSCjkyIDAgUgo5MyAwIFJdL0NvbnRlbnRzIDc3IDAg Ugo+PgplbmRvYmoKOTYgMCBvYmoKPDwvVHlwZS9QYWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0K L1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVzb3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQov RXh0R1N0YXRlIDExMyAwIFIKL0ZvbnQgMTE0IDAgUgo+PgovQW5ub3RzWzk5IDAgUgoxMDAgMCBS CjEwMSAwIFIKMTAyIDAgUgoxMDMgMCBSCjEwNCAwIFIKMTA1IDAgUgoxMDYgMCBSCjEwNyAwIFIK MTA4IDAgUgoxMDkgMCBSCjExMCAwIFIKMTExIDAgUgoxMTIgMCBSXS9Db250ZW50cyA5NyAwIFIK Pj4KZW5kb2JqCjExNSAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQov Um90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9F eHRHU3RhdGUgMTIxIDAgUgovRm9udCAxMjIgMCBSCj4+Ci9Bbm5vdHNbMTE4IDAgUgoxMTkgMCBS CjEyMCAwIFJdL0NvbnRlbnRzIDExNiAwIFIKPj4KZW5kb2JqCjEyMyAwIG9iago8PC9UeXBlL1Bh Z2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJj ZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMTMwIDAgUgovRm9udCAxMzEgMCBS Cj4+Ci9Bbm5vdHNbMTI2IDAgUgoxMjcgMCBSCjEyOCAwIFIKMTI5IDAgUl0vQ29udGVudHMgMTI0 IDAgUgo+PgplbmRvYmoKMTMyIDAgb2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDU5NSA4 NDJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4 dF0KL0V4dEdTdGF0ZSAxNDMgMCBSCi9Gb250IDE0NCAwIFIKPj4KL0Fubm90c1sxMzUgMCBSCjEz NiAwIFIKMTM3IDAgUgoxMzggMCBSCjEzOSAwIFIKMTQwIDAgUgoxNDEgMCBSCjE0MiAwIFJdL0Nv bnRlbnRzIDEzMyAwIFIKPj4KZW5kb2JqCjE0NSAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3gg WzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0 Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMTUxIDAgUgovRm9udCAxNTIgMCBSCj4+Ci9Bbm5vdHNb MTQ4IDAgUgoxNDkgMCBSCjE1MCAwIFJdL0NvbnRlbnRzIDE0NiAwIFIKPj4KZW5kb2JqCjE1MyAw IG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50 IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMTYxIDAg UgovRm9udCAxNjIgMCBSCj4+Ci9Bbm5vdHNbMTU2IDAgUgoxNTcgMCBSCjE1OCAwIFIKMTU5IDAg UgoxNjAgMCBSXS9Db250ZW50cyAxNTQgMCBSCj4+CmVuZG9iagoxNjMgMCBvYmoKPDwvVHlwZS9Q YWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVzb3Vy Y2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDE3MyAwIFIKL0ZvbnQgMTc0IDAg Ugo+PgovQW5ub3RzWzE2NiAwIFIKMTY3IDAgUgoxNjggMCBSCjE2OSAwIFIKMTcwIDAgUgoxNzEg MCBSCjE3MiAwIFJdL0NvbnRlbnRzIDE2NCAwIFIKPj4KZW5kb2JqCjE3NSAwIG9iago8PC9UeXBl L1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNv dXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMTgxIDAgUgovRm9udCAxODIg MCBSCj4+Ci9Bbm5vdHNbMTc4IDAgUgoxNzkgMCBSCjE4MCAwIFJdL0NvbnRlbnRzIDE3NiAwIFIK Pj4KZW5kb2JqCjE4MyAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQov Um90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9F eHRHU3RhdGUgMTg5IDAgUgovRm9udCAxOTAgMCBSCj4+Ci9Bbm5vdHNbMTg2IDAgUgoxODcgMCBS CjE4OCAwIFJdL0NvbnRlbnRzIDE4NCAwIFIKPj4KZW5kb2JqCjE5MSAwIG9iago8PC9UeXBlL1Bh Z2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJj ZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMTk3IDAgUgovRm9udCAxOTggMCBS Cj4+Ci9Bbm5vdHNbMTk0IDAgUgoxOTUgMCBSCjE5NiAwIFJdL0NvbnRlbnRzIDE5MiAwIFIKPj4K ZW5kb2JqCjE5OSAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90 YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRH U3RhdGUgMjA4IDAgUgovRm9udCAyMDkgMCBSCj4+Ci9Bbm5vdHNbMjAyIDAgUgoyMDMgMCBSCjIw NCAwIFIKMjA1IDAgUgoyMDYgMCBSCjIwNyAwIFJdL0NvbnRlbnRzIDIwMCAwIFIKPj4KZW5kb2Jq CjIxMCAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAv UGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUg MjE2IDAgUgovRm9udCAyMTcgMCBSCj4+Ci9Bbm5vdHNbMjEzIDAgUgoyMTQgMCBSCjIxNSAwIFJd L0NvbnRlbnRzIDIxMSAwIFIKPj4KZW5kb2JqCjIxOCAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFC b3ggWzAgMCA1OTUgODQyXQovUm90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9j U2V0Wy9QREYgL1RleHRdCi9FeHRHU3RhdGUgMjI2IDAgUgovRm9udCAyMjcgMCBSCj4+Ci9Bbm5v dHNbMjIxIDAgUgoyMjIgMCBSCjIyMyAwIFIKMjI0IDAgUgoyMjUgMCBSXS9Db250ZW50cyAyMTkg MCBSCj4+CmVuZG9iagoyMjggMCBvYmoKPDwvVHlwZS9QYWdlL01lZGlhQm94IFswIDAgNTk1IDg0 Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVzb3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0 XQovRXh0R1N0YXRlIDIzNCAwIFIKL0ZvbnQgMjM1IDAgUgo+PgovQW5ub3RzWzIzMSAwIFIKMjMy IDAgUgoyMzMgMCBSXS9Db250ZW50cyAyMjkgMCBSCj4+CmVuZG9iagoyMzYgMCBvYmoKPDwvVHlw ZS9QYWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgovUmVz b3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDI0NyAwIFIKL0ZvbnQgMjQ4 IDAgUgo+PgovQW5ub3RzWzIzOSAwIFIKMjQwIDAgUgoyNDEgMCBSCjI0MiAwIFIKMjQzIDAgUgoy NDQgMCBSCjI0NSAwIFIKMjQ2IDAgUl0vQ29udGVudHMgMjM3IDAgUgo+PgplbmRvYmoKMjQ5IDAg b2JqCjw8L1R5cGUvUGFnZS9NZWRpYUJveCBbMCAwIDU5NSA4NDJdCi9Sb3RhdGUgMC9QYXJlbnQg MyAwIFIKL1Jlc291cmNlczw8L1Byb2NTZXRbL1BERiAvVGV4dF0KL0V4dEdTdGF0ZSAyNjUgMCBS Ci9Gb250IDI2NiAwIFIKPj4KL0Fubm90c1syNTIgMCBSCjI1MyAwIFIKMjU0IDAgUgoyNTUgMCBS CjI1NiAwIFIKMjU3IDAgUgoyNTggMCBSCjI1OSAwIFIKMjYwIDAgUgoyNjEgMCBSCjI2MiAwIFIK MjYzIDAgUgoyNjQgMCBSXS9Db250ZW50cyAyNTAgMCBSCj4+CmVuZG9iagoyNjcgMCBvYmoKPDwv VHlwZS9QYWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1JvdGF0ZSAwL1BhcmVudCAzIDAgUgov UmVzb3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0R1N0YXRlIDMwMSAwIFIKL0ZvbnQg MzAyIDAgUgo+PgovQW5ub3RzWzI3MCAwIFIKMjcxIDAgUgoyNzIgMCBSCjI3MyAwIFIKMjc0IDAg UgoyNzUgMCBSCjI3NiAwIFIKMjc3IDAgUgoyNzggMCBSCjI3OSAwIFIKMjgwIDAgUgoyODEgMCBS CjI4MiAwIFIKMjgzIDAgUgoyODQgMCBSCjI4NSAwIFIKMjg2IDAgUgoyODcgMCBSCjI4OCAwIFIK Mjg5IDAgUgoyOTAgMCBSCjI5MSAwIFIKMjkyIDAgUgoyOTMgMCBSCjI5NCAwIFIKMjk1IDAgUgoy OTYgMCBSCjI5NyAwIFIKMjk4IDAgUgoyOTkgMCBSCjMwMCAwIFJdL0NvbnRlbnRzIDI2OCAwIFIK Pj4KZW5kb2JqCjMwMyAwIG9iago8PC9UeXBlL1BhZ2UvTWVkaWFCb3ggWzAgMCA1OTUgODQyXQov Um90YXRlIDAvUGFyZW50IDMgMCBSCi9SZXNvdXJjZXM8PC9Qcm9jU2V0Wy9QREYgL1RleHRdCi9F eHRHU3RhdGUgMzM3IDAgUgovRm9udCAzMzggMCBSCj4+Ci9Bbm5vdHNbMzA2IDAgUgozMDcgMCBS CjMwOCAwIFIKMzA5IDAgUgozMTAgMCBSCjMxMSAwIFIKMzEyIDAgUgozMTMgMCBSCjMxNCAwIFIK MzE1IDAgUgozMTYgMCBSCjMxNyAwIFIKMzE4IDAgUgozMTkgMCBSCjMyMCAwIFIKMzIxIDAgUgoz MjIgMCBSCjMyMyAwIFIKMzI0IDAgUgozMjUgMCBSCjMyNiAwIFIKMzI3IDAgUgozMjggMCBSCjMy OSAwIFIKMzMwIDAgUgozMzEgMCBSCjMzMiAwIFIKMzMzIDAgUgozMzQgMCBSCjMzNSAwIFIKMzM2 IDAgUl0vQ29udGVudHMgMzA0IDAgUgo+PgplbmRvYmoKMzM5IDAgb2JqCjw8L1R5cGUvUGFnZS9N ZWRpYUJveCBbMCAwIDU5NSA4NDJdCi9Sb3RhdGUgMC9QYXJlbnQgMyAwIFIKL1Jlc291cmNlczw8 L1Byb2NTZXRbL1BERiAvVGV4dF0KL0V4dEdTdGF0ZSAzNjcgMCBSCi9Gb250IDM2OCAwIFIKPj4K L0Fubm90c1szNDIgMCBSCjM0MyAwIFIKMzQ0IDAgUgozNDUgMCBSCjM0NiAwIFIKMzQ3IDAgUgoz NDggMCBSCjM0OSAwIFIKMzUwIDAgUgozNTEgMCBSCjM1MiAwIFIKMzUzIDAgUgozNTQgMCBSCjM1 NSAwIFIKMzU2IDAgUgozNTcgMCBSCjM1OCAwIFIKMzU5IDAgUgozNjAgMCBSCjM2MSAwIFIKMzYy IDAgUgozNjMgMCBSCjM2NCAwIFIKMzY1IDAgUgozNjYgMCBSXS9Db250ZW50cyAzNDAgMCBSCj4+ CmVuZG9iagozNjkgMCBvYmoKPDwvVHlwZS9QYWdlL01lZGlhQm94IFswIDAgNTk1IDg0Ml0KL1Jv dGF0ZSAwL1BhcmVudCAzIDAgUgovUmVzb3VyY2VzPDwvUHJvY1NldFsvUERGIC9UZXh0XQovRXh0 R1N0YXRlIDM3NCAwIFIKL0ZvbnQgMzc1IDAgUgo+PgovQW5ub3RzWzM3MiAwIFIKMzczIDAgUl0v Q29udGVudHMgMzcwIDAgUgo+PgplbmRvYmoKMyAwIG9iago8PCAvVHlwZSAvUGFnZXMgL0tpZHMg Wwo0IDAgUgoxNyAwIFIKNjQgMCBSCjc2IDAgUgo5NiAwIFIKMTE1IDAgUgoxMjMgMCBSCjEzMiAw IFIKMTQ1IDAgUgoxNTMgMCBSCjE2MyAwIFIKMTc1IDAgUgoxODMgMCBSCjE5MSAwIFIKMTk5IDAg UgoyMTAgMCBSCjIxOCAwIFIKMjI4IDAgUgoyMzYgMCBSCjI0OSAwIFIKMjY3IDAgUgozMDMgMCBS CjMzOSAwIFIKMzY5IDAgUgpdIC9Db3VudCAyNAo+PgplbmRvYmoKMSAwIG9iago8PC9UeXBlIC9D YXRhbG9nIC9QYWdlcyAzIDAgUgovRGVzdHMgOCAwIFIKL01ldGFkYXRhIDM3NyAwIFIKPj4KZW5k b2JqCjcgMCBvYmoKPDwvVHlwZS9FeHRHU3RhdGUKL09QTSAxPj5lbmRvYmoKMTAgMCBvYmoKPDwv VHlwZS9Bbm5vdAovUmVjdCBbMzg0LjcyIDU4MC41NjQgNDI4LjUgNTkxLjQ1NF0KL0JvcmRlciBb MCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3Rvb2xzLmlldGYub3JnL3BkZi9yZmM4NDg0 KT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoxMSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsx NzAuODggNDQ5Ljg4MyAyMDguNzIgNDYwLjc3M10KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkK L1VSSShodHRwczovL3Rvb2xzLmlldGYub3JnL3BkZi9iY3A3OCk+PgovU3VidHlwZS9MaW5rPj5l bmRvYmoKMTIgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMjM2LjIyIDQ0OS44ODMgMjc0LjA2 IDQ2MC43NzNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly90b29scy5p ZXRmLm9yZy9wZGYvYmNwNzkpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEzIDAgb2JqCjw8L1R5 cGUvQW5ub3QKL1JlY3QgWzE2NC45NCAzOTAuNDgzIDQyOC41IDQwMS4zNzNdCi9Cb3JkZXIgWzAg MCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kcmFmdHMv Y3VycmVudC8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE0IDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzI1NC4wNCAyMjQuMTYyIDI5MS44OCAyMzUuMDUyXQovQm9yZGVyIFswIDAgMF0KL0E8 PC9TL1VSSQovVVJJKGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcGRmL2JjcDc4KT4+Ci9TdWJ0eXBl L0xpbms+PmVuZG9iagoxNSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoxNiAwIG9iago8PC9S OQo5IDAgUj4+CmVuZG9iagoyMCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDc3MC42 NDUgNzguMDQgNzgxLjUzNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzIKL1N1YnR5cGUvTGluaz4+ ZW5kb2JqCjIxIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzkzLjY2IDcyMy4xMjUgMzE1LjY0 IDczNC4wMTVdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly90cnVzdGVl LmlldGYub3JnL2xpY2Vuc2UtaW5mbyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjIgMCBvYmoK PDwvVHlwZS9Bbm5vdAovUmVjdCBbODcuNzIgNjA0LjMyNCA5NS44NTk5IDYxNS4yMTRdCi9Cb3Jk ZXIgWzAgMCAwXQovRGVzdC8zCi9TdWJ0eXBlL0xpbms+PmVuZG9iagoyMyAwIG9iago8PC9UeXBl L0Fubm90Ci9SZWN0IFs0OTEuNjQgNjA0LjMyNCA0OTkuNzggNjE1LjIxNF0KL0JvcmRlciBbMCAw IDBdCi9EZXN0LzIKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI0IDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzg3LjcyIDU5Mi40NDQgOTUuODU5OSA2MDMuMzM0XQovQm9yZGVyIFswIDAgMF0KL0Rl c3QvNAovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjUgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBb NDkxLjY0IDU5Mi40NDQgNDk5Ljc4IDYwMy4zMzRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8yCi9T dWJ0eXBlL0xpbms+PmVuZG9iagoyNiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs4Ny43MiA1 ODAuNTY0IDk1Ljg1OTkgNTkxLjQ1NF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzYKL1N1YnR5cGUv TGluaz4+ZW5kb2JqCjI3IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzQ5MS42NCA1ODAuNTY0 IDQ5OS43OCA1OTEuNDU0XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNQovU3VidHlwZS9MaW5rPj5l bmRvYmoKMjggMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbODcuNzIgNTY4LjY4NCA5NS44NTk5 IDU3OS41NzRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC83Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoy OSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0OTEuNjQgNTY4LjY4NCA0OTkuNzggNTc5LjU3 NF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzUKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjMwIDAgb2Jq Cjw8L1R5cGUvQW5ub3QKL1JlY3QgWzg3LjcyIDU1Ni44MDQgOTUuODU5OSA1NjcuNjk0XQovQm9y ZGVyIFswIDAgMF0KL0Rlc3QvOQovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzEgMCBvYmoKPDwvVHlw ZS9Bbm5vdAovUmVjdCBbNDkxLjY0IDU1Ni44MDQgNDk5Ljc4IDU2Ny42OTRdCi9Cb3JkZXIgWzAg MCAwXQovRGVzdC84Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozMiAwIG9iago8PC9UeXBlL0Fubm90 Ci9SZWN0IFs4Ny43MiA1MzMuMDQ0IDk1Ljg1OTkgNTQzLjkzNF0KL0JvcmRlciBbMCAwIDBdCi9E ZXN0LzEyCi9TdWJ0eXBlL0xpbms+PmVuZG9iagozMyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFs0OTEuNjQgNTMzLjA0NCA0OTkuNzggNTQzLjkzNF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzEw Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs4Ny43 MiA1MjEuMTY0IDk1Ljg1OTkgNTMyLjA1NF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzE0Ci9TdWJ0 eXBlL0xpbms+PmVuZG9iagozNSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0OTEuNjQgNTIx LjE2NCA0OTkuNzggNTMyLjA1NF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzEzCi9TdWJ0eXBlL0xp bms+PmVuZG9iagozNiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs4Ny43MiA1MDkuMjg0IDk1 Ljg1OTkgNTIwLjE3NF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzIzCi9TdWJ0eXBlL0xpbms+PmVu ZG9iagozNyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0ODUuNyA1MDkuMjg0IDQ5OS43OCA1 MjAuMTc0XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjIKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjM4 IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzg3LjcyIDQ5Ny40MDQgMTAxLjggNTA4LjI5M10K L0JvcmRlciBbMCAwIDBdCi9EZXN0LzI1Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozOSAwIG9iago8 PC9UeXBlL0Fubm90Ci9SZWN0IFs0ODUuNyA0OTcuNDA0IDQ5OS43OCA1MDguMjkzXQovQm9yZGVy IFswIDAgMF0KL0Rlc3QvMjQKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjQwIDAgb2JqCjw8L1R5cGUv QW5ub3QKL1JlY3QgWzg3LjcyIDQ4NS41MjMgMTAxLjggNDk2LjQxM10KL0JvcmRlciBbMCAwIDBd Ci9EZXN0LzMwCi9TdWJ0eXBlL0xpbms+PmVuZG9iago0MSAwIG9iago8PC9UeXBlL0Fubm90Ci9S ZWN0IFs0ODUuNyA0ODUuNTIzIDQ5OS43OCA0OTYuNDEzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3Qv MjkKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjQyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzg3 LjcyIDQ3My42NDMgMTAxLjggNDg0LjUzM10KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzMxCi9TdWJ0 eXBlL0xpbms+PmVuZG9iago0MyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0ODUuNyA0NzMu NjQzIDQ5OS43OCA0ODQuNTMzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjkKL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjQ0IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzg3LjcyIDQ2MS43NjMgMTAx LjggNDcyLjY1M10KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzMyCi9TdWJ0eXBlL0xpbms+PmVuZG9i ago0NSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0ODUuNyA0NjEuNzYzIDQ5OS43OCA0NzIu NjUzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjkKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjQ2IDAg b2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzg3LjcyIDQ0OS44ODMgMTAxLjggNDYwLjc3M10KL0Jv cmRlciBbMCAwIDBdCi9EZXN0LzMzCi9TdWJ0eXBlL0xpbms+PmVuZG9iago0NyAwIG9iago8PC9U eXBlL0Fubm90Ci9SZWN0IFs0ODUuNyA0NDkuODgzIDQ5OS43OCA0NjAuNzczXQovQm9yZGVyIFsw IDAgMF0KL0Rlc3QvMjkKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjQ4IDAgb2JqCjw8L1R5cGUvQW5u b3QKL1JlY3QgWzg3LjcyIDQzOC4wMDMgMTAxLjggNDQ4Ljg5M10KL0JvcmRlciBbMCAwIDBdCi9E ZXN0LzM1Ci9TdWJ0eXBlL0xpbms+PmVuZG9iago0OSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFs0ODUuNyA0MzguMDAzIDQ5OS43OCA0NDguODkzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMzQK L1N1YnR5cGUvTGluaz4+ZW5kb2JqCjUwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzk5LjYg NDI2LjEyMyAxMjUuNTYgNDM3LjAxM10KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzM2Ci9TdWJ0eXBl L0xpbms+PmVuZG9iago1MSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0ODUuNyA0MjYuMTIz IDQ5OS43OCA0MzcuMDEzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMzQKL1N1YnR5cGUvTGluaz4+ ZW5kb2JqCjUyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzk5LjYgNDE0LjI0MyAxMjUuNTYg NDI1LjEzM10KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzQ1Ci9TdWJ0eXBlL0xpbms+PmVuZG9iago1 MyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0ODUuNyA0MTQuMjQzIDQ5OS43OCA0MjUuMTMz XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNDQKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjU0IDAgb2Jq Cjw8L1R5cGUvQW5ub3QKL1JlY3QgWzg3LjcyIDQwMi4zNjMgMTQ5LjMyIDQxMy4yNTNdCi9Cb3Jk ZXIgWzAgMCAwXQovRGVzdC85OAovU3VidHlwZS9MaW5rPj5lbmRvYmoKNTUgMCBvYmoKPDwvVHlw ZS9Bbm5vdAovUmVjdCBbNDg1LjcgNDAyLjM2MyA0OTkuNzggNDEzLjI1M10KL0JvcmRlciBbMCAw IDBdCi9EZXN0LzgxCi9TdWJ0eXBlL0xpbms+PmVuZG9iago1NiAwIG9iago8PC9UeXBlL0Fubm90 Ci9SZWN0IFs4Ny43MiAzOTAuNDgzIDE0OS4zMiA0MDEuMzczXQovQm9yZGVyIFswIDAgMF0KL0Rl c3QvMTAwCi9TdWJ0eXBlL0xpbms+PmVuZG9iago1NyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFs0ODUuNyAzOTAuNDgzIDQ5OS43OCA0MDEuMzczXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvOTkK L1N1YnR5cGUvTGluaz4+ZW5kb2JqCjU4IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzQ4NS43 IDM3OC42MDMgNDk5Ljc4IDM4OS40OTNdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC85OQovU3VidHlw ZS9MaW5rPj5lbmRvYmoKNTkgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbNjkuOSAzNTQuODQz IDc4LjA0IDM2NS43MzNdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8zCi9TdWJ0eXBlL0xpbms+PmVu ZG9iago2MCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFszOTAuNjYgMzMxLjA4MiA0MzQuNDQg MzQxLjk3Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3Rvb2xzLmll dGYub3JnL3BkZi9yZmM4NDg0KT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iago2MSAwIG9iago8PC9U eXBlL0Fubm90Ci9SZWN0IFs2OS45IDIzNi4wNDIgNzguMDQgMjQ2LjkzMl0KL0JvcmRlciBbMCAw IDBdCi9EZXN0LzQKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjYyIDAgb2JqCjw8L1I3CjcgMCBSPj4K ZW5kb2JqCjYzIDAgb2JqCjw8L1I5CjkgMCBSPj4KZW5kb2JqCjY3IDAgb2JqCjw8L1R5cGUvQW5u b3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0KL0Rl c3QvNQovU3VidHlwZS9MaW5rPj5lbmRvYmoKNjggMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBb MjQyLjE2IDYzOS45NjQgMjg1Ljk0IDY1MC44NTRdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJ Ci9VUkkoaHR0cHM6Ly90b29scy5pZXRmLm9yZy9wZGYvcmZjODQ4NCk+PgovU3VidHlwZS9MaW5r Pj5lbmRvYmoKNjkgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbNjkuOSA2MTYuMjA0IDc4LjA0 IDYyNy4wOTRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC82Ci9TdWJ0eXBlL0xpbms+PmVuZG9iago3 MCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0NTAuMDYgMzkwLjQ4MyA0NTguMiA0MDEuMzcz XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNDYKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjcxIDAgb2Jq Cjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgMjI0LjE2MiA3OC4wNCAyMzUuMDUyXQovQm9yZGVy IFswIDAgMF0KL0Rlc3QvNwovU3VidHlwZS9MaW5rPj5lbmRvYmoKNzIgMCBvYmoKPDwvVHlwZS9B bm5vdAovUmVjdCBbNDE0LjQyIDE4OC41MjEgNDIyLjU2IDE5OS40MTFdCi9Cb3JkZXIgWzAgMCAw XQovRGVzdC80NwovU3VidHlwZS9MaW5rPj5lbmRvYmoKNzMgMCBvYmoKPDwvVHlwZS9Bbm5vdAov UmVjdCBbMTI5LjMgMTY0Ljc2MSAxMzcuNDQgMTc1LjY1MV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0 LzQ4Ci9TdWJ0eXBlL0xpbms+PmVuZG9iago3NCAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iago3 NSAwIG9iago8PC9SOQo5IDAgUj4+CmVuZG9iago3OSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFs2OS45IDc3MC42NDUgNzguMDQgNzgxLjUzNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzgKL1N1 YnR5cGUvTGluaz4+ZW5kb2JqCjgwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzI3MS44NiA3 MjMuMTI1IDI4MCA3MzQuMDE1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNDkKL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjgxIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzkzLjY2IDY5OS4zNjUgMTAx LjggNzEwLjI1NV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzUwCi9TdWJ0eXBlL0xpbms+PmVuZG9i ago4MiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDYxNi4yMDQgNzguMDQgNjI3LjA5 NF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzkKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjgzIDAgb2Jq Cjw8L1R5cGUvQW5ub3QKL1JlY3QgWzMzNy4yIDQzOC4wMDMgMzQ1LjM0IDQ0OC44OTNdCi9Cb3Jk ZXIgWzAgMCAwXQovRGVzdC81MQovU3VidHlwZS9MaW5rPj5lbmRvYmoKODQgMCBvYmoKPDwvVHlw ZS9Bbm5vdAovUmVjdCBbMjQyLjE2IDQxNC4yNDMgMjUwLjMgNDI1LjEzM10KL0JvcmRlciBbMCAw IDBdCi9EZXN0LzUyCi9TdWJ0eXBlL0xpbms+PmVuZG9iago4NSAwIG9iago8PC9UeXBlL0Fubm90 Ci9SZWN0IFszMTMuNDQgMzY2LjcyMyAzMjEuNTggMzc3LjYxM10KL0JvcmRlciBbMCAwIDBdCi9E ZXN0LzUzCi9TdWJ0eXBlL0xpbms+PmVuZG9iago4NiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFszNzIuODQgMzQyLjk2MiAzODAuOTggMzUzLjg1Ml0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzU0 Ci9TdWJ0eXBlL0xpbms+PmVuZG9iago4NyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFszNDMu MTQgMjcxLjY4MiAzNTcuMjIgMjgyLjU3Ml0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzU1Ci9TdWJ0 eXBlL0xpbms+PmVuZG9iago4OCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0NzMuODIgMjcx LjY4MiA0ODcuOSAyODIuNTcyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNTYKL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjg5IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzIzMC4yOCAyNTkuODAyIDI0 NC4zNiAyNzAuNjkyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNTcKL1N1YnR5cGUvTGluaz4+ZW5k b2JqCjkwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzQ2MS45NCAyNTkuODAyIDQ3Ni4wMiAy NzAuNjkyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNTgKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjkx IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzM0My4xNCAyNDcuOTIyIDM1Ny4yMiAyNTguODEy XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNTkKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjkyIDAgb2Jq Cjw8L1R5cGUvQW5ub3QKL1JlY3QgWzIxMi40NiAyMzYuMDQyIDIyNi41NCAyNDYuOTMyXQovQm9y ZGVyIFswIDAgMF0KL0Rlc3QvNjAKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjkzIDAgb2JqCjw8L1R5 cGUvQW5ub3QKL1JlY3QgWzEzNS4yNCAyMjQuMTYyIDE0OS4zMiAyMzUuMDUyXQovQm9yZGVyIFsw IDAgMF0KL0Rlc3QvNjEKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjk0IDAgb2JqCjw8L1I3CjcgMCBS Pj4KZW5kb2JqCjk1IDAgb2JqCjw8L1I5CjkgMCBSPj4KZW5kb2JqCjk5IDAgb2JqCjw8L1R5cGUv QW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0K L0Rlc3QvMTAKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEwMCAwIG9iago8PC9UeXBlL0Fubm90Ci9S ZWN0IFsyNTQuMDQgNzIzLjEyNSAyNjguMTIgNzM0LjAxNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0 LzYzCi9TdWJ0eXBlL0xpbms+PmVuZG9iagoxMDEgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBb MjU5Ljk4IDcxMS4yNDUgMjc0LjA2IDcyMi4xMzVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC82NAov U3VidHlwZS9MaW5rPj5lbmRvYmoKMTAyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzE0Ny4x MiA2ODcuNDg1IDE2MS4yIDY5OC4zNzVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC82NQovU3VidHlw ZS9MaW5rPj5lbmRvYmoKMTAzIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzEwNS41NCA0NzMu NjQzIDE2MS4yIDQ4NC41MzNdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8xNAovU3VidHlwZS9MaW5r Pj5lbmRvYmoKMTA0IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzE4OC43IDQ3My42NDMgMjQ0 LjM2IDQ4NC41MzNdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8yMwovU3VidHlwZS9MaW5rPj5lbmRv YmoKMTA1IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgNDQ5Ljg4MyA3OC4wNCA0NjAu NzczXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMTEKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEwNiAw IG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFszNDkuMDggMzY2LjcyMyA0MDQuNzQgMzc3LjYxM10K L0JvcmRlciBbMCAwIDBdCi9EZXN0LzkKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEwNyAwIG9iago8 PC9UeXBlL0Fubm90Ci9SZWN0IFsyNTQuMDQgMzE5LjIwMiAyNjguMTIgMzMwLjA5Ml0KL0JvcmRl ciBbMCAwIDBdCi9EZXN0LzY2Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoxMDggMCBvYmoKPDwvVHlw ZS9Bbm5vdAovUmVjdCBbNjkuOSAyODMuNTYyIDc4LjA0IDI5NC40NTJdCi9Cb3JkZXIgWzAgMCAw XQovRGVzdC8xMgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMTA5IDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzE2NC45NCAyNDcuOTIyIDE3OS4wMiAyNTguODEyXQovQm9yZGVyIFswIDAgMF0KL0Rl c3QvNjcKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjExMCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFszMDcuNSAyNDcuOTIyIDMyMS41OCAyNTguODEyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNjgK L1N1YnR5cGUvTGluaz4+ZW5kb2JqCjExMSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs0MjYu MyAyNDcuOTIyIDQ0MC4zOCAyNTguODEyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNjkKL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjExMiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFszMTkuMzggMjM2 LjA0MiAzMzMuNDYgMjQ2LjkzMl0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzcwCi9TdWJ0eXBlL0xp bms+PmVuZG9iagoxMTMgMCBvYmoKPDwvUjcKNyAwIFI+PgplbmRvYmoKMTE0IDAgb2JqCjw8L1I5 CjkgMCBSPj4KZW5kb2JqCjExOCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDc3MC42 NDUgNzguMDQgNzgxLjUzNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzEzCi9TdWJ0eXBlL0xpbms+ PmVuZG9iagoxMTkgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTQxLjE4IDM5MC40ODMgMTU1 LjI2IDQwMS4zNzNdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC83MQovU3VidHlwZS9MaW5rPj5lbmRv YmoKMTIwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgMjEyLjI4MiA3OC4wNCAyMjMu MTcyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMTQKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEyMSAw IG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoxMjIgMCBvYmoKPDwvUjkKOSAwIFI+PgplbmRvYmoK MTI2IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEuNTM1 XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMTUKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEyNyAwIG9i ago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxNTMuMDYgNDYxLjc2NCAxNjcuMTQgNDcyLjY1NF0KL0Jv cmRlciBbMCAwIDBdCi9EZXN0LzcyCi9TdWJ0eXBlL0xpbms+PmVuZG9iagoxMjggMCBvYmoKPDwv VHlwZS9Bbm5vdAovUmVjdCBbMzE5LjM4IDQ2MS43NjQgMzMzLjQ2IDQ3Mi42NTRdCi9Cb3JkZXIg WzAgMCAwXQovRGVzdC83MwovU3VidHlwZS9MaW5rPj5lbmRvYmoKMTI5IDAgb2JqCjw8L1R5cGUv QW5ub3QKL1JlY3QgWzM3OC43OCAzOTAuNDgzIDM5Mi44NiA0MDEuMzczXQovQm9yZGVyIFswIDAg MF0KL0Rlc3QvNzQKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEzMCAwIG9iago8PC9SNwo3IDAgUj4+ CmVuZG9iagoxMzEgMCBvYmoKPDwvUjkKOSAwIFI+PgplbmRvYmoKMTM1IDAgb2JqCjw8L1R5cGUv QW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0K L0Rlc3QvMTYKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjEzNiAwIG9iago8PC9UeXBlL0Fubm90Ci9S ZWN0IFs0MjAuMzYgNzIzLjEyNSA0MzQuNDQgNzM0LjAxNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0 Lzc1Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoxMzcgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBb MjEyLjQ2IDcxMS4yNDUgMjI2LjU0IDcyMi4xMzVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC83Ngov U3VidHlwZS9MaW5rPj5lbmRvYmoKMTM4IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzM2MC45 NiA3MTEuMjQ1IDM3NS4wNCA3MjIuMTM1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNzcKL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjEzOSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMjMuMzYgNjk5 LjM2NSAxMzcuNDQgNzEwLjI1NV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0Lzc4Ci9TdWJ0eXBlL0xp bms+PmVuZG9iagoxNDAgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMjgzLjc0IDY5OS4zNjUg Mjk3LjgyIDcxMC4yNTVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC83OQovU3VidHlwZS9MaW5rPj5l bmRvYmoKMTQxIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzQyNi4zIDY5OS4zNjUgNDQwLjM4 IDcxMC4yNTVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC84MAovU3VidHlwZS9MaW5rPj5lbmRvYmoK MTQyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzEyMy4zNiA2NzUuNjA1IDEzNy40NCA2ODYu NDk1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvODIKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE0MyAw IG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoxNDQgMCBvYmoKPDwvUjkKOSAwIFI+PgplbmRvYmoK MTQ4IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEuNTM1 XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMTcKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE0OSAwIG9i ago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxODIuNzYgMjgzLjU2MiAyMjYuNTQgMjk0LjQ1Ml0KL0Jv cmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3Rvb2xzLmlldGYub3JnL3BkZi9y ZmM4NDk5KT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoxNTAgMCBvYmoKPDwvVHlwZS9Bbm5vdAov UmVjdCBbMTQxLjE4IDE3Ni42NDIgMjkxLjg4IDE4Ny41MzJdCi9Cb3JkZXIgWzAgMCAwXQovQTw8 L1MvVVJJCi9VUkkoaHR0cHM6Ly9hY2NvdW50aW5nLXN5c3RlbS8pPj4KL1N1YnR5cGUvTGluaz4+ ZW5kb2JqCjE1MSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoxNTIgMCBvYmoKPDwvUjkKOSAw IFI+PgplbmRvYmoKMTU2IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3 OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMTgKL1N1YnR5cGUvTGluaz4+ZW5k b2JqCjE1NyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgNzIzLjEyNSAxNjEuMiA3 MzQuMDE1XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vdG9vbHMuaWV0 Zi5vcmcvcGRmL3JmYzE5MTgpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE1OCAwIG9iago8PC9U eXBlL0Fubm90Ci9SZWN0IFs0MDIuNTQgMjk1LjQ0MyA0MTYuNjIgMzA2LjMzM10KL0JvcmRlciBb MCAwIDBdCi9EZXN0LzgzCi9TdWJ0eXBlL0xpbms+PmVuZG9iagoxNTkgMCBvYmoKPDwvVHlwZS9B bm5vdAovUmVjdCBbMTk0LjY0IDI4My41NjMgMjA4LjcyIDI5NC40NTNdCi9Cb3JkZXIgWzAgMCAw XQovRGVzdC84NAovU3VidHlwZS9MaW5rPj5lbmRvYmoKMTYwIDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzMzNy4yIDI0Ny45MjMgMzUxLjI4IDI1OC44MTNdCi9Cb3JkZXIgWzAgMCAwXQovRGVz dC84NQovU3VidHlwZS9MaW5rPj5lbmRvYmoKMTYxIDAgb2JqCjw8L1I3CjcgMCBSPj4KZW5kb2Jq CjE2MiAwIG9iago8PC9SOQo5IDAgUj4+CmVuZG9iagoxNjYgMCBvYmoKPDwvVHlwZS9Bbm5vdAov UmVjdCBbNjkuOSA3NzAuNjQ1IDc4LjA0IDc4MS41MzVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8x OQovU3VidHlwZS9MaW5rPj5lbmRvYmoKMTY3IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzMw MS41NiA1ODAuNTY0IDQyOC41IDU5MS40NTRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8zNwovU3Vi dHlwZS9MaW5rPj5lbmRvYmoKMTY4IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzEyMy4zNiA1 NjguNjg0IDI1MC4zIDU3OS41NzRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8zOAovU3VidHlwZS9M aW5rPj5lbmRvYmoKMTY5IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzI5NS42MiA1NjguNjg0 IDQyMi41NiA1NzkuNTc0XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMzkKL1N1YnR5cGUvTGluaz4+ ZW5kb2JqCjE3MCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMjMuMzYgMzc4LjYwMyAxNjcu MTQgMzg5LjQ5M10KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3Rvb2xz LmlldGYub3JnL3BkZi9yZmM2ODkxKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoxNzEgMCBvYmoK PDwvVHlwZS9Bbm5vdAovUmVjdCBbMTgyLjc2IDM3OC42MDMgMjI2LjU0IDM4OS40OTNdCi9Cb3Jk ZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly90b29scy5pZXRmLm9yZy9wZGYvcmZj Nzg3MSk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMTcyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1Jl Y3QgWzEzNS4yNCAxNzYuNjQyIDE5Ni44NCAxODcuNTMyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3Qv MjUKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE3MyAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagox NzQgMCBvYmoKPDwvUjkKOSAwIFI+PgplbmRvYmoKMTc4IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1Jl Y3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjAK L1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE3OSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMjMu MzYgNjc1LjYwNSAxMzcuNDQgNjg2LjQ5NV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0Lzg2Ci9TdWJ0 eXBlL0xpbms+PmVuZG9iagoxODAgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMjcxLjg2IDI0 Ny45MjIgMjg1Ljk0IDI1OC44MTJdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC84NwovU3VidHlwZS9M aW5rPj5lbmRvYmoKMTgxIDAgb2JqCjw8L1I3CjcgMCBSPj4KZW5kb2JqCjE4MiAwIG9iago8PC9S OQo5IDAgUj4+CmVuZG9iagoxODYgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbNjkuOSA3NzAu NjQ1IDc4LjA0IDc4MS41MzVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8yMQovU3VidHlwZS9MaW5r Pj5lbmRvYmoKMTg3IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzMxMy40NCA0MjYuMTIzIDMy Ny41MiA0MzcuMDEzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvODgKL1N1YnR5cGUvTGluaz4+ZW5k b2JqCjE4OCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsyMDYuNTIgNDE0LjI0MyAyMjAuNiA0 MjUuMTMzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvODkKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE4 OSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoxOTAgMCBvYmoKPDwvUjkKOSAwIFI+PgplbmRv YmoKMTk0IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEu NTM1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjIKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjE5NSAw IG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMjMuMzYgNjUxLjg0NSAxMzcuNDQgNjYyLjczNV0K L0JvcmRlciBbMCAwIDBdCi9EZXN0LzkwCi9TdWJ0eXBlL0xpbms+PmVuZG9iagoxOTYgMCBvYmoK PDwvVHlwZS9Bbm5vdAovUmVjdCBbNjkuOSA2MDQuMzI0IDc4LjA0IDYxNS4yMTVdCi9Cb3JkZXIg WzAgMCAwXQovRGVzdC8yMwovU3VidHlwZS9MaW5rPj5lbmRvYmoKMTk3IDAgb2JqCjw8L1I3Cjcg MCBSPj4KZW5kb2JqCjE5OCAwIG9iago8PC9SOQo5IDAgUj4+CmVuZG9iagoyMDIgMCBvYmoKPDwv VHlwZS9Bbm5vdAovUmVjdCBbNjkuOSA3NzAuNjQ1IDc4LjA0IDc4MS41MzVdCi9Cb3JkZXIgWzAg MCAwXQovRGVzdC8yNAovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjAzIDAgb2JqCjw8L1R5cGUvQW5u b3QKL1JlY3QgWzY5LjkgNDAyLjM2NCA4My45OCA0MTMuMjU0XQovQm9yZGVyIFswIDAgMF0KL0Rl c3QvMjUKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjIwNCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFsxMjMuMzYgMzMxLjA4NCAxNjcuMTQgMzQxLjk3NF0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9V UkkKL1VSSShodHRwczovL3Rvb2xzLmlldGYub3JnL3BkZi9yZmM4NDg0KT4+Ci9TdWJ0eXBlL0xp bms+PmVuZG9iagoyMDUgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbNDI2LjMgMjAwLjQwMyA0 OTMuODQgMjExLjI5M10KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3Rv b2xzLmlldGYub3JnL3BkZi9kcmFmdC1pZXRmLWRvaC1yZXNvbHZlci1hc3NvY2lhdGVkLWRvaCk+ PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjA2IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzEx Ny40MiAxODguNTIzIDI4MCAxOTkuNDEzXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJ KGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcGRmL2RyYWZ0LWlldGYtZG9oLXJlc29sdmVyLWFzc29j aWF0ZWQtZG9oKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoyMDcgMCBvYmoKPDwvVHlwZS9Bbm5v dAovUmVjdCBbMjg5LjY4IDE4OC41MjMgMzAzLjc2IDE5OS40MTNdCi9Cb3JkZXIgWzAgMCAwXQov RGVzdC85MQovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjA4IDAgb2JqCjw8L1I3CjcgMCBSPj4KZW5k b2JqCjIwOSAwIG9iago8PC9SOQo5IDAgUj4+CmVuZG9iagoyMTMgMCBvYmoKPDwvVHlwZS9Bbm5v dAovUmVjdCBbNjkuOSA3NzAuNjQ1IDc4LjA0IDc4MS41MzVdCi9Cb3JkZXIgWzAgMCAwXQovRGVz dC8yNgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjE0IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3Qg WzQ0NC4xMiA0NzMuNjQ0IDQ1OC4yIDQ4NC41MzRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC85Mgov U3VidHlwZS9MaW5rPj5lbmRvYmoKMjE1IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzQ2MS45 NCAyNDcuOTIzIDQ3Ni4wMiAyNTguODEzXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvOTMKL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjIxNiAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoyMTcgMCBvYmoK PDwvUjkKOSAwIFI+PgplbmRvYmoKMjIxIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5Ljkg NzcwLjY0NSA3OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjcKL1N1YnR5cGUv TGluaz4+ZW5kb2JqCjIyMiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMjMuMzYgNjYzLjcy NSAxMzcuNDQgNjc0LjYxNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0Lzk0Ci9TdWJ0eXBlL0xpbms+ PmVuZG9iagoyMjMgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbNDQ0LjEyIDU0NC45MjQgNDU4 LjIgNTU1LjgxNF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0Lzk1Ci9TdWJ0eXBlL0xpbms+PmVuZG9i agoyMjQgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMjM2LjIyIDIwMC40MDIgMjkxLjg4IDIx MS4yOTJdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8xNAovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjI1 IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzMxOS4zOCAyMDAuNDAyIDM3NS4wNCAyMTEuMjky XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjMKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjIyNiAwIG9i ago8PC9SNwo3IDAgUj4+CmVuZG9iagoyMjcgMCBvYmoKPDwvUjkKOSAwIFI+PgplbmRvYmoKMjMx IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0NSA3OC4wNCA3ODEuNTM1XQov Qm9yZGVyIFswIDAgMF0KL0Rlc3QvMjgKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjIzMiAwIG9iago8 PC9UeXBlL0Fubm90Ci9SZWN0IFsxNTMuMDYgNDYxLjc2NCAxNjcuMTQgNDcyLjY1NF0KL0JvcmRl ciBbMCAwIDBdCi9EZXN0Lzk2Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoyMzMgMCBvYmoKPDwvVHlw ZS9Bbm5vdAovUmVjdCBbMzM3LjIgNDYxLjc2NCAzNTEuMjggNDcyLjY1NF0KL0JvcmRlciBbMCAw IDBdCi9EZXN0Lzk3Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoyMzQgMCBvYmoKPDwvUjcKNyAwIFI+ PgplbmRvYmoKMjM1IDAgb2JqCjw8L1I5CjkgMCBSPj4KZW5kb2JqCjIzOSAwIG9iago8PC9UeXBl L0Fubm90Ci9SZWN0IFs2OS45IDc3MC42NDUgNzguMDQgNzgxLjUzNV0KL0JvcmRlciBbMCAwIDBd Ci9EZXN0LzI5Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoyNDAgMCBvYmoKPDwvVHlwZS9Bbm5vdAov UmVjdCBbNjkuOSA0OTcuNDA0IDgzLjk4IDUwOC4yOTRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8z MAovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjQxIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5 LjkgMzkwLjQ4MyA4My45OCA0MDEuMzczXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMzEKL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjI0MiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDMxOS4y MDMgODMuOTggMzMwLjA5M10KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzMyCi9TdWJ0eXBlL0xpbms+ PmVuZG9iagoyNDMgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMjcxLjg2IDI3MS42ODIgMzE1 LjY0IDI4Mi41NzJdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly90b29s cy5pZXRmLm9yZy9wZGYvcmZjODQ4NCk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjQ0IDAgb2Jq Cjw8L1R5cGUvQW5ub3QKL1JlY3QgWzI3MS44NiAyMzYuMDQyIDMyNy41MiAyNDYuOTMyXQovQm9y ZGVyIFswIDAgMF0KL0Rlc3QvMTQKL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI0NSAwIG9iago8PC9U eXBlL0Fubm90Ci9SZWN0IFs2OS45IDIxMi4yODIgODMuOTggMjIzLjE3Ml0KL0JvcmRlciBbMCAw IDBdCi9EZXN0LzMzCi9TdWJ0eXBlL0xpbms+PmVuZG9iagoyNDYgMCBvYmoKPDwvVHlwZS9Bbm5v dAovUmVjdCBbMjcxLjg2IDE2NC43NjIgMzE1LjY0IDE3NS42NTJdCi9Cb3JkZXIgWzAgMCAwXQov QTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly90b29scy5pZXRmLm9yZy9wZGYvcmZjODQ4NCk+PgovU3Vi dHlwZS9MaW5rPj5lbmRvYmoKMjQ3IDAgb2JqCjw8L1I3CjcgMCBSPj4KZW5kb2JqCjI0OCAwIG9i ago8PC9SOQo5IDAgUj4+CmVuZG9iagoyNTIgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbNjku OSA3NzAuNjQ1IDc4LjA0IDc4MS41MzVdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8zNAovU3VidHlw ZS9MaW5rPj5lbmRvYmoKMjUzIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExMS40OCA2NjMu NzI1IDE2Ny4xNCA2NzQuNjE1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvMjMKL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjI1NCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDYzOS45NjUgODMu OTggNjUwLjg1NF0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzM1Ci9TdWJ0eXBlL0xpbms+PmVuZG9i agoyNTUgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbNjkuOSA2MTYuMjA0IDk1Ljg2IDYyNy4w OTRdCi9Cb3JkZXIgWzAgMCAwXQovRGVzdC8zNgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjU2IDAg b2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzMxOS4zOCA0MDIuMzYzIDM2OS4xIDQxMy4yNTNdCi9C b3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly90b29scy5pZXRmLm9yZy9wZGYv cmZjNjg5MSk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjU3IDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzE1OSAzNzguNjAzIDM5Mi44NiAzODkuNDkzXQovQm9yZGVyIFswIDAgMF0KL0E8PC9T L1VSSQovVVJJKGh0dHBzOi8vd3d3LnJmYy1lZGl0b3Iub3JnL2luZm8vcmZjNjg5MSk+PgovU3Vi dHlwZS9MaW5rPj5lbmRvYmoKMjU4IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzM5MC42NiAz NDIuOTYyIDQ0MC4zOCAzNTMuODUyXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcGRmL3JmYzc4NzEpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2Jq CjI1OSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxNTkgMzE5LjIwMiAzOTIuODYgMzMwLjA5 Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3d3dy5yZmMtZWRpdG9y Lm9yZy9pbmZvL3JmYzc4NzEpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI2MCAwIG9iago8PC9U eXBlL0Fubm90Ci9SZWN0IFsyMDAuNTggMjgzLjU2MiAyNTAuMyAyOTQuNDUyXQovQm9yZGVyIFsw IDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcGRmL3JmYzg0ODQp Pj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI2MSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsx NTkgMjcxLjY4MiAzOTIuODYgMjgyLjU3Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VS SShodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzg0ODQpPj4KL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjI2MiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsyMzYuMjIgMjM2LjA0MiAy ODAgMjQ2LjkzMl0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3Rvb2xz LmlldGYub3JnL3BkZi9iY3AyMTkpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI2MyAwIG9iago8 PC9UeXBlL0Fubm90Ci9SZWN0IFsyODkuNjggMjM2LjA0MiAzMzkuNCAyNDYuOTMyXQovQm9yZGVy IFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcGRmL3JmYzg0 OTkpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI2NCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0 IFsyNDIuMTYgMjI0LjE2MiA0NzYuMDIgMjM1LjA1Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9V UkkKL1VSSShodHRwczovL3d3dy5yZmMtZWRpdG9yLm9yZy9pbmZvL3JmYzg0OTkpPj4KL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjI2NSAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagoyNjYgMCBvYmoK PDwvUjkKOSAwIFI+PgplbmRvYmoKMjcwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5Ljkg NzcwLjY0NSA3OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvNDQKL1N1YnR5cGUv TGluaz4+ZW5kb2JqCjI3MSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDcyMy4xMjUg OTUuODYgNzM0LjAxNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzQ1Ci9TdWJ0eXBlL0xpbms+PmVu ZG9iagoyNzIgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTExLjQ4IDY5OS4zNjUgMjk3Ljgy IDcxMC4yNTVdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cDovL29wZW5yZXNv bHZlcnByb2plY3Qub3JnLyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjczIDAgb2JqCjw8L1R5 cGUvQW5ub3QKL1JlY3QgWzExMS40OCA2NzUuNjA1IDQ1OC4yIDY4Ni40OTVdCi9Cb3JkZXIgWzAg MCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9ibG9nLm5pZ2h0bHkubW96aWxsYS5vcmcvMjAx OC8wNi8wMS9pbXByb3ZpbmctZG5zLXByaXZhY3ktaW4tZmlyZWZveC8pPj4KL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjI3NCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTEuNDggNjYzLjcyNSAy MjYuNTQgNjc0LjYxNV0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2Js b2cubmlnaHRseS5tb3ppbGxhLm9yZy8yMDE4LzA2LzAxL2ltcHJvdmluZy1kbnMtcHJpdmFjeS1p bi1maXJlZm94Lyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjc1IDAgb2JqCjw8L1R5cGUvQW5u b3QKL1JlY3QgWzExMS40OCA2MzkuOTY0IDQ3Ni4wMiA2NTAuODU0XQovQm9yZGVyIFswIDAgMF0K L0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vZGV2ZWxvcGVycy5nb29nbGUuY29tL3NwZWVkL3B1Ymxp Yy1kbnMvZG9jcy9kbnMtb3Zlci1odHRwcyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjc2IDAg b2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExMS40OCA2MjguMDg0IDE0My4zOCA2MzguOTc0XQov Qm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vZGV2ZWxvcGVycy5nb29nbGUu Y29tL3NwZWVkL3B1YmxpYy1kbnMvZG9jcy9kbnMtb3Zlci1odHRwcyk+PgovU3VidHlwZS9MaW5r Pj5lbmRvYmoKMjc3IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExMS40OCA2MDQuMzI0IDQ5 OS43OCA2MTUuMjE0XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vYmxv Zy5tb3ppbGxhLm9yZy9mdXR1cmVyZWxlYXNlcy8yMDE4LzExLzI3L25leHQtc3RlcHMtaW4tZG5z LW92ZXItaHR0cHMtdGVzdGluZy8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI3OCAwIG9iago8 PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTEuNDggNTkyLjQ0NCAyNTAuMyA2MDMuMzM0XQovQm9yZGVy IFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vYmxvZy5tb3ppbGxhLm9yZy9mdXR1cmVy ZWxlYXNlcy8yMDE4LzExLzI3L25leHQtc3RlcHMtaW4tZG5zLW92ZXItaHR0cHMtdGVzdGluZy8p Pj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI3OSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsx MTEuNDggNTY4LjY4NCA0NzYuMDIgNTc5LjU3NF0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkK L1VSSShodHRwczovL2RldmVsb3BlcnMuZ29vZ2xlLmNvbS9zcGVlZC9wdWJsaWMtZG5zL2RvY3Mv ZG5zLW92ZXItaHR0cHMpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI4MCAwIG9iago8PC9UeXBl L0Fubm90Ci9SZWN0IFsxMTEuNDggNTU2LjgwNCAxNDMuMzggNTY3LjY5NF0KL0JvcmRlciBbMCAw IDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2RldmVsb3BlcnMuZ29vZ2xlLmNvbS9zcGVlZC9w dWJsaWMtZG5zL2RvY3MvZG5zLW92ZXItaHR0cHMpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI4 MSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTEuNDggNTMzLjA0NCA0OTMuODQgNTQzLjkz NF0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3hjb25vbXkuY29tL2Jv c3Rvbi8yMDA5LzEwLzIwL2FyYm9yLW5ldHdvcmtzLXJlcG9ydHMtb24tdGhlLXJpc2Utb2YtdGhl LWludGVybmV0LWh5cGVyLWdpYW50cy8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI4MiAwIG9i ago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTEuNDggNTIxLjE2NCAzMzkuNCA1MzIuMDU0XQovQm9y ZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8veGNvbm9teS5jb20vYm9zdG9uLzIw MDkvMTAvMjAvYXJib3ItbmV0d29ya3MtcmVwb3J0cy1vbi10aGUtcmlzZS1vZi10aGUtaW50ZXJu ZXQtaHlwZXItZ2lhbnRzLyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjgzIDAgb2JqCjw8L1R5 cGUvQW5ub3QKL1JlY3QgWzExMS40OCA0OTcuNDA0IDQzNC40NCA1MDguMjkzXQovQm9yZGVyIFsw IDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vY3liZXIuaGFydmFyZC5lZHUvc2l0ZXMvY3li ZXIubGF3LmhhcnZhcmQuZWR1L2ZpbGVzLzIwMTBfRERvU19BdHRhY2tzX0h1bWFuX1JpZ2h0c19h bmRfTWVkaWEucGRmKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoyODQgMCBvYmoKPDwvVHlwZS9B bm5vdAovUmVjdCBbMTExLjQ4IDQ4NS41MjMgNDEwLjY4IDQ5Ni40MTNdCi9Cb3JkZXIgWzAgMCAw XQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9jeWJlci5oYXJ2YXJkLmVkdS9zaXRlcy9jeWJlci5s YXcuaGFydmFyZC5lZHUvZmlsZXMvMjAxMF9ERG9TX0F0dGFja3NfSHVtYW5fUmlnaHRzX2FuZF9N ZWRpYS5wZGYpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI4NSAwIG9iago8PC9UeXBlL0Fubm90 Ci9SZWN0IFsxMTEuNDggNDYxLjc2MyA0ODcuOSA0NzIuNjUzXQovQm9yZGVyIFswIDAgMF0KL0E8 PC9TL1VSSQovVVJJKGh0dHBzOi8vd3d3LnNhbmR2aW5lLmNvbS9ibG9nL3lvdXR1YmUtcnVsZXMt bW9iaWxlLTIwMTktbW9iaWxlLWludGVybmV0LXBoZW5vbWVuYS1yZXBvcnQtcmVsZWFzZWQpPj4K L1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI4NiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTEu NDggNDQ5Ljg4MyAzMTUuNjQgNDYwLjc3M10KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VS SShodHRwczovL3d3dy5zYW5kdmluZS5jb20vYmxvZy95b3V0dWJlLXJ1bGVzLW1vYmlsZS0yMDE5 LW1vYmlsZS1pbnRlcm5ldC1waGVub21lbmEtcmVwb3J0LXJlbGVhc2VkKT4+Ci9TdWJ0eXBlL0xp bms+PmVuZG9iagoyODcgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTExLjQ4IDQyNi4xMjMg NDQ2LjMyIDQzNy4wMTNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93 d3cuc2FuZHZpbmUuY29tL2Jsb2cvZ2xvYmFsLWludGVybmV0LXBoZW5vbWVuYS13b3JsZHdpZGUt YW5kLXJlZ2lvbmFsLXRvdGFsLWludGVybmV0LXRyYWZmaWMtc2hhcmUtdmlkZW8tYW5kLSk+Pgov U3VidHlwZS9MaW5rPj5lbmRvYmoKMjg4IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExMS40 OCA0MTQuMjQzIDQ4MS45NiA0MjUuMTMzXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJ KGh0dHBzOi8vd3d3LnNhbmR2aW5lLmNvbS9ibG9nL2dsb2JhbC1pbnRlcm5ldC1waGVub21lbmEt d29ybGR3aWRlLWFuZC1yZWdpb25hbC10b3RhbC1pbnRlcm5ldC10cmFmZmljLXNoYXJlLXZpZGVv LWFuZC0pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI4OSAwIG9iago8PC9UeXBlL0Fubm90Ci9S ZWN0IFsxMTcuNDIgMzc4LjYwMyA0OTMuODQgMzg5LjQ5M10KL0JvcmRlciBbMCAwIDBdCi9BPDwv Uy9VUkkKL1VSSShodHRwczovL2Fyc3RlY2huaWNhLmNvbS90ZWNoLXBvbGljeS8yMDE0LzAyL3Rp bS1iZXJuZXJzLWxlZS13ZS1uZWVkLXRvLXJlLWRlY2VudHJhbGl6ZS10aGUtd2ViLyk+PgovU3Vi dHlwZS9MaW5rPj5lbmRvYmoKMjkwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40MiAz NjYuNzIzIDMwOS43IDM3Ny42MTNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0 cHM6Ly9hcnN0ZWNobmljYS5jb20vdGVjaC1wb2xpY3kvMjAxNC8wMi90aW0tYmVybmVycy1sZWUt d2UtbmVlZC10by1yZS1kZWNlbnRyYWxpemUtdGhlLXdlYi8pPj4KL1N1YnR5cGUvTGluaz4+ZW5k b2JqCjI5MSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMzQyLjk2MiA0NjQuMTQg MzUzLjg1Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2dpem1vZG8u Y29tL3RoZS13ZWItcy1jcmVhdG9yLW5vdy13YW50cy10by11bmZ1Y2staXQtMTc4MTI2MDU1OSk+ PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjkyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzEx Ny40MiAzMzEuMDgyIDE5Ni44NCAzNDEuOTcyXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQov VVJJKGh0dHBzOi8vZ2l6bW9kby5jb20vdGhlLXdlYi1zLWNyZWF0b3Itbm93LXdhbnRzLXRvLXVu ZnVjay1pdC0xNzgxMjYwNTU5KT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoyOTMgMCBvYmoKPDwv VHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDMwNy4zMjIgNDkzLjg0IDMxOC4yMTJdCi9Cb3JkZXIg WzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93d3cubnl0aW1lcy5jb20vMjAxNi8wNi8w OC90ZWNobm9sb2d5L3RoZS13ZWJzLWNyZWF0b3ItbG9va3MtdG8tcmVpbnZlbnQtaXQuaHRtbCk+ PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjk0IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzEx Ny40MiAyOTUuNDQyIDI2OC4xMiAzMDYuMzMyXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQov VVJJKGh0dHBzOi8vd3d3Lm55dGltZXMuY29tLzIwMTYvMDYvMDgvdGVjaG5vbG9neS90aGUtd2Vi cy1jcmVhdG9yLWxvb2tzLXRvLXJlaW52ZW50LWl0Lmh0bWwpPj4KL1N1YnR5cGUvTGluaz4+ZW5k b2JqCjI5NSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMjcxLjY4MiA0ODEuOTYg MjgyLjU3Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2Jsb2cuYXJj aGl2ZS5vcmcvMjAxNi8wNi8xNi9kZWNlbnRyYWxpemVkLXdlYi1zdW1taXQtd2l0aC10aW0tYmVy bmVycy1sZWUtdmludC1jZXJmLWFuZC1wb2x5ZmlsbC8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2Jq CjI5NiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMjU5LjgwMiAzODAuOTggMjcw LjY5Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2Jsb2cuYXJjaGl2 ZS5vcmcvMjAxNi8wNi8xNi9kZWNlbnRyYWxpemVkLXdlYi1zdW1taXQtd2l0aC10aW0tYmVybmVy cy1sZWUtdmludC1jZXJmLWFuZC1wb2x5ZmlsbC8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjI5 NyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMjM2LjA0MiA0OTkuNzggMjQ2Ljkz Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3NwZWN0cnVtLmllZWUu b3JnL3ZpZXctZnJvbS10aGUtdmFsbGV5L3RlbGVjb20vaW50ZXJuZXQvYnJld3N0ZXIta2FobGUt b24td2hhdHMtbmV4dC1mb3ItdGhlLWRlY2VudHJhbGl6ZWQtd2ViLW1vdmVtZW50KT4+Ci9TdWJ0 eXBlL0xpbms+PmVuZG9iagoyOTggMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDIy NC4xNjIgNDkzLjg0IDIzNS4wNTJdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0 cHM6Ly9zcGVjdHJ1bS5pZWVlLm9yZy92aWV3LWZyb20tdGhlLXZhbGxleS90ZWxlY29tL2ludGVy bmV0L2JyZXdzdGVyLWthaGxlLW9uLXdoYXRzLW5leHQtZm9yLXRoZS1kZWNlbnRyYWxpemVkLXdl Yi1tb3ZlbWVudCk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMjk5IDAgb2JqCjw8L1R5cGUvQW5u b3QKL1JlY3QgWzExNy40MiAyMDAuNDAyIDMzOS40IDIxMS4yOTJdCi9Cb3JkZXIgWzAgMCAwXQov QTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9kY2kubWl0LmVkdS9kZWNlbnRyYWxpemVkd2ViLyk+Pgov U3VidHlwZS9MaW5rPj5lbmRvYmoKMzAwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40 MiAxNzYuNjQxIDI5MS44OCAxODcuNTMxXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJ KGh0dHBzOi8vZGVjZW50cmFsaXplZHdlYi5uZXQvKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoz MDEgMCBvYmoKPDwvUjcKNyAwIFI+PgplbmRvYmoKMzAyIDAgb2JqCjw8L1I5CjkgMCBSPj4KZW5k b2JqCjMwNiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDc3MC42NDUgNzguMDQgNzgx LjUzNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzYyCi9TdWJ0eXBlL0xpbms+PmVuZG9iagozMDcg MCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDcyMy4xMjUgNDM0LjQ0IDczNC4wMTVd Ci9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly90b29scy5pZXRmLm9yZy9o dG1sL2RyYWZ0LWFya2tvLWlhYi1pbnRlcm5ldC1jb25zb2xpZGF0aW9uLTAwKT4+Ci9TdWJ0eXBl L0xpbms+PmVuZG9iagozMDggMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDcxMS4y NDUgMjE0LjY2IDcyMi4xMzVdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6 Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWFya2tvLWlhYi1pbnRlcm5ldC1jb25zb2xpZGF0 aW9uLTAwKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozMDkgMCBvYmoKPDwvVHlwZS9Bbm5vdAov UmVjdCBbMTE3LjQyIDY4Ny40ODUgMzU3LjIyIDY5OC4zNzVdCi9Cb3JkZXIgWzAgMCAwXQovQTw8 L1MvVVJJCi9VUkkoaHR0cHM6Ly93d3cuaWV0Zi5vcmcvYmxvZy9jb25zb2xpZGF0aW9uLyk+Pgov U3VidHlwZS9MaW5rPj5lbmRvYmoKMzEwIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40 MiA2NjMuNzI1IDQ2NC4xNCA2NzQuNjE1XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJ KGh0dHBzOi8vd3d3LmludGVybmV0c29jaWV0eS5vcmcvZ2xvYmFsaW50ZXJuZXRyZXBvcnQvMjAx OC9jb25jZXB0LW5vdGUvKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozMTEgMCBvYmoKPDwvVHlw ZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDY1MS44NDUgMTk2Ljg0IDY2Mi43MzVdCi9Cb3JkZXIgWzAg MCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93d3cuaW50ZXJuZXRzb2NpZXR5Lm9yZy9nbG9i YWxpbnRlcm5ldHJlcG9ydC8yMDE4L2NvbmNlcHQtbm90ZS8pPj4KL1N1YnR5cGUvTGluaz4+ZW5k b2JqCjMxMiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgNjI4LjA4NCA0NTguMiA2 MzguOTc0XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vd3d3LmludGVy bmV0c29jaWV0eS5vcmcvYmxvZy8yMDE4LzEyL2Rucy1wcml2YWN5LXN1cHBvcnQtaW4tbW96aWxs YS1maXJlZm94Lyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzEzIDAgb2JqCjw8L1R5cGUvQW5u b3QKL1JlY3QgWzExNy40MiA2MTYuMjA0IDI4MCA2MjcuMDk0XQovQm9yZGVyIFswIDAgMF0KL0E8 PC9TL1VSSQovVVJJKGh0dHBzOi8vd3d3LmludGVybmV0c29jaWV0eS5vcmcvYmxvZy8yMDE4LzEy L2Rucy1wcml2YWN5LXN1cHBvcnQtaW4tbW96aWxsYS1maXJlZm94Lyk+PgovU3VidHlwZS9MaW5r Pj5lbmRvYmoKMzE0IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40MiA1OTIuNDQ0IDMw OS43IDYwMy4zMzRdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93d3cu d29ybGRpcHY2bGF1bmNoLm9yZy8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjMxNSAwIG9iago8 PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgNTY4LjY4NCAyOTcuODIgNTc5LjU3NF0KL0JvcmRl ciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9X b3JsZF9JUHY2X0RheV9hbmRfV29ybGRfSVB2Nl9MYXVuY2hfRGF5KT4+Ci9TdWJ0eXBlL0xpbms+ PmVuZG9iagozMTYgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDU1Ni44MDQgMzU3 LjIyIDU2Ny42OTRdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9lbi53 aWtpcGVkaWEub3JnL3dpa2kvV29ybGRfSVB2Nl9EYXlfYW5kX1dvcmxkX0lQdjZfTGF1bmNoX0Rh eSk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzE3IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3Qg WzExNy40MiA1MzMuMDQ0IDQ5My44NCA1NDMuOTM0XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VS SQovVVJJKGh0dHBzOi8vZW5naW5lZXJpbmcubGlua2VkaW4uY29tL2Jsb2cvMjAxOC8wNi9jZWxl YnJhdGluZy1pcHY2LWxhdW5jaC1kYXkpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjMxOCAwIG9i ago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgNTIxLjE2NCAxNzkuMDIgNTMyLjA1NF0KL0Jv cmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2VuZ2luZWVyaW5nLmxpbmtlZGlu LmNvbS9ibG9nLzIwMTgvMDYvY2VsZWJyYXRpbmctaXB2Ni1sYXVuY2gtZGF5KT4+Ci9TdWJ0eXBl L0xpbms+PmVuZG9iagozMTkgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDQ5Ny40 MDQgMzYzLjE2IDUwOC4yOTNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cDov L3d3dy5kbnNzZWMtZGVwbG95bWVudC5vcmcvaGlzdG9yeS8pPj4KL1N1YnR5cGUvTGluaz4+ZW5k b2JqCjMyMCAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgNDczLjY0MyA0ODEuOTYg NDg0LjUzM10KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3d3dy5pbnRl cm5ldHNvY2lldHkub3JnL2Jsb2cvMjAxOS8wMi9mdXR1cmUtdGhpbmtpbmctYWxpc3NhLWNvb3Bl ci10ZWNobmljYWwtaW1wYWN0LWludGVybmV0LWNvbnNvbGlkYXRpb24vKT4+Ci9TdWJ0eXBlL0xp bms+PmVuZG9iagozMjEgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDQ2MS43NjMg NDQwLjM4IDQ3Mi42NTNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93 d3cuaW50ZXJuZXRzb2NpZXR5Lm9yZy9ibG9nLzIwMTkvMDIvZnV0dXJlLXRoaW5raW5nLWFsaXNz YS1jb29wZXItdGVjaG5pY2FsLWltcGFjdC1pbnRlcm5ldC1jb25zb2xpZGF0aW9uLyk+PgovU3Vi dHlwZS9MaW5rPj5lbmRvYmoKMzIyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40MiA0 MzguMDAzIDQ0Ni4zMiA0NDguODkzXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0 dHBzOi8vYmxvZy5jbG91ZGZsYXJlLmNvbS90b2RheS13ZS1taXRpZ2F0ZWQtMS0xLTEtMS8pPj4K L1N1YnR5cGUvTGluaz4+ZW5kb2JqCjMyMyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcu NDIgNDE0LjI0MyA0NzAuMDggNDI1LjEzM10KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VS SShodHRwczovL2R5bi5jb20vYmxvZy9keW4tc3RhdGVtZW50LW9uLTEwMjEyMDE2LWRkb3MtYXR0 YWNrLyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzI0IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1Jl Y3QgWzExNy40MiAzOTAuNDgzIDQzNC40NCA0MDEuMzczXQovQm9yZGVyIFswIDAgMF0KL0E8PC9T L1VSSQovVVJJKGh0dHBzOi8vd3d3Lmhicy5lZHUvZmFjdWx0eS9QYWdlcy9pdGVtLmFzcHg/bnVt PTUzODMwKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozMjUgMCBvYmoKPDwvVHlwZS9Bbm5vdAov UmVjdCBbMTE3LjQyIDM2Ni43MjMgNDU4LjIgMzc3LjYxM10KL0JvcmRlciBbMCAwIDBdCi9BPDwv Uy9VUkkKL1VSSShodHRwczovL3d3dy5pbnRlcm5ldHNvY2lldHkub3JnL2Jsb2cvMjAxOC8wNS93 aGF0LWlzLWJncC1oaWphY2tpbmctYW55d2F5Lyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzI2 IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40MiAzNTQuODQzIDIyMC42IDM2NS43MzNd Ci9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93d3cuaW50ZXJuZXRzb2Np ZXR5Lm9yZy9ibG9nLzIwMTgvMDUvd2hhdC1pcy1iZ3AtaGlqYWNraW5nLWFueXdheS8pPj4KL1N1 YnR5cGUvTGluaz4+ZW5kb2JqCjMyNyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIg MzMxLjA4MiA0NzYuMDIgMzQxLjk3Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSSho dHRwczovL2ZyZWVkb20tdG8tdGlua2VyLmNvbS8yMDE4LzA0LzExL3JvdXRpbmctYXR0YWNrcy1v bi1pbnRlcm5ldC1zZXJ2aWNlcy8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjMyOCAwIG9iago8 PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMzE5LjIwMiAyMjYuNTQgMzMwLjA5Ml0KL0JvcmRl ciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2ZyZWVkb20tdG8tdGlua2VyLmNvbS8y MDE4LzA0LzExL3JvdXRpbmctYXR0YWNrcy1vbi1pbnRlcm5ldC1zZXJ2aWNlcy8pPj4KL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjMyOSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMjk1 LjQ0MiA0NDYuMzIgMzA2LjMzMl0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRw czovL3d3dy5jc29vbmxpbmUuY29tL2FydGljbGUvMzMyMDk5Ni9wb3NzaWJsZS1iZ3AtaGlqYWNr aW5nLXRha2VzLWdvb2dsZS1kb3duLmh0bWwpPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjMzMCAw IG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMjgzLjU2MiAzMDkuNyAyOTQuNDUyXQov Qm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vd3d3LmNzb29ubGluZS5jb20v YXJ0aWNsZS8zMzIwOTk2L3Bvc3NpYmxlLWJncC1oaWphY2tpbmctdGFrZXMtZ29vZ2xlLWRvd24u aHRtbCk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzMxIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1Jl Y3QgWzExNy40MiAyNTkuODAyIDQ5My44NCAyNzAuNjkyXQovQm9yZGVyIFswIDAgMF0KL0E8PC9T L1VSSQovVVJJKGh0dHBzOi8vd3d3LnpkbmV0LmNvbS9hcnRpY2xlL3BlcnNpYW4tc3RhbGtlci1n cmF5d2FyZS10YXJnZXRzLXRlbGVncmFtLWluc3RhZ3JhbS11c2Vycy8pPj4KL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjMzMiAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMjQ3LjkyMiAy NjguMTIgMjU4LjgxMl0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3d3 dy56ZG5ldC5jb20vYXJ0aWNsZS9wZXJzaWFuLXN0YWxrZXItZ3JheXdhcmUtdGFyZ2V0cy10ZWxl Z3JhbS1pbnN0YWdyYW0tdXNlcnMvKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozMzMgMCBvYmoK PDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDIyNC4xNjIgNDQ2LjMyIDIzNS4wNTJdCi9Cb3Jk ZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20vaW5mb3Jt YXRpb24tdGVjaG5vbG9neS8yMDE4LzA0L3N1c3BpY2lvdXMtZXZlbnQtaGlqYWNrcy1hbWF6b24t dHJhZmZpYy1mb3ItMi1ob3Vycy1zdGVhbHMtKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozMzQg MCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDIxMi4yODIgNDcwLjA4IDIyMy4xNzJd Ci9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9hcnN0ZWNobmljYS5jb20v aW5mb3JtYXRpb24tdGVjaG5vbG9neS8yMDE4LzA0L3N1c3BpY2lvdXMtZXZlbnQtaGlqYWNrcy1h bWF6b24tdHJhZmZpYy1mb3ItMi1ob3Vycy1zdGVhbHMtKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9i agozMzUgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDE3Ni42NDEgMzM5LjQgMTg3 LjUzMV0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL3NlcnZpY2VzLmdv b2dsZS5jb20vZmgvZmlsZXMvYmxvZ3MvM3ZlX2dvb2dsZV93aGl0ZW9wc193aGl0ZXBhcGVyX2Zp bmFsX25vdl8yMDE4LnBkZik+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzM2IDAgb2JqCjw8L1R5 cGUvQW5ub3QKL1JlY3QgWzExNy40MiAxNjQuNzYxIDQ0Ni4zMiAxNzUuNjUxXQovQm9yZGVyIFsw IDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vc2VydmljZXMuZ29vZ2xlLmNvbS9maC9maWxl cy9ibG9ncy8zdmVfZ29vZ2xlX3doaXRlb3BzX3doaXRlcGFwZXJfZmluYWxfbm92XzIwMTgucGRm KT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozMzcgMCBvYmoKPDwvUjcKNyAwIFI+PgplbmRvYmoK MzM4IDAgb2JqCjw8L1I5CjkgMCBSPj4KZW5kb2JqCjM0MiAwIG9iago8PC9UeXBlL0Fubm90Ci9S ZWN0IFs2OS45IDc3MC42NDUgNzguMDQgNzgxLjUzNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0Lzgx Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNDMgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3 LjQyIDcyMy4xMjUgNDcwLjA4IDczNC4wMTVdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9V UkkoaHR0cHM6Ly9keW4uY29tL2Jsb2cvZHluLXN0YXRlbWVudC1vbi0xMDIxMjAxNi1kZG9zLWF0 dGFjay8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjM0NCAwIG9iago8PC9UeXBlL0Fubm90Ci9S ZWN0IFsxMTcuNDIgNjk5LjM2NSAzODAuOTggNzEwLjI1NV0KL0JvcmRlciBbMCAwIDBdCi9BPDwv Uy9VUkkKL1VSSShodHRwczovL2llZWV4cGxvcmUuaWVlZS5vcmcvZG9jdW1lbnQvNDc2ODY0OCk+ PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzQ1IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzEx Ny40MiA2NzUuNjA1IDQzNC40NCA2ODYuNDk1XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQov VVJJKGh0dHBzOi8vZnJlZWRvbS10by10aW5rZXIuY29tLzIwMDQvMDIvMTkvbW9ub2N1bHR1cmUv KT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNDYgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBb MTE3LjQyIDY1MS44NDUgMzc1LjA0IDY2Mi43MzVdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJ Ci9VUkkoaHR0cHM6Ly93d3cubm9taW5ldC51ay90aGUtcGFja2V0LW9mLWRlYXRoLyk+PgovU3Vi dHlwZS9MaW5rPj5lbmRvYmoKMzQ3IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40MiA2 MjguMDg0IDMyNy41MiA2MzguOTc0XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0 dHBzOi8vZ2l0aHViLmNvbS9TcGlkZXJMYWJzL0RvSEMyKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9i agozNDggMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDYwNC4zMjQgNDc2LjAyIDYx NS4yMTRdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9ibG9nLm5pZ2h0 bHkubW96aWxsYS5vcmcvMjAxOC8wOC8yOC9maXJlZm94LW5pZ2h0bHktc2VjdXJlLWRucy1leHBl cmltZW50YWwtcmVzdWx0cy8pPj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjM0OSAwIG9iago8PC9U eXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgNTkyLjQ0NCAzMDkuNyA2MDMuMzM0XQovQm9yZGVyIFsw IDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vYmxvZy5uaWdodGx5Lm1vemlsbGEub3JnLzIw MTgvMDgvMjgvZmlyZWZveC1uaWdodGx5LXNlY3VyZS1kbnMtZXhwZXJpbWVudGFsLXJlc3VsdHMv KT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNTAgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBb MTE3LjQyIDU2OC42ODQgMzY5LjEgNTc5LjU3NF0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkK L1VSSShodHRwczovL3VrLm5vcnRvbi5jb20vbm9ydG9uLWJsb2cvMjAxNi8xMi93aGF0X2lzX3Nw ZWFyX3BoaXNoaS5odG1sKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNTEgMCBvYmoKPDwvVHlw ZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDU1Ni44MDQgMjY4LjEyIDU2Ny42OTRdCi9Cb3JkZXIgWzAg MCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly91ay5ub3J0b24uY29tL25vcnRvbi1ibG9nLzIw MTYvMTIvd2hhdF9pc19zcGVhcl9waGlzaGkuaHRtbCk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoK MzUyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzExNy40MiA1MzMuMDQ0IDQ3MC4wOCA1NDMu OTM0XQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBzOi8vd3d3LmZpcmVleWUu Y29tL2N1cnJlbnQtdGhyZWF0cy9hbmF0b215LW9mLWEtY3liZXItYXR0YWNrLmh0bWwpPj4KL1N1 YnR5cGUvTGluaz4+ZW5kb2JqCjM1MyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIg NTIxLjE2NCAxODQuOTYgNTMyLjA1NF0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSSho dHRwczovL3d3dy5maXJlZXllLmNvbS9jdXJyZW50LXRocmVhdHMvYW5hdG9teS1vZi1hLWN5YmVy LWF0dGFjay5odG1sKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNTQgMCBvYmoKPDwvVHlwZS9B bm5vdAovUmVjdCBbMTE3LjQyIDQ5Ny40MDQgMzkyLjg2IDUwOC4yOTNdCi9Cb3JkZXIgWzAgMCAw XQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy93Zy9jYXBwb3J0 L2Fib3V0Lyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzU1IDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzExNy40MiA0NzMuNjQzIDQ1OC4yIDQ4NC41MzNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8 L1MvVVJJCi9VUkkoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQtaWV0Zi1k b2gtcmVzb2x2ZXItYXNzb2NpYXRlZC1kb2gvKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNTYg MCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDQ2MS43NjMgMjA4LjcyIDQ3Mi42NTNd Ci9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRm Lm9yZy9kb2MvZHJhZnQtaWV0Zi1kb2gtcmVzb2x2ZXItYXNzb2NpYXRlZC1kb2gvKT4+Ci9TdWJ0 eXBlL0xpbms+PmVuZG9iagozNTcgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDQz OC4wMDMgMzg2LjkyIDQ0OC44OTNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0 cHM6Ly93d3cud29ybGRpcHY2bGF1bmNoLm9yZy9tZWFzdXJlbWVudHMvKT4+Ci9TdWJ0eXBlL0xp bms+PmVuZG9iagozNTggMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDQxNC4yNDMg MzE1LjY0IDQyNS4xMzNdCi9Cb3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93 d3cuaWNhbm4ub3JnL2dyb3Vwcy9zc2FjKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagozNTkgMCBv YmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDM5MC40ODMgMzIxLjU4IDQwMS4zNzNdCi9C b3JkZXIgWzAgMCAwXQovQTw8L1MvVVJJCi9VUkkoaHR0cHM6Ly93d3cuaWNhbm4ub3JnL2dyb3Vw cy9yc3NhYyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzYwIDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzExNy40MiAzNjYuNzIzIDQ2NC4xNCAzNzcuNjEzXQovQm9yZGVyIFswIDAgMF0KL0E8 PC9TL1VSSQovVVJJKGh0dHBzOi8vbmV3Z3RsZHMuaWNhbm4ub3JnL3NpdGVzL2RlZmF1bHQvZmls ZXMvYWdyZWVtZW50cy9hZ3JlZW1lbnQtYXBwcm92ZWQtMzFqdWwxNy1lbi5wZGYpPj4KL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjM2MSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMzU0 Ljg0MyAzMTUuNjQgMzY1LjczM10KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRw czovL25ld2d0bGRzLmljYW5uLm9yZy9zaXRlcy9kZWZhdWx0L2ZpbGVzL2FncmVlbWVudHMvYWdy ZWVtZW50LWFwcHJvdmVkLTMxanVsMTctZW4ucGRmKT4+Ci9TdWJ0eXBlL0xpbms+PmVuZG9iagoz NjIgMCBvYmoKPDwvVHlwZS9Bbm5vdAovUmVjdCBbMTE3LjQyIDMzMS4wODIgNDg3LjkgMzQxLjk3 Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkKL1VSSShodHRwczovL2Jsb2cuYXBuaWMubmV0 LzIwMTgvMDgvMTcvc3VucmlzZS1kbnMtb3Zlci10bHMtc3Vuc2V0LWRuc3NlYy8pPj4KL1N1YnR5 cGUvTGluaz4+ZW5kb2JqCjM2MyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsxMTcuNDIgMzE5 LjIwMiAxNjEuMiAzMzAuMDkyXQovQm9yZGVyIFswIDAgMF0KL0E8PC9TL1VSSQovVVJJKGh0dHBz Oi8vYmxvZy5hcG5pYy5uZXQvMjAxOC8wOC8xNy9zdW5yaXNlLWRucy1vdmVyLXRscy1zdW5zZXQt ZG5zc2VjLyk+PgovU3VidHlwZS9MaW5rPj5lbmRvYmoKMzY0IDAgb2JqCjw8L1R5cGUvQW5ub3QK L1JlY3QgWzExNy40MiAyOTUuNDQyIDQ1OC4yIDMwNi4zMzJdCi9Cb3JkZXIgWzAgMCAwXQovQTw8 L1MvVVJJCi9VUkkoaHR0cHM6Ly93d3cuaWNhbm4ub3JnL2VuL3N5c3RlbS9maWxlcy9maWxlcy9w cmVzZW50YXRpb24tc3VucmlzZS1kbnMtdGxzLXN1bnNldC1kbnNzZWMtMTNqdWwxOC1lbi5wZGYp Pj4KL1N1YnR5cGUvTGluaz4+ZW5kb2JqCjM2NSAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFsx MTcuNDIgMjgzLjU2MiAzODAuOTggMjk0LjQ1Ml0KL0JvcmRlciBbMCAwIDBdCi9BPDwvUy9VUkkK L1VSSShodHRwczovL3d3dy5pY2Fubi5vcmcvZW4vc3lzdGVtL2ZpbGVzL2ZpbGVzL3ByZXNlbnRh dGlvbi1zdW5yaXNlLWRucy10bHMtc3Vuc2V0LWRuc3NlYy0xM2p1bDE4LWVuLnBkZik+PgovU3Vi dHlwZS9MaW5rPj5lbmRvYmoKMzY2IDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgMjU5 LjgwMiAxMzEuNSAyNzAuNjkyXQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvOTgKL1N1YnR5cGUvTGlu az4+ZW5kb2JqCjM2NyAwIG9iago8PC9SNwo3IDAgUj4+CmVuZG9iagozNjggMCBvYmoKPDwvUjkK OSAwIFI+PgplbmRvYmoKMzcyIDAgb2JqCjw8L1R5cGUvQW5ub3QKL1JlY3QgWzY5LjkgNzcwLjY0 NSA3OC4wNCA3ODEuNTM1XQovQm9yZGVyIFswIDAgMF0KL0Rlc3QvOTkKL1N1YnR5cGUvTGluaz4+ ZW5kb2JqCjM3MyAwIG9iago8PC9UeXBlL0Fubm90Ci9SZWN0IFs2OS45IDcyMy4xMjUgMTMxLjUg NzM0LjAxNV0KL0JvcmRlciBbMCAwIDBdCi9EZXN0LzEwMAovU3VidHlwZS9MaW5rPj5lbmRvYmoK Mzc0IDAgb2JqCjw8L1I3CjcgMCBSPj4KZW5kb2JqCjM3NSAwIG9iago8PC9SOQo5IDAgUj4+CmVu ZG9iago5IDAgb2JqCjw8L0Jhc2VGb250L0NvdXJpZXIvVHlwZS9Gb250Ci9FbmNvZGluZyAzNzYg MCBSL1N1YnR5cGUvVHlwZTE+PgplbmRvYmoKMzc2IDAgb2JqCjw8L1R5cGUvRW5jb2RpbmcvRGlm ZmVyZW5jZXNbCjEyOS9wYXJlbmxlZnQvcGFyZW5yaWdodF0+PgplbmRvYmoKOCAwIG9iago8PC8w IFs0IDAgUiAvWFlaIC00IDg0MiBudWxsXQovMSBbNCAwIFIgL1hZWiAtNCA4NDIgbnVsbF0KLzIg WzE3IDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi8zIFsxNyAwIFIgL1hZWiAtNCAzNjkuMTk3NTQg bnVsbF0KLzQgWzE3IDAgUiAvWFlaIC00IDI1MC4zOTY3OSBudWxsXQovNSBbNjQgMCBSIC9YWVog LTQgNzg1LjAgbnVsbF0KLzYgWzY0IDAgUiAvWFlaIC00IDYzMC41NTkzMjYgbnVsbF0KLzcgWzY0 IDAgUiAvWFlaIC00IDIzOC41MTY2NjMgbnVsbF0KLzggWzc2IDAgUiAvWFlaIC00IDc4NS4wIG51 bGxdCi85IFs3NiAwIFIgL1hZWiAtNCA2MzAuNTU5MzI2IG51bGxdCi8xMCBbOTYgMCBSIC9YWVog LTQgNzg1LjAgbnVsbF0KLzExIFs5NiAwIFIgL1hZWiAtNCA0NjQuMjM4MTU5IG51bGxdCi8xMiBb OTYgMCBSIC9YWVogLTQgMjk3LjkxNzA4NCBudWxsXQovMTMgWzExNSAwIFIgL1hZWiAtNCA3ODUu MCBudWxsXQovMTQgWzExNSAwIFIgL1hZWiAtNCAyMjYuNjM2NTk3IG51bGxdCi8xNSBbMTIzIDAg UiAvWFlaIC00IDc4NS4wIG51bGxdCi8xNiBbMTMyIDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi8x NyBbMTQ1IDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi8xOCBbMTUzIDAgUiAvWFlaIC00IDc4NS4w IG51bGxdCi8xOSBbMTYzIDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi8yMCBbMTc1IDAgUiAvWFla IC00IDc4NS4wIG51bGxdCi8yMSBbMTgzIDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi8yMiBbMTkx IDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi8yMyBbMTkxIDAgUiAvWFlaIC00IDYxOC42Nzk2MjYg bnVsbF0KLzI0IFsxOTkgMCBSIC9YWVogLTQgNzg1LjAgbnVsbF0KLzI1IFsxOTkgMCBSIC9YWVog LTQgNDE2LjcxOTAyNSBudWxsXQovMjYgWzIxMCAwIFIgL1hZWiAtNCA3ODUuMCBudWxsXQovMjcg WzIxOCAwIFIgL1hZWiAtNCA3ODUuMCBudWxsXQovMjggWzIyOCAwIFIgL1hZWiAtNCA3ODUuMCBu dWxsXQovMjkgWzIzNiAwIFIgL1hZWiAtNCA3ODUuMCBudWxsXQovMzAgWzIzNiAwIFIgL1hZWiAt NCA1MTEuNzU4OTExIG51bGxdCi8zMSBbMjM2IDAgUiAvWFlaIC00IDQwNC44MzgxNjUgbnVsbF0K LzMyIFsyMzYgMCBSIC9YWVogLTQgMzMzLjU1NzcwOSBudWxsXQovMzMgWzIzNiAwIFIgL1hZWiAt NCAyMjYuNjM3MDI0IG51bGxdCi8zNCBbMjQ5IDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi8zNSBb MjQ5IDAgUiAvWFlaIC00IDY1NC4zMTk0NTggbnVsbF0KLzM2IFsyNDkgMCBSIC9YWVogLTQgNjMw LjU1OTMyNiBudWxsXQovMzcgWzI0OSAwIFIgL1hZWiAtNCA2MDYuNzk5MTMzIG51bGxdCi8zOCBb MjQ5IDAgUiAvWFlaIC00IDU0Ny4zOTg3NDMgbnVsbF0KLzM5IFsyNDkgMCBSIC9YWVogLTQgNDg3 Ljk5ODM1MiBudWxsXQovNDAgWzI0OSAwIFIgL1hZWiAtNCA0MjguNTk3OTMxIG51bGxdCi80MSBb MjQ5IDAgUiAvWFlaIC00IDM2OS4xOTc1NCBudWxsXQovNDIgWzI0OSAwIFIgL1hZWiAtNCAzMDku Nzk3MTggbnVsbF0KLzQzIFsyNDkgMCBSIC9YWVogLTQgMjYyLjI3Njg1NSBudWxsXQovNDQgWzI2 NyAwIFIgL1hZWiAtNCA3ODUuMCBudWxsXQovNDUgWzI2NyAwIFIgL1hZWiAtNCA3MzcuNDggbnVs bF0KLzQ2IFsyNjcgMCBSIC9YWVogLTQgNzEzLjcxOTg0OSBudWxsXQovNDcgWzI2NyAwIFIgL1hZ WiAtNCA2ODkuOTU5NzE3IG51bGxdCi80OCBbMjY3IDAgUiAvWFlaIC00IDY1NC4zMTk0NTggbnVs bF0KLzQ5IFsyNjcgMCBSIC9YWVogLTQgNjE4LjY3OTE5OSBudWxsXQovNTAgWzI2NyAwIFIgL1hZ WiAtNCA1ODMuMDM5IG51bGxdCi81MSBbMjY3IDAgUiAvWFlaIC00IDU0Ny4zOTg3NDMgbnVsbF0K LzUyIFsyNjcgMCBSIC9YWVogLTQgNTExLjc1ODUxNCBudWxsXQovNTMgWzI2NyAwIFIgL1hZWiAt NCA0NzYuMTE4MjU2IG51bGxdCi81NCBbMjY3IDAgUiAvWFlaIC00IDQ0MC40NzgwMjcgbnVsbF0K LzU1IFsyNjcgMCBSIC9YWVogLTQgMzkyLjk1NzcwMyBudWxsXQovNTYgWzI2NyAwIFIgL1hZWiAt NCAzNTcuMzE3NDc0IG51bGxdCi81NyBbMjY3IDAgUiAvWFlaIC00IDMyMS42NzcyNDYgbnVsbF0K LzU4IFsyNjcgMCBSIC9YWVogLTQgMjg2LjAzNyBudWxsXQovNTkgWzI2NyAwIFIgL1hZWiAtNCAy NTAuMzk2NzkgbnVsbF0KLzYwIFsyNjcgMCBSIC9YWVogLTQgMjE0Ljc1NjUzMSBudWxsXQovNjEg WzI2NyAwIFIgL1hZWiAtNCAxOTAuOTk2MzM4IG51bGxdCi82MiBbMzAzIDAgUiAvWFlaIC00IDc4 NS4wIG51bGxdCi82MyBbMzAzIDAgUiAvWFlaIC00IDczNy40OCBudWxsXQovNjQgWzMwMyAwIFIg L1hZWiAtNCA3MDEuODM5NzgzIG51bGxdCi82NSBbMzAzIDAgUiAvWFlaIC00IDY3OC4wNzk1OSBu dWxsXQovNjYgWzMwMyAwIFIgL1hZWiAtNCA2NDIuNDM5MzMxIG51bGxdCi82NyBbMzAzIDAgUiAv WFlaIC00IDYwNi43OTkxMzMgbnVsbF0KLzY4IFszMDMgMCBSIC9YWVogLTQgNTgzLjAzOSBudWxs XQovNjkgWzMwMyAwIFIgL1hZWiAtNCA1NDcuMzk4NzQzIG51bGxdCi83MCBbMzAzIDAgUiAvWFla IC00IDUxMS43NTg1MTQgbnVsbF0KLzcxIFszMDMgMCBSIC9YWVogLTQgNDg3Ljk5ODM1MiBudWxs XQovNzIgWzMwMyAwIFIgL1hZWiAtNCA0NTIuMzU4MTI0IG51bGxdCi83MyBbMzAzIDAgUiAvWFla IC00IDQyOC41OTc5MzEgbnVsbF0KLzc0IFszMDMgMCBSIC9YWVogLTQgNDA0LjgzNzc5OSBudWxs XQovNzUgWzMwMyAwIFIgL1hZWiAtNCAzODEuMDc3NjM3IG51bGxdCi83NiBbMzAzIDAgUiAvWFla IC00IDM0NS40Mzc0MDggbnVsbF0KLzc3IFszMDMgMCBSIC9YWVogLTQgMzA5Ljc5NzE4IG51bGxd Ci83OCBbMzAzIDAgUiAvWFlaIC00IDI3NC4xNTY5NTIgbnVsbF0KLzc5IFszMDMgMCBSIC9YWVog LTQgMjM4LjUxNjY2MyBudWxsXQovODAgWzMwMyAwIFIgL1hZWiAtNCAxOTAuOTk2MzM4IG51bGxd Ci84MSBbMzM5IDAgUiAvWFlaIC00IDc4NS4wIG51bGxdCi84MiBbMzM5IDAgUiAvWFlaIC00IDcz Ny40OCBudWxsXQovODMgWzMzOSAwIFIgL1hZWiAtNCA3MTMuNzE5ODQ5IG51bGxdCi84NCBbMzM5 IDAgUiAvWFlaIC00IDY4OS45NTk3MTcgbnVsbF0KLzg1IFszMzkgMCBSIC9YWVogLTQgNjY2LjE5 OTUyNCBudWxsXQovODYgWzMzOSAwIFIgL1hZWiAtNCA2NDIuNDM5MzMxIG51bGxdCi84NyBbMzM5 IDAgUiAvWFlaIC00IDYxOC42NzkxOTkgbnVsbF0KLzg4IFszMzkgMCBSIC9YWVogLTQgNTgzLjAz OSBudWxsXQovODkgWzMzOSAwIFIgL1hZWiAtNCA1NDcuMzk4NzQzIG51bGxdCi85MCBbMzM5IDAg UiAvWFlaIC00IDUxMS43NTg1MTQgbnVsbF0KLzkxIFszMzkgMCBSIC9YWVogLTQgNDg3Ljk5ODM1 MiBudWxsXQovOTIgWzMzOSAwIFIgL1hZWiAtNCA0NTIuMzU4MTI0IG51bGxdCi85MyBbMzM5IDAg UiAvWFlaIC00IDQyOC41OTc5MzEgbnVsbF0KLzk0IFszMzkgMCBSIC9YWVogLTQgNDA0LjgzNzc5 OSBudWxsXQovOTUgWzMzOSAwIFIgL1hZWiAtNCAzODEuMDc3NjM3IG51bGxdCi85NiBbMzM5IDAg UiAvWFlaIC00IDM0NS40Mzc0MDggbnVsbF0KLzk3IFszMzkgMCBSIC9YWVogLTQgMzA5Ljc5NzE4 IG51bGxdCi85OCBbMzM5IDAgUiAvWFlaIC00IDI3NC4xNTY5NTIgbnVsbF0KLzk5IFszNjkgMCBS IC9YWVogLTQgNzg1LjAgbnVsbF0KLzEwMCBbMzY5IDAgUiAvWFlaIC00IDczNy40OCBudWxsXT4+ ZW5kb2JqCjM3NyAwIG9iago8PC9UeXBlL01ldGFkYXRhCi9TdWJ0eXBlL1hNTC9MZW5ndGggMTY2 Nz4+c3RyZWFtCjw/eHBhY2tldCBiZWdpbj0n77u/JyBpZD0nVzVNME1wQ2VoaUh6cmVTek5UY3pr YzlkJz8+Cjw/YWRvYmUteGFwLWZpbHRlcnMgZXNjPSJDUkxGIj8+Cjx4OnhtcG1ldGEgeG1sbnM6 eD0nYWRvYmU6bnM6bWV0YS8nIHg6eG1wdGs9J1hNUCB0b29sa2l0IDIuOS4xLTEzLCBmcmFtZXdv cmsgMS42Jz4KPHJkZjpSREYgeG1sbnM6cmRmPSdodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIy LXJkZi1zeW50YXgtbnMjJyB4bWxuczppWD0naHR0cDovL25zLmFkb2JlLmNvbS9pWC8xLjAvJz4K PHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9J3V1aWQ6Njk1ZGI1MjQtN2EyMy0xMWY0LTAwMDAt MWVkM2FiMzZjNWZhJyB4bWxuczpwZGY9J2h0dHA6Ly9ucy5hZG9iZS5jb20vcGRmLzEuMy8nPjxw ZGY6UHJvZHVjZXI+R1BMIEdob3N0c2NyaXB0IDkuMDU8L3BkZjpQcm9kdWNlcj4KPHBkZjpLZXl3 b3Jkcz4oKTwvcGRmOktleXdvcmRzPgo8L3JkZjpEZXNjcmlwdGlvbj4KPHJkZjpEZXNjcmlwdGlv biByZGY6YWJvdXQ9J3V1aWQ6Njk1ZGI1MjQtN2EyMy0xMWY0LTAwMDAtMWVkM2FiMzZjNWZhJyB4 bWxuczp4bXA9J2h0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8nPjx4bXA6TW9kaWZ5RGF0ZT4y MDE5LTAzLTA4VDE3OjAxOjI1LTA4OjAwPC94bXA6TW9kaWZ5RGF0ZT4KPHhtcDpDcmVhdGVEYXRl PjIwMTktMDMtMDhUMTc6MDE6MjUtMDg6MDA8L3htcDpDcmVhdGVEYXRlPgo8eG1wOkNyZWF0b3JU b29sPmh0bWwycHMgdmVyc2lvbiAxLjAgYmV0YTc8L3htcDpDcmVhdG9yVG9vbD48L3JkZjpEZXNj cmlwdGlvbj4KPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9J3V1aWQ6Njk1ZGI1MjQtN2EyMy0x MWY0LTAwMDAtMWVkM2FiMzZjNWZhJyB4bWxuczp4YXBNTT0naHR0cDovL25zLmFkb2JlLmNvbS94 YXAvMS4wL21tLycgeGFwTU06RG9jdW1lbnRJRD0ndXVpZDo2OTVkYjUyNC03YTIzLTExZjQtMDAw MC0xZWQzYWIzNmM1ZmEnLz4KPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9J3V1aWQ6Njk1ZGI1 MjQtN2EyMy0xMWY0LTAwMDAtMWVkM2FiMzZjNWZhJyB4bWxuczpkYz0naHR0cDovL3B1cmwub3Jn L2RjL2VsZW1lbnRzLzEuMS8nIGRjOmZvcm1hdD0nYXBwbGljYXRpb24vcGRmJz48ZGM6dGl0bGU+ PHJkZjpBbHQ+PHJkZjpsaSB4bWw6bGFuZz0neC1kZWZhdWx0Jz5kcmFmdC1saXZpbmdvb2QtZG9o LWltcGxlbWVudGF0aW9uLXJpc2tzLWlzc3Vlcy0wMSAtIENlbnRyYWxpemVkIEROUyBvdmVyIEhU VFBTICYjMTI5O0RvSCYjMTMwOyBJbXBsZW1lbnRhdGlvbiBJc3N1ZXMgYW5kIFJpc2tzPC9yZGY6 bGk+PC9yZGY6QWx0PjwvZGM6dGl0bGU+PGRjOmNyZWF0b3I+PHJkZjpTZXE+PHJkZjpsaT4oKTwv cmRmOmxpPjwvcmRmOlNlcT48L2RjOmNyZWF0b3I+PGRjOmRlc2NyaXB0aW9uPjxyZGY6U2VxPjxy ZGY6bGk+KCk8L3JkZjpsaT48L3JkZjpTZXE+PC9kYzpkZXNjcmlwdGlvbj48L3JkZjpEZXNjcmlw dGlvbj4KPC9yZGY6UkRGPgo8L3g6eG1wbWV0YT4KICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIAo8P3hwYWNrZXQgZW5kPSd3Jz8+CmVuZHN0cmVhbQplbmRvYmoKMiAwIG9iago8PC9Qcm9k dWNlcihHUEwgR2hvc3RzY3JpcHQgOS4wNSkKL0NyZWF0aW9uRGF0ZShEOjIwMTkwMzA4MTcwMTI1 LTA4JzAwJykKL01vZERhdGUoRDoyMDE5MDMwODE3MDEyNS0wOCcwMCcpCi9DcmVhdG9yKGh0bWwy cHMgdmVyc2lvbiAxLjAgYmV0YTcpCi9BdXRob3IoKQovS2V5d29yZHMoKQovU3ViamVjdCgpCi9U aXRsZShkcmFmdC1saXZpbmdvb2QtZG9oLWltcGxlbWVudGF0aW9uLXJpc2tzLWlzc3Vlcy0wMSAt IENlbnRyYWxpemVkIEROUyBvdmVyIEhUVFBTIFwyMDFEb0hcMjAyIEltcGxlbWVudGF0aW9uIElz c3VlcyBhbmQgUmlza3MpPj5lbmRvYmoKeHJlZgowIDM3OAowMDAwMDAwMDAwIDY1NTM1IGYgCjAw MDAwNDU5MjQgMDAwMDAgbiAKMDAwMDA4ODQ0OSAwMDAwMCBuIAowMDAwMDQ1Njg0IDAwMDAwIG4g CjAwMDAwMzk2MDYgMDAwMDAgbiAKMDAwMDAwMDAxNSAwMDAwMCBuIAowMDAwMDAxMzg5IDAwMDAw IG4gCjAwMDAwNDYwMDMgMDAwMDAgbiAKMDAwMDA4MzAzNyAwMDAwMCBuIAowMDAwMDgyODgzIDAw MDAwIG4gCjAwMDAwNDYwNDQgMDAwMDAgbiAKMDAwMDA0NjE5NiAwMDAwMCBuIAowMDAwMDQ2MzQ3 IDAwMDAwIG4gCjAwMDAwNDY0OTggMDAwMDAgbiAKMDAwMDA0NjY2MCAwMDAwMCBuIAowMDAwMDQ2 ODExIDAwMDAwIG4gCjAwMDAwNDY4NDEgMDAwMDAgbiAKMDAwMDAzOTgwOSAwMDAwMCBuIAowMDAw MDAxNDA5IDAwMDAwIG4gCjAwMDAwMDMzNDQgMDAwMDAgbiAKMDAwMDA0Njg3MSAwMDAwMCBuIAow MDAwMDQ2OTc1IDAwMDAwIG4gCjAwMDAwNDcxMzAgMDAwMDAgbiAKMDAwMDA0NzIzNyAwMDAwMCBu IAowMDAwMDQ3MzQ0IDAwMDAwIG4gCjAwMDAwNDc0NTEgMDAwMDAgbiAKMDAwMDA0NzU1OCAwMDAw MCBuIAowMDAwMDQ3NjY1IDAwMDAwIG4gCjAwMDAwNDc3NzIgMDAwMDAgbiAKMDAwMDA0Nzg3OSAw MDAwMCBuIAowMDAwMDQ3OTg2IDAwMDAwIG4gCjAwMDAwNDgwOTMgMDAwMDAgbiAKMDAwMDA0ODIw MCAwMDAwMCBuIAowMDAwMDQ4MzA4IDAwMDAwIG4gCjAwMDAwNDg0MTYgMDAwMDAgbiAKMDAwMDA0 ODUyNCAwMDAwMCBuIAowMDAwMDQ4NjMyIDAwMDAwIG4gCjAwMDAwNDg3NDAgMDAwMDAgbiAKMDAw MDA0ODg0NyAwMDAwMCBuIAowMDAwMDQ4OTUzIDAwMDAwIG4gCjAwMDAwNDkwNjAgMDAwMDAgbiAK MDAwMDA0OTE2NiAwMDAwMCBuIAowMDAwMDQ5MjczIDAwMDAwIG4gCjAwMDAwNDkzNzkgMDAwMDAg biAKMDAwMDA0OTQ4NiAwMDAwMCBuIAowMDAwMDQ5NTkyIDAwMDAwIG4gCjAwMDAwNDk2OTkgMDAw MDAgbiAKMDAwMDA0OTgwNSAwMDAwMCBuIAowMDAwMDQ5OTEyIDAwMDAwIG4gCjAwMDAwNTAwMTgg MDAwMDAgbiAKMDAwMDA1MDEyNSAwMDAwMCBuIAowMDAwMDUwMjMxIDAwMDAwIG4gCjAwMDAwNTAz MzggMDAwMDAgbiAKMDAwMDA1MDQ0NCAwMDAwMCBuIAowMDAwMDUwNTUxIDAwMDAwIG4gCjAwMDAw NTA2NTggMDAwMDAgbiAKMDAwMDA1MDc2NSAwMDAwMCBuIAowMDAwMDUwODczIDAwMDAwIG4gCjAw MDAwNTA5ODAgMDAwMDAgbiAKMDAwMDA1MTA4NyAwMDAwMCBuIAowMDAwMDUxMTkxIDAwMDAwIG4g CjAwMDAwNTEzNDQgMDAwMDAgbiAKMDAwMDA1MTQ0OCAwMDAwMCBuIAowMDAwMDUxNDc4IDAwMDAw IG4gCjAwMDAwNDAyNzMgMDAwMDAgbiAKMDAwMDAwMzM2NSAwMDAwMCBuIAowMDAwMDA1MTY1IDAw MDAwIG4gCjAwMDAwNTE1MDggMDAwMDAgbiAKMDAwMDA1MTYxMiAwMDAwMCBuIAowMDAwMDUxNzY1 IDAwMDAwIG4gCjAwMDAwNTE4NjkgMDAwMDAgbiAKMDAwMDA1MTk3NiAwMDAwMCBuIAowMDAwMDUy MDgwIDAwMDAwIG4gCjAwMDAwNTIxODggMDAwMDAgbiAKMDAwMDA1MjI5NSAwMDAwMCBuIAowMDAw MDUyMzI1IDAwMDAwIG4gCjAwMDAwNDA0OTIgMDAwMDAgbiAKMDAwMDAwNTE4NiAwMDAwMCBuIAow MDAwMDA3MzE2IDAwMDAwIG4gCjAwMDAwNTIzNTUgMDAwMDAgbiAKMDAwMDA1MjQ1OSAwMDAwMCBu IAowMDAwMDUyNTY0IDAwMDAwIG4gCjAwMDAwNTI2NzAgMDAwMDAgbiAKMDAwMDA1Mjc3NCAwMDAw MCBuIAowMDAwMDUyODgxIDAwMDAwIG4gCjAwMDAwNTI5ODggMDAwMDAgbiAKMDAwMDA1MzA5NiAw MDAwMCBuIAowMDAwMDUzMjA0IDAwMDAwIG4gCjAwMDAwNTMzMTIgMDAwMDAgbiAKMDAwMDA1MzQx OSAwMDAwMCBuIAowMDAwMDUzNTI3IDAwMDAwIG4gCjAwMDAwNTM2MzUgMDAwMDAgbiAKMDAwMDA1 Mzc0MyAwMDAwMCBuIAowMDAwMDUzODUxIDAwMDAwIG4gCjAwMDAwNTM5NTkgMDAwMDAgbiAKMDAw MDA1Mzk4OSAwMDAwMCBuIAowMDAwMDQwNzY3IDAwMDAwIG4gCjAwMDAwMDczMzcgMDAwMDAgbiAK MDAwMDAwOTMyOSAwMDAwMCBuIAowMDAwMDU0MDE5IDAwMDAwIG4gCjAwMDAwNTQxMjQgMDAwMDAg biAKMDAwMDA1NDIzMyAwMDAwMCBuIAowMDAwMDU0MzQyIDAwMDAwIG4gCjAwMDAwNTQ0NTAgMDAw MDAgbiAKMDAwMDA1NDU1OCAwMDAwMCBuIAowMDAwMDU0NjY2IDAwMDAwIG4gCjAwMDAwNTQ3NzIg MDAwMDAgbiAKMDAwMDA1NDg4MCAwMDAwMCBuIAowMDAwMDU0OTg5IDAwMDAwIG4gCjAwMDAwNTUw OTUgMDAwMDAgbiAKMDAwMDA1NTIwNCAwMDAwMCBuIAowMDAwMDU1MzEyIDAwMDAwIG4gCjAwMDAw NTU0MjAgMDAwMDAgbiAKMDAwMDA1NTUyOSAwMDAwMCBuIAowMDAwMDU1NTYwIDAwMDAwIG4gCjAw MDAwNDEwNTAgMDAwMDAgbiAKMDAwMDAwOTM1MCAwMDAwMCBuIAowMDAwMDEwOTgxIDAwMDAwIG4g CjAwMDAwNTU1OTEgMDAwMDAgbiAKMDAwMDA1NTY5NyAwMDAwMCBuIAowMDAwMDU1ODA2IDAwMDAw IG4gCjAwMDAwNTU5MTIgMDAwMDAgbiAKMDAwMDA1NTk0MyAwMDAwMCBuIAowMDAwMDQxMjQ4IDAw MDAwIG4gCjAwMDAwMTEwMDMgMDAwMDAgbiAKMDAwMDAxMjc1MSAwMDAwMCBuIAowMDAwMDU1OTc0 IDAwMDAwIG4gCjAwMDAwNTYwODAgMDAwMDAgbiAKMDAwMDA1NjE4OSAwMDAwMCBuIAowMDAwMDU2 Mjk4IDAwMDAwIG4gCjAwMDAwNTY0MDcgMDAwMDAgbiAKMDAwMDA1NjQzOCAwMDAwMCBuIAowMDAw MDQxNDU0IDAwMDAwIG4gCjAwMDAwMTI3NzMgMDAwMDAgbiAKMDAwMDAxNDU3OCAwMDAwMCBuIAow MDAwMDU2NDY5IDAwMDAwIG4gCjAwMDAwNTY1NzUgMDAwMDAgbiAKMDAwMDA1NjY4NCAwMDAwMCBu IAowMDAwMDU2NzkzIDAwMDAwIG4gCjAwMDAwNTY5MDIgMDAwMDAgbiAKMDAwMDA1NzAxMSAwMDAw MCBuIAowMDAwMDU3MTIwIDAwMDAwIG4gCjAwMDAwNTcyMjggMDAwMDAgbiAKMDAwMDA1NzMzNyAw MDAwMCBuIAowMDAwMDU3MzY4IDAwMDAwIG4gCjAwMDAwNDE2OTIgMDAwMDAgbiAKMDAwMDAxNDYw MCAwMDAwMCBuIAowMDAwMDE2MzYwIDAwMDAwIG4gCjAwMDAwNTczOTkgMDAwMDAgbiAKMDAwMDA1 NzUwNSAwMDAwMCBuIAowMDAwMDU3NjU5IDAwMDAwIG4gCjAwMDAwNTc4MDUgMDAwMDAgbiAKMDAw MDA1NzgzNiAwMDAwMCBuIAowMDAwMDQxODkwIDAwMDAwIG4gCjAwMDAwMTYzODIgMDAwMDAgbiAK MDAwMDAxODE0OSAwMDAwMCBuIAowMDAwMDU3ODY3IDAwMDAwIG4gCjAwMDAwNTc5NzMgMDAwMDAg biAKMDAwMDA1ODEyNiAwMDAwMCBuIAowMDAwMDU4MjM1IDAwMDAwIG4gCjAwMDAwNTgzNDQgMDAw MDAgbiAKMDAwMDA1ODQ1MiAwMDAwMCBuIAowMDAwMDU4NDgzIDAwMDAwIG4gCjAwMDAwNDIxMDQg MDAwMDAgbiAKMDAwMDAxODE3MSAwMDAwMCBuIAowMDAwMDIwMDM3IDAwMDAwIG4gCjAwMDAwNTg1 MTQgMDAwMDAgbiAKMDAwMDA1ODYyMCAwMDAwMCBuIAowMDAwMDU4NzI4IDAwMDAwIG4gCjAwMDAw NTg4MzYgMDAwMDAgbiAKMDAwMDA1ODk0NSAwMDAwMCBuIAowMDAwMDU5MDk5IDAwMDAwIG4gCjAw MDAwNTkyNTMgMDAwMDAgbiAKMDAwMDA1OTM2MiAwMDAwMCBuIAowMDAwMDU5MzkzIDAwMDAwIG4g CjAwMDAwNDIzMzQgMDAwMDAgbiAKMDAwMDAyMDA1OSAwMDAwMCBuIAowMDAwMDIxODA3IDAwMDAw IG4gCjAwMDAwNTk0MjQgMDAwMDAgbiAKMDAwMDA1OTUzMCAwMDAwMCBuIAowMDAwMDU5NjM5IDAw MDAwIG4gCjAwMDAwNTk3NDggMDAwMDAgbiAKMDAwMDA1OTc3OSAwMDAwMCBuIAowMDAwMDQyNTMy IDAwMDAwIG4gCjAwMDAwMjE4MjkgMDAwMDAgbiAKMDAwMDAyMzUwOCAwMDAwMCBuIAowMDAwMDU5 ODEwIDAwMDAwIG4gCjAwMDAwNTk5MTYgMDAwMDAgbiAKMDAwMDA2MDAyNSAwMDAwMCBuIAowMDAw MDYwMTMzIDAwMDAwIG4gCjAwMDAwNjAxNjQgMDAwMDAgbiAKMDAwMDA0MjczMCAwMDAwMCBuIAow MDAwMDIzNTMwIDAwMDAwIG4gCjAwMDAwMjUxODIgMDAwMDAgbiAKMDAwMDA2MDE5NSAwMDAwMCBu IAowMDAwMDYwMzAxIDAwMDAwIG4gCjAwMDAwNjA0MTAgMDAwMDAgbiAKMDAwMDA2MDUxNiAwMDAw MCBuIAowMDAwMDYwNTQ3IDAwMDAwIG4gCjAwMDAwNDI5MjggMDAwMDAgbiAKMDAwMDAyNTIwNCAw MDAwMCBuIAowMDAwMDI2ODU4IDAwMDAwIG4gCjAwMDAwNjA1NzggMDAwMDAgbiAKMDAwMDA2MDY4 NCAwMDAwMCBuIAowMDAwMDYwNzkwIDAwMDAwIG4gCjAwMDAwNjA5NDQgMDAwMDAgbiAKMDAwMDA2 MTEyOCAwMDAwMCBuIAowMDAwMDYxMzEwIDAwMDAwIG4gCjAwMDAwNjE0MTkgMDAwMDAgbiAKMDAw MDA2MTQ1MCAwMDAwMCBuIAowMDAwMDQzMTUwIDAwMDAwIG4gCjAwMDAwMjY4ODAgMDAwMDAgbiAK MDAwMDAyODQ1MSAwMDAwMCBuIAowMDAwMDYxNDgxIDAwMDAwIG4gCjAwMDAwNjE1ODcgMDAwMDAg biAKMDAwMDA2MTY5NSAwMDAwMCBuIAowMDAwMDYxODA0IDAwMDAwIG4gCjAwMDAwNjE4MzUgMDAw MDAgbiAKMDAwMDA0MzM0OCAwMDAwMCBuIAowMDAwMDI4NDczIDAwMDAwIG4gCjAwMDAwMzAwODEg MDAwMDAgbiAKMDAwMDA2MTg2NiAwMDAwMCBuIAowMDAwMDYxOTcyIDAwMDAwIG4gCjAwMDAwNjIw ODEgMDAwMDAgbiAKMDAwMDA2MjE4OSAwMDAwMCBuIAowMDAwMDYyMjk4IDAwMDAwIG4gCjAwMDAw NjI0MDcgMDAwMDAgbiAKMDAwMDA2MjQzOCAwMDAwMCBuIAowMDAwMDQzNTYyIDAwMDAwIG4gCjAw MDAwMzAxMDMgMDAwMDAgbiAKMDAwMDAzMTYyNiAwMDAwMCBuIAowMDAwMDYyNDY5IDAwMDAwIG4g CjAwMDAwNjI1NzUgMDAwMDAgbiAKMDAwMDA2MjY4NCAwMDAwMCBuIAowMDAwMDYyNzkyIDAwMDAw IG4gCjAwMDAwNjI4MjMgMDAwMDAgbiAKMDAwMDA0Mzc2MCAwMDAwMCBuIAowMDAwMDMxNjQ4IDAw MDAwIG4gCjAwMDAwMzMyMTggMDAwMDAgbiAKMDAwMDA2Mjg1NCAwMDAwMCBuIAowMDAwMDYyOTYw IDAwMDAwIG4gCjAwMDAwNjMwNjYgMDAwMDAgbiAKMDAwMDA2MzE3MiAwMDAwMCBuIAowMDAwMDYz Mjc4IDAwMDAwIG4gCjAwMDAwNjM0MzIgMDAwMDAgbiAKMDAwMDA2MzU0MSAwMDAwMCBuIAowMDAw MDYzNjQ3IDAwMDAwIG4gCjAwMDAwNjM4MDEgMDAwMDAgbiAKMDAwMDA2MzgzMiAwMDAwMCBuIAow MDAwMDQzOTk4IDAwMDAwIG4gCjAwMDAwMzMyNDAgMDAwMDAgbiAKMDAwMDAzNDcwMiAwMDAwMCBu IAowMDAwMDYzODYzIDAwMDAwIG4gCjAwMDAwNjM5NjkgMDAwMDAgbiAKMDAwMDA2NDA3OCAwMDAw MCBuIAowMDAwMDY0MTg0IDAwMDAwIG4gCjAwMDAwNjQyOTAgMDAwMDAgbiAKMDAwMDA2NDQ0MyAw MDAwMCBuIAowMDAwMDY0NTk5IDAwMDAwIG4gCjAwMDAwNjQ3NTMgMDAwMDAgbiAKMDAwMDA2NDkw OSAwMDAwMCBuIAowMDAwMDY1MDYyIDAwMDAwIG4gCjAwMDAwNjUyMTggMDAwMDAgbiAKMDAwMDA2 NTM2OCAwMDAwMCBuIAowMDAwMDY1NTIxIDAwMDAwIG4gCjAwMDAwNjU2ODAgMDAwMDAgbiAKMDAw MDA2NTcxMSAwMDAwMCBuIAowMDAwMDQ0Mjc2IDAwMDAwIG4gCjAwMDAwMzQ3MjQgMDAwMDAgbiAK MDAwMDAzNjE1OCAwMDAwMCBuIAowMDAwMDY1NzQyIDAwMDAwIG4gCjAwMDAwNjU4NDggMDAwMDAg biAKMDAwMDA2NTk1NCAwMDAwMCBuIAowMDAwMDY2MTA1IDAwMDAwIG4gCjAwMDAwNjYzMDEgMDAw MDAgbiAKMDAwMDA2NjQ5OCAwMDAwMCBuIAowMDAwMDY2Njg0IDAwMDAwIG4gCjAwMDAwNjY4NzAg MDAwMDAgbiAKMDAwMDA2NzA3OCAwMDAwMCBuIAowMDAwMDY3Mjg1IDAwMDAwIG4gCjAwMDAwNjc0 NzEgMDAwMDAgbiAKMDAwMDA2NzY1NyAwMDAwMCBuIAowMDAwMDY3ODc5IDAwMDAwIG4gCjAwMDAw NjgxMDAgMDAwMDAgbiAKMDAwMDA2ODMyNCAwMDAwMCBuIAowMDAwMDY4NTQ4IDAwMDAwIG4gCjAw MDAwNjg3NjQgMDAwMDAgbiAKMDAwMDA2ODk4MSAwMDAwMCBuIAowMDAwMDY5MjE5IDAwMDAwIG4g CjAwMDAwNjk0NTcgMDAwMDAgbiAKMDAwMDA2OTY3MiAwMDAwMCBuIAowMDAwMDY5ODg2IDAwMDAw IG4gCjAwMDAwNzAwNzcgMDAwMDAgbiAKMDAwMDA3MDI2OCAwMDAwMCBuIAowMDAwMDcwNDc2IDAw MDAwIG4gCjAwMDAwNzA2ODQgMDAwMDAgbiAKMDAwMDA3MDkwOSAwMDAwMCBuIAowMDAwMDcxMTM0 IDAwMDAwIG4gCjAwMDAwNzEzODEgMDAwMDAgbiAKMDAwMDA3MTYyOCAwMDAwMCBuIAowMDAwMDcx Nzg0IDAwMDAwIG4gCjAwMDAwNzE5MzMgMDAwMDAgbiAKMDAwMDA3MTk2NCAwMDAwMCBuIAowMDAw MDQ0Njk4IDAwMDAwIG4gCjAwMDAwMzYxODAgMDAwMDAgbiAKMDAwMDAzNzU4NCAwMDAwMCBuIAow MDAwMDcxOTk1IDAwMDAwIG4gCjAwMDAwNzIxMDEgMDAwMDAgbiAKMDAwMDA3MjI5MCAwMDAwMCBu IAowMDAwMDcyNDc5IDAwMDAwIG4gCjAwMDAwNzI2MzkgMDAwMDAgbiAKMDAwMDA3MjgzMCAwMDAw MCBuIAowMDAwMDczMDIxIDAwMDAwIG4gCjAwMDAwNzMyMjQgMDAwMDAgbiAKMDAwMDA3MzQyNSAw MDAwMCBuIAowMDAwMDczNTc2IDAwMDAwIG4gCjAwMDAwNzM3NjYgMDAwMDAgbiAKMDAwMDA3Mzk1 NiAwMDAwMCBuIAowMDAwMDc0MTQ5IDAwMDAwIG4gCjAwMDAwNzQzNDIgMDAwMDAgbiAKMDAwMDA3 NDUwMyAwMDAwMCBuIAowMDAwMDc0NzM4IDAwMDAwIG4gCjAwMDAwNzQ5NzMgMDAwMDAgbiAKMDAw MDA3NTE0OCAwMDAwMCBuIAowMDAwMDc1MzI3IDAwMDAwIG4gCjAwMDAwNzU1MDAgMDAwMDAgbiAK MDAwMDA3NTY5MyAwMDAwMCBuIAowMDAwMDc1ODg2IDAwMDAwIG4gCjAwMDAwNzYwODQgMDAwMDAg biAKMDAwMDA3NjI4MiAwMDAwMCBuIAowMDAwMDc2NDg5IDAwMDAwIG4gCjAwMDAwNzY2OTUgMDAw MDAgbiAKMDAwMDA3NjkwMyAwMDAwMCBuIAowMDAwMDc3MTExIDAwMDAwIG4gCjAwMDAwNzczNDUg MDAwMDAgbiAKMDAwMDA3NzU3OSAwMDAwMCBuIAowMDAwMDc3NzkwIDAwMDAwIG4gCjAwMDAwNzgw MDIgMDAwMDAgbiAKMDAwMDA3ODAzMyAwMDAwMCBuIAowMDAwMDQ1MTIwIDAwMDAwIG4gCjAwMDAw Mzc2MDYgMDAwMDAgbiAKMDAwMDAzODkyMSAwMDAwMCBuIAowMDAwMDc4MDY0IDAwMDAwIG4gCjAw MDAwNzgxNzAgMDAwMDAgbiAKMDAwMDA3ODM0OSAwMDAwMCBuIAowMDAwMDc4NTEzIDAwMDAwIG4g CjAwMDAwNzg2ODYgMDAwMDAgbiAKMDAwMDA3ODg0OSAwMDAwMCBuIAowMDAwMDc5MDA0IDAwMDAw IG4gCjAwMDAwNzkyMTYgMDAwMDAgbiAKMDAwMDA3OTQyNyAwMDAwMCBuIAowMDAwMDc5NjEzIDAw MDAwIG4gCjAwMDAwNzk4MDAgMDAwMDAgbiAKMDAwMDA3OTk5MCAwMDAwMCBuIAowMDAwMDgwMTgw IDAwMDAwIG4gCjAwMDAwODAzNDYgMDAwMDAgbiAKMDAwMDA4MDUzNyAwMDAwMCBuIAowMDAwMDgw NzI5IDAwMDAwIG4gCjAwMDAwODA4OTQgMDAwMDAgbiAKMDAwMDA4MTA0NyAwMDAwMCBuIAowMDAw MDgxMjAxIDAwMDAwIG4gCjAwMDAwODE0MTIgMDAwMDAgbiAKMDAwMDA4MTYyMyAwMDAwMCBuIAow MDAwMDgxODExIDAwMDAwIG4gCjAwMDAwODE5OTkgMDAwMDAgbiAKMDAwMDA4MjIxOSAwMDAwMCBu IAowMDAwMDgyNDQwIDAwMDAwIG4gCjAwMDAwODI1NDYgMDAwMDAgbiAKMDAwMDA4MjU3NyAwMDAw MCBuIAowMDAwMDQ1NDk0IDAwMDAwIG4gCjAwMDAwMzg5NDMgMDAwMDAgbiAKMDAwMDAzOTU4NSAw MDAwMCBuIAowMDAwMDgyNjA4IDAwMDAwIG4gCjAwMDAwODI3MTQgMDAwMDAgbiAKMDAwMDA4Mjgy MSAwMDAwMCBuIAowMDAwMDgyODUyIDAwMDAwIG4gCjAwMDAwODI5NjIgMDAwMDAgbiAKMDAwMDA4 NjcwNCAwMDAwMCBuIAp0cmFpbGVyCjw8IC9TaXplIDM3OCAvUm9vdCAxIDAgUiAvSW5mbyAyIDAg UgovSUQgWzwzOTc4NzExQkU4QzA5RTlGQTIxRTA2QzlDMTVERkMwMj48Mzk3ODcxMUJFOEMwOUU5 RkEyMUUwNkM5QzE1REZDMDI+XQo+PgpzdGFydHhyZWYKODg3NzMKJSVFT0YK --_002_EA2A119D06CF4B0B899486A99CD8AC0Bcablecomcastcom_-- From nobody Sat Mar 9 10:29:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12BF4130EB9 for ; Sat, 9 Mar 2019 10:29:18 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, LOTS_OF_MONEY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l8sfwtn7d9Lo for ; Sat, 9 Mar 2019 10:29:14 -0800 (PST) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9833F130EC8 for ; Sat, 9 Mar 2019 10:29:13 -0800 (PST) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id D2CDAA052F; Sat, 9 Mar 2019 19:29:09 +0100 (CET) Received: by godin (Postfix, from userid 1000) id D1BB4EC0B08; Sat, 9 Mar 2019 19:28:57 +0100 (CET) Date: Sat, 9 Mar 2019 19:28:57 +0100 From: Stephane Bortzmeyer To: "Livingood, Jason" Cc: DoH WG Message-ID: <20190309182857.GA29321@laperouse.bortzmeyer.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 18:29:20 -0000 On Sat, Mar 09, 2019 at 01:23:56AM +0000, Livingood, Jason wrote a message of 1765 lines which said: > FYI that this document has posted. I have requested 10 mins of > agenda time in the DOH WG at IETF 104. A few remarks (summary: a real issue but the draft obscures it, by piling a lot of questionable arguments, and by lacking rigor in separating DoH from the general issue of public DNS resolvers). > Separating the Protocol from Implementation Issues There have been already discussions about the need to discuss separately DoH-the-protocol and DoH-the-deployment. For the latter, Bert Hubert suggested DoC (DNS-over-Cloud). > Network operators, ranging from ISPs to enterprises, schools, and > others work hard to provide outstanding DNS and network performance, Nice but clearly false. One of the reasons why many users switch to public DNS resolvers is because many local networks and ISP do a lousy job (specially in some parts of the world). Not to mention those who simply announce 8.8.8.8 trough DHCP... > In addition, most also provide DNS-based services such as opt-in > parental controls for consumers or malware/security protection in > enterprises, content filtering in schools, etc. "most"? I doubt it. Source? > the current Centralized DoH implementation model does not appear to > make it possible for these operators to continue to play a value > added role in the delivery of network services Some people may consider that this is not something we want from the ISPs. "value added" is often the code word for violations of network neutrality. > with 30 companies being responsible for 30% of global traffic A very questionable metric. If you care only about bytes, video providers will always win. But other metrics could be used: is a video of a cute kitten more important than a PDF document which is a multi-million dollars contract? > The Dyn attack provides a vivid illustration of how DNS > infrastructure vulnerabilities - and DNS space concentration - can > wreak havoc on the stability of the Internet." Is it really relevant, since it was an attack on authoritative DNS servers? Having lot of local resolvers would not have changed its consequences. > DNS blocklists, which are one of the primary and most effective ways > to protect a network and its users against malware, phishing, spam, > DDoS attacks, etc. Can you explain how a blocklist on the DNS resolver protects against spam and dDoS? > Loss of Parental Controls or other Content Controls The draft seems to assume that lying DNS resolvers are a good thing (politically and technically) but I don't think there is an IETF consensus here. > Disruption of Legally-Mandated National-Level DNS Blocks It think it is a feature of DoH, not a bug. In Europe, for instance, many users switch to public DNS resolvers precisely to be able to bypass the lying resolver. > Smaller DNS Labor Market Certainly we, at the IETF, don't work just to preserve our jobs! Really, you pile way too many arguments to kill "centralized DoH", and some are really weak. > This document makes the following recommendations The most important is missing: help developers to create DoH servers that can be easily installed and managed so, instead of a few DoH providers, we can have many of them. (Currently, there is no easy way to download and install a DoH server.) > ICANN legal department assessment: > ICANN currently required Generic Top Level Domain (gTLD) operators > to meet certain technical criteria, as noted in Specification 6, > Part 1.1 of their Registry Agreement [48]. ICANN may need to > consider whether those DNS operators should or must add support for > DoT and/or DoH in the future Besides the fact that ICANN already suffers from a serious mission creep, gTLD operators operate authoritative servers so I don't see why you mention DoH or DoT, which are currently only for the stub-to-resolver link. > Develop Centralized DoH Data Privacy Guidelines/Frameworks draft-reid-operator-doh draft-dickinson-bcp-op draft-dickinson-doh-dohpe From nobody Sat Mar 9 13:58:03 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD95D1274A1 for ; Sat, 9 Mar 2019 13:58:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F6f6JMmCiRLt for ; Sat, 9 Mar 2019 13:57:59 -0800 (PST) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id D196A12705F for ; Sat, 9 Mar 2019 13:57:58 -0800 (PST) Received: by nyx.guxx.net (Postfix, from userid 107) id A1D615F421F8; Sat, 9 Mar 2019 22:57:57 +0100 (CET) Received: from [172.19.153.81] (p4FF53782.dip0.t-ipconnect.de [79.245.55.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 048625F402AB; Sat, 9 Mar 2019 22:57:55 +0100 (CET) From: "Ralf Weber" To: "Stephane Bortzmeyer" Cc: "Livingood, Jason" , "DoH WG" Date: Sat, 09 Mar 2019 22:57:53 +0100 X-Mailer: MailMate (1.12.4r5594) Message-ID: <6ED365D5-8717-46A6-B75E-A628753C2979@fl1ger.de> In-Reply-To: <20190309182857.GA29321@laperouse.bortzmeyer.org> References: <20190309182857.GA29321@laperouse.bortzmeyer.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 21:58:02 -0000 Moin! On 9 Mar 2019, at 19:28, Stephane Bortzmeyer wrote: >> Network operators, ranging from ISPs to enterprises, schools, and >> others work hard to provide outstanding DNS and network performance, > > Nice but clearly false. One of the reasons why many users switch to > public DNS resolvers is because many local networks and ISP do a lousy > job (specially in some parts of the world). Not to mention those who > simply announce 8.8.8.8 trough DHCP... While it is true that there are ISPs that give you 8.8.8.8 as a resolver there are also a lot of ISPs that invest in their DNS service and offer a service that (due to the network nature) is better than what a public resolver can provide. So stating this as false also clearly is false. It is as with in most service oriented business, you have good and you have bad ones, to simplify does not work here. >> In addition, most also provide DNS-based services such as opt-in >> parental controls for consumers or malware/security protection in >> enterprises, content filtering in schools, etc. > > "most"? I doubt it. Source? It depends on the region, but e.g in the UK all of the big providers offer such a service. Also working for a company (Nominum now part of Akamai) that builds software for such DNS based service I can tell you that we sold the software around the world and we are not the only company in that space. >> The Dyn attack provides a vivid illustration of how DNS >> infrastructure vulnerabilities - and DNS space concentration - can >> wreak havoc on the stability of the Internet." > > Is it really relevant, since it was an attack on authoritative DNS > servers? Having lot of local resolvers would not have changed its > consequences. Well given that as a result of it a lot of work has been done to use resolvers to protect against such a authoritative outage, e.g draft-ietf-dnsop-serve-stale so the it certainly is relevant for the next attack. >> DNS blocklists, which are one of the primary and most effective ways >> to protect a network and its users against malware, phishing, spam, >> DDoS attacks, etc. > > Can you explain how a blocklist on the DNS resolver protects against > spam and dDoS? Easy. Spam is often send by bots. DNS resolvers that e.g block or redirect MX lookups or stop the communication of the bots with its masters by blocking the C&C domain. I have seen networks coming of spam list just by deploying these technologies. >> Disruption of Legally-Mandated National-Level DNS Blocks > > It think it is a feature of DoH, not a bug. In Europe, for instance, > many users switch to public DNS resolvers precisely to be able to > bypass the lying resolver. Well again not sure how you quantify many, but those users and even more so these public resolver service providers, who usually also do business in these countries, are breaking the law. I never understood why this has no consequences for them, while when I worked at a European multi national ISP we had to deliver the mandated blocks per country of the user and not of the server for the any cast network we had, which often served users out of country. >> This document makes the following recommendations > > The most important is missing: help developers to create DoH servers > that can be easily installed and managed so, instead of a few DoH > providers, we can have many of them. (Currently, there is no easy way > to download and install a DoH server.) There is some server or proxy software out there already, and I know there are others working on it. But to deploy it you need money and a business case, and I can not find a primary business case to run a DoH server. There are secondary business cases like deliver fast Internet for the ISPs or gather more user data for Ad networks or better map users for CDNs. Bur the relative cost to different players is different, as for examples ISP would have to scale up siginpificantly from there current DNS service to deliver DoH, while for ad networks or CDNs the additional cost for the DNS service is low. I think the only way to get lots of DoH providers is to help the ISPs to do it as they are the natural decentralised player on the internet. So long -Ralf —-- Ralf Weber From nobody Sat Mar 9 19:30:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C0B3131074 for ; Sat, 9 Mar 2019 19:30:06 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2tlIn5qFpw0v for ; Sat, 9 Mar 2019 19:30:04 -0800 (PST) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45376130E62 for ; Sat, 9 Mar 2019 19:30:04 -0800 (PST) Received: from [10.255.253.7] (ADSL-130-24.myt.mu [41.212.130.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 418A4242109D for ; Sun, 10 Mar 2019 03:29:54 +0000 (UTC) From: Jim Reid Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> To: DoH WG Date: Sun, 10 Mar 2019 03:29:51 +0000 X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 03:30:14 -0000 FYI colleagues. The draft below has just been submitted. I've been given = 10 minutes of WG agenda time at IETF104. > A new version of I-D, draft-reid-doh-operator-00.txt > has been successfully submitted by Jim Reid and posted to the > IETF repository. >=20 > Name: draft-reid-doh-operator > Revision: 00 > Title: DNS over HTTPS (DoH) Considerations for Operator = Networks > Document date: 2019-03-10 > Group: Individual Submission > Pages: 17 > URL: = https://www.ietf.org/internet-drafts/draft-reid-doh-operator-00.txt > Status: = https://datatracker.ietf.org/doc/draft-reid-doh-operator/ > Htmlized: https://tools.ietf.org/html/draft-reid-doh-operator-00 > Htmlized: = https://datatracker.ietf.org/doc/html/draft-reid-doh-operator >=20 >=20 > Abstract: > The introduction of DNS over HTTPS (DoH), defined in RFC8484, > presents a number of challenges to network operators. These are > described in this document. The objective is to document the = problem > space and make suggestions that could help inform network operators > on how to take account of DoH deployment. This document also > identifies topics that may require further analysis. From nobody Sat Mar 9 22:49:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E0E0C12787E for ; Sat, 9 Mar 2019 22:49:35 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pLOz_OpXEuSY for ; Sat, 9 Mar 2019 22:49:33 -0800 (PST) Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EDD72126DFA for ; Sat, 9 Mar 2019 22:49:32 -0800 (PST) Received: by mail-qk1-x72e.google.com with SMTP id y15so974760qki.8 for ; Sat, 09 Mar 2019 22:49:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=EJZXriF7XDqk/0NZqUGa3Wi3ka+QTfXbVGL8JbOsK1Q=; b=ebrnYWx9eU2lpSitzqgItc99nGJiQdgBZPYjMq1BZBanIfxQbqJ00u1KvHSVRR+Fhk BNIn2pmxnKNyyr7wIQ5CsrCh6PQu75lrtMkrQbLscRzebiqPzKAdHT4STVxlSF4I+MXx r3C8087bMCN/y53l3YXPTUbeKP0foCfdjR7RJIXQA97m9tkSwhoaBjHPdY4e500IidZz avTC8QH2IP2F4e1wb/B+leSeyzvpIoDcAoC+uJJPLYNqz+zgUad4cYOsotd3qnkqro7f uTbOZRQKj0JDhX2OjrEwMYKhZTnqDtq8MCWut2DQ0ebgu3NjuhSz1bWmNBJ0UF7lGTO2 fuow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=EJZXriF7XDqk/0NZqUGa3Wi3ka+QTfXbVGL8JbOsK1Q=; b=nbHon9yTlMS4o/o3zAQmxlU483LeuzEHSYayFUzp6QkUwjrlo0ny/wMExw4wG9wnMc Btd2pvRIm4vHZflvmKsAoUoTLxPPc5m7SIGfskNNTbiMapn2vWg7GnU/MvDjcr7b9bAl f/23Xy+GIv0C2P/blnf2od7WH1MKD8iQ4y6782OQWqdrsfTGlXfeMXtkC70ewFh+gHqi OdNtmV2OXOkP8x+/dFq5K7lKkDD4EZeIvaRfSQPvx2pZyUkus4w5QqkPMaYGGTVp60xQ /p9VrnFIBTWmexqvbcTzqr/3uY5GaEQXwsv2YJHCQm3RSOeOcFRyVCuLCwwtkTS6635k BzUw== X-Gm-Message-State: APjAAAXIHMmkXaPxkYG4nLf7L+wR869vSLq3PSTZTH+K7JDCEXkXOdNS XLlZKjE/Yn8KY1IhRc4cXYBgrGA7BmmK5dUb17rJHkBaJnSkbQ== X-Google-Smtp-Source: APXvYqzSsZRqcKGn2BWOebZZ9X7+Bo9Tra4afzzYXLU58IDmUzf2sdCBwluHcGuOMKD8XF/aZWMNiHxhHbb516fReqk= X-Received: by 2002:a37:c50f:: with SMTP id p15mr907375qki.278.1552200571672; Sat, 09 Mar 2019 22:49:31 -0800 (PST) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> In-Reply-To: From: Warren Kumari Date: Sun, 10 Mar 2019 15:48:52 +0900 Message-ID: To: Jim Reid Cc: DoH WG , dnsop Content-Type: multipart/alternative; boundary="000000000000b1f2c60583b7db8d" Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 06:49:36 -0000 --000000000000b1f2c60583b7db8d Content-Type: text/plain; charset="UTF-8" [ + DNSOP] On Sun, Mar 10, 2019 at 12:31 PM Jim Reid wrote: > FYI colleagues. The draft below has just been submitted. I've been given > 10 minutes of WG agenda time at IETF104. > I haven't given this a full review yet, but I'd like to note that almost all of this is about concerns around applications (including browsers) deciding to use their own name resolution and bypass the system resolver, and that very little of this document is actually about DoH itself. I think it would be very valuable to not conflate DNS-over-HTTPS (the protocol) with the "applications might choose to use their own resolvers" concerns. As an example: " For most users, DNS resolution is currently part of the service provided by their ISP. With DoH, users can be expected to rely on DoH service providers and are likely to have no business or contractual relationship with those providers." This about the latter, and I *really* think that this is not helpful to use the term DoH to refer to it -- applications have always been able to write code to bypass the system resolver if they had chosen to - for example apps, including browsers, could have equally done this with "plain DNS", DNS-over-TLS, DNS over foo, etc. As an example it appears that the NetFlix apps have been bypassing the system resolvers sinde before the times of DoH. Yes, the Mozilla / CloudFlare experiment used the DoH protocol, but it could queally have used DoT, DNS over IPSec, $whatever. I encourage discussion of the concerns and what the implications of applications doing their own DNS are, but they are different to the DoH protocol - please do not conflate / confuse the two. Someone (it may have been Vittorio Bertola) coined the term DNS-over-Cloud (DoC) to refer to the deployment concerns - while I don't think it is a great term, it is much better than using the the term DoH to refer to all of: 1: the protocol, 2: the deployment concerns, 3: "resolverless DNS", 4: the loss of visibility from encrypting the DNS Also, I think that this topic would be better discussed in the DNSOP WG - the DoH charter (https://datatracker.ietf.org/wg/doh/about/) talks about: "The primary focus of this working group is to develop a mechanism that provides confidentiality and connectivity between DNS clients (e.g., operating system stub resolvers) and recursive resolvers." While it does say: "The working group will analyze the security and privacy issues that could arise from accessing DNS over HTTPS. In particular, the working group will consider the interaction of DNS and HTTP caching." it goes on to say: "In particular, DNSOP will be consulted for guidance on the operational impacts that result from traditional host behaviors (i.e., stub-resolver to recursive-resolver interaction) being replaced with the specified mechanism." So can the document please be updated to discuss either the DoH protocol *or* the larger issues - and if the latter, this document / discussion should happen in DNSOP. W > > A new version of I-D, draft-reid-doh-operator-00.txt > > has been successfully submitted by Jim Reid and posted to the > > IETF repository. > > > > Name: draft-reid-doh-operator > > Revision: 00 > > Title: DNS over HTTPS (DoH) Considerations for Operator > Networks > > Document date: 2019-03-10 > > Group: Individual Submission > > Pages: 17 > > URL: > https://www.ietf.org/internet-drafts/draft-reid-doh-operator-00.txt > > Status: > https://datatracker.ietf.org/doc/draft-reid-doh-operator/ > > Htmlized: https://tools.ietf.org/html/draft-reid-doh-operator-00 > > Htmlized: > https://datatracker.ietf.org/doc/html/draft-reid-doh-operator > > > > > > Abstract: > > The introduction of DNS over HTTPS (DoH), defined in RFC8484, > > presents a number of challenges to network operators. These are > > described in this document. The objective is to document the problem > > space and make suggestions that could help inform network operators > > on how to take account of DoH deployment. This document also > > identifies topics that may require further analysis. > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf --000000000000b1f2c60583b7db8d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
[= =C2=A0+ DNSOP]=C2=A0

On Sun, Mar 10, 2019 at 12:31 PM Jim Reid <jim@rfc1035.com> wrote:
FYI colleagues. The draft be= low has just been submitted. I've been given 10 minutes of WG agenda ti= me at IETF104.

I haven't given this a fu= ll review yet, but I'd like to note that almost all of this is about co= ncerns around applications (including browsers) deciding to use their own n= ame resolution and bypass the system resolver, and that very little of this= document is actually about DoH itself.

I think it would be very v= aluable to not conflate DNS-over-HTTPS (the protocol) with the "applic= ations might choose to use their own resolvers" concerns.
As an exampl= e:
" For most users, DNS resolution is
=C2=A0 =C2=A0 =C2=A0 currently = part of the service provided by their ISP.=C2=A0 With DoH,
=C2=A0 =C2=A0 = =C2=A0 users can be expected to rely on DoH service providers and are
=
=C2= =A0 =C2=A0 =C2=A0 likely to have no business or contractual relationship wi= th those
=C2=A0 =C2=A0 =C2=A0 providers."

This about the latter, = and I *really* think that this is not helpful to use the term DoH to refer = to it -- applications have always been able to write code to bypass the sys= tem resolver if they had chosen to - for example apps, including browsers, = could have equally done this with "plain DNS", DNS-over-TLS, DNS = over foo, etc. As an example it appears that the NetFlix apps have been byp= assing the system resolvers sinde before the times of DoH. Yes, the Mozilla= / CloudFlare experiment used the DoH protocol, but it could queally have u= sed DoT, DNS over IPSec, $whatever.=C2=A0=C2=A0

I encourage dis= cussion of the concerns and what the implications of applications doing the= ir own DNS are, but they are different to the DoH protocol - please do not = conflate / confuse the two.=C2=A0
Someone (it may have been=C2=A0Vittorio= Bertola) coined the term DNS-over-Cloud (DoC) to refer to the deployment c= oncerns - while I don't think it is a great term, it is much better tha= n=C2=A0 using the the term DoH to refer to all of:
1: the protocol,=C2=A0
2= : the deployment concerns,=C2=A0
3: "resolverless DNS",
4: the lo= ss of visibility from encrypting the DNS

Also, I think that this topic= would be better discussed in the DNSOP WG -=C2=A0 the DoH charter (https://datatracker.ietf.or= g/wg/doh/about/)=C2=A0talks about:
"The primary focus of this work= ing group is to develop a mechanism that
provides confidentiality and conne= ctivity between DNS clients (e.g., operating
system stub resolvers) and rec= ursive resolvers."

While it does say:
"The working group wil= l analyze the security and privacy issues that
could arise from accessing D= NS over HTTPS. In particular, the working
group will consider the interacti= on of DNS and HTTP caching."
it goes on to say:
"In particular,= DNSOP will be consulted for guidance on the
operational impacts that resul= t from traditional host behaviors (i.e.,
stub-resolver to recursive-resolve= r interaction) being replaced with the
specified mechanism."

So c= an the document please be updated to discuss either the DoH protocol *or* t= he larger issues - and if the latter, this document / discussion should hap= pen in DNSOP.

W


> A new version of I-D, draft-reid-doh-operator-00.txt
> has been successfully submitted by Jim Reid and posted to the
> IETF repository.
>
> Name:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft-reid-doh-operator
> Revision:=C2=A0 =C2=A0 =C2=A000
> Title:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 DNS over= HTTPS (DoH) Considerations for Operator Networks
> Document date:=C2=A0 =C2=A0 =C2=A0 =C2=A0 2019-03-10
> Group:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 Individu= al Submission
> Pages:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 17
> URL:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 https://www.ietf.org/internet-drafts/draft-reid-doh-opera= tor-00.txt
> Status:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/draft-reid-doh-operator/
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https= ://tools.ietf.org/html/draft-reid-doh-operator-00
> Htmlized:=C2=A0 =C2=A0 =C2=A0 =C2=A0https://datatracker.ietf.org/doc/html/draft-reid-doh-operator
>
>
> Abstract:
>=C2=A0 =C2=A0The introduction of DNS over HTTPS (DoH), defined in RFC84= 84,
>=C2=A0 =C2=A0presents a number of challenges to network operators.=C2= =A0 These are
>=C2=A0 =C2=A0described in this document.=C2=A0 The objective is to docu= ment the problem
>=C2=A0 =C2=A0space and make suggestions that could help inform network = operators
>=C2=A0 =C2=A0on how to take account of DoH deployment.=C2=A0 This docum= ent also
>=C2=A0 =C2=A0identifies topics that may require further analysis.

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh


--
I don't think the execution is relevant when= it was obviously a bad idea in the first place.
This is like putting ra= bid weasels in your pants, and later expressing regret at having chosen tho= se particular rabid weasels and that pair of pants.
=C2=A0 =C2=A0---maf<= /div>
--000000000000b1f2c60583b7db8d-- From nobody Sat Mar 9 23:01:54 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90EE5129508; Sat, 9 Mar 2019 23:01:36 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5ncX-cqeNmqq; Sat, 9 Mar 2019 23:01:35 -0800 (PST) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F29AB128766; Sat, 9 Mar 2019 23:01:34 -0800 (PST) Received: from [IPv6:2001:559:8000:c9:5055:7992:c019:3c37] (unknown [IPv6:2001:559:8000:c9:5055:7992:c019:3c37]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 9E1B9892C6; Sun, 10 Mar 2019 07:01:34 +0000 (UTC) To: Warren Kumari Cc: Jim Reid , dnsop , DoH WG References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> From: Paul Vixie Message-ID: <8855871d-c059-3938-12a1-62f21c089e1d@redbarn.org> Date: Sat, 9 Mar 2019 23:01:33 -0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.11 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 07:01:45 -0000 Warren Kumari wrote on 2019-03-09 22:48: > [ + DNSOP] > > ... > > I think it would be very valuable to not conflate DNS-over-HTTPS (the > protocol) with the "applications might choose to use their own > resolvers" concerns. i disagree. as an example: > Two primary use cases were considered during this protocol's > development. These use cases are preventing on-path devices from > interfering with DNS operations, ... (from the Introduction of RFC 8484.) no other off-network RDNS is reachable by malware which somehow gets into my network, or BYOD devices that have a coffee-shop configuration, or any other rogue purpose which is at odds with me as the operator of "on-path devices". i intend to interfere. DoH turns traditional rules on their head, and does so _deliberately_. if the authors of DoH don't want to be lumped in with the "apps (malware) that might choose to use their own resolvers" then they ought to have designed it to work in concern with local network policy. in other words, make it blockable. by explicitly and aggressively taking the position they took, they own the followup, including the Reid draft. i have been away as long as possible, which means i was surprised that the IESG was willing to allow a document to standardize hostility between me as a parent and my children who are subject to my parental controls technology, and between me as a network operator and malware authors who can't succeed without bypassing my DNS servers. but, the cat is out of the bag now, and it's going to be pretty messy. please do not blame that mess on jim reid or on his draft. -- P Vixie From nobody Sat Mar 9 23:37:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD25B1274D0 for ; Sat, 9 Mar 2019 23:36:58 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rihkxsVYSVSd for ; Sat, 9 Mar 2019 23:36:55 -0800 (PST) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9003C126DFA for ; Sat, 9 Mar 2019 23:36:55 -0800 (PST) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id D2B49A052E; Sun, 10 Mar 2019 08:36:52 +0100 (CET) Received: by godin (Postfix, from userid 1000) id 0A361EC0B0D; Sun, 10 Mar 2019 08:33:06 +0100 (CET) Date: Sun, 10 Mar 2019 08:33:06 +0100 From: Stephane Bortzmeyer To: Ralf Weber Cc: Stephane Bortzmeyer , "Livingood, Jason" , DoH WG Message-ID: <20190310073306.GA10396@laperouse.bortzmeyer.org> References: <20190309182857.GA29321@laperouse.bortzmeyer.org> <6ED365D5-8717-46A6-B75E-A628753C2979@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <6ED365D5-8717-46A6-B75E-A628753C2979@fl1ger.de> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 07:36:59 -0000 On Sat, Mar 09, 2019 at 10:57:53PM +0100, Ralf Weber wrote a message of 93 lines which said: > > > Network operators, ranging from ISPs to enterprises, schools, > > > and others work hard to provide outstanding DNS and network > > > performance, > > > > Nice but clearly false. One of the reasons why many users switch > > to public DNS resolvers is because many local networks and ISP do > > a lousy job (specially in some parts of the world). Not to mention > > those who simply announce 8.8.8.8 trough DHCP... > > While it is true that there are ISPs that give you 8.8.8.8 as a > resolver there are also a lot of ISPs that invest in their DNS > service and offer a service that (due to the network nature) is > better than what a public resolver can provide. So stating this as > false also clearly is false. I never said that "_all_ ISPs are this or that". The draft did. Sometimes, the service provided by the public resolver is better, sometimes it is not. Saying that all ISPs "work hard to provide outstanding DNS" is simply advertisment. > > Can you explain how a blocklist on the DNS resolver protects against > > spam and dDoS? > > Easy. Spam is often send by bots. DNS resolvers that e.g block or > redirect MX lookups or stop the communication of the bots with its > masters by blocking the C&C domain. OK. It does not protect you against spam, it protects other users against the spam you send. That's quite different. If the "regular" DNS resolver blocs C&C, spam-sending bots won't use it and will switch to other systems: alternative name resolution systems or simply DNS-over-somethng (I agree here with Warren Kmmari ). > those users and even more so these public resolver service > providers, who usually also do business in these countries, are > breaking the law. You are not a lawyer and neither I am but I think it is more complicated. At least in France but probably in many other countries, legal rulings by court are to be enforced only by organisations which have been named in the rulings. Most of them don't name Google Public DNS or Cloudflare 1.1.1.1 or Yandex DNS. For the censorship which does not go through courts, such as the blacklist of the governement in France, the list is not public and therefore public DNS resolvers cannot follow it, even if they want (at least one not-for-profit organisation explicitely asks for this list and was denied). So, no, I don't think they are breaking the law (yes, IANAL, but nobody here is). > There is some server or proxy software out there already, I know, I wrote one. But most of them are experimental, hard to install, not something that you can install as easily as a HTTP server or a regular DNS resolver. > But to deploy it you need money and a business case, and I can not > find a primary business case to run a DoH server. The will to provide an alternative? In France, at least two not-for-profit organisations operate a public DNS resolver precisely for that. There is not only business in life. > I think the only way to get lots of DoH providers is to help the > ISPs to do it as they are the natural decentralised player on the > internet. Clearly, we disagree here, but it seems more a political disagreement than a technical issue with the protocol of this WG. From nobody Sun Mar 10 00:02:18 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6017126DFA for ; Sun, 10 Mar 2019 00:02:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PWXQG8rf8rVs for ; Sun, 10 Mar 2019 00:02:15 -0800 (PST) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [IPv6:2001:4b98:dc0:41:216:3eff:fe27:3d3f]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC772124B91 for ; Sun, 10 Mar 2019 00:02:14 -0800 (PST) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 3EEE8A052E; Sun, 10 Mar 2019 09:02:12 +0100 (CET) Received: by godin (Postfix, from userid 1000) id B24E6EC0B0D; Sun, 10 Mar 2019 09:01:01 +0100 (CET) Date: Sun, 10 Mar 2019 09:01:01 +0100 From: Stephane Bortzmeyer To: Jim Reid Cc: DoH WG Message-ID: <20190310080101.GA11452@laperouse.bortzmeyer.org> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 08:02:17 -0000 On Sun, Mar 10, 2019 at 03:29:51AM +0000, Jim Reid wrote a message of 30 lines which said: > FYI colleagues. The draft below has just been submitted. I've been given 10 minutes of WG agenda time at IETF104. I'm surprised that it is published more or less at the same time draft-livingood-doh-implementation-risks-issues. They have a lot of overlap, and even one author in common. May be a merge would be a good idea? > When DoH is used, the customer will probably be dependent on DoH > servers operated by third parties and have no contractual or > business relationship with those providers. Like draft-livingood-doh-implementation-risks-issues, there is a lot of confusion between DoH-the-protocol and possible deployments of DNS resolution via a public DNS resolver. The specific issue mentioned above is exactly the same whether I use DoH or DNS-over-UDP to 8.8.8.8 or 9.9.9.9. [To be more precise: most of this draft is off-topic for the DoH WG. If this is asked, I will say No to adoption by the WG.] > Operators can also be required to perform DNS blocking and filtering > or rewriting for legal reasons Sure, but is it IETF's job to make it easier? RFC 2804 and 7754 would be good references here. > Typical regulations that could apply include General Data Protection > Regulation (EU) 2016/679 [GDPR] and the EU-US Privacy Shield > Framework [USPS]. [...] Logs containing individual DNS queries and > the IP addresses or other data correlating those queries to specific > users or homes may in some legal jurisdictions be considered as > personally identifying information (PII). In such jurisdictions > detailed DNS query logs may be subject to data protection and > retention regulations, or other legal and/or compliance > requirements. I'm very glad that people consider the importance of personal data protection, and the useful role of the GDPR in it. But I fail to see why it's specific to DoH. For *every* IETF protocol, the two parties communicating may be in different countries (well, may be not for ND, ARP and DHCP), and logging by one may infringe the laws of another. Yet, we don't write drafts on the GDPR risks associated with each specific protocol. > Some list or registry of "trusted" DoH servers is probably > necessary. Why? I don't see it as necessary or unavoidable and even if it were, why would it be IETF's business? Do we mention a "list of trusted AC" in PKIX RFCs? > DoH has the potential to be more privacy intrusive than ECS, largely > because DoH is based on HTTP and can leverage the rich per-user and > per-device tracking that pervades the web today. The implications > of that are not yet well understood. draft-dickinson-doh-dohpe From nobody Sun Mar 10 03:42:30 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CA706124D68 for ; Sun, 10 Mar 2019 03:42:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wWYzcTQ3Pvza for ; Sun, 10 Mar 2019 03:42:26 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 51AB81200ED for ; Sun, 10 Mar 2019 03:42:25 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 0D88DBE2E; Sun, 10 Mar 2019 10:42:23 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7Cwdm6Z1N2Of; Sun, 10 Mar 2019 10:42:21 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 62BA0BE2C; Sun, 10 Mar 2019 10:42:21 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552214541; bh=wbRL/mTyPQt/Alwi+/4beo8vx/uZ0oqMldkYWLXpJok=; h=From:Subject:To:References:Date:In-Reply-To:From; b=IWbb5N77j5zx1h7Nf8Jz45IjLwxbpxenEnc4EWfCNcTc/wWKVmv89y+XRfFYWZdNN CyfQZ6+o0G6uE80tPZYN1YYF95KI0NuKFArv9PCxpGQ5OV8SdxQKK1VpW8T5ph6+79 jxU+82rU4K2X/Ag1VhVhDIlnz53JQ+bVIcZy/Z20= From: Stephen Farrell To: "Livingood, Jason" , DoH WG References: Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> Date: Sun, 10 Mar 2019 10:42:20 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="nj3CPnuRX5KHcxknzcOYGqnXdSQUK7ISs" Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 10:42:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --nj3CPnuRX5KHcxknzcOYGqnXdSQUK7ISs Content-Type: multipart/mixed; boundary="jCVMIYja4HIsq7jpIh7ODyUyWK1CE4ynX"; protected-headers="v1" From: Stephen Farrell To: "Livingood, Jason" , DoH WG Message-ID: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues References: In-Reply-To: --jCVMIYja4HIsq7jpIh7ODyUyWK1CE4ynX Content-Type: multipart/mixed; boundary="------------531235ECF396F732B044C494" Content-Language: en-GB This is a multi-part message in MIME format. --------------531235ECF396F732B044C494 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 09/03/2019 01:23, Livingood, Jason wrote: > FYI that this document has posted. I have requested 10 mins of agenda > time in the DOH WG at IETF 104. You'll be doing well to cover even the relevant parts of that in 10 minutes! (And yes it may well make more sense to discuss these topics in dnsops.) I say "relevant parts" because I think the draft has a mixture of arguments about DoH and ones that are fairly clearly independent of DoH. For example: AMP and smart-speakers are technologies that could also be criticised as enabling mega-companies to bypass systems operated by many others (such as the DNS and/or the web); a bunch of arguments are fairly generic "confidentiality mechanisms change who can see what", and lastly, the ability of current web-browser/service-provider combinations to quickly change network traffic patterns affects lots more than just DNS. I think I also agree with some of Stephane's criticism, (of this and also of draft-reid) e.g. the recommendations described here don't seem to me to be justified by the arguments provided - some I'd agree with, others not, but the current text just does not justify making that set of recommendations. I guess there isn't time before the submission cut-off, and it depends whether or not you really want this draft to end up as an RFC, but a serious re-structuring and merging with draft-reid could help a lot if the authors did want that text to end up in an RFC. Cheers, S. --------------531235ECF396F732B044C494 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------531235ECF396F732B044C494-- --jCVMIYja4HIsq7jpIh7ODyUyWK1CE4ynX-- --nj3CPnuRX5KHcxknzcOYGqnXdSQUK7ISs Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyE6gwACgkQWrL68XsX K+oJIRAAwIO31NsvBz8mIa8biKkJBXYfYrBft7MfF4EjkBIulYMrK0g79D5kBZeT lhudAa1DZdlHs5v6vHCBvV1CH1nZZdOwVhfO4Y6PDsFy9fjYK+tbKHS5hx+xBe5z 5dsFsBrlZvdu6pNRrebfPlByzrJ3H7tu6Fj8sJ8Uq9WeV6f6CUN7rkTFzRl7ov/A k/Xc/5QavnnWvbvuPRRDn1g6s/UjmB3lRikDzCnGtX+lNmVf2DBJYjOTDkn0Md2L MgCsLLpRVUAXNG0I4pNKjVrSkA3699A12CP57QXmPMbuRulwxh4xgHmqxwqhfBUr Wo+JKNzCvlfk03/8VwXTypwIVLi8VfeZJtlZ8a8SZwOMBS3Xt57r2LrTBMy6K9FU JkE3C3ebFg9ym59Pc8UI+GPM73xz8lv8SB23oIbQ/5RTO0NE0ZWVUOLCnLtdJq2O 91lbC4ihkxw0KBVjteSMo4uXsX1y+HD6eC632WtGScFaRifvZtblN1gM1qbkYAgZ rQwxj8O3YCz0lmxo7Nk6RXRL0Cgadoe9jfKpKTRPkIJC6ew4gcTaf8lDXbFsQdoI N/ipeaAW3NsrZMd+JmwUQi0FXqLWmhl/7P+zN7CBS6Zt3ZA8rrnlMpx5p9ZB6BPN s6grY5P2ZK0UXRCPFMy2A4lp0qqemuIB8OLmyZaL/XWagW861Nk= =CPhD -----END PGP SIGNATURE----- --nj3CPnuRX5KHcxknzcOYGqnXdSQUK7ISs-- From nobody Sun Mar 10 03:59:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 948001200ED; Sun, 10 Mar 2019 03:59:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UQLf57h-6tA0; Sun, 10 Mar 2019 03:59:08 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6180C124D68; Sun, 10 Mar 2019 03:59:08 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 54BE6A052E; Sun, 10 Mar 2019 11:59:06 +0100 (CET) Received: by godin (Postfix, from userid 1000) id 622F4EC0B0D; Sun, 10 Mar 2019 11:58:15 +0100 (CET) Date: Sun, 10 Mar 2019 11:58:15 +0100 From: Stephane Bortzmeyer To: Warren Kumari Cc: Jim Reid , dnsop , DoH WG Message-ID: <20190310105815.GA16820@laperouse.bortzmeyer.org> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 10:59:11 -0000 On Sun, Mar 10, 2019 at 03:48:52PM +0900, Warren Kumari wrote a message of 281 lines which said: > I think it would be very valuable to not conflate DNS-over-HTTPS > (the protocol) with the "applications might choose to use their own > resolvers" concerns. I fully agree. Applications using their own resolver is Bad, IMHO, but 1) it is unclear what the IETF can do since it is outside of the protocol field (may be documenting our concerns?) 2) it has little to do with DoH. > Someone (it may have been Vittorio Bertola) coined the term DNS-over-Cloud > (DoC) Bert Hubert > 3: "resolverless DNS", I personnaly don't agree with "resolverless DNS". There *is* a resolver, just not the "usual" one. > Also, I think that this topic would be better discussed in the DNSOP > WG - Again, I fully agree, since it is not DoH-specific. From nobody Sun Mar 10 04:03:24 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2B40124D68; Sun, 10 Mar 2019 04:03:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bfzD9nCq17CM; Sun, 10 Mar 2019 04:03:21 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3579D1200ED; Sun, 10 Mar 2019 04:03:21 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id B676DA052E; Sun, 10 Mar 2019 12:03:19 +0100 (CET) Received: by godin (Postfix, from userid 1000) id 77480EC0B0D; Sun, 10 Mar 2019 12:01:20 +0100 (CET) Date: Sun, 10 Mar 2019 12:01:20 +0100 From: Stephane Bortzmeyer To: Paul Vixie Cc: Warren Kumari , DoH WG , dnsop Message-ID: <20190310110120.GB16820@laperouse.bortzmeyer.org> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <8855871d-c059-3938-12a1-62f21c089e1d@redbarn.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <8855871d-c059-3938-12a1-62f21c089e1d@redbarn.org> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 11:03:23 -0000 On Sat, Mar 09, 2019 at 11:01:33PM -0800, Paul Vixie wrote a message of 32 lines which said: > i have been away as long as possible, which means i was surprised > that the IESG was willing to allow a document to standardize I'm not surprised, since, in the last years, there have been a strong increase in network neutrality violations, censorship through DNS, privacy invasions, etc. I'm glad the IETF (not just the IESG) decided to act and to develop techniques that can help to restore some sort of access. From nobody Sun Mar 10 04:32:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2336B124D68 for ; Sun, 10 Mar 2019 04:32:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dYSqmi0ZeVZp for ; Sun, 10 Mar 2019 04:32:47 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E8D711200ED for ; Sun, 10 Mar 2019 04:32:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4149; q=dns/txt; s=iport; t=1552217567; x=1553427167; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=CxXjpUikNiS3JVMp2fncAdGnLO0se0Bo7Q06SyQrh7o=; b=FynXBtslMDS9jWQVOLrb0jRK28M+wza+AWZ4Xn9tgriiSUjxFTM9zOHg KyNouI/YVwO2YONYGdoUKaz+Odm79BCELDZSxy0qYsiiGhRL2Ue0n6KLJ e2rivCa0Ji5bDPZkBDmRzZ40UGG52wZyCiPLsnVXik2qTkQvDoHR8WB0c U=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A9AABh9YRc/xbLJq1jGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYNIIRKEMIh5jDeSWIduCAMBAYRsAoRXOBIBAQMBAQc?= =?us-ascii?q?BAwJtKIVLBiNPBxALBD4CAlcGgzUBgXWuS4EvhUWEUA+BL4FJiXuBf4E4DBO?= =?us-ascii?q?CTIRagzExgiYDkTySZQmEWY4zGYsCiDiaUYJuAgQGBQIVgV4hgVYzGggbFWU?= =?us-ascii?q?BgkI9kA4+A45ogk0BAQ?= X-IronPort-AV: E=Sophos;i="5.58,464,1544486400"; d="asc'?scan'208,217";a="10653213" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 10 Mar 2019 11:32:44 +0000 Received: from [10.61.245.251] ([10.61.245.251]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x2ABWhSC023115 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sun, 10 Mar 2019 11:32:44 GMT From: Eliot Lear Message-Id: <6FD34084-C26C-4B82-8033-165C22E544FD@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_229251FD-6891-4084-BC74-8C5EC8D04B2F"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Sun, 10 Mar 2019 12:32:42 +0100 In-Reply-To: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> Cc: "Livingood, Jason" , DoH WG To: Stephen Farrell References: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.245.251, [10.61.245.251] X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 11:32:49 -0000 --Apple-Mail=_229251FD-6891-4084-BC74-8C5EC8D04B2F Content-Type: multipart/alternative; boundary="Apple-Mail=_CBA8046F-9BC1-4210-BCDD-CFD876305BA0" --Apple-Mail=_CBA8046F-9BC1-4210-BCDD-CFD876305BA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Stephen, I think this is a great discussion to have. Both drafts are provocative = and, at least to me, important. I don=E2=80=99t agree with everything = in them, but I especially like how draft-livingood is organised, because = one can essentially break out each paragraph into its own exploration to = determine if one agrees or not, both in terms of issues raised and = recommendations. Is this a DoH thing? I guess that boils down to whether the IETF views = its standards as enabling technology. In as much as we do, then we = should discuss the ramifications of our decisions, especially if someone = sees architectural risks. Two examples of how this broadens out: Centralization/concentration isn=E2=80=99t limited to DoH but DoH could = well act as a catalyst. it depends if the mechanism is benefiting from = non-preexisting relationships. Trust and accountability, as relates to a service. This is a whopper of = a topic, but clearly worthy of exploration. Anyone who thinks this is a = simple topic is fooling themselves. I=E2=80=99d be up for a side meeting on all of this in Prague if others = are interested. Eliot --Apple-Mail=_CBA8046F-9BC1-4210-BCDD-CFD876305BA0 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi Stephen,

I think this is a great = discussion to have.  Both drafts are provocative and, at least to = me, important.  I don=E2=80=99t agree with everything in them, but = I especially like how draft-livingood is organised, because one can = essentially break out each paragraph into its own exploration to = determine if one agrees or not, both in terms of issues raised and = recommendations.

Is this a DoH thing?  I guess that boils down to whether = the IETF views its standards as enabling technology.  In as much as = we do, then we should discuss the ramifications of our decisions, = especially if someone sees architectural risks.  Two examples of = how this broadens out:
  • Centralization/concentration isn=E2=80=99t limited to DoH but = DoH could well act as a catalyst.  it depends if the mechanism is = benefiting from non-preexisting relationships.
  • Trust = and accountability, as relates to a service. This is a whopper of a = topic, but clearly worthy of exploration.  Anyone who thinks this = is a simple topic is fooling themselves.
I=E2=80=99d be up for a side meeting on all of this in Prague = if others are interested.

Eliot

= --Apple-Mail=_CBA8046F-9BC1-4210-BCDD-CFD876305BA0-- --Apple-Mail=_229251FD-6891-4084-BC74-8C5EC8D04B2F Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyE9doACgkQh7ZrRtnS ejN4tAf9HlMFhVF/jlOLnh4MhGwn9+JylKDnSx9Y9XM+oiYIPx6tzeT6rXJkl4Be fweg1D5BBT8IAj06PflsxNqGXhtEXXNKV1zSxQ+MC8aerCOEQ+aLmy5V/Mxjhq7P sN7To/+SSwhf0InlvHjzwB/LPmmTNyGB58of0OUbwi4P3ilZfcpYOe+xuAvvK4rB zKjioxN8u+I9sr/uReRvaxj8/LxHkJ4o6y15bzrNubDpMh9lvnJCOLNT0mPqvTHz oO0dAadPJe8kE8JWgVo1+7QcibHAlLMNJpShxv1TwqaU/5ymq+7N7fO9W+YTrTOI WydCtGZsLTMCslcCW+9jsRkH4HtLYw== =m7P9 -----END PGP SIGNATURE----- --Apple-Mail=_229251FD-6891-4084-BC74-8C5EC8D04B2F-- From nobody Sun Mar 10 05:27:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E517130DCD for ; Sun, 10 Mar 2019 05:27:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rQP4q9Ft_PWZ for ; Sun, 10 Mar 2019 05:27:20 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A6F23128B01 for ; Sun, 10 Mar 2019 05:27:17 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id A667ABE2E; Sun, 10 Mar 2019 12:27:13 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0vNdU0hYmO90; Sun, 10 Mar 2019 12:27:12 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 45905BE2C; Sun, 10 Mar 2019 12:27:12 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552220832; bh=d9QOIXND00t9NJGiCUpy+a7jFTBy2c38X6vkykYCNlI=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=03x9B5UokUEvBk/TYtmIKD+rddsJVMpiAZJuClgZos2v3nPgi4bV+FmeYeUIO1/gO xxuXMEUFyKvEkg4cH3Iy4nryO0vyP4UkPe3QZNvyqf+8x+B6FzuDiYQXvMh+J+a8wK u4EMNoMTND0ffJKnOn1qLpgUUVtVqQwELNXajWN4= To: Eliot Lear Cc: "Livingood, Jason" , DoH WG References: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> <6FD34084-C26C-4B82-8033-165C22E544FD@cisco.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <0e7986ba-b1f4-da0d-9edb-146aabb00540@cs.tcd.ie> Date: Sun, 10 Mar 2019 12:27:11 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <6FD34084-C26C-4B82-8033-165C22E544FD@cisco.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ksE1MOVYAOKlcUxEzMUYD8owsdNUpiikd" Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 12:27:25 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ksE1MOVYAOKlcUxEzMUYD8owsdNUpiikd Content-Type: multipart/mixed; boundary="H8nWut9KNarAj2RbcRxMazKNZH2jqugM2"; protected-headers="v1" From: Stephen Farrell To: Eliot Lear Cc: "Livingood, Jason" , DoH WG Message-ID: <0e7986ba-b1f4-da0d-9edb-146aabb00540@cs.tcd.ie> Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues References: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> <6FD34084-C26C-4B82-8033-165C22E544FD@cisco.com> In-Reply-To: <6FD34084-C26C-4B82-8033-165C22E544FD@cisco.com> --H8nWut9KNarAj2RbcRxMazKNZH2jqugM2 Content-Type: multipart/mixed; boundary="------------E65AAF9D8C19A97B0E2FE8FE" Content-Language: en-GB This is a multi-part message in MIME format. --------------E65AAF9D8C19A97B0E2FE8FE Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 10/03/2019 11:32, Eliot Lear wrote: > Centralization/concentration isn=E2=80=99t limited to DoH but > DoH could well act as a catalyst.=20 With one caveat, I agree: the mozilla/CF/DoH experiment (and that google could do similarly) has caused a reaction all right;-) I don't think that it's the protocol or RFC itself that's the catalyst though, it's the combination of the RFC with all the rest of the above. Cheers, S. --------------E65AAF9D8C19A97B0E2FE8FE Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------E65AAF9D8C19A97B0E2FE8FE-- --H8nWut9KNarAj2RbcRxMazKNZH2jqugM2-- --ksE1MOVYAOKlcUxEzMUYD8owsdNUpiikd Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyFAp8ACgkQWrL68XsX K+qKnw/+K7GCxQAu/jfgQFq1vPd6N1NSbVvXGrcS1OnNdYpaLiZV0scFrkssuOSa C+qo5yUb3YWY8SRCptuI5LL32NK30S2oCQq46cKTqfu+clEvEHX364uUGaNX/lN0 D/65K+RiDlisciReSAXf72OHLbFmw1PsN62hoL/bss4XpgULFqZGL1SVTSo0e5tl h0gr0Ly+NT/hGAoAJDlt6Ex5Jzphcb7M2oX7PXV0VoTDxSexR1UfJvQEC2/oQzlz EkV2G6UsYSP8dTePR1Z2GtUbkChu55xxURVsb312vFWQhH20lqOX5Aws9SDep6F6 GRaqXLwMUDItO5G1GjRWerp0xFVIO22ImqxJupkHV7Byg10+MBcrsz1Czp9eOgKw 9iPF4TYBU8Q7LUnKtyKkle7WQJnFipAX3c0EopQEMRj2QQeKp3qveUA2hLHz+26R fkSqgCcbqR5P30sWuznu1tl6ZyR/3aXdTHfqcYa93fVipSary6Sr8n40j4ddYT8C n+xrZClOe+famC5IJxR6vUZtBrcCzK+OwPw4hBocDvvNu2gT8xiChKS7taPLsxJ/ 3u4YB6bbU0kbN0r0dppO1lzKxmClaaoSFDIRcPyOI8+GZkxbOpf+6vzB+JWGEUbh oDvi50tsy/ARDw6oZlH606rwsuAnlOa/r1RT0DlyTdgonODAcT0= =3J9e -----END PGP SIGNATURE----- --ksE1MOVYAOKlcUxEzMUYD8owsdNUpiikd-- From nobody Sun Mar 10 05:54:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C72E51295EC for ; Sun, 10 Mar 2019 05:54:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0LNZ6fm4qfCk for ; Sun, 10 Mar 2019 05:54:32 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0530012D84C for ; Sun, 10 Mar 2019 05:54:32 -0700 (PDT) Received: from [10.255.249.140] (ADSL-130-146.myt.mu [41.212.130.146]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id AF4DA242109D; Sun, 10 Mar 2019 12:54:23 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190310080101.GA11452@laperouse.bortzmeyer.org> Date: Sun, 10 Mar 2019 12:54:18 +0000 Cc: DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <1964B641-FA66-4245-82B4-1351AA042BD2@rfc1035.com> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 12:54:36 -0000 On 10 Mar 2019, at 08:01, Stephane Bortzmeyer wrote: >=20 >> Operators can also be required to perform DNS blocking and filtering >> or rewriting for legal reasons >=20 > Sure, but is it IETF's job to make it easier? RFC 2804 and 7754 would > be good references here. The draft is not asking the IETF to do that Stephane. And it's a *huge* = mistake to make that assumption. All the I-D is doing here is = documenting one of the issues that will arise in operator networks once = DoH is widely deployed. There are other issues. As the draft explains. Personally speaking I think on DNS blocking and filtering, the train = left the station a long, long time ago. It isn't coming back and the = IETF is highly unlikely to define a protocol for DNS blocking and = filtering. That doesn't mean it isn't an issue in certain environments. = Or that widespread uptake of DoH is going to complicate matters for = those who do have to do these things. > I'm very glad that people consider the importance of personal data > protection, and the useful role of the GDPR in it. But I fail to see > why it's specific to DoH. Well, this is the DoH WG. Where else should we consider the role of GDPR = for that protocol and its usage? ;-) GDPR is a huge, sprawling issue = that cannot possibly be addressed in one over-arching framework for esch = IETF protocol. So IMO it's best to approach that on a = procotol-by-protpcol (or WG-by-WG) basis. YMMV.= From nobody Sun Mar 10 12:16:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DBE2C1200ED for ; Sun, 10 Mar 2019 12:15:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cuhoF9ZYhxqi for ; Sun, 10 Mar 2019 12:15:58 -0700 (PDT) Received: from mbox1.develooper.com (mbox1.develooper.com [207.171.7.178]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 315D9126CFF for ; Sun, 10 Mar 2019 12:15:58 -0700 (PDT) Received: from mbox1.develooper.com (mbox1.develooper.com [127.0.0.1]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mbox1.develooper.com (Postfix) with ESMTPS id 5A116176105 for ; Sun, 10 Mar 2019 12:15:55 -0700 (PDT) Received: (qmail 4244 invoked from network); 10 Mar 2019 19:15:55 -0000 Received: from c-98-248-50-174.hsd1.ca.comcast.net (HELO ?10.0.200.100?) (ask@mail.dev@98.248.50.174) by smtp.develooper.com with ESMTPA; 10 Mar 2019 19:15:55 -0000 From: =?utf-8?Q?Ask_Bj=C3=B8rn_Hansen?= Message-Id: <3B3B491B-AF65-4121-A936-EC058D5143A4@develooper.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_5FA55BD4-473A-4765-9753-82ED7A886917" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.2\)) Date: Sun, 10 Mar 2019 12:15:53 -0700 In-Reply-To: Cc: Jim Reid , dnsop , DoH WG To: Warren Kumari References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> X-Mailer: Apple Mail (2.3445.104.2) Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 19:16:00 -0000 --Apple-Mail=_5FA55BD4-473A-4765-9753-82ED7A886917 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Mar 9, 2019, at 10:48 PM, Warren Kumari wrote: >=20 > Also, I think that this topic would be better discussed in the DNSOP = WG - the DoH charter (https://datatracker.ietf.org/wg/doh/about/ = ) talks about: > "The primary focus of this working group is to develop a mechanism = that > provides confidentiality and connectivity between DNS clients (e.g., = operating > system stub resolvers) and recursive resolvers." I agree with this (and everything else you said). The new topics that are coming up all seem like they=E2=80=99d fit = better in DNSOP or DPRIVE. I see promise in DoH for the ways it might (eventually) change our = technology options to better make use of the (much larger than DNS) = investments in infrastructure for HTTP (and HTTP/2,3, =E2=80=A6). The =E2=80=9CDoC=E2=80=9D / policy / operational work is important, but = I don=E2=80=99t understand what=E2=80=99s DoH specific about it. Ask= --Apple-Mail=_5FA55BD4-473A-4765-9753-82ED7A886917 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On Mar 9, 2019, at 10:48 PM, Warren Kumari <warren@kumari.net> = wrote:

Also, I think that this topic would be better = discussed in the DNSOP WG -  the DoH charter (https://datatracker.ietf.org/wg/doh/about/) talks = about:
"The primary focus of this = working group is to develop a mechanism that
provides confidentiality and connectivity between = DNS clients (e.g., operating
system stub = resolvers) and recursive resolvers."

I agree with this (and everything else you = said).

The new = topics that are coming up all seem like they=E2=80=99d fit better in = DNSOP or DPRIVE.

I see promise in DoH for the ways it might (eventually) = change our technology options to better make use of the (much larger = than DNS) investments in infrastructure for HTTP (and HTTP/2,3, = =E2=80=A6).

The = =E2=80=9CDoC=E2=80=9D / policy / operational work is important, but I = don=E2=80=99t understand what=E2=80=99s DoH specific about it.


Ask
= --Apple-Mail=_5FA55BD4-473A-4765-9753-82ED7A886917-- From nobody Sun Mar 10 18:26:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04D9812D4ED for ; Sun, 10 Mar 2019 18:25:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PX3ZgePeob3a for ; Sun, 10 Mar 2019 18:25:56 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 076D01286CD for ; Sun, 10 Mar 2019 18:25:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552267553; x=2416181153; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Q/qZS+lSA0PAIMFo/tkuocDMhfB5nBm6aX5hq+oBEzM=; b=AhT+EWQvFSVbLtoAx0D+gReKtyBTliGYAUPeCrSsFpdj9OFfuUgaE2jrfR0QlgeE 0IWxXjQB/yOe+LX6eZ7KGFpP++wcy0hHtbp1AzKEmCMAzyMQAfzjJtfI7TQXwgaL 5hN7/HtFi00s98KfNAxSOn2OmN1+LBCAgnZ1ZTyW/Pm+Dap/mHlrAUh6C0dh9veT GLsuwRn6NNT0T5fxULwlOF7F0BFAcTo5IhwBdBPoebWVO7GBCdodng6XCBIN9RoP /c6rwtR5HGXMYysHLL8/b5ZGEIdf8rPoof1nyhP60jcTPnD64La9i22pFTkPn1xc SZ4RA/2MeSCXJW7MpEVl/0jbtL04Q+W/QmK0xFfr98FFyTmkEKTKODYAB3HZAl4K JUfNdzIufSk7cyjWnzmkEdgJ/EN/RzgIpva1p/3+/E8+QsUnsbXGNc7w15mYdThk R03S2ZWCpHHq3L1PNUKBgJ5PLoIqTWRh8NavFeEAJ2OjkUIZ/3TqO/onDH/6RwSS LDSlpuHhXFWDzPyPqhuLyRtVgPNSxdYa8yFQftxxWVCh+OGIdmvkYFdYzxvNLwuo iYucShuhSjyJ8VtTn6q/H+inXhDFQIe8tC70wfARe0y1H5ef3lreafGSJ/PGIqBP mj9t02kGtxQuCwadqWw0Ywq8HnqkE5AZdzJ8DlHFDJ8=; X-AuditID: a2962c47-fbdff7000001abb1-81-5c85b92142e7 Received: from COPDCEXC35.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 82.78.43953.129B58C5; Sun, 10 Mar 2019 19:25:53 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC35.cable.comcast.com (147.191.125.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Sun, 10 Mar 2019 21:25:54 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Sun, 10 Mar 2019 21:25:54 -0400 From: "Livingood, Jason" To: Stephane Bortzmeyer , Jim Reid CC: DoH WG Thread-Topic: [Doh] New I-D: draft-reid-doh-operator Thread-Index: AQHU1vHKZEEzA1Fq+0maaOBX0/6/hKYEw/iAgADg4IA= Date: Mon, 11 Mar 2019 01:25:54 +0000 Message-ID: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> In-Reply-To: <20190310080101.GA11452@laperouse.bortzmeyer.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [96.114.156.9] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrAKsWRmVeSWpSXmKPExsWSUDRnsq7iztYYg3nnBC0mLHzJaHHt7kU2 i3PPEhyYPZYs+cnkMfHfBiaP01dfMQcwRzUw2pRkFKUmlrikpqXmFafacSlgAJuk1LT8olTX xKKcyqDUnNRE7MpAKlNSczLLUov0sRqjj9WchC6mjHOXrAvecVTsONXB2MB4gaOLkZNDQsBE YsbN/cxdjFwcQgK7mCR2bD3HAuG0MEmsuHaVFcI5zShxb/9KNpAWNgEzibsLrzCD2CIC7hIL Vu1jAbGZBSQlHh0/xA5iCwsYSxzeeZsdosZEYuO26WwQtpXEl31bwHpZBFQl2vYtYwKxeQVc JFruXmIEsYUEtjFKTNhjAWJzCthJHDr7ECzOKCAm8f3UGiaIXeISt57MZ4J4QUBiyZ7zzBC2 qMTLx/9YQWxRAX2JLX0PWCDiChLv/50CuoEDqFdTYv0ufYgxVhINa48zQ9iKElO6H7JDnCMo cXLmE6hWcYnDR3awTmCUnIVk8yyESbOQTJqFZNIsJJMWMLKuYuQ1NDPSMzQ10DMx0TM33MQI TEeLpum472D8cD72EKMAB6MSD2/9jtYYIdbEsuLK3EOMEhzMSiK891YBhXhTEiurUovy44tK c1KLDzFKc7AoifMKbQZKCaQnlqRmp6YWpBbBZJk4OKUaGFXEXppveHozOKb/wPuuzxrSqrWP VMM3Lr/SXmzI7l7p53bsnZoaV2PVg6DyeUYnSsTm37B2XCf22I/hxn7vwBVdBmwlkxta//VW 8PnMlLQ2PflIb5+3sUzJMo4vqvpzg3/JrUgunlFTvKCyo0Z05q8F55XOS5mH68fOUX5xOzmO JUn/x/udSizFGYmGWsxFxYkA8G07rUMDAAA= Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 01:25:58 -0000 T24gMy8xMC8xOSwgNDowMiBBTSwgIkRvaCBvbiBiZWhhbGYgb2YgU3RlcGhhbmUgQm9ydHptZXll ciIgPGRvaC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBib3J0em1leWVyQG5pYy5mcj4g d3JvdGU6DQogICAgDQo+ICAgIEknbSBzdXJwcmlzZWQgdGhhdCBpdCBpcyBwdWJsaXNoZWQgbW9y ZSBvciBsZXNzIGF0IHRoZSBzYW1lIHRpbWUNCiAgICBkcmFmdC1saXZpbmdvb2QtZG9oLWltcGxl bWVudGF0aW9uLXJpc2tzLWlzc3Vlcy4gVGhleSBoYXZlIGEgbG90IG9mDQogICAgb3ZlcmxhcCwg YW5kIGV2ZW4gb25lIGF1dGhvciBpbiBjb21tb24uIE1heSBiZSBhIG1lcmdlIHdvdWxkIGJlIGEg Z29vZA0KICAgIGlkZWE/DQoNCltKTF0gUGVyaGFwcyBzby4gVGltZSB3YXMgc2hvcnQgYmVmb3Jl IHRoZSBjdXRvZmYgYW5kIEkgdGhpbmsgd2Ugd2FudGVkIHRvIGdldCBzb21lIHRob3VnaHRzIG91 dCB0aGVyZSBmb3IgY29tbWVudC4gDQogICAgDQogICAgPiBUaGUgc3BlY2lmaWMgaXNzdWUgbWVu dGlvbmVkICBhYm92ZSBpcyBleGFjdGx5IHRoZSBzYW1lIHdoZXRoZXIgSSB1c2UgRG9IIG9yIERO Uy1vdmVyLVVEUCB0byA4LjguOC44DQogICAgb3IgOS45LjkuOS4NCg0KW0pMXSBJIHRoaW5rIGEg c2xpZ2h0IGRpZmZlcmVuY2UgaXMgdGhhdCB3aXRoIHB1YmxpYyBETlMgc2VydmljZXMsIHRoZSB1 cHRha2Ugb2NjdXJzIGdyYWR1YWxseSBhcyBlYWNoIGluZGl2aWR1YWwgdXNlciBtYWtlcyBhbiBl eHBsaWNpdCBjaG9pY2UuIFRoaXMgaXNuJ3QgdGhlIGNhc2Ugc2hvdWxkIGxhcmdlIGFwcHMgZW5h YmxlIERvSC4NCiAgICAgICAgDQogICAgDQoNCg== From nobody Sun Mar 10 18:49:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E77DA130DD8 for ; Sun, 10 Mar 2019 18:49:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, LOTS_OF_MONEY=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v0BpAgXxbq-U for ; Sun, 10 Mar 2019 18:49:34 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 410A312EB11 for ; Sun, 10 Mar 2019 18:49:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552268971; x=2416182571; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Q+8PWAm66fDjLmwJZhdrFUKpy9tb0ldTIVEys+LK12A=; b=QnngcW8xEdyczouch/97yVPjUrhbadg9tKxZp9Y9NwDXpksmIAOTPchAXeX8Nslt u2CNUYwfYTOCxKFIyy/KD5k1Jz5+ZdVJYGRGk99OHeTwnzPKy4D1P2s7z3TGMMAq c8zCC8pMj0I/Sz/7ZjtQc7k910oebQ5ae49Qs1jPNpUmIQs60hKUS6iLBtZrqAN6 /7rJ5+xD4KyNvHwxQJfl2fdk6VAbhb2cpHKVUkygW0cEN9V3eZ5WHKKzuVl6EBe5 va8x0TggAUnIZqFGYPnj8WjDLhPcaLSz9f905dMw7lX46mnla9obsSgSRXxARI6f wgLRZl562k1lZtJvr3l+aq+K9mpBbupCzFmlvoilhBNdV9Q0ozWLCrXFJVJ6VRwC V7K8QVz4VykzYMHld7T8+rrPxRiaY9rySSk3DGN3UxqMPCUGUpV/f8ALFToLqx0E /SIFRyfcy9T80QajLyXrO4NyySAJdvdems0bA8vcTiwcCZWvHBl9fnH93zsRb7Zb aDZlQjunzk9piqtHti2sit4u3IGMqvLh8ZZAs/S71JkYAWFehJCWdNsEIXVyAjgc +XZEJ44/Kh+XooAha1MBSqyZmJ0MSXF0OgeZ49FfKbNV4jbtx5Hz7XCfJd43SXdW 1xjGnem2aqECxQBCTSDFZvCNohbAkroUuk7oaBbdAi8=; X-AuditID: 60729ed4-2e5ff700000044dc-80-5c85beabbd2f Received: from COPDCEXC38.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id DA.1E.17628.BAEB58C5; Sun, 10 Mar 2019 19:49:31 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC38.cable.comcast.com (147.191.125.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Sun, 10 Mar 2019 21:49:30 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Sun, 10 Mar 2019 21:49:31 -0400 From: "Livingood, Jason" To: Stephane Bortzmeyer CC: DoH WG Thread-Topic: [EXTERNAL] Re: [Doh] New: draft-livingood-doh-implementation-risks-issues Thread-Index: AQHU1hbDDNj2GhBc2k6lTCYNWHxRBaYD846AgAG5mIA= Date: Mon, 11 Mar 2019 01:49:31 +0000 Message-ID: References: <20190309182857.GA29321@laperouse.bortzmeyer.org> In-Reply-To: <20190309182857.GA29321@laperouse.bortzmeyer.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [96.114.156.7] Content-Type: text/plain; charset="utf-8" Content-ID: <9A16A3CBCAC25C4A998A4E00C29155D5@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrKKsWRmVeSWpSXmKPExsWSUDRnsu7qfa0xBjP2WFlMWPiS0eLa3Yts DkweS5b8ZPKY+G8DUwBTVAOjTUlGUWpiiUtqWmpecaodlwIGsElKTcsvSnVNLMqpDErNSU3E rgykMiU1J7MstUgfqzH6WM1J6GLKOPxEteCMWsXBZd1sDYxnVLsYOTkkBEwkll+9z9rFyMUh JLCLSeLCnn9sEE4Lk8SKy8uhMqcZJY7d/M0K0sImYCZxd+EVZhBbREBbYvLNHkYQm1lAUuLR 8UPsILawQIRE8/GlUDWRElf3T2eEsK0kWnrng8VZBFQlzq/8DmbzCrhILDn/lA3EFhKokDh7 fgXQLg4OTgE7ibenEkHCjAJiEt9PrWGCWCUucevJfCaIDwQkluw5zwxhi0q8fPwP7ExRAX2J LX0PWCDiChI9E6Yzg4xkFtCUWL9LH8K0klhxRw9ioqLElO6H7BDHCEqcnPkEqlNc4vCRHawT GCVnIVk8C2HQLIRBs5AMmoVk0AJG1lWMfJZmeoaGJnqGphZ6RoZGmxjBiWfelR2Ml6d7HGIU 4GBU4uFt39EaI8SaWFZcmXuIUYKDWUmE994qoBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXFe9c1A KYH0xJLU7NTUgtQimCwTB6dUA2Ndjs7qYtsWWYVuK+GyzLLs+2kTl13+8D7TZE1t9rbtAexe fjlC3WJJgZr/+jSULPgtt99QDXroWcd7x+1MneubU7d2N/E1RJuK+BnNfV+n1/i3Sfz77jLF I6ZOd5YKyvV/2hagIPTi1n7fptTUaTzHy0S3XFW3is0XnHutkefQ6mVRF1cGKrEUZyQaajEX FScCAGxvn5g4AwAA Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 01:49:36 -0000 T24gMy85LzE5LCAxOjI5IFBNLCAiU3RlcGhhbmUgQm9ydHptZXllciIgPGJvcnR6bWV5ZXJAbmlj LmZyPiB3cm90ZToNCg0KICAgID4+IE5ldHdvcmsgb3BlcmF0b3JzLCByYW5naW5nIGZyb20gSVNQ cyB0byBlbnRlcnByaXNlcywgc2Nob29scywgYW5kDQogICAgPj4gb3RoZXJzIHdvcmsgaGFyZCB0 byBwcm92aWRlIG91dHN0YW5kaW5nIEROUyBhbmQgbmV0d29yayBwZXJmb3JtYW5jZSwNCiAgICAN CiAgICA+IE5pY2UgYnV0IGNsZWFybHkgZmFsc2UuIE9uZSBvZiB0aGUgcmVhc29ucyB3aHkgbWFu eSB1c2VycyBzd2l0Y2ggdG8NCiAgICBwdWJsaWMgRE5TIHJlc29sdmVycyBpcyBiZWNhdXNlIG1h bnkgbG9jYWwgbmV0d29ya3MgYW5kIElTUCBkbyBhIGxvdXN5DQogICAgam9iIChzcGVjaWFsbHkg aW4gc29tZSBwYXJ0cyBvZiB0aGUgd29ybGQpLiBOb3QgdG8gbWVudGlvbiB0aG9zZSB3aG8NCiAg ICBzaW1wbHkgYW5ub3VuY2UgOC44LjguOCB0cm91Z2ggREhDUC4uLg0KDQpbSkxdIEl0IGlzIG15 IGV4cGVyaWVuY2UgYXMgYW4gb3BlcmF0b3IgdGhhdCBpdCBpcyBpbmRlZWQgKm5vdCogZmFsc2Us IGVsc2UgSSdkIG5vdCBoYXZlIHdyaXR0ZW4gaXQgbm9yIHdvdWxkIG1hbnkgSVNQcyB3aXRoIHNp bWlsYXIgY29uY2VybnMgbm90IGFncmVlZCB3aXRoIHRoZSBzdGF0ZW1lbnQuIFRoZSBrZXkgcGVy aGFwcyBpcyB0aGF0IEkgZGlkbid0IHNheSAqYWxsKiBvZiBjb3Vyc2UgLSBidXQgaXQgc3VyZSBz ZWVtcyBsaWtlIHdlJ3JlIG5pdCBwaWNraW5nIGhlcmUuIEkgZG9uJ3QgZGlzYWdyZWUgdGhhdCBp biBzb21lIHBhcnRzIG9mIHRoZSB3b3JsZCBhbmQgaW4gc29tZSBuZXR3b3JrcyB0aGF0IEROUyBv cGVyYXRpb25zIGNvdWxkIGJlIGltcHJvdmVkLiBCdXQgSSBjZXJ0YWlubHkgdGhpbmsgeW91IGNh biBjb25jZWRlIGdlbmVyYWxseSBzcGVha2luZyB0aGF0IG5ldHdvcmtzIChvZiBhbGwgdHlwZXMp IHN0cml2ZSB0byBtYXhpbWl6ZSBwZXJmb3JtYW5jZSAmIHJlbGlhYmlsaXR5LCBhbmQgdGhpcyB1 c3VhbGx5IGluY2x1ZGVzIGdvb2QgRE5TIHNlcnZpY2VzLiANCg0KICAgPiA+IHRoZSBjdXJyZW50 IENlbnRyYWxpemVkIERvSCBpbXBsZW1lbnRhdGlvbiBtb2RlbCBkb2VzIG5vdCBhcHBlYXIgdG8N CiAgID4gPiBtYWtlIGl0IHBvc3NpYmxlIGZvciB0aGVzZSBvcGVyYXRvcnMgdG8gY29udGludWUg dG8gcGxheSBhIHZhbHVlDQogICA+ID4gYWRkZWQgcm9sZSBpbiB0aGUgZGVsaXZlcnkgb2YgbmV0 d29yayBzZXJ2aWNlcw0KICAgIA0KICAgID4gU29tZSBwZW9wbGUgbWF5IGNvbnNpZGVyIHRoYXQg dGhpcyBpcyBub3Qgc29tZXRoaW5nIHdlIHdhbnQgZnJvbSB0aGUNCiAgICBJU1BzLiAidmFsdWUg YWRkZWQiIGlzIG9mdGVuIHRoZSBjb2RlIHdvcmQgZm9yIHZpb2xhdGlvbnMgb2YgbmV0d29yaw0K ICAgIG5ldXRyYWxpdHkuDQoNCltKTF0gSXQgaXMgbm90IHdoYXQgaXMgaW50ZW5kZWQgaW4gdGhl IGRvY3VtZW50IGJ1dCB5b3VyIHBlcnNwZWN0aXZlIG9uIHRoYXQgaXNzdWUgaXMgbm90ZWQuDQoN CiAgID4gSWYgeW91IGNhcmUgb25seSBhYm91dCBieXRlcywgdmlkZW8NCiAgICBwcm92aWRlcnMg d2lsbCBhbHdheXMgd2luLiBCdXQgb3RoZXIgbWV0cmljcyBjb3VsZCBiZSB1c2VkOiBpcyBhIHZp ZGVvDQogICAgb2YgYSBjdXRlIGtpdHRlbiBtb3JlIGltcG9ydGFudCB0aGFuIGEgUERGIGRvY3Vt ZW50IHdoaWNoIGlzIGENCiAgICBtdWx0aS1taWxsaW9uIGRvbGxhcnMgY29udHJhY3Q/DQoNCiAg ID4gPiBUaGUgRHluIGF0dGFjayBwcm92aWRlcyBhIHZpdmlkIGlsbHVzdHJhdGlvbiBvZiBob3cg RE5TDQogICA+ID4gaW5mcmFzdHJ1Y3R1cmUgdnVsbmVyYWJpbGl0aWVzIC0gYW5kIEROUyBzcGFj ZSBjb25jZW50cmF0aW9uIC0gY2FuDQogICA+ID4gd3JlYWsgaGF2b2Mgb24gdGhlIHN0YWJpbGl0 eSBvZiB0aGUgSW50ZXJuZXQuIg0KICAgIA0KICAgPiBJcyBpdCByZWFsbHkgcmVsZXZhbnQsIHNp bmNlIGl0IHdhcyBhbiBhdHRhY2sgb24gYXV0aG9yaXRhdGl2ZSBETlMNCiAgICBzZXJ2ZXJzPyBI YXZpbmcgbG90IG9mIGxvY2FsIHJlc29sdmVycyB3b3VsZCBub3QgaGF2ZSBjaGFuZ2VkIGl0cw0K ICAgIGNvbnNlcXVlbmNlcy4NCg0KW0pMXSBZZXMsIGl0IHN1Z2dlc3RzIHRoYXQgd2hlbiBhIHBy b3ZpZGVyIGhhbmRsZXMgcmF0aGVyIGEgbG90IG9mIGEgcGFydGljdWxhciBwcm90b2NvbCB0aGF0 IGFuIG91dGFnZSBvciBhdHRhY2sgb24gdGhhdCBwcm92aWRlciBjYW4gaGF2ZSBhIHNpZ25pZmlj YW50IGltcGFjdC4gVGhlIHF1b3RlZCBwYXBlciB1c2VzIGl0IGFzIGFuIGV4YW1wbGUgb2YgdGhl IGxhcmdlciBpc3N1ZS4gDQoNCiAgID4gPiBETlMgYmxvY2tsaXN0cywgd2hpY2ggYXJlIG9uZSBv ZiB0aGUgcHJpbWFyeSBhbmQgbW9zdCBlZmZlY3RpdmUgd2F5cw0KICAgPiA+IHRvIHByb3RlY3Qg YSBuZXR3b3JrIGFuZCBpdHMgdXNlcnMgYWdhaW5zdCBtYWx3YXJlLCBwaGlzaGluZywgc3BhbSwN CiAgID4gPiBERG9TIGF0dGFja3MsIGV0Yy4NCiAgICANCiAgICA+IENhbiB5b3UgZXhwbGFpbiBo b3cgYSBibG9ja2xpc3Qgb24gdGhlIEROUyByZXNvbHZlciBwcm90ZWN0cyBhZ2FpbnN0DQogICAg c3BhbSBhbmQgZERvUz8NCg0KW0pMXSBRdWl0ZSBhIGxvdCBvZiBzcGFtIGFuZCBERG9TIHRyYWZm aWMgZW1hbmF0ZXMgZnJvbSBib3R0ZWQgaG9zdHMuIFRvIHRoZSBleHRlbnQgdGhhdCB5b3UgY2Fu IHByZXZlbnQgbWFsd2FyZSBpbmZlY3Rpb24sIGRldGVjdCBhbmQgcmVtZWRpYXRlIGluZmVjdGlv biwgb3IgZGV0ZWN0IGFuZC9vciBpbnRlcnJ1cHQgY29tbWFuZCAmIGNvbnRyb2wgdHJhZmZpYyB0 aGVuIHlvdSBjYW4gaGF2ZSBhbiBpbXBhY3Qgb24gc3BhbSBhbmQgRERvUy4gDQoNCiAgPiAgPiBM b3NzIG9mIFBhcmVudGFsIENvbnRyb2xzIG9yIG90aGVyIENvbnRlbnQgQ29udHJvbHMNCiAgICAN CiAgID4gVGhlIGRyYWZ0IHNlZW1zIHRvIGFzc3VtZSB0aGF0IGx5aW5nIEROUyByZXNvbHZlcnMg YXJlIGEgZ29vZCB0aGluZw0KICAgIChwb2xpdGljYWxseSBhbmQgdGVjaG5pY2FsbHkpIGJ1dCBJ IGRvbid0IHRoaW5rIHRoZXJlIGlzIGFuIElFVEYNCiAgICBjb25zZW5zdXMgaGVyZS4NCg0KW0pM XSBJIHRvdGFsbHkgdW5kZXJzdGFuZCB0aGUgJ2x5aW5nIHJlc29sdmVyJyBwZXJzcGVjdGl2ZS4g QnV0IHdlIG5lZWQgdG8gYmUgcmVhbGlzdGljIGFib3V0IGhvdyB0ZWNobm9sb2d5IGlzIHVsdGlt YXRlbHkgdXNlZC4gTWFueSBwZW9wbGUgaGF2ZSB5b3VuZyBjaGlsZHJlbiBhbmQgbWF5IHdhbnQg dG8gZmlsdGVyIHdoYXQgY29udGVudCB0aGV5IGhhdmUgYWNjZXNzIHRvIGF0IGhvbWUuIEFuZCBz Y2hvb2xzIGZvciB5b3VuZyBjaGlsZHJlbiBtYXkgc2ltaWxhcmx5IHdhbnQgdG8gYmxvY2sgY2Vy dGFpbiBjb250ZW50IGZyb20gc2Nob29sLiBPciB3YW50IHRvIGVuc3VyZSB0aGVpciBkZXZpY2Vz IGFyZW4ndCB0YWxraW5nIHRvIHdlbGwta25vd24gbWFsd2FyZSBDJkMgc2VydmVycywgZXRjLg0K DQpBbnl3YXkgLSB0aGFua3MgZm9yIHlvdXIgcmV2aWV3IGFuZCBzaGFyaW5nIHlvdXIgdGhvdWdo dHMhDQoNCkphc29uIA0KDQo= From nobody Sun Mar 10 19:01:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 36BA9130E7C for ; Sun, 10 Mar 2019 19:01:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Vc99Cq4PulE for ; Sun, 10 Mar 2019 19:01:22 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42963130E90 for ; Sun, 10 Mar 2019 19:01:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552269681; x=2416183281; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=04NxZ+BwBjyaI/f9Qgcq0ywwRc19wp+kT++BDuPIT6I=; b=gJFG56wh5bi+DHptDfFnzd45MLMfAVR90VmBbOgGowfnUF3JJzcRNT/LZaTI4Lbm f8YS24RoThgItEHBoEMt+XUWBNraO24FNHe10tDLtR9aMXHDmV/QXsQVxtZgBswX dG/3nk8aL7tAJbaUZ3lemIxnTIUIkX1gJ1hoptH6byFluoXNkN268nyiQ/aMNhO1 +aCKYPzg+D/QSADbgNdojJDp1Q+3vG1WsmNb1Efnjyjm3SFdubODUbNTYonNK3Cc M09FhpRioi7jwk58iErB2y4DFJt/NDdlMgY2fVwtVfKpvr3v4Pavz2Hx/wPbI0nq h/1HXTO/y2Gecsf+SAcEq73ruQjZuLe6HjU39GunntQMS+BkqxIOcVc0Bzw5q7qa hTTDaIZmDnCShFUh57+95PJhTn9ft+6BjxCOahMYXGVkqRHddz/0bv0F9zNSVnbM ORvdmfv5HFW1PZxHryxt9CgB6OOzn1B5e4PDA9IUHxENGJzBnMrofO1Fepn7F1uc vE0lZPVf6Y6zsKhuGh7kZZDFYsc0q4+UNmmSBKCnm9CLNQQ8BlnoFOgv9X0EyRAz oP5bvRIPydwDFRa5vHsUH6nj/b3M73HkIk3qZJfQTTRn7JggtDF/3pFR1l/FxXg+ Un2XV08FZOdKuji7wqRGK2x6ctTK2ZRyVT0aKWuloZ4=; X-AuditID: 60729ed4-2e5ff700000044dc-7a-5c85c171f069 Received: from COPDCEXC40.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id A8.7E.17628.171C58C5; Sun, 10 Mar 2019 20:01:21 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC40.cable.comcast.com (147.191.125.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Sun, 10 Mar 2019 22:01:20 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Sun, 10 Mar 2019 22:01:20 -0400 From: "Livingood, Jason" To: Stephane Bortzmeyer , Ralf Weber CC: DoH WG Thread-Topic: [EXTERNAL] Re: [Doh] New: draft-livingood-doh-implementation-risks-issues Thread-Index: AQHU1hbDDNj2GhBc2k6lTCYNWHxRBaYD846AgAA6YICAAI/zAIAA8pSA Date: Mon, 11 Mar 2019 02:01:20 +0000 Message-ID: <108AC104-CE43-4DD7-8C6C-383BBACDE038@cable.comcast.com> References: <20190309182857.GA29321@laperouse.bortzmeyer.org> <6ED365D5-8717-46A6-B75E-A628753C2979@fl1ger.de> <20190310073306.GA10396@laperouse.bortzmeyer.org> In-Reply-To: <20190310073306.GA10396@laperouse.bortzmeyer.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [68.87.29.8] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrMKsWRmVeSWpSXmKPExsWSUDRnsm7hwdYYg4mHxCwmLHzJaPF841Y2 i2t3L7I5MHt8f72A2WPJkp9MHhP/bWAKYI5qYLQpyShKTSxxSU1LzStOteNSwAA2Salp+UWp rolFOZVBqTmpidiVgVSmpOZklqUW6WM1Rh+rOQldTBnNB34zFdxjr7jQuIyxgfEIexcjJ4eE gIlE36EpLF2MXBxCAruYJHZM/APltDBJ7F04B8o5zShx5OtXVpAWNgEzibsLrzCD2CIC7hJT f/SB2cwCkhKPjh8CGyssECHRfHwpVE2kxNX90xm7GDmAbDeJpvs5IGEWAVWJE3s+s4DYvAIu Eh/u/YPadR9o1/d/YL2cAnYSE7ZeAytiFBCT+H5qDRPELnGJW0/mM0G8ICCxZM95ZghbVOLl 439gd4oK6Ets6XvAAhGXk+jZ0Qp2A7OApsT6XfoQY6wkOicsZYOwFSWmdD9kh7hHUOLkzCdQ reISh4/sYJ3AKDkLyeZZCJNmIZk0C8mkWUgmLWBkXcXIZ2mmZ2hoomdoaqFnZGi0iRGclOZd 2cF4ebrHIUYBDkYlHt72Ha0xQqyJZcWVuYcYJTiYlUR4760CCvGmJFZWpRblxxeV5qQWH2KU 5mBREudV3wyUEkhPLEnNTk0tSC2CyTJxcEo1MDLq/3Rye5NekyLfuWWW8Gaf3U5Mwsz7l/5l 8K/RtZIRCRYzNbra2fFl3ambiZeOvudhcrs4zVTB7sCSSxJs8t4KMV1lS4UvLtEPPu/XZ7wp MWStqVm1VPXmvbHSSutu5OcUTdHmznQTCupUkm+dyalvsyZt2o/bt0/L5PwqWbjJOtrcKa5A iaU4I9FQi7moOBEAUMp6KUYDAAA= Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 02:01:34 -0000 DQoNCu+7v09uIDMvMTAvMTksIDM6MzcgQU0sICJTdGVwaGFuZSBCb3J0em1leWVyIiA8Ym9ydHpt ZXllckBuaWMuZnI+IHdyb3RlOg0KICAgID4gSSB0aGluayB0aGUgb25seSB3YXkgdG8gZ2V0IGxv dHMgb2YgRG9IIHByb3ZpZGVycyBpcyB0byBoZWxwIHRoZQ0KICAgID4gSVNQcyB0byBkbyBpdCBh cyB0aGV5IGFyZSB0aGUgbmF0dXJhbCBkZWNlbnRyYWxpc2VkIHBsYXllciBvbiB0aGUNCiAgICA+ IGludGVybmV0Lg0KICAgIA0KICAgIENsZWFybHksIHdlIGRpc2FncmVlIGhlcmUsIGJ1dCBpdCBz ZWVtcyBtb3JlIGEgcG9saXRpY2FsIGRpc2FncmVlbWVudA0KICAgIHRoYW4gYSB0ZWNobmljYWwg aXNzdWUgd2l0aCB0aGUgcHJvdG9jb2wgb2YgdGhpcyBXRy4NCg0KW0pMXSBQZXJoYXBzIHNvLiBT ZWUgU2VjdGlvbiAyIEAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LWxpdmluZ29v ZC1kb2gtaW1wbGVtZW50YXRpb24tcmlza3MtaXNzdWVzLTAxI3NlY3Rpb24tMi4gSW4gYW55IGNh c2UsIG1vbnRocyBhZ28gSSBzdGFydGVkIHRvIHJhaXNlIHNvbWUgb2YgdGhlc2UgKG5vbi1wcm90 b2NvbCBidXQgaW1wbGVtZW50YXRpb24pIGlzc3VlcyBvbiB0aGUgRG9IIFdHIGxpc3QgYW5kIGl0 IHdhcyBzdWdnZXN0ZWQgSSBkb2N1bWVudCB0aGVtIGFuZCBicmluZyBpdCBiYWNrIHRvIHRoZSBX Rywgd2hpY2ggaXMgd2hhdCBJIGhhdmUgZG9uZS4NCiAgICANCg0K From nobody Sun Mar 10 19:03:15 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5E225130E2E; Sun, 10 Mar 2019 19:03:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sOvudlyYrbU7; Sun, 10 Mar 2019 19:03:07 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B626E130E7C; Sun, 10 Mar 2019 19:03:05 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 84E296A27C; Mon, 11 Mar 2019 03:03:03 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552269783; bh=2x6sJEDk+y7MD5XWb5jMyeyXNdYOIJzmT+mH8ucIoRQ=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=rBk+70v/cWp51ZoHu6DVycMmR8okeu7530c8/vtyZ2+Hl8nTkcTxEks5cKlxjcM7h Sj5eKLbFcwPnyaoC+haiOjwTjWiySI6oQvS9TG9FyRzHv+siKtd5k6bu+omsOqEm2M eknFc86M6OPb8B28PpxVGLWjE8jodhmWOwNxRbmCbQIAssV/be10G5ZrC1ykxItUbG Pa6pT0LAAblg+ASEP30XvQ3A0Gktp9MYLOqXoiOAciMR7kR5GH4uJgCo/Vpp/LNT9E Qi0T7l6d3uoyzLGej+Y+JxSw/jzAoDI/sNoSVeyxyEVVo9WTdJ81aprTq9nmGbLyfF ywX3sac22Evfw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 69B5A3C0734; Mon, 11 Mar 2019 03:03:03 +0100 (CET) Date: Mon, 11 Mar 2019 03:03:02 +0100 (CET) From: Vittorio Bertola To: =?UTF-8?Q?Ask_Bj=C3=B8rn_Hansen?= , Warren Kumari Cc: DoH WG , dnsop Message-ID: <1615000186.12829.1552269783372@appsuite.open-xchange.com> In-Reply-To: <3B3B491B-AF65-4121-A936-EC058D5143A4@develooper.com> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3B3B491B-AF65-4121-A936-EC058D5143A4@develooper.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_12828_1737723645.1552269783363" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 02:03:10 -0000 ------=_Part_12828_1737723645.1552269783363 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable > Il 10 marzo 2019 alle 20.15 Ask Bj=C3=B8rn Hansen ha= scritto: >=20 >=20 >=20 >=20 > > > On Mar 9, 2019, at 10:48 PM, Warren Kumari < warren@k= umari.net mailto:warren@kumari.net > wrote: > >=20 > > Also, I think that this topic would be better discussed in the = DNSOP WG - the DoH charter ( https://datatracker.ietf.org/wg/doh/about/) t= alks about: > > "The primary focus of this working group is to develop a mechan= ism that > > provides confidentiality and connectivity between DNS clients (= e.g., operating > > system stub resolvers) and recursive resolvers." > >=20 > > >=20 > I agree with this (and everything else you said). >=20 > The new topics that are coming up all seem like they=E2=80=99d fit be= tter in DNSOP or DPRIVE. >=20 For the sake of completeness, I will mention that I have also just posted a= draft that tries to address the issues deriving from the adoption of encry= pted DNS protocols, under the form of a best practice document for client a= pplications: https://mailarchive.ietf.org/arch/msg/dns-privacy/3ryu5BxcjRJO1-zeRXJaKIcID= UY I decided that dprive was the right place for it, and I will briefly presen= t it there, but I agree that the first discussion (even in a side meeting i= n Prague, if there is interest) would be where to deal with the topic withi= n the IETF, and to which extent; it would make sense to have a single coord= inated discussion rather than multiple parallel ones. Regards, --=20 Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com= =20 Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_12828_1737723645.1552269783363 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =20 =20

Il 10 marzo 2019 alle 20.15 Ask Bj=C3=B8rn Hansen <ask@develooper.com= > ha scritto:=20



On Mar 9, 2019, at 10:48 PM, Warren Kumari <=20 warren@kumari.net= > wrote:

Also, I think that this topic would be better discussed in the DNSOP= WG -  the DoH charter (=20 ht= tps://datatracker.ietf.org/wg/doh/about/) talks about:
"The primary focus of this working group is to develop a mechanism t= hat
provides confidentiality and connectivity between DNS clients (e.g.,= operating
system stub resolvers) and recursive resolvers."

I agree with this (and everything else you said).

The new topics that are coming up all seem like they=E2=80=99d fit bett= er in DNSOP or DPRIVE.
For the sake of completeness, I will mention that I have also just poste= d a draft that tries to address the issues deriving from the adoption of en= crypted DNS protocols, under the form of a best practice document for clien= t applications:


I decided that dprive was the right place for it, and I will briefly pre= sent it there, but I agree that the first discussion (even in a side meetin= g in Prague, if there is interest) would be where to deal with the topic wi= thin the IETF, and to which extent; it would make sense to have a single co= ordinated discussion rather than multiple parallel ones.

Regards,
--=20 
Vittorio Bertola | Head of Policy & Innovation, Open=
-Xchange
vittorio.b=
ertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Ital=
y
=20 ------=_Part_12828_1737723645.1552269783363-- From nobody Sun Mar 10 19:07:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDBB6130E2E for ; Sun, 10 Mar 2019 19:07:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vr9brAryNPee for ; Sun, 10 Mar 2019 19:07:24 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 523B5127598 for ; Sun, 10 Mar 2019 19:07:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552270043; x=2416183643; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Io5uyXrjNyx2EO615NVstbISfK+3wv2tpH9VrjuuE5s=; b=bkBNUBYYg3Ec+abDZVo58Jf44ktvhfeSdBZKpftKmrZ2jniouCYn0phdOpRnyx25 w8qe5WaHnq7MI2YpsBk0VntHutQ1OWR1oD6ITzbn1A4HKGEUzCmYFiO6c8T/BoiZ MtYeQqE2SMh9T16yN0lbveiNcugLFOeeZwb3rxCX3Xh+HW6weVD9aXVcAWeuHECp LY3ndlTxFmJYzkK6SercJ1JQeHIwBeYqX5F+h0zTORP/4PwZmWVC7izXyboKAh9w m+aOn2nAZFUcbnK39Bg0fyWpeN6YBlEqDFxLjCUrCXydj1cq9eK0IBfIqXs6dY7U GnOxKApLM8bRIKKo9+iy+tjMzWvLmCPgEOh73MPzU+sBJF/APmtQg8eJq6GRaBzS cv6UFXcdiaxLllhT4IfhMEzoKViB8HecOrJNz9CXWfU2sdMb5llnxTULHl4lmfZi 3TDU2cVWJwsqBXjlt0/Q1wZyuK27OiOXe7QJaA/wnwUUgheD/KyCIVhzXt/Fhb5g 43wC8iYBQPL5roJ+e6CouVf+pYNJF7X/yUoszXBd11cs+7O1d/3LGR/+yG1HTvVP DyXv9ovwNM8e8k0Jn+BszrkLKFNkE1/wd9UWPf0nSP1G+YE+kaCbZfTitoGU6ucz lva6Ae3Bwv6qNfNhElTFjnTUusmMbIiKhV/vVWx1nZw=; X-AuditID: 60729ed4-2cdff700000044dc-6b-5c85c2db8987 Received: from COPDCEXC36.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 7B.9E.17628.BD2C58C5; Sun, 10 Mar 2019 20:07:23 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC36.cable.comcast.com (147.191.125.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Sun, 10 Mar 2019 22:07:22 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Sun, 10 Mar 2019 22:07:23 -0400 From: "Livingood, Jason" To: Stephen Farrell , DoH WG Thread-Topic: [Doh] New: draft-livingood-doh-implementation-risks-issues Thread-Index: AQHU1hbDDNj2GhBc2k6lTCYNWHxRBaYE8sAAgAC/ZIA= Date: Mon, 11 Mar 2019 02:07:22 +0000 Message-ID: <417D5522-AB62-4B40-813E-36A388667B49@cable.comcast.com> References: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> In-Reply-To: <5c663bdb-c3af-9bf8-4a1b-6ccfa32b583d@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 x-originating-ip: [96.114.156.8] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprFKsWRmVeSWpSXmKPExsWSUDRnsu7tQ60xBl8/KFpcu3uRzWL63mvs Dkwea7uvsnksWfKTKYApqoHRpiSjKDWxxCU1LTWvONWOSwED2CSlpuUXpbomFuVUBqXmpCZi VwZSmZKak1mWWqSP1Rh9rOYkdDFlbF/ykbFgHn/Fwn17GBsY3/B1MXJwSAiYSMyYa93FyMUh JLCLSWL3la/sEE4Lk8SNTyuZuhg5gZzTjBInV+eC2GwCZhJ3F15hBrFFBNwkdr1YA2YLC7hL HOvrZoKIe0g0LHjIArJARMBKom8GC0iYRUBVYsmUr2wgNq+Ai8TTmz1Q48slPhz4CTaGU8BW 4vm17WA2o4CYxPdTa8BqmAXEJW49mQ9mSwgISCzZc54ZwhaVePn4HyuILSqgL7Gl7wELRFxB Yvv+bWAnMAtoSqzfpQ8xxkqi+9U6dghbUWJK90N2iHMEJU7OfALVKi5x+MgO1gmMErOQbJ6F MGkWkkmzkEyahWTSAkbWVYx8lmZ6hoYmeoamFnpGhkabGMEpZt6VHYyXp3scYhTgYFTi4W3f 0RojxJpYVlyZe4hRgoNZSYT33iqgEG9KYmVValF+fFFpTmrxIUZpDhYlcV71zUApgfTEktTs 1NSC1CKYLBMHp1QDY1/fHUnG9X9m/HPV9zeznfNg4puuJ1rKMxLK2BZm3Lj/+0Edp9GrrjXz Z30KL/vhzpZf2p7/7I4O96d/T8sbvh27NKMvZWvbV7b+kIsn53Qz7qlccERtA8cFX6s7Whe+ OepLLZhiYekttN50fkfv3225Fdab7eZu+foicuPGV01y8jY9Op+je5VYijMSDbWYi4oTARcT pEMtAwAA Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 02:07:26 -0000 T24gMy8xMC8xOSwgNjo0MiBBTSwgIkRvaCBvbiBiZWhhbGYgb2YgU3RlcGhlbiBGYXJyZWxsIiA8 ZG9oLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIHN0ZXBoZW4uZmFycmVsbEBjcy50Y2Qu aWU+IHdyb3RlOg0KPiAgKEFuZCB5ZXMgaXQgbWF5IHdlbGwgbWFrZSBtb3JlIHNlbnNlDQogICAg dG8gZGlzY3VzcyB0aGVzZSB0b3BpY3MgaW4gZG5zb3BzLikNCg0KW0pMXSBIYXBweSB0byBnbyB0 byB3aGF0ZXZlciB2ZW51ZSB1bHRpbWF0ZWx5IG1ha2VzIHNlbnNlLiA6LSkNCiAgICAgICAgDQo+ ICAgIEkgdGhpbmsgSSBhbHNvIGFncmVlIHdpdGggc29tZSBvZiBTdGVwaGFuZSdzIGNyaXRpY2lz bSwNCiAgICAob2YgdGhpcyBhbmQgYWxzbyBvZiBkcmFmdC1yZWlkKSBlLmcuIHRoZSByZWNvbW1l bmRhdGlvbnMNCiAgICBkZXNjcmliZWQgaGVyZSBkb24ndCBzZWVtIHRvIG1lIHRvIGJlIGp1c3Rp ZmllZCBieSB0aGUNCiAgICBhcmd1bWVudHMgcHJvdmlkZWQgLSBzb21lIEknZCBhZ3JlZSB3aXRo LCBvdGhlcnMgbm90LCBidXQNCiAgICB0aGUgY3VycmVudCB0ZXh0IGp1c3QgZG9lcyBub3QganVz dGlmeSBtYWtpbmcgdGhhdCBzZXQgb2YNCiAgICByZWNvbW1lbmRhdGlvbnMuDQoNCltKTF0gWWVh aCwgdGhhdCBpcyBmYWlyLiBJdCdzIHJhdGhlciBhIGxvbmcgbGlzdCBhbmQgc29tZSBwYXJ0cyBh cmUgcHJvYmFibHkgbW9yZSBjZXJ0YWluIHdoaWxzdCBvdGhlcnMgbW9yZSBzcGVjdWxhdGl2ZS4g R2l2ZW4gYXZhaWxhYmxlIHRpbWUgSSB0aG91Z2h0IGdldHRpbmcgdGhlIGRpZmZlcmVudCBwb2lu dHMgb3V0IGZvciBjb21tZW50IHdhcyBiZXN0IC0gYWZ0ZXIgYWxsIHRoYXQncyB3aGF0IEktRHMg YXJlIHJlYWxseSBhbnl3YXkgLSBqdXN0IGEgZG9jIHRvIHNwdXIgY29tbWVudC9kaXNjdXNzaW9u LiANCiAgICANCj4gICAgSSBndWVzcyB0aGVyZSBpc24ndCB0aW1lIGJlZm9yZSB0aGUgc3VibWlz c2lvbiBjdXQtb2ZmLCBhbmQNCiAgICBpdCBkZXBlbmRzIHdoZXRoZXIgb3Igbm90IHlvdSByZWFs bHkgd2FudCB0aGlzIGRyYWZ0IHRvIGVuZA0KICAgIHVwIGFzIGFuIFJGQywgYnV0IGEgc2VyaW91 cyByZS1zdHJ1Y3R1cmluZyBhbmQgbWVyZ2luZyB3aXRoDQogICAgZHJhZnQtcmVpZCBjb3VsZCBo ZWxwIGEgbG90IGlmIHRoZSBhdXRob3JzIGRpZCB3YW50IHRoYXQgdGV4dA0KICAgIHRvIGVuZCB1 cCBpbiBhbiBSRkMuDQoNCltKTF0gRHVubm8gLSB3ZSBzaGFsbCBzZWUuIEknbSBub3Qgc3VwZXIg ZmFuYXRpY2FsIGFib3V0IHRoZSBkb2MgaXRzZWxmLiBJZiBtZXJnaW5nIGl0IHdpdGggb3RoZXJz IG1ha2VzIHNlbnNlLCBvciBtb3ZpbmcgaXQgdG8gYSBkaWZmZXJlbnQgV0csIG9yIHdoYXRldmVy IC0gdGhhdCBpcyBmaW5lLCBJIGFtIHF1aXRlIGZsZXhpYmxlIG9uIHRoaXMuDQoNCg0KIA0KDQo= From nobody Sun Mar 10 19:28:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50A54130E46 for ; Sun, 10 Mar 2019 19:27:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bJOWP1OZLnXe for ; Sun, 10 Mar 2019 19:27:56 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EA48127918 for ; Sun, 10 Mar 2019 19:27:56 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id b3so3477543qtj.3 for ; Sun, 10 Mar 2019 19:27:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HBjoetofJ6r28f/IjgFqz586Getj/QcH7F38dYl4Qg0=; b=zpw7ZRNHtG9crE8vMvxiu7OotyDtEx/ratNn0UXH0fvKJXTlTtGt1t4ZE8/OxP+b1F haIjv8q7WdGcb9tJlJi2p+t3eFARpwgqhmIyUi2qrD9c5EBf+7/Y7CzEEOgsbz0rU3he /xq8cLX7kIF0sIcBSB/cFGY3iUp/+9ibJZ2AIEEoaMLm73TCDd44b0AYM5k3Bz2fOGCD OPwb3AJH3K+fZb+BrxpRiuOU+xc8lmYiHQNHPO+XsBWDx5ErzLqSwEHZefxKzH7/3Cze AbTKsDw/CBL8qqvnfcF+5F2Bs8exRwujpw4fL5Wu4fXtz2XFM2uCbYUqG5Xzj0zAjykX /zug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HBjoetofJ6r28f/IjgFqz586Getj/QcH7F38dYl4Qg0=; b=P4u0q5/u0ruXMg/wYg9Xwu9Q3QvyJFJ2adY4XatmT0WnuEJGxzy0+b51ofDplMav8q 7n8ewbR94L+JLeEluyef/7ST58Ls5Vh5SSYzwIgli3CFS9mnjmWGSG63f4eZkCXMmzvL cCDUuKYh+J56Xd64TcpXoshzSCbVdDZm0dE7ycqHLUWYYorAnWIU+ZpsQPz9IvJwvNpT qD7FXwWMAmexyIO0HEVQLXzRXMsalwEDhWna6kXB90jM2YWw7TRQifaTuVOO0AH5bsbW iTDJ1dr8UVmA7Yj+iBZmcmNbJeAxY+NVhyigvLPdMFUuH5ul01vEky+Ee+E6Fhh2uyIo yRBg== X-Gm-Message-State: APjAAAUaf46clluW8pJVJUS6XerCOkK1kiO3fU0GJCeTcmNaxD6xCf6z CFpO0abkUHRMsI38tFbbS3kEwQphmslxSiIisVdUaQ== X-Google-Smtp-Source: APXvYqz47FwY02Rl0NP21bddrPy+1vxb1C8uQSKQL5JQD9FeD7S9t6pNalqgCVIOQjt5VmiALdFHlfu7kGYwgl+uCk4= X-Received: by 2002:ac8:191b:: with SMTP id t27mr24637523qtj.163.1552271274887; Sun, 10 Mar 2019 19:27:54 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> In-Reply-To: From: Warren Kumari Date: Mon, 11 Mar 2019 11:27:17 +0900 Message-ID: To: "Livingood, Jason" Cc: Stephane Bortzmeyer , Jim Reid , DoH WG Content-Type: multipart/alternative; boundary="000000000000ef62e10583c851ce" Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 02:28:00 -0000 --000000000000ef62e10583c851ce Content-Type: text/plain; charset="UTF-8" On Mon, Mar 11, 2019 at 10:26 AM Livingood, Jason < Jason_Livingood@comcast.com> wrote: > On 3/10/19, 4:02 AM, "Doh on behalf of Stephane Bortzmeyer" < > doh-bounces@ietf.org on behalf of bortzmeyer@nic.fr> wrote: > > > I'm surprised that it is published more or less at the same time > draft-livingood-doh-implementation-risks-issues. They have a lot of > overlap, and even one author in common. May be a merge would be a good > idea? > > [JL] Perhaps so. Time was short before the cutoff and I think we wanted to > get some thoughts out there for comment. > > > The specific issue mentioned above is exactly the same whether I > use DoH or DNS-over-UDP to 8.8.8.8 > or 9.9.9.9. > > [JL] I think a slight difference is that with public DNS services, the > uptake occurs gradually as each individual user makes an explicit choice. > This isn't the case should large apps enable DoH. > s/This isn't the case should large apps enable DoH./This isn't the case should large apps enable using their own resolvers./ DoH is a protocol - the concerns you are talking about (and I'm glad they are being discussed, they are important policy discussions) are not specific to DoH -- this sentence works just as well with DNS-over-TLS, plain DNS, using some completely proprietary name resolution mechanism. It is trivial for any "large app" writer to invent a proprietary way to do DNS resolution - please please, let's keep the DoH (protocol) versus "apps doing their own resolution" separate. W > > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf --000000000000ef62e10583c851ce Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Mon, Mar 11, 2019 at 10:26 AM Liv= ingood, Jason <Jason_Livi= ngood@comcast.com> wrote:
On 3/10/19, 4:02 AM, "Doh on behalf of Stephane Bortz= meyer" <d= oh-bounces@ietf.org on behalf of bortzmeyer@nic.fr> wrote:

>=C2=A0 =C2=A0 I'm surprised that it is published more or less at th= e same time
=C2=A0 =C2=A0 draft-livingood-doh-implementation-risks-issues. They have a = lot of
=C2=A0 =C2=A0 overlap, and even one author in common. May be a merge would = be a good
=C2=A0 =C2=A0 idea?

[JL] Perhaps so. Time was short before the cutoff and I think we wanted to = get some thoughts out there for comment.

=C2=A0 =C2=A0 > The specific issue mentioned=C2=A0 above is exactly the = same whether I use DoH or DNS-over-UDP to 8.8.8.8
=C2=A0 =C2=A0 or 9.9.9.9.

[JL] I think a slight difference is that with public DNS services, the upta= ke occurs gradually as each individual user makes an explicit choice. This = isn't the case should large apps enable DoH.

<= /div>
s/This isn'= t the case should large apps enable DoH./This isn't the case should large apps enabl= e using their own resolvers./

DoH is a protocol - the= concerns you are talking about (and I'm glad they are being discussed,= they are important policy discussions) are not specific to DoH -- this sen= tence works just as well with DNS-over-TLS, plain DNS, using some completel= y proprietary name resolution mechanism. It is trivial for any "large = app" writer to invent a proprietary way to do DNS resolution - please = please, let's keep the DoH (protocol) versus "apps doing their own= resolution" separate.

W

=C2=A0



_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh


--
I don't think the execution is relevant when= it was obviously a bad idea in the first place.
This is like putting ra= bid weasels in your pants, and later expressing regret at having chosen tho= se particular rabid weasels and that pair of pants.
=C2=A0 =C2=A0---maf<= /div>
--000000000000ef62e10583c851ce-- From nobody Sun Mar 10 20:25:28 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4F96F130EB9 for ; Sun, 10 Mar 2019 20:25:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZbJPbF4CQkkm for ; Sun, 10 Mar 2019 20:25:24 -0700 (PDT) Received: from mail-lj1-x22d.google.com (mail-lj1-x22d.google.com [IPv6:2a00:1450:4864:20::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96ED0130EB5 for ; Sun, 10 Mar 2019 20:25:23 -0700 (PDT) Received: by mail-lj1-x22d.google.com with SMTP id z7so2712072lji.0 for ; Sun, 10 Mar 2019 20:25:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=9IKiD6CpLovUwBErlWk6G8yLEAww3/X1Ecffurzt2HU=; b=MbxykKbMAEDOYHHkG2LFQDx5HDmWE74g9G4TOfEKvgoGRzXuOHh37yvRzem+0WhMA3 hhsUDmfDdQq7og/1fnI5uontcISYERr+Q5cBMRaPavjAOHbzZocsurHwmw8MARZNBYqR ZuiF/8Lavs6fxd2sucTjNcoyvMCDhEcA68QDPFJW7e8Z2Xm1SEPujhG8Uh7ZS2MnAlBb mxMXfUtGyXQQjr/YABWZ1f2TUId1Bz1BArQOZPAtc1v9yQX1j747jv5SgLgEcBwUMQNY clT+KCAADxorDXZugYkDD4MyVv2YSJfiGtJH5tYqdMTLnlkjuvJJvlyFKNYRI9lMQkk/ 9z6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=9IKiD6CpLovUwBErlWk6G8yLEAww3/X1Ecffurzt2HU=; b=Qd4VM1N71zmTcs9YJHC57nGHtd8nanQLijYbmjlBWbJW7OjS+k5PvoFQ3Apy/+VuM0 rUTQdcYHZ3inF3tYn127/02mPln3FUh4zPbspL7hmB5LN8y+TtOi8H7NNVsoJcYgEo1v rZRU8L02x4n1HaaQm7bJgc+Li9Zi3JwtOfwC/tTtcFsaktylmu+ChQZ9cwywyu3OHQYM w6wHR2OE/MxZZfXcRdw4EW0XWTl2SuMDM5isAXKBVmxSuNsz+6kDtLQOamCF3QIAgOIW Yi74nOaCgI0YdjICxLmAWXeRCJDA4/BphqgpLH/NNFlEwR9ad1PfIjF1WFepEzcJGEwo HhBQ== X-Gm-Message-State: APjAAAWOJVhI5ilhAQIBcfDdDaY02Y38bkALsnPPnetwYXEfNdgizu8g YJxdrn4QOnWSVNxNzjrvKlmW9+jvJWDesuOm/NDGXg== X-Google-Smtp-Source: APXvYqwiZ1APh+hymPH6C28PgZnmlajXgW6Bd5evGlKv9zI/6bXwF0iqHKJljei5pga7Ab8+tK4VaHfp6f0o1CvUmVo= X-Received: by 2002:a2e:9b15:: with SMTP id u21mr15233154lji.82.1552274721524; Sun, 10 Mar 2019 20:25:21 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> In-Reply-To: From: nalini elkins Date: Mon, 11 Mar 2019 08:55:18 +0530 Message-ID: To: Christian Huitema Cc: Vittorio Bertola , Stephen Farrell , dns-privacy@ietf.org, doh@ietf.org, dnsop@ietf.org, "Ackermann, Michael" Content-Type: multipart/alternative; boundary="0000000000005ee33e0583c91fa1" Archived-At: Subject: Re: [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 03:25:26 -0000 --0000000000005ee33e0583c91fa1 Content-Type: text/plain; charset="UTF-8" > Similarly, putting DNS in user space allows for immediate adoption of DNSSEC and privacy enhancements, even when the operating system or the local network does not support them At enterprises (banks, insurance, etc) on their internal networks, people run their own DNS servers which may resolve for both internal and external sites. We were recently talking to a Fortune 50 company in the United States about what might happen you install a version of the browser which uses DNS-over-HTTPS automatically. (Clearly, this applies to any variant.) The questions that the Fortune 50 company architect asked were something like this: 1. You mean that DNS could be resolved outside my enterprise? 2. So whoever that is that resolves my DNS sees the pattern and frequency of what sites my company goes to? 3. How do I change this? I look forward to a discussion on this issue. There will be at least one enterprise present in Prague to speak for themselves. I will see if I can get others to participate remotely. It would be good to also discuss how to warn enterprises that this is about to happen. I wonder if an announcement via CERT or another group may be appropriate. Thanks, Nalini On Mon, Mar 11, 2019 at 6:36 AM Christian Huitema wrote: > > On 3/10/2019 4:07 PM, Vittorio Bertola wrote: > > Honestly, I understood it differently - at this point in time they are > > doing tests on whether their resolver performs better or worse than > > the system's one, but their announced model is that Firefox will adopt > > a DoH resolver (though it's unclear how it will be chosen) and it will > > just use that one. But if people from Mozilla could make a clearer > > announcement on what their plans currently are, that would be good. > > Still, most of the issues arise whenever an application, for whatever > > reason and under any mechanism, starts to use one or more resolvers > > different than the one set up in the operating system: even if it used > > more than one, you would still get many of the issues listed in the > > document (though, if it used more than one at the same time, I think > > you'd actually also get some new specific issues, so we'd need to add > > a discussion of this possibility). > > > Your view of operating systems and applications is firmly rooted in > history, which is another way to say in the past. The evolution in the > past years points to a systematic deconstruction of that relation, with > for example virtual machine, containers, or the trend to move network > stacks out of the operating system and into the application. This is > pretty obvious for security stacks, but it is also becoming very clear > with QUIC and transport stacks. There are two big drivers: portability, > and rapid adoption of innovation. These two drivers apply to DNS just > like they apply to transport. > > Putting QUIC in application space allows for immediate provision of > innovations like 0-RTT, head-of-queue blocking mitigation, or the better > crypto of TLS 1.3. Similarly, putting DNS in user space allows for > immediate adoption of DNSSEC and privacy enhancements, even when the > operating system or the local network does not support them. That genie > is not going back in the bottle any time soon. > > -- Christian Huitema > > > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --0000000000005ee33e0583c91fa1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
=C2=A0> Similarly, putting DNS in user= space allows for=C2=A0immediate adoption of DNSSEC and privacy enhancement= s, even when the=C2=A0operating system or the local network does not suppor= t them=C2=A0=C2=A0

At enterprises (banks, insurance,= etc) on their internal networks, people run their own DNS servers which ma= y resolve for both internal and external sites.

We were recently talking to a Fortune 50 company in the United States ab= out what might happen you install a version of the browser which uses DNS-o= ver-HTTPS automatically.=C2=A0 (Clearly, this applies to any variant.)

The questions that the Fortune 50 company architect as= ked were something like this:

1. You mean that DNS= could be resolved outside my enterprise?

2. So wh= oever that is that resolves my DNS sees the pattern and frequency of what s= ites my company goes to?

3. How do I change this?<= /div>

I look forward to a discussion on this issue= .=C2=A0 =C2=A0 There will be at least one enterprise present in Prague to s= peak for themselves.=C2=A0 I will see if I can get others to participate re= motely.

It would be good to also discuss how to wa= rn enterprises that this is about to happen.=C2=A0 =C2=A0I wonder if an ann= ouncement via CERT or another group may be appropriate.=C2=A0 =C2=A0
<= div>
Thanks,
Nalini

On Mon, Mar 11, 2019= at 6:36 AM Christian Huitema <huitema@huitema.net> wrote:

On 3/10/2019 4:07 PM, Vittorio Bertola wrote:
> Honestly, I understood it differently - at this point in time they are=
> doing tests on whether their resolver performs better or worse than > the system's one, but their announced model is that Firefox will a= dopt
> a DoH resolver (though it's unclear how it will be chosen) and it = will
> just use that one. But if people from Mozilla could make a clearer
> announcement on what their plans currently are, that would be good. > Still, most of the issues arise whenever an application, for whatever<= br> > reason and under any mechanism, starts to use one or more resolvers > different than the one set up in the operating system: even if it used=
> more than one, you would still get many of the issues listed in the > document (though, if it used more than one at the same time, I think > you'd actually also get some new specific issues, so we'd need= to add
> a discussion of this possibility).


Your view of operating systems and applications is firmly rooted in
history, which is another way to say in the past. The evolution in the
past years points to a systematic deconstruction of that relation, with
for example virtual machine, containers, or the trend to move network
stacks out of the operating system and into the application. This is
pretty obvious for security stacks, but it is also becoming very clear
with QUIC and transport stacks. There are two big drivers: portability,
and rapid adoption of innovation. These two drivers apply to DNS just
like they apply to transport.

Putting QUIC in application space allows for immediate provision of
innovations like 0-RTT, head-of-queue blocking mitigation, or the better crypto of TLS 1.3. Similarly, putting DNS in user space allows for
immediate adoption of DNSSEC and privacy enhancements, even when the
operating system or the local network does not support them. That genie
is not going back in the bottle any time soon.

-- Christian Huitema


_______________________________________________
dns-privacy mailing list
dns-privacy@ietf.= org
https://www.ietf.org/mailman/listinfo/dns-privacy


--
--0000000000005ee33e0583c91fa1-- From nobody Sun Mar 10 21:29:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 96519130EE6 for ; Sun, 10 Mar 2019 21:29:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F_0_bW0GE_wb for ; Sun, 10 Mar 2019 21:29:18 -0700 (PDT) Received: from mail-lj1-x22a.google.com (mail-lj1-x22a.google.com [IPv6:2a00:1450:4864:20::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 878FB12F19D for ; Sun, 10 Mar 2019 21:29:17 -0700 (PDT) Received: by mail-lj1-x22a.google.com with SMTP id g80so2773958ljg.6 for ; Sun, 10 Mar 2019 21:29:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bZ8GHngTmbV/D+Ul0BQx34xVx0Xm24zcy2gPspAMfoQ=; b=fo3obhPTtW7eLhzPE4qOYCV0OTUrrQUdQohUd7cWC5yIXz9g72eDIknpXyI2hGcXXu u0l6221D9ckYvQOzc08SkuB6y4ib58aXUT1Nzey15wIx0qGdFrIMMZQFi0ZiwX1opYTS dcRIp0Ap7kpRgn0O0h8j0tB7COroYZsptn3Q16zOdlZQv/rg8/wSuvF0u16jsHF5biRF wqCBCio6KSupsJz0ykPm5YL6GHm4h5r+P68O92VWwfMq0cmzcSoa6+yeXZDgFe2f9HUE 2CQ9TofCyPWIg3bRizS9jCWSixdS4O4oP+3yQgRCA2BCrBy1Ema8y860a6O2jFWHseEU 76Cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bZ8GHngTmbV/D+Ul0BQx34xVx0Xm24zcy2gPspAMfoQ=; b=Kl16dVry6XEr+hvea60VZvqOvxl3qWEOGEJSfjwZ5v0wj2enaFdRuGq9zszMbep0uR eF1tEfK4Kq5JX0+JJUUHlWsaKIZ7hCw/yvQvyoDiVpKkT0FghtHTPMuU3EXFpkyiWhUe CKzeGCMxTT7kgGk81SWU0Lc3gBIY6fklinpH2uVcgfbu+Ry2T52hWpVsDYSpF8kjfyQA advlhOFy3cL+CFTg8BMYKNYgsmeuEjuqYffgFmRmsLqTZ/86XykRFso97pmttzSwUrqL +nIY15QYfDeOwbeOvstwEI7L6Jvo8t7QWrQU/mgG3fMXM/01ghuMgRoFR8b9oxHiRL6g Na/A== X-Gm-Message-State: APjAAAVig0/PhkfzYjzsl3gMWSD/+9q/Xc8v/NhNjBXzhnGCldd2arue 1Clwy330W11ZUqRDjjdE+qoTV+LsBXJPRt5RLoBPGw== X-Google-Smtp-Source: APXvYqwj19cYpe++6C+vt6xW4ACzOFCJj8H3QoCLID0bwxXnyB9W9DLKAxWyMu7MoWKIe7KPasNTBXKCf8G3Yrxz+RQ= X-Received: by 2002:a2e:7a03:: with SMTP id v3mr15426649ljc.22.1552278555537; Sun, 10 Mar 2019 21:29:15 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> In-Reply-To: From: nalini elkins Date: Mon, 11 Mar 2019 09:59:11 +0530 Message-ID: To: Christian Huitema Cc: doh@ietf.org, Vittorio Bertola , dnsop@ietf.org, dns-privacy@ietf.org, "Ackermann, Michael" , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000e5456b0583ca03c7" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 04:29:21 -0000 --000000000000e5456b0583ca03c7 Content-Type: text/plain; charset="UTF-8" BTW, I am reading the draft Tiru et al just posted on DPRIVE about this issue to see if we have any comments. > 4) I am using my work laptop on the enterprise network, and using application-X This could be an internal application or on the Internet. Enterprises have connections to: - Internal LAN / WAN clients - "Cloud" (much as I dislike the term) applications - Business partners - The Internet Companies also (validly, in my opinion) wish to know if their employees are going to fantasyfootballgame.com while they are supposedly doing work and of course, other sites which people should not be going to during work time. If I am paying someone, I expect them to do work that I wish them to do. The cloud example gets quite a bit more complex with some architectures some companies are proposing where there will be a complicated topology on premises. Let me check with the enterprise who told me about this & I will see if I can post the diagram or an explanation of what is planned. This is a complex problem. Thank your for your thoughtful consideration of the issues. Please let me know if my explanation makes the requirements any clearer. Nalini On Mon, Mar 11, 2019 at 9:44 AM Christian Huitema wrote: > > On 3/10/2019 8:25 PM, nalini elkins wrote: > > > Similarly, putting DNS in user space allows for immediate adoption > > of DNSSEC and privacy enhancements, even when the operating system or > > the local network does not support them > > > > At enterprises (banks, insurance, etc) on their internal networks, > > people run their own DNS servers which may resolve for both internal > > and external sites. > > > > We were recently talking to a Fortune 50 company in the United States > > about what might happen you install a version of the browser which > > uses DNS-over-HTTPS automatically. (Clearly, this applies to any > > variant.) > > > > The questions that the Fortune 50 company architect asked were > > something like this: > > > > 1. You mean that DNS could be resolved outside my enterprise? > > > > 2. So whoever that is that resolves my DNS sees the pattern and > > frequency of what sites my company goes to? > > > > 3. How do I change this? > > > There are a bunch of conflicting requirements here, and it would be good > to tease out the contradictions. Consider the following cases: > > 1) I am using my phone, and using application-X. > > 2) I am at home, using application-X on my home computer. > > 3) I am using Wi-Fi in a hotel, and using application-X. > > 4) I am using my work laptop on the enterprise network, and using > application-X > > 5) I am using my work laptop in a hotel, and using application-X > > 6) I am using my work laptop on the network of a customer, and using > application-X. > > Today, plenty of people claim the right to control how I use the DNS: my > phone carrier, my ISP at home, the company that got the contract to > manage the hotel's Wi-Fi, the IT manager for my company's laptop, the IT > manager for the company that I am visiting. Out of those, there is just > one scenario for which the claim has some legitimacy: if the company > pays for my laptop and own the laptop, yes of course it has a legitimate > claim to control how I am using it. Otherwise, I, the user, get to > decide. If I like the application's setting better than the network's > default, then of course I expect those settings to stick. > > -- Christian Huitema > > > > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --000000000000e5456b0583ca03c7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
BTW, I am reading the draft Tiru et al just posted on= DPRIVE about this issue to see if we have any comments.

> 4) I am using my work laptop on the enterprise network, and using=C2= =A0application-X
=C2=A0
This could be an internal application or on = the Internet.=C2=A0 =C2=A0

Enterprises have connec= tions to:

- Internal LAN / WAN clients
<= br>
- "Cloud" (much as I dislike the term) applications=

- Business partners

- Th= e Internet

Companies also (validly, in my opinion)= wish to know if their employees are going to fantasyfootballgame.com while they are supposedly doing w= ork and of course, other sites which people should not be going to during w= ork time.=C2=A0 If I am paying someone, I expect them to do work that I wis= h them to do.

The cloud example gets quite a bit m= ore complex with some architectures some companies are proposing where ther= e will be a complicated topology on premises.=C2=A0 =C2=A0Let me check with= the enterprise who told me about this & I will see if I can post the d= iagram or an explanation of what is planned.=C2=A0 This is a complex proble= m.

Thank your for your thoughtful consideration of= the issues.=C2=A0 Please let me know if my explanation makes the requireme= nts any clearer.

Nalini

= =C2=A0=C2=A0

On Mon, Mar 11, 2019 at 9:44 AM Christian Huitema <= ;huitema@huitema.net> wrote:<= br>

On 3/10/2019 8:25 PM, nalini elkins wrote:
> =C2=A0> Similarly, putting DNS in user space allows for=C2=A0immedi= ate adoption
> of DNSSEC and privacy enhancements, even when the=C2=A0operating syste= m or
> the local network does not support them=C2=A0=C2=A0
>
> At enterprises (banks, insurance, etc) on their internal networks,
> people run their own DNS servers which may resolve for both internal > and external sites.
>
> We were recently talking to a Fortune 50 company in the United States<= br> > about what might happen you install a version of the browser which
> uses DNS-over-HTTPS automatically.=C2=A0 (Clearly, this applies to any=
> variant.)
>
> The questions that the Fortune 50 company architect asked were
> something like this:
>
> 1. You mean that DNS could be resolved outside my enterprise?
>
> 2. So whoever that is that resolves my DNS sees the pattern and
> frequency of what sites my company goes to?
>
> 3. How do I change this?


There are a bunch of conflicting requirements here, and it would be good to tease out the contradictions. Consider the following cases:

1) I am using my phone, and using application-X.

2) I am at home, using application-X on my home computer.

3) I am using Wi-Fi in a hotel, and using application-X.

4) I am using my work laptop on the enterprise network, and using
application-X

5) I am using my work laptop in a hotel, and using application-X

6) I am using my work laptop on the network of a customer, and using
application-X.

Today, plenty of people claim the right to control how I use the DNS: my phone carrier, my ISP at home, the company that got the contract to
manage the hotel's Wi-Fi, the IT manager for my company's laptop, t= he IT
manager for the company that I am visiting. Out of those, there is just
one scenario for which the claim has some legitimacy: if the company
pays for my laptop and own the laptop, yes of course it has a legitimate claim to control how I am using it. Otherwise, I, the user, get to
decide. If I like the application's setting better than the network'= ;s
default, then of course I expect those settings to stick.

-- Christian Huitema





--
Thanks,
Nalini = Elkins
President
Enterprise Data Center Operators

--000000000000e5456b0583ca03c7-- From nobody Sun Mar 10 22:03:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC37C130F0D for ; Sun, 10 Mar 2019 22:03:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Hbk991b_oZdr for ; Sun, 10 Mar 2019 22:03:30 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD26312798E for ; Sun, 10 Mar 2019 22:03:30 -0700 (PDT) Received: from xsmtp04.mail2web.com ([168.144.250.231]) by mx62.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3CKG-00088k-OT for doh@ietf.org; Mon, 11 Mar 2019 05:14:09 +0100 Received: from [10.5.2.31] (helo=xmail09.myhosting.com) by xsmtp04.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3CKB-0006OD-W1 for doh@ietf.org; Mon, 11 Mar 2019 00:14:04 -0400 Received: (qmail 20766 invoked from network); 11 Mar 2019 04:14:03 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail09.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 11 Mar 2019 04:14:03 -0000 To: nalini elkins Cc: doh@ietf.org, Vittorio Bertola , dnsop@ietf.org, dns-privacy@ietf.org, "Ackermann, Michael" , Stephen Farrell References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Sun, 10 Mar 2019 21:14:02 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US X-Originating-IP: 168.144.250.231 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.20) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5gTKdGpwITB4Og1dMoC8hl1602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxqxJxF+LAp7DjZF7exyDyikh5 mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2wQwuOVbOJlufBNa9jDYDifvRa7MR4hgRIg8N 1QlY4G7x1YBTEs55LirRLgpsvCFt8i77Wu2Jb/TI0CxS53moc/SlgXpNwUDmiieE9G+9VqfZ1kay mqFCHRp6u+mIhIXg5jssJAnfERZ2C5vj1sOdsnQOD0r6/AaHZiEtdTMtMljoSvSqrGwueTSCQFid cy15jQ4HwbF4aWaRl0axA525ouWBOXp8nHKe0R+FkIqN7hkgzj0zEmu34GPXR572RNl5VgW9/bkt U41htiJ8fk7NkHmplbyYh4+w03es32OzjfSo5Jhwk+hMTKYppuA2BaWeipTPWMHGUquOFNpW9R6n Md9TLrF9l3ItGfA/WrnALV4KU1KUj6WmLwrt1V2W2O8S8rA9GQEGJYN7OQMZTChgaGI67KPdMMMU qiBDQeX5GH069TdE5SQ4dxJir0Y8rHr0CnFV4ppbCSIV+5MQOIhZD0YsNwSrwzPbXZMD1WP1LXFD lJBVkCSQ2iLcAY5Y0XJtqwPiG77RlB1oqlzsN7KI5PkKIKnisj+1ZHYjRAh7nr2r2Sqw9KBaAUuM ZylbRx9EfEXGioT+mjOYGM8ss+hlV7jXIuUkHV/h7xc/Bc5f+z8UjH7OdA4AxqY9XSPDZhXTPRj4 ONIshumWrYWvtS5nqAxWFSzsWt2uE/YFyU00jIgVNusVRf/yaIf6yq8z+dbV7R9lLUJTOMC9AqYW 1lRNjkWXJryJ9+EiOvBe6vFbUGRrwytzyq4nhu0+m3/YUu4UI2GoiS4jWHSkvyyyS8KErWmYf+RR A94if7oLzRs73BRh3+MrOOK4NgfP/RZivWtTzbcnsscMdnMYECIJ64duuA== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 05:03:34 -0000 On 3/10/2019 8:25 PM, nalini elkins wrote: > =C2=A0> Similarly, putting DNS in user space allows for=C2=A0immediate = adoption > of DNSSEC and privacy enhancements, even when the=C2=A0operating system= or > the local network does not support them=C2=A0=C2=A0 > > At enterprises (banks, insurance, etc) on their internal networks, > people run their own DNS servers which may resolve for both internal > and external sites. > > We were recently talking to a Fortune 50 company in the United States > about what might happen you install a version of the browser which > uses DNS-over-HTTPS automatically.=C2=A0 (Clearly, this applies to any > variant.) > > The questions that the Fortune 50 company architect asked were > something like this: > > 1. You mean that DNS could be resolved outside my enterprise? > > 2. So whoever that is that resolves my DNS sees the pattern and > frequency of what sites my company goes to? > > 3. How do I change this? There are a bunch of conflicting requirements here, and it would be good to tease out the contradictions. Consider the following cases: 1) I am using my phone, and using application-X. 2) I am at home, using application-X on my home computer. 3) I am using Wi-Fi in a hotel, and using application-X. 4) I am using my work laptop on the enterprise network, and using application-X 5) I am using my work laptop in a hotel, and using application-X 6) I am using my work laptop on the network of a customer, and using application-X. Today, plenty of people claim the right to control how I use the DNS: my phone carrier, my ISP at home, the company that got the contract to manage the hotel's Wi-Fi, the IT manager for my company's laptop, the IT manager for the company that I am visiting. Out of those, there is just one scenario for which the claim has some legitimacy: if the company pays for my laptop and own the laptop, yes of course it has a legitimate claim to control how I am using it. Otherwise, I, the user, get to decide. If I like the application's setting better than the network's default, then of course I expect those settings to stick. -- Christian Huitema From nobody Sun Mar 10 22:25:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 043A4130F32; Sun, 10 Mar 2019 22:25:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5WSArU3Zfkg9; Sun, 10 Mar 2019 22:25:00 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8DFEE130F2B; Sun, 10 Mar 2019 22:25:00 -0700 (PDT) Received: from [IPv6:2001:559:8000:c9:c469:941:d0ef:306d] (unknown [IPv6:2001:559:8000:c9:c469:941:d0ef:306d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id BD4E8892C6; Mon, 11 Mar 2019 05:24:59 +0000 (UTC) To: Christian Huitema Cc: nalini elkins , doh@ietf.org, Vittorio Bertola , dnsop@ietf.org, dns-privacy@ietf.org, "Ackermann, Michael" , Stephen Farrell References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> From: Paul Vixie Message-ID: <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> Date: Sun, 10 Mar 2019 22:24:56 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.11 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 05:25:02 -0000 Christian Huitema wrote on 2019-03-10 21:14: ... > There are a bunch of conflicting requirements here, and it would be good > to tease out the contradictions. Consider the following cases: > > 1) I am using my phone, and using application-X. > > 2) I am at home, using application-X on my home computer. > > 3) I am using Wi-Fi in a hotel, and using application-X. > > 4) I am using my work laptop on the enterprise network, and using > application-X > > 5) I am using my work laptop in a hotel, and using application-X > > 6) I am using my work laptop on the network of a customer, and using > application-X. this distinction is not useful. there are two cases. a user or app trusts its network. or not. in the first case, you'll use an RDNS service which is in the set (allowed (preferred)). that is, you'll use the server you desire most out of the set that your network operator allows you to reach. in the second case, you'll use a VPN, for all of your traffic, not just for DNS, because if you hide your DNS but not the connections which result from such hiding, it will add no measurable privacy. > Today, plenty of people claim the right to control how I use the DNS: my > phone carrier, my ISP at home, the company that got the contract to > manage the hotel's Wi-Fi, the IT manager for my company's laptop, the IT > manager for the company that I am visiting. Out of those, there is just > one scenario for which the claim has some legitimacy: if the company > pays for my laptop and own the laptop, yes of course it has a legitimate > claim to control how I am using it. Otherwise, I, the user, get to > decide. If I like the application's setting better than the network's > default, then of course I expect those settings to stick. this distinction is also false. if you are using my network, then it makes no difference which of us bought you that laptop. you will use the RDNS i allow you to use. RDNS is part of the control plane, and i use it for both monitoring and control. sometimes that's so that i can see malware beacon to its C&C. sometimes that's so that i can institute parental controls. if you don't like my rules, you should vote with your feet, and not visit me. because that is the only choice you will have. (yes, i will be part of a major new project to identify and block all DoH services, so that behavioural security policies can still work, because you may have noticed that the internet has never become MORE secure from new tech, but it occasionally becomes LESS secure more slowly because of policy.) quoting again the salient passage of RFC 8484's self-damning introduction: > ... Two primary use cases were considered during this protocol's > development. These use cases are preventing on-path devices from > interfering with DNS operations, ... let me give you advance notice: "i aim to misbehave."[1] that is, _i am on-path, and i intend to interfere._ why on earth the IETF decided to equate dissidents (of whom there are tens of thousands, all of which need full VPN's not just DoH for actual safety) with bots (of which there are tens of millions), and set up a war between end users and network operators, i will never understand, or try to. now, we fight. -- P Vixie From nobody Sun Mar 10 22:35:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 09BB4130F43 for ; Sun, 10 Mar 2019 22:35:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SpKIppz_Jc7m for ; Sun, 10 Mar 2019 22:35:08 -0700 (PDT) Received: from mail-lj1-x229.google.com (mail-lj1-x229.google.com [IPv6:2a00:1450:4864:20::229]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F06301277E7 for ; Sun, 10 Mar 2019 22:35:04 -0700 (PDT) Received: by mail-lj1-x229.google.com with SMTP id v10so2870081lji.3 for ; Sun, 10 Mar 2019 22:35:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HjJOl/KImwRPVzc7N0Est7Zsv9CYBlS8C6fffgrhrnw=; b=nRyaDJbaiRWWbs+UZmZnISIm7R1F2BYBTVVcamgmn7Qhe9TuuwS3vAPO9xCkzThABF njltV5HN4AB+R5Y4oa0aXpctwmvMNs73O0CAYCyIv+IBpmFPQYs7DWHFWQqGRVpplKHB D2Z7uw+hKSQNjMphtYErF20y3KJfP2iJ9r4qq/IACCT89Sohf/l7Yx42BA4SErBTAN7p ToZB/HMKxBoZMh+4wpxQ0ig4naOnkve4bEnyjBDIOhZRdcp/zpXn+lDbWzKbKGYapOF8 ldLKiLwLe0fpe41I6O/O/4uaW8ygo5r1HLqRJnNA4/Te4ByJ/lL0je9vC6I+JT+na0W1 lg8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HjJOl/KImwRPVzc7N0Est7Zsv9CYBlS8C6fffgrhrnw=; b=epU8gcFgrbytoFRBk7aJuEZkG3T66zUB8gZFCaRfzXlSoLHIFM+pvLPHS/fOUGTo2p M4MVo9yTN1p1Q1eQVXsfs0ynWky8ORGC7zME02HI4fWDrNo5zHDrcb7UJJLbaeLxSXIg 51EgeT0q4DfkmawnCHTS1uFByAdiEfVV+mlKR+PADIaqTX7erWrpTy0UTxpq/4VdMhYt 7Mozv3tWrn5H7oBKWVdZ9XpPHwOiOzRQcGAYRM9Uwtg4OZx/iQkLuf5dTp43hc2ADabX WCipmRESesTPIClp5IYQ5oXosO0+M/ONQo7L2cMXTSFa15eEnDzdhEPI3SUWrqjsPWdk tjBQ== X-Gm-Message-State: APjAAAUz0cGSM+OMO65RKQNSmGWlivwduTTIZ20EkSKaTEah54rM7vnO P16ZbdV0AE/UFkTqKEdp2NSL6Zcyvyklkn2m5IrnEA== X-Google-Smtp-Source: APXvYqxeZn+rf9VLuQZXKmxfMMr7+VAU6kUdKYX1ifz9yw8dazeLZh7ZzwuzebKWPufb6TVwwROSEaAmNNOMjbf9FEU= X-Received: by 2002:a2e:898e:: with SMTP id c14mr16634915lji.115.1552282502811; Sun, 10 Mar 2019 22:35:02 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> In-Reply-To: <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> From: nalini elkins Date: Mon, 11 Mar 2019 11:04:59 +0530 Message-ID: To: Paul Vixie Cc: Christian Huitema , doh@ietf.org, Vittorio Bertola , dnsop@ietf.org, dns-privacy@ietf.org, "Ackermann, Michael" , Stephen Farrell Content-Type: multipart/alternative; boundary="0000000000002be7700583caef88" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 05:35:15 -0000 --0000000000002be7700583caef88 Content-Type: text/plain; charset="UTF-8" Paul, > (yes, i will be part of a major new project to identify and block all DoH services, so > that behavioural security policies can still work, because you may have > noticed that the internet has never become MORE secure from new tech, > but it occasionally becomes LESS secure more slowly because of policy.) I would be very interested, if you are so inclined, to hear more of what you are thinking. Is this something you can (are willing to) talk about? It sounds like a very thought-provoking initiative. Thanks, Nalini On Mon, Mar 11, 2019 at 10:55 AM Paul Vixie wrote: > > > Christian Huitema wrote on 2019-03-10 21:14: > ... > > There are a bunch of conflicting requirements here, and it would be good > > to tease out the contradictions. Consider the following cases: > > > > 1) I am using my phone, and using application-X. > > > > 2) I am at home, using application-X on my home computer. > > > > 3) I am using Wi-Fi in a hotel, and using application-X. > > > > 4) I am using my work laptop on the enterprise network, and using > > application-X > > > > 5) I am using my work laptop in a hotel, and using application-X > > > > 6) I am using my work laptop on the network of a customer, and using > > application-X. > > this distinction is not useful. > > there are two cases. > > a user or app trusts its network. > > or not. > > in the first case, you'll use an RDNS service which is in the set > (allowed (preferred)). that is, you'll use the server you desire most > out of the set that your network operator allows you to reach. > > in the second case, you'll use a VPN, for all of your traffic, not just > for DNS, because if you hide your DNS but not the connections which > result from such hiding, it will add no measurable privacy. > > > Today, plenty of people claim the right to control how I use the DNS: my > > phone carrier, my ISP at home, the company that got the contract to > > manage the hotel's Wi-Fi, the IT manager for my company's laptop, the IT > > manager for the company that I am visiting. Out of those, there is just > > one scenario for which the claim has some legitimacy: if the company > > pays for my laptop and own the laptop, yes of course it has a legitimate > > claim to control how I am using it. Otherwise, I, the user, get to > > decide. If I like the application's setting better than the network's > > default, then of course I expect those settings to stick. > > this distinction is also false. > > if you are using my network, then it makes no difference which of us > bought you that laptop. you will use the RDNS i allow you to use. RDNS > is part of the control plane, and i use it for both monitoring and > control. sometimes that's so that i can see malware beacon to its C&C. > sometimes that's so that i can institute parental controls. > > if you don't like my rules, you should vote with your feet, and not > visit me. because that is the only choice you will have. (yes, i will be > part of a major new project to identify and block all DoH services, so > that behavioural security policies can still work, because you may have > noticed that the internet has never become MORE secure from new tech, > but it occasionally becomes LESS secure more slowly because of policy.) > > quoting again the salient passage of RFC 8484's self-damning introduction: > > > ... Two primary use cases were considered during this protocol's > > development. These use cases are preventing on-path devices from > > interfering with DNS operations, ... > > let me give you advance notice: "i aim to misbehave."[1] that is, _i am > on-path, and i intend to interfere._ why on earth the IETF decided to > equate dissidents (of whom there are tens of thousands, all of which > need full VPN's not just DoH for actual safety) with bots (of which > there are tens of millions), and set up a war between end users and > network operators, i will never understand, or try to. now, we fight. > > -- > P Vixie > > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --0000000000002be7700583caef88 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Paul,

> (yes, i will be p= art of a major new project to identify and block all DoH services, so=C2=A0=
> that behavioural security policies can still work, because you m= ay have=C2=A0
> noticed that the internet has never become MORE secur= e from new tech,=C2=A0
> but it occasionally becomes LESS secure more= slowly because of policy.)

I would be very interest= ed, if you are so inclined, to hear more of what you are thinking.=C2=A0 = =C2=A0Is this something you can (are willing to) talk about?=C2=A0 =C2=A0

It sounds like a very thought-provoking initiative.=

Thanks,
Nalini

On Mon, Mar 11, 201= 9 at 10:55 AM Paul Vixie <paul@redba= rn.org> wrote:


Christian Huitema wrote on 2019-03-10 21:14:
...
> There are a bunch of conflicting requirements here, and it would be go= od
> to tease out the contradictions. Consider the following cases:
>
> 1) I am using my phone, and using application-X.
>
> 2) I am at home, using application-X on my home computer.
>
> 3) I am using Wi-Fi in a hotel, and using application-X.
>
> 4) I am using my work laptop on the enterprise network, and using
> application-X
>
> 5) I am using my work laptop in a hotel, and using application-X
>
> 6) I am using my work laptop on the network of a customer, and using > application-X.

this distinction is not useful.

there are two cases.

a user or app trusts its network.

or not.

in the first case, you'll use an RDNS service which is in the set
(allowed (preferred)). that is, you'll use the server you desire most <= br> out of the set that your network operator allows you to reach.

in the second case, you'll use a VPN, for all of your traffic, not just=
for DNS, because if you hide your DNS but not the connections which
result from such hiding, it will add no measurable privacy.

> Today, plenty of people claim the right to control how I use the DNS: = my
> phone carrier, my ISP at home, the company that got the contract to > manage the hotel's Wi-Fi, the IT manager for my company's lapt= op, the IT
> manager for the company that I am visiting. Out of those, there is jus= t
> one scenario for which the claim has some legitimacy: if the company > pays for my laptop and own the laptop, yes of course it has a legitima= te
> claim to control how I am using it. Otherwise, I, the user, get to
> decide. If I like the application's setting better than the networ= k's
> default, then of course I expect those settings to stick.

this distinction is also false.

if you are using my network, then it makes no difference which of us
bought you that laptop. you will use the RDNS i allow you to use. RDNS
is part of the control plane, and i use it for both monitoring and
control. sometimes that's so that i can see malware beacon to its C&= ;C.
sometimes that's so that i can institute parental controls.

if you don't like my rules, you should vote with your feet, and not visit me. because that is the only choice you will have. (yes, i will be part of a major new project to identify and block all DoH services, so
that behavioural security policies can still work, because you may have noticed that the internet has never become MORE secure from new tech,
but it occasionally becomes LESS secure more slowly because of policy.)

quoting again the salient passage of RFC 8484's self-damning introducti= on:

> ... Two primary use cases were considered during this protocol's <= br> > development. These use cases are preventing on-path devices from
> interfering with DNS operations, ...

let me give you advance notice: "i aim to misbehave."[1] that is,= _i am
on-path, and i intend to interfere._ why on earth the IETF decided to
equate dissidents (of whom there are tens of thousands, all of which
need full VPN's not just DoH for actual safety) with bots (of which there are tens of millions), and set up a war between end users and
network operators, i will never understand, or try to. now, we fight.

--
P Vixie



--
Thanks,
Nalini = Elkins
President
Enterprise Data Center Operators

--0000000000002be7700583caef88-- From nobody Sun Mar 10 23:17:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 50BB5130F4F; Sun, 10 Mar 2019 23:17:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lHdF2PgySFoU; Sun, 10 Mar 2019 23:17:44 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DF264130F46; Sun, 10 Mar 2019 23:17:44 -0700 (PDT) Received: from [IPv6:2001:559:8000:c9:c469:941:d0ef:306d] (unknown [IPv6:2001:559:8000:c9:c469:941:d0ef:306d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id AEF55892C6; Mon, 11 Mar 2019 06:17:44 +0000 (UTC) To: Christian Huitema Cc: Stephen Farrell , doh@ietf.org, dnsop@ietf.org, nalini elkins , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> From: Paul Vixie Message-ID: <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> Date: Sun, 10 Mar 2019 23:17:43 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.11 MIME-Version: 1.0 In-Reply-To: <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 06:17:47 -0000 Christian Huitema wrote on 2019-03-10 23:05: > On 3/10/2019 10:24 PM, Paul Vixie wrote: > >> if you are using my network, then it makes no difference which of us >> bought you that laptop. you will use the RDNS i allow you to use. RDNS >> is part of the control plane, and i use it for both monitoring and >> control. sometimes that's so that i can see malware beacon to its C&C. >> sometimes that's so that i can institute parental controls. >> >> if you don't like my rules, you should vote with your feet, and not >> visit me. because that is the only choice you will have. (yes, i will >> be part of a major new project to identify and block all DoH services, >> so that behavioural security policies can still work, because you may >> have noticed that the internet has never become MORE secure from new >> tech, but it occasionally becomes LESS secure more slowly because of >> policy.) > > > "Use a VPN, or use the local defaults". that is not what i said. > Well, there are plenty of > in-between. yes, and i gave examples. see above. > You claim the right to impose your rules, because it is "your network". > Yet you have to define ownership. You are providing network services > under some contractual terms. There are cases where an imperial network > can dictate those terms, but there are also many cases in which the > contractual power of the network is limited  -- thinks like fair access, > network neutrality, etc. Just claiming an empire does not automatically > make you the emperor. my network, my rules. your provider's network, their rules. they are more likely to have to follow their government's laws of commerce and privacy than i am likely to have to follow mine. but if the rules your network operator can make allow you to do what you want, use that network. that's invariant, for all networks, and for all instances of you. -- P Vixie From nobody Sun Mar 10 23:21:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B3584130F5C for ; Sun, 10 Mar 2019 23:21:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NYE_CKWyk1CG for ; Sun, 10 Mar 2019 23:21:05 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73DFF130F4D for ; Sun, 10 Mar 2019 23:21:05 -0700 (PDT) Received: from xsmtp31.mail2web.com ([168.144.250.234] helo=xsmtp11.mail2web.com) by mx37.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3E4X-00013y-Gp for doh@ietf.org; Mon, 11 Mar 2019 07:06:02 +0100 Received: from [10.5.2.18] (helo=xmail08.myhosting.com) by xsmtp11.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3E4U-000418-4o for doh@ietf.org; Mon, 11 Mar 2019 02:06:00 -0400 Received: (qmail 6832 invoked from network); 11 Mar 2019 06:05:54 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail08.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 11 Mar 2019 06:05:54 -0000 To: Paul Vixie Cc: Stephen Farrell , doh@ietf.org, dnsop@ietf.org, nalini elkins , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> Date: Sun, 10 Mar 2019 23:05:52 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US X-Originating-IP: 168.144.250.234 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.18) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5vl7LL4QAJoZsF4yRt4dGf5602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxqwnQaHMZiZeQhwYIo4wji0h5 mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2sYjO05mTPID+/6Aj9ZzRI/vRa7MR4hgRIg8N 1QlY4G7x1YBTEs55LirRLgpsvCFt8i77Wu2Jb/TI0CxS53moc/SlgXpNwUDmiieE9G+9VqfZ1kay mqFCHRp6u+mIhIXg5jssJAnfERZ2C5vj1sOdsnQOD0r6/AaHZiEtdTMtMljoSvSqrGwueTSCQFid cy15jQ4HwbF4aWaRl0axA525ouWBOXp8nHKe0R+FkIqN7hkgzj0zEmu34GPXR572RNl5VgW9/bkt U41htiJ8fk7NkHmplbyYh4+w03es32OzjfSo5Jhwk+hMTKYppuA2BaWeipTPWMHGUquOFNpW9R6n Md9TLrF9l3ItGfA/WrnALV5BhFjwanMsx4Rx/4gso194KaqCE0LDxXmwujGmer4bH3Ezefe7A/Y+ 1TcuLkMAAkM69TdE5SQ4dxJir0Y8rHr0CnFV4ppbCSIV+5MQOIhZD0YsNwSrwzPbXZMD1WP1LXFD lJBVkCSQ2iLcAY5Y0XJtqwPiG77RlB1oqlzsN7KI5Od/gB/NihMPulp0+atPY7ir2Sqw9KBaAUuM ZylbRx9EJMbvY+SCVD4S6/AuCzHYfXL80ktPRElqZvYiXSixw5oUjH7OdA4AxqY9XSPDZhXTawLW W3GG8MACLK1/XOkZcwxWFSzsWt2uE/YFyU00jIgFmOuE2myvw52ju4vOqkVF7R9lLUJTOMC9AqYW 1lRNjkWXJryJ9+EiOvBe6vFbUGRrwytzyq4nhu0+m3/YUu4UI2GoiS4jWHSkvyyyS8KErWmYf+RR A94if7oLzRs73BRh3+MrOOK4NgfP/RZivWtTzbcnsscMdnMYECIJ64duuA== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 06:21:07 -0000 On 3/10/2019 10:24 PM, Paul Vixie wrote: > if you are using my network, then it makes no difference which of us > bought you that laptop. you will use the RDNS i allow you to use. RDNS > is part of the control plane, and i use it for both monitoring and > control. sometimes that's so that i can see malware beacon to its C&C. > sometimes that's so that i can institute parental controls. > > if you don't like my rules, you should vote with your feet, and not > visit me. because that is the only choice you will have. (yes, i will > be part of a major new project to identify and block all DoH services, > so that behavioural security policies can still work, because you may > have noticed that the internet has never become MORE secure from new > tech, but it occasionally becomes LESS secure more slowly because of > policy.)=20 "Use a VPN, or use the local defaults". Well, there are plenty of in-between. For example, I might be using a web proxy, which is sort of like a VPN but not quite. Or I might be using some web-RTC application, which uses something else than DNS to identify my peers. DNS is just one way to locate servers I want to connect to. You claim the right to impose your rules, because it is "your network". Yet you have to define ownership. You are providing network services under some contractual terms. There are cases where an imperial network can dictate those terms, but there are also many cases in which the contractual power of the network is limited=C2=A0 -- thinks like fair acc= ess, network neutrality, etc. Just claiming an empire does not automatically make you the emperor. -- Christian Huitema From nobody Mon Mar 11 00:43:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DD471310E7 for ; Mon, 11 Mar 2019 00:43:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9oLWGNc-Wr-q for ; Mon, 11 Mar 2019 00:43:53 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A0DBB128678 for ; Mon, 11 Mar 2019 00:43:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=5414; q=dns/txt; s=iport; t=1552290233; x=1553499833; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=DcB1rZoMP0dZE6brX63jnlzVOiDN1SC0hX9H++6hZyA=; b=AIxtMhEn906zMtpIaSjq3qcF//yRUrJ6lXDHLYPFUNX3wiUvqsxv0arN 0Nu570PyXjB0o2/TC38BsEIFD2dig/ZTa9k86CdCQ5rUoBWDrsuqifogY BrVqqwJHbBYq0RY5cm4YyffuTTENKcl8KRuRMdNW5qN684NfZsouSxWYU M=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A9AABpEYZc/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYNpEieECYh5jFySM4duCAMBAYRsAoRbOBIBAQMBAQc?= =?us-ascii?q?BAwJtKIVKAQEBAwEjVgULCwQUKgICVwYTFIMOAYFtCK8EgS+FRYRRD4EvgUm?= =?us-ascii?q?Je4F/gTgfgkyICzGCJgOKSIYoTJJlCYRZjjMZgXmFZotbmlGCbgIEBgUCFYF?= =?us-ascii?q?eIYFWMxoIGxVlAYJBPoFYF44fPgMwkD4BAQ?= X-IronPort-AV: E=Sophos;i="5.58,467,1544486400"; d="asc'?scan'208,217";a="10607167" Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Mar 2019 07:43:50 +0000 Received: from ams3-vpn-dhcp7163.cisco.com (ams3-vpn-dhcp7163.cisco.com [10.61.91.250]) by aer-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x2B7hnZN005204 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 11 Mar 2019 07:43:50 GMT From: Eliot Lear Message-Id: <825A194A-1DC5-44C0-A7CD-34E0B8C8A5E7@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_680F1187-45F8-4E2C-8FD9-252BAB4A43A8"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Mon, 11 Mar 2019 08:43:48 +0100 In-Reply-To: Cc: "Livingood, Jason" , Jim Reid , DoH WG , Stephane Bortzmeyer To: Warren Kumari References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.91.250, ams3-vpn-dhcp7163.cisco.com X-Outbound-Node: aer-core-2.cisco.com Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 07:43:55 -0000 --Apple-Mail=_680F1187-45F8-4E2C-8FD9-252BAB4A43A8 Content-Type: multipart/alternative; boundary="Apple-Mail=_B34B1CA8-C49D-450D-AC1C-CBB75D6FF881" --Apple-Mail=_B34B1CA8-C49D-450D-AC1C-CBB75D6FF881 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Warren, > On 11 Mar 2019, at 03:27, Warren Kumari wrote: >=20 > DoH is a protocol - the concerns you are talking about (and I'm glad = they are being discussed, they are important policy discussions) are not = specific to DoH -- this sentence works just as well with DNS-over-TLS, = plain DNS, using some completely proprietary name resolution mechanism. = It is trivial for any "large app" writer to invent a proprietary way to = do DNS resolution - please please, let's keep the DoH (protocol) versus = "apps doing their own resolution" separate. A standardized DoH enables alternative interoperable service = infrastructure to be formed and not be easily blocked by access = providers. That=E2=80=99s different from all other models, and it has = ramifications. The point is that our providing the path of = interoperability means, as Paul Vixie points out, that we owe it to = ourselves and to the community to understand those ramifications. We have been here before. When the IAB allocated 10/8, they were = providing an interoperable method for private networks in direct = response to people picking networks out of a hat. It too had = substantial ramifications.[1]* It is absolutely possible for the existing infrastructure to adopt DoH, = and I suspect that will happen. But that is not the driving use case = today. An alternate DNS infrastructure is the driving use case, and we = should be mindful of that. Eliot [1] RFCs 1597, 1617, 1918, et al. * Amusingly, Paul and I were heavily involved in that discussion as = well. --Apple-Mail=_B34B1CA8-C49D-450D-AC1C-CBB75D6FF881 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Warren,

On 11 Mar 2019, at 03:27, Warren Kumari = <warren@kumari.net> wrote:

DoH is a protocol - the = concerns you are talking about (and I'm glad they are being discussed, = they are important policy discussions) are not specific to DoH -- this = sentence works just as well with DNS-over-TLS, plain DNS, using some = completely proprietary name resolution mechanism. It is trivial for any = "large app" writer to invent a proprietary way to do DNS resolution - = please please, let's keep the DoH (protocol) versus "apps doing their = own resolution" separate.


A standardized DoH = enables alternative interoperable service = infrastructure to be formed and not be easily blocked by access = providers.  That=E2=80=99s different from all other models, and it = has ramifications. The point is that our providing the path of = interoperability means, as Paul Vixie points out, that we owe it to = ourselves and to the community to understand those ramifications. =  

We have been here before. =  When the IAB allocated 10/8, they were providing an interoperable method for private networks in direct = response to people picking networks out of a hat.  It too had = substantial ramifications.[1]* 

It is absolutely possible for the existing = infrastructure to adopt DoH, and I suspect that will happen.  But = that is not the driving use case today.  An alternate DNS = infrastructure is the driving use case, and we should be mindful of = that.

Eliot
[1] RFCs 1597, = 1617, 1918, et al.
* Amusingly, Paul and I were heavily = involved in that discussion as well.
= --Apple-Mail=_B34B1CA8-C49D-450D-AC1C-CBB75D6FF881-- --Apple-Mail=_680F1187-45F8-4E2C-8FD9-252BAB4A43A8 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyGEbQACgkQh7ZrRtnS ejPJegf/cPBNWVG95lymGCUrwoiwIN6sMpOVLQUFG1hivFdlLnyV/dUrEEra91iM V0nq/1DrA4+bVy9FZaiyq+w9sDBUlH8jxD33EIqXiBS+ZTGCwUYQY3Cj2/0Oj/Pi k9pwSDVEl/5diZ9a9FX/NsQp5sRED4/IIZFDKlVIMlEAwUm7FXX0+WxLD8ebcRcG YzAvwrQtc7qB8MYceeAWvf+StlfMCK8af8FU8vu1a0PVYoZF+onSX1qDkrdcCMFH aEJIqVLKDaWxsur1KDmzU4eGxXXO44SxnmQc3MW2DSZZy3hy9U8yyygjidOo9aaw 9oOpnHOj6mVPrtytE4F0RKroeOU2yw== =vpsl -----END PGP SIGNATURE----- --Apple-Mail=_680F1187-45F8-4E2C-8FD9-252BAB4A43A8-- From nobody Mon Mar 11 01:47:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3964130FCF for ; Mon, 11 Mar 2019 01:47:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eZypc0TYCGHm for ; Mon, 11 Mar 2019 01:47:07 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 99953129A85 for ; Mon, 11 Mar 2019 01:47:07 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 7CAC65F403F6; Mon, 11 Mar 2019 09:47:06 +0100 (CET) Received: from [172.19.153.81] (p4FF53782.dip0.t-ipconnect.de [79.245.55.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id AB5725F40330; Mon, 11 Mar 2019 09:47:04 +0100 (CET) From: "Ralf Weber" To: "Stephane Bortzmeyer" Cc: "Livingood, Jason" , "DoH WG" Date: Mon, 11 Mar 2019 09:47:03 +0100 X-Mailer: MailMate (1.12.4r5594) Message-ID: <5FE94C8C-158D-43AD-86B6-1949A8F740EC@fl1ger.de> In-Reply-To: <20190310073306.GA10396@laperouse.bortzmeyer.org> References: <20190309182857.GA29321@laperouse.bortzmeyer.org> <6ED365D5-8717-46A6-B75E-A628753C2979@fl1ger.de> <20190310073306.GA10396@laperouse.bortzmeyer.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 08:47:10 -0000 Moin! On 10 Mar 2019, at 8:33, Stephane Bortzmeyer wrote: > You are not a lawyer and neither I am but I think it is more > complicated. At least in France but probably in many other countries, > legal rulings by court are to be enforced only by organisations which > have been named in the rulings. Most of them don't name Google Public > DNS or Cloudflare 1.1.1.1 or Yandex DNS. For the censorship which does > not go through courts, such as the blacklist of the governement in > France, the list is not public and therefore public DNS resolvers > cannot follow it, even if they want (at least one not-for-profit > organisation explicitely asks for this list and was denied). So, no, I > don't think they are breaking the law (yes, IANAL, but nobody here is). As you say we are both not lawyers and law is a thing that still is highly country dependant, so it might be different in different countries. Most jurisdictions though have something from the old roman law “Ignorantia legis non excusat” meaning not knowning the law doesn’t protect you from punishment. So while you may be fine now, because your volume is so low that lawmakers don’t care, you might not be in the future. >> But to deploy it you need money and a business case, and I can not >> find a primary business case to run a DoH server. > > The will to provide an alternative? In France, at least two > not-for-profit organisations operate a public DNS resolver precisely > for that. There is not only business in life. Good, but even not for profit need money from someone and I doubt that we can supply DoH service for large portion of the Internet using non profit organisations. >> I think the only way to get lots of DoH providers is to help the >> ISPs to do it as they are the natural decentralised player on the >> internet. > > Clearly, we disagree here, but it seems more a political disagreement > than a technical issue with the protocol of this WG. You didn’t mention an alternative or do you really think a lot of different non profit organisations will provide resolving for the Internet? Also the DoH protocol and subsequent actions of application providers triggered these discussions. So were should we discuss them if not here. So long -Ralf —-- Ralf Weber From nobody Mon Mar 11 08:00:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C95D31310D7 for ; Mon, 11 Mar 2019 08:00:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GcOPJRLcZ-AG for ; Mon, 11 Mar 2019 08:00:07 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92305131159 for ; Mon, 11 Mar 2019 08:00:07 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 99F54242109D; Mon, 11 Mar 2019 15:00:04 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190310080101.GA11452@laperouse.bortzmeyer.org> Date: Mon, 11 Mar 2019 15:00:03 +0000 Cc: DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 15:00:10 -0000 > On 10 Mar 2019, at 08:01, Stephane Bortzmeyer = wrote: >=20 > I'm surprised that it is published more or less at the same time > draft-livingood-doh-implementation-risks-issues. They have a lot of > overlap, and even one author in common. May be a merge would be a good > idea? Maybe, though I=E2=80=99m not sure that=E2=80=99s a good idea. Although there is overlap in content between the two drafts, the = underlying focus of both documents are very different. They don=E2=80=99t = overlap. Another way forward might be to take out the common material from both = drafts and out that into yet another I-D (for dnsop?) which examines the = privacy/security aspects. [Some of those aspects are already in = draft-bertola-bcp-doh-clients, so maybe that could be a new home for = this material?] That would leave the DoH WG with a draft that considers = the consolidation and aggregation issues. And another draft that looks = at the impact of DoH uptake in operator networks. From nobody Mon Mar 11 08:07:55 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6F0E13116E; Mon, 11 Mar 2019 08:07:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p5M6bDWblXMC; Mon, 11 Mar 2019 08:07:34 -0700 (PDT) Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 06ED213115A; Mon, 11 Mar 2019 08:07:33 -0700 (PDT) X-NAI-Header: Modified by McAfee Email Gateway (5500) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552316645; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-ms-exchange-purlcount:x-microsoft-exchange-diagnostics: x-microsoft-antispam-prvs:x-forefront-prvs: x-forefront-antispam-report:received-spf:x-ms-exchange-senderadcheck: x-microsoft-antispam-message-info:Content-Type: MIME-Version:X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Threshold: X-NAI-Spam-Score:X-NAI-Spam-Version; bh=Z V9XPsCyUZuIWfK0U6j3XMQOeb/v+WwEDuGz1+isEz k=; b=drM6eFNwjdbpq6lRTVJpYvZv1B2k1zDHxpde8MwtHI8Z xiiSRPc0MdObACqTvqs/C0gwH881ZIslQjHggnVupHEbMeV36+ Llp+cf05DNGKfLgsDrNetJNNZ9D+uzPP47QHwelQlfL8pdVdBU rFf3mABNP1W1xqkruzJ+O+pkomU= Received: from DNVEXAPP1N06.corpzone.internalzone.com (unknown [10.44.48.90]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 4d23_2773_afb60513_be75_48fd_9cec_d2c84b98a6cd; Mon, 11 Mar 2019 09:04:04 -0600 Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N06.corpzone.internalzone.com (10.44.48.90) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 09:06:55 -0600 Received: from DNVO365EDGE2.corpzone.internalzone.com (10.44.176.74) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 11 Mar 2019 09:06:55 -0600 Received: from NAM04-CO1-obe.outbound.protection.outlook.com (10.44.176.243) by edge.mcafee.com (10.44.176.74) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 09:06:54 -0600 Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2534.namprd16.prod.outlook.com (20.177.225.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.21; Mon, 11 Mar 2019 15:06:53 +0000 Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1686.021; Mon, 11 Mar 2019 15:06:53 +0000 From: "Konda, Tirumaleswar Reddy" To: nalini elkins , Paul Vixie CC: Stephen Farrell , "doh@ietf.org" , "dnsop@ietf.org" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" Thread-Topic: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU18EUlfcZSGs9J0KNFyMWu+pdj6YF5gQAgAACz4CAAJwPEA== Date: Mon, 11 Mar 2019 15:06:53 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com; x-originating-ip: [49.37.203.5] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: cddb0001-2a1b-423f-1f14-08d6a63331fb x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB2534; x-ms-traffictypediagnostic: BYAPR16MB2534: x-ms-exchange-purlcount: 2 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtCWUFQUjE2TUIyNTM0OzIzOlM2QVNrckQxc1pZUGwrQnZ5WXhnd1h3YnFa?= =?utf-8?B?VEhRdEhDaVhIQXUvMXM2NitCTkE0ZXhRN3lXV1RIM05IL0kvSEM4cDdJdXpF?= =?utf-8?B?ZkJzZFNjTzNuTmZ2eGtBK2FmNGRWK1VwcTFjY2tsTzJJUUdlbjcyeWJVS3FL?= =?utf-8?B?OXB6QWZXV1ZMbzBhcGJUWDZpcXhDRUdzY1lVaU1hQlhFVTl1dDhpUXYxWitB?= =?utf-8?B?WENtMjZRazdQNUhyNGlYQ2RnZzFONFNrOHRIRXo3TVlNOGxOVnB1bUNjQmpu?= =?utf-8?B?QlJOMnF3ZmNTUVBzV1RPNEVsTUZvY1k0WGQ2ay9HbFN4OE55TllIQ1dPRFhU?= =?utf-8?B?anBkVHVXK0xEK0RiYVlIMkpwZGpJaUhac2pUVUE1MEpqOXFRb1hoK2dySThn?= =?utf-8?B?K2Qyb3FIUytNTTFUZlRJK0I2YnNkbzJubXN0MUFYUm5aUWEvdUtNNWsvZEpK?= =?utf-8?B?RTFEVENmK3dBVjJoVlgvLzRpSEpkMHArRVc5TFVMTTRlaGxLOFI4TDM3UDdl?= =?utf-8?B?cHFTc0dJODZvVnd0MmU1eDBNOERSREMzNVZ0MVdvYVRXajJYcW9RVStlZWly?= =?utf-8?B?bUhPSXpoWTdSSWpEQUZPWnhGT0F1ckhkYW9ENTAzUjRPZEpvaXU5Z1hMQ2ZI?= =?utf-8?B?Z0VMRVZEUjNIYWEyOHZnMXczQlViajkxZHlnWm1LRVBxT3hMVlZ6Z0J5QzBn?= =?utf-8?B?TUI2amlxcmRkdE9WZHlyOS94YlB6RXIyWEYyS2pxcmZnQS9WSDErTTYyZ2FU?= =?utf-8?B?NGt5OGFUOGZSQ1dLc2xMOTJBV2dCd1FKYStYQlFoNUhlMFcrN0UyOW0vOFRy?= =?utf-8?B?bDB1aUlvaVR6WGgxQmNTVWNTeW5KQ0l5R3RmUmFFdGEvU085anE0bHYwTXg3?= =?utf-8?B?bXh4ck0xQmNPUllidHlyeGhQMUxwQlVPbi9IL3EvL21BRmpIQXZ6U3p1Vzhh?= =?utf-8?B?VmZwc1lnNFYzVjY2N05ZUU1wVENKU2FSZ2RjSGVyVU9zNEkwMTBMUUJtZ1Y5?= =?utf-8?B?akpsTTZuWUFzRFNIdmlXSTRZN2U0OEh2UHZaZTl6dEhRUlE4emxwK2xHdUo1?= =?utf-8?B?Zlc5bFhJOFZhYWIxMTBKR2p6bTlRY3R5RzZTcyt6TFMwdFQyN04rWStLaUxr?= =?utf-8?B?UnpNeVFpY2ltZjd3L2grQjhnTStNY3h2MEpjS0pvSFRtcHE5QjNueGtUYmtR?= =?utf-8?B?OTVNR1JoNTZVVTRwNktMNGhwRWhrOGJuYlZuQ2szUmQ2V1lKMHBhV0pNejU2?= =?utf-8?B?RUVTakxUY2dPOFRLU1dhb0R0UitzbFZYcjhIYzBlUTZtUVVZVDBralBqdWhN?= =?utf-8?B?dklud1FZV2s1enI5OXpWK2dTZ3lKd01lRk5UM09UZ1JCYldvVEVkd2VvTGRq?= =?utf-8?B?RDJlajhpTG13b0Q1VlZCenlaVGVrakpONXMzQkV1bEp2dGUrbHcwKzMrTnFQ?= =?utf-8?B?TGVjMHR4T1puMlVkY2hnMVZNblNIMVdlcXNDZEN2elZSR2prUWNKY0tsdUh0?= =?utf-8?B?RysvSFA0NStRYUZJRnNHUko3K0k4R0lOU2kzaDVMVHVpNlVpK3FtRVhsK2VS?= =?utf-8?B?RjVkbmU0cHFpejJhVGM3Q2tEU28rWVVvdEp0bHhMaHB3ck5MNkNVcS92R2Fn?= =?utf-8?B?SHFPZ0pjRzlBSXVCL1diUlhJNVBWOWhnTHZLajFnUUFOQnA1Rm14SWo2QTdF?= =?utf-8?B?TDNhY09TQTdrYXQ1WmFMcmFzV0NocDJRbWVWd0c3SzdXVmp4S0lPRXRxUkdX?= =?utf-8?B?dUhjV21abDdOVVFJeG1Kc3N5bGwwSStiUytMZk9TUnNlOFAwRXJqOUhadlpz?= =?utf-8?B?VEl6RkdlTDEzYk1XNzg0c2RENjQ1bGlwS3l6eTNqTytKWmVNM1ovd1d0c3VR?= =?utf-8?B?MExzNm1YeE8wWjQxcW5uOGJHSlEvSk90eStJbjFORWVseW42V3dsWTBUdVp3?= =?utf-8?B?QTBMZWhxNXBmMFhBRE9La2ptVzJCenpJQk5zc28rRy9TQmFRZkh4ZzBaOThs?= =?utf-8?B?c3o5S3p3TElUWW4rQVR4K2lhb3JUT1ovUk5qeU8wd3RDUWFYYmUzQWdJSmxX?= =?utf-8?Q?jpAwLMPv5Wz6FvjtsWKocM2zg?= x-microsoft-antispam-prvs: x-forefront-prvs: 09730BD177 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(396003)(366004)(39860400002)(346002)(136003)(199004)(189003)(32952001)(316002)(105586002)(53936002)(102836004)(66066001)(76176011)(33656002)(7696005)(54906003)(110136005)(606006)(186003)(99286004)(6506007)(106356001)(71190400001)(71200400001)(53546011)(6246003)(4326008)(2906002)(8936002)(14454004)(8676002)(229853002)(81166006)(81156014)(80792005)(26005)(68736007)(7736002)(97736004)(54896002)(72206003)(966005)(52536013)(790700001)(74316002)(53386004)(86362001)(5660300002)(476003)(478600001)(6116002)(236005)(93886005)(3846002)(25786009)(446003)(486006)(256004)(5024004)(14444005)(11346002)(6436002)(66574012)(6306002)(55016002)(9686003)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2534; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: teVwJn81MqvgBQ0yhGH2exmiguzpV8MC4X1LGsrRkNbazuBkX0X6f2drIq20QMfiVBj23NjBLYj6JBgbr0QaWZnGX16ni2bTubu+UiVUyRaub8zebd47njFzR/49XpiMGqKMmKlbAycvO2V1k8WMCz9BPB8axW6KM4xNzVWZiqhliAbyH49Burt84Zh5wJdPmRBuH6UEYIfoK4MPl/ruLKGFm0FXFRaA/aeiUS8bhFouBVoX0h8CuSjblODiHfzrFYR5c7a/zDaVDe6gme/9I78PxpmTzbuZWxO9fss3L2aVX+67lBXYBipe/x+sZV4IBAU0G2VTRPrSJA6Ty1jmU7z9uc9ELCDeqWDFIOin/wFhqu732rNjislp/XQiS178K5amOpWtonw+Mz7/mPB7swJZroHWbJcL5eBxAtIjBZg= Content-Type: multipart/alternative; boundary="_000_BYAPR16MB279065EE519680E7FC9A637CEA480BYAPR16MB2790namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: cddb0001-2a1b-423f-1f14-08d6a63331fb X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2019 15:06:53.0677 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2534 X-OriginatorOrg: mcafee.com X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 15 X-NAI-Spam-Score: 0 X-NAI-Spam-Version: 2.3.0.9418 : core <6500> : inlines <7030> : streams <1815404> : uri <2810816> Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 15:07:42 -0000 --_000_BYAPR16MB279065EE519680E7FC9A637CEA480BYAPR16MB2790namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UGxlYXNlIHNlZSBpbmxpbmUgW1RSXQ0KDQpGcm9tOiBkbnMtcHJpdmFjeSA8ZG5zLXByaXZhY3kt Ym91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIG5hbGluaSBlbGtpbnMNClNlbnQ6IE1vbmRh eSwgTWFyY2ggMTEsIDIwMTkgMTE6MDUgQU0NClRvOiBQYXVsIFZpeGllIDxwYXVsQHJlZGJhcm4u b3JnPg0KQ2M6IFN0ZXBoZW4gRmFycmVsbCA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT47IGRv aEBpZXRmLm9yZzsgZG5zb3BAaWV0Zi5vcmc7IENocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1 aXRlbWEubmV0PjsgZG5zLXByaXZhY3lAaWV0Zi5vcmc7IFZpdHRvcmlvIEJlcnRvbGEgPHZpdHRv cmlvLmJlcnRvbGE9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnPjsgQWNrZXJtYW5u LCBNaWNoYWVsIDxtYWNrZXJtYW5uQGJjYnNtLmNvbT4NClN1YmplY3Q6IFJlOiBbZG5zLXByaXZh Y3ldIFtETlNPUF0gTmV3OiBkcmFmdC1iZXJ0b2xhLWJjcC1kb2gtY2xpZW50cw0KDQoNCkNBVVRJ T046IEV4dGVybmFsIGVtYWlsLiBEbyBub3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRhY2htZW50 cyB1bmxlc3MgeW91IHJlY29nbml6ZSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlz IHNhZmUuDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18NClBhdWwsDQoNCj4g KHllcywgaSB3aWxsIGJlIHBhcnQgb2YgYSBtYWpvciBuZXcgcHJvamVjdCB0byBpZGVudGlmeSBh bmQgYmxvY2sgYWxsIERvSCBzZXJ2aWNlcywgc28NCj4gdGhhdCBiZWhhdmlvdXJhbCBzZWN1cml0 eSBwb2xpY2llcyBjYW4gc3RpbGwgd29yaywgYmVjYXVzZSB5b3UgbWF5IGhhdmUNCj4gbm90aWNl ZCB0aGF0IHRoZSBpbnRlcm5ldCBoYXMgbmV2ZXIgYmVjb21lIE1PUkUgc2VjdXJlIGZyb20gbmV3 IHRlY2gsDQo+IGJ1dCBpdCBvY2Nhc2lvbmFsbHkgYmVjb21lcyBMRVNTIHNlY3VyZSBtb3JlIHNs b3dseSBiZWNhdXNlIG9mIHBvbGljeS4pDQoNCkkgd291bGQgYmUgdmVyeSBpbnRlcmVzdGVkLCBp ZiB5b3UgYXJlIHNvIGluY2xpbmVkLCB0byBoZWFyIG1vcmUgb2Ygd2hhdCB5b3UgYXJlIHRoaW5r aW5nLiAgIElzIHRoaXMgc29tZXRoaW5nIHlvdSBjYW4gKGFyZSB3aWxsaW5nIHRvKSB0YWxrIGFi b3V0Pw0KDQpbVFJdIEVudGVycHJpc2UgbmV0d29ya3MgYXJlIGFscmVhZHkgYWJsZSB0byBibG9j ayBEb0ggc2VydmljZXMsIGl0IGlzIGNhdXNpbmcgdGhlIERvSCBjbGllbnQgdG8gZmFsbGJhY2sg dG8gY2xlYXItdGV4dCBETlMgY29tcHJvbWlzaW5nIGVuZHBvaW50IHNlY3VyaXR5IGFuZCBwcml2 YWN5LiBJbiBkcmFmdCBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHktZHBy aXZlLWJvb3RzdHJhcC1kbnMtc2VydmVyLTAxIHdlIGFyZSBwcm9wb3NpbmcgbWVjaGFuaXNtcyB0 byBhdXRvbWF0aWNhbGx5IGJvb3RzdHJhcCBlbmRwb2ludHMgdG8gZGlzY292ZXIgYW5kIGF1dGhl bnRpY2F0ZSBwcml2YWN5LWVuYWJsaW5nIEROUyBzZXJ2ZXJzIHByb3ZpZGVkIGJ5IHRoZSBFbnRl cnByaXNlIG5ldHdvcmsuDQoNClRoZSB1c2VyIGFsc28gZ2V0cyB0byBrbm93IHRoZSBwcml2YWN5 IHByZXNlcnZpbmcgZGF0YSBwb2xpY3kgYnkgdGhlIEROUyBzZXJ2ZXIgYW5kIGNhbiBkZWNpZGUg d2hldGhlciB0byBzd2l0Y2ggdG8gYW5vdGhlciBuZXR3b3JrIG9yIGlmIHRoZSB1c2VyIHRydXN0 cyB0aGUgbmV0d29yayBhbmQgcHJpdmFjeSBwb2xpY3ksIHRoZSB1c2VyIGNhbiBlbmFibGUgc3Ry aWN0IHByaXZhY3kgcHJvZmlsZSB3aXRoIHRoZSBwcml2YWN5IGVuYWJsaW5nIEROUyBzZXJ2ZXIg ZGlzY292ZXJlZCBpbiB0aGUgRW50ZXJwcmlzZSBuZXR3b3JrIGl0c2VsZiBpbnN0ZWFkIG9mIGRv d25ncmFkaW5nIHRvIG9wcG9ydHVuaXN0aWMgcHJpdmFjeSBwcm9maWxlLg0KDQpDaGVlcnMsDQot VGlydQ0KDQpJdCBzb3VuZHMgbGlrZSBhIHZlcnkgdGhvdWdodC1wcm92b2tpbmcgaW5pdGlhdGl2 ZS4NCg0KVGhhbmtzLA0KTmFsaW5pDQoNCk9uIE1vbiwgTWFyIDExLCAyMDE5IGF0IDEwOjU1IEFN IFBhdWwgVml4aWUgPHBhdWxAcmVkYmFybi5vcmc8bWFpbHRvOnBhdWxAcmVkYmFybi5vcmc+PiB3 cm90ZToNCg0KDQpDaHJpc3RpYW4gSHVpdGVtYSB3cm90ZSBvbiAyMDE5LTAzLTEwIDIxOjE0Og0K Li4uLg0KPiBUaGVyZSBhcmUgYSBidW5jaCBvZiBjb25mbGljdGluZyByZXF1aXJlbWVudHMgaGVy ZSwgYW5kIGl0IHdvdWxkIGJlIGdvb2QNCj4gdG8gdGVhc2Ugb3V0IHRoZSBjb250cmFkaWN0aW9u cy4gQ29uc2lkZXIgdGhlIGZvbGxvd2luZyBjYXNlczoNCj4NCj4gMSkgSSBhbSB1c2luZyBteSBw aG9uZSwgYW5kIHVzaW5nIGFwcGxpY2F0aW9uLVguDQo+DQo+IDIpIEkgYW0gYXQgaG9tZSwgdXNp bmcgYXBwbGljYXRpb24tWCBvbiBteSBob21lIGNvbXB1dGVyLg0KPg0KPiAzKSBJIGFtIHVzaW5n IFdpLUZpIGluIGEgaG90ZWwsIGFuZCB1c2luZyBhcHBsaWNhdGlvbi1YLg0KPg0KPiA0KSBJIGFt IHVzaW5nIG15IHdvcmsgbGFwdG9wIG9uIHRoZSBlbnRlcnByaXNlIG5ldHdvcmssIGFuZCB1c2lu Zw0KPiBhcHBsaWNhdGlvbi1YDQo+DQo+IDUpIEkgYW0gdXNpbmcgbXkgd29yayBsYXB0b3AgaW4g YSBob3RlbCwgYW5kIHVzaW5nIGFwcGxpY2F0aW9uLVgNCj4NCj4gNikgSSBhbSB1c2luZyBteSB3 b3JrIGxhcHRvcCBvbiB0aGUgbmV0d29yayBvZiBhIGN1c3RvbWVyLCBhbmQgdXNpbmcNCj4gYXBw bGljYXRpb24tWC4NCg0KdGhpcyBkaXN0aW5jdGlvbiBpcyBub3QgdXNlZnVsLg0KDQp0aGVyZSBh cmUgdHdvIGNhc2VzLg0KDQphIHVzZXIgb3IgYXBwIHRydXN0cyBpdHMgbmV0d29yay4NCg0Kb3Ig bm90Lg0KDQppbiB0aGUgZmlyc3QgY2FzZSwgeW91J2xsIHVzZSBhbiBSRE5TIHNlcnZpY2Ugd2hp Y2ggaXMgaW4gdGhlIHNldA0KKGFsbG93ZWQgKHByZWZlcnJlZCkpLiB0aGF0IGlzLCB5b3UnbGwg dXNlIHRoZSBzZXJ2ZXIgeW91IGRlc2lyZSBtb3N0DQpvdXQgb2YgdGhlIHNldCB0aGF0IHlvdXIg bmV0d29yayBvcGVyYXRvciBhbGxvd3MgeW91IHRvIHJlYWNoLg0KDQppbiB0aGUgc2Vjb25kIGNh c2UsIHlvdSdsbCB1c2UgYSBWUE4sIGZvciBhbGwgb2YgeW91ciB0cmFmZmljLCBub3QganVzdA0K Zm9yIEROUywgYmVjYXVzZSBpZiB5b3UgaGlkZSB5b3VyIEROUyBidXQgbm90IHRoZSBjb25uZWN0 aW9ucyB3aGljaA0KcmVzdWx0IGZyb20gc3VjaCBoaWRpbmcsIGl0IHdpbGwgYWRkIG5vIG1lYXN1 cmFibGUgcHJpdmFjeS4NCg0KPiBUb2RheSwgcGxlbnR5IG9mIHBlb3BsZSBjbGFpbSB0aGUgcmln aHQgdG8gY29udHJvbCBob3cgSSB1c2UgdGhlIEROUzogbXkNCj4gcGhvbmUgY2FycmllciwgbXkg SVNQIGF0IGhvbWUsIHRoZSBjb21wYW55IHRoYXQgZ290IHRoZSBjb250cmFjdCB0bw0KPiBtYW5h Z2UgdGhlIGhvdGVsJ3MgV2ktRmksIHRoZSBJVCBtYW5hZ2VyIGZvciBteSBjb21wYW55J3MgbGFw dG9wLCB0aGUgSVQNCj4gbWFuYWdlciBmb3IgdGhlIGNvbXBhbnkgdGhhdCBJIGFtIHZpc2l0aW5n LiBPdXQgb2YgdGhvc2UsIHRoZXJlIGlzIGp1c3QNCj4gb25lIHNjZW5hcmlvIGZvciB3aGljaCB0 aGUgY2xhaW0gaGFzIHNvbWUgbGVnaXRpbWFjeTogaWYgdGhlIGNvbXBhbnkNCj4gcGF5cyBmb3Ig bXkgbGFwdG9wIGFuZCBvd24gdGhlIGxhcHRvcCwgeWVzIG9mIGNvdXJzZSBpdCBoYXMgYSBsZWdp dGltYXRlDQo+IGNsYWltIHRvIGNvbnRyb2wgaG93IEkgYW0gdXNpbmcgaXQuIE90aGVyd2lzZSwg SSwgdGhlIHVzZXIsIGdldCB0bw0KPiBkZWNpZGUuIElmIEkgbGlrZSB0aGUgYXBwbGljYXRpb24n cyBzZXR0aW5nIGJldHRlciB0aGFuIHRoZSBuZXR3b3JrJ3MNCj4gZGVmYXVsdCwgdGhlbiBvZiBj b3Vyc2UgSSBleHBlY3QgdGhvc2Ugc2V0dGluZ3MgdG8gc3RpY2suDQoNCnRoaXMgZGlzdGluY3Rp b24gaXMgYWxzbyBmYWxzZS4NCg0KaWYgeW91IGFyZSB1c2luZyBteSBuZXR3b3JrLCB0aGVuIGl0 IG1ha2VzIG5vIGRpZmZlcmVuY2Ugd2hpY2ggb2YgdXMNCmJvdWdodCB5b3UgdGhhdCBsYXB0b3Au IHlvdSB3aWxsIHVzZSB0aGUgUkROUyBpIGFsbG93IHlvdSB0byB1c2UuIFJETlMNCmlzIHBhcnQg b2YgdGhlIGNvbnRyb2wgcGxhbmUsIGFuZCBpIHVzZSBpdCBmb3IgYm90aCBtb25pdG9yaW5nIGFu ZA0KY29udHJvbC4gc29tZXRpbWVzIHRoYXQncyBzbyB0aGF0IGkgY2FuIHNlZSBtYWx3YXJlIGJl YWNvbiB0byBpdHMgQyZDLg0Kc29tZXRpbWVzIHRoYXQncyBzbyB0aGF0IGkgY2FuIGluc3RpdHV0 ZSBwYXJlbnRhbCBjb250cm9scy4NCg0KaWYgeW91IGRvbid0IGxpa2UgbXkgcnVsZXMsIHlvdSBz aG91bGQgdm90ZSB3aXRoIHlvdXIgZmVldCwgYW5kIG5vdA0KdmlzaXQgbWUuIGJlY2F1c2UgdGhh dCBpcyB0aGUgb25seSBjaG9pY2UgeW91IHdpbGwgaGF2ZS4gKHllcywgaSB3aWxsIGJlDQpwYXJ0 IG9mIGEgbWFqb3IgbmV3IHByb2plY3QgdG8gaWRlbnRpZnkgYW5kIGJsb2NrIGFsbCBEb0ggc2Vy dmljZXMsIHNvDQp0aGF0IGJlaGF2aW91cmFsIHNlY3VyaXR5IHBvbGljaWVzIGNhbiBzdGlsbCB3 b3JrLCBiZWNhdXNlIHlvdSBtYXkgaGF2ZQ0Kbm90aWNlZCB0aGF0IHRoZSBpbnRlcm5ldCBoYXMg bmV2ZXIgYmVjb21lIE1PUkUgc2VjdXJlIGZyb20gbmV3IHRlY2gsDQpidXQgaXQgb2NjYXNpb25h bGx5IGJlY29tZXMgTEVTUyBzZWN1cmUgbW9yZSBzbG93bHkgYmVjYXVzZSBvZiBwb2xpY3kuKQ0K DQpxdW90aW5nIGFnYWluIHRoZSBzYWxpZW50IHBhc3NhZ2Ugb2YgUkZDIDg0ODQncyBzZWxmLWRh bW5pbmcgaW50cm9kdWN0aW9uOg0KDQo+IC4uLiBUd28gcHJpbWFyeSB1c2UgY2FzZXMgd2VyZSBj b25zaWRlcmVkIGR1cmluZyB0aGlzIHByb3RvY29sJ3MNCj4gZGV2ZWxvcG1lbnQuIFRoZXNlIHVz ZSBjYXNlcyBhcmUgcHJldmVudGluZyBvbi1wYXRoIGRldmljZXMgZnJvbQ0KPiBpbnRlcmZlcmlu ZyB3aXRoIEROUyBvcGVyYXRpb25zLCAuLi4NCg0KbGV0IG1lIGdpdmUgeW91IGFkdmFuY2Ugbm90 aWNlOiAiaSBhaW0gdG8gbWlzYmVoYXZlLiJbMV0gdGhhdCBpcywgX2kgYW0NCm9uLXBhdGgsIGFu ZCBpIGludGVuZCB0byBpbnRlcmZlcmUuXyB3aHkgb24gZWFydGggdGhlIElFVEYgZGVjaWRlZCB0 bw0KZXF1YXRlIGRpc3NpZGVudHMgKG9mIHdob20gdGhlcmUgYXJlIHRlbnMgb2YgdGhvdXNhbmRz LCBhbGwgb2Ygd2hpY2gNCm5lZWQgZnVsbCBWUE4ncyBub3QganVzdCBEb0ggZm9yIGFjdHVhbCBz YWZldHkpIHdpdGggYm90cyAob2Ygd2hpY2gNCnRoZXJlIGFyZSB0ZW5zIG9mIG1pbGxpb25zKSwg YW5kIHNldCB1cCBhIHdhciBiZXR3ZWVuIGVuZCB1c2VycyBhbmQNCm5ldHdvcmsgb3BlcmF0b3Jz LCBpIHdpbGwgbmV2ZXIgdW5kZXJzdGFuZCwgb3IgdHJ5IHRvLiBub3csIHdlIGZpZ2h0Lg0KDQot LQ0KUCBWaXhpZQ0KDQoNCi0tDQpUaGFua3MsDQpOYWxpbmkgRWxraW5zDQpQcmVzaWRlbnQNCkVu dGVycHJpc2UgRGF0YSBDZW50ZXIgT3BlcmF0b3JzDQp3d3cuZS1kY28uY29tPGh0dHA6Ly93d3cu ZS1kY28uY29tPg0KDQo= --_000_BYAPR16MB279065EE519680E7FC9A637CEA480BYAPR16MB2790namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpEZW5nWGlhbjsNCglwYW5vc2UtMToy IDEgNiAwIDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OiJcQERlbmdYaWFuIjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCi8qIFN0 eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9y bWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFu Lk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0 ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtG b2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQt ZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYu bXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3At YWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJn aW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldv cmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hh cGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlm XS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQi Pg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94 bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIg dmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+UGxlYXNlIHNlZSBpbmxpbmUgW1RSXTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItbGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQi Pg0KPGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFF MSAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxiPkZyb206PC9iPiBkbnMtcHJpdmFjeSAmbHQ7ZG5zLXByaXZhY3ktYm91bmNlc0BpZXRmLm9y ZyZndDsgPGI+T24gQmVoYWxmIE9mDQo8L2I+bmFsaW5pIGVsa2luczxicj4NCjxiPlNlbnQ6PC9i PiBNb25kYXksIE1hcmNoIDExLCAyMDE5IDExOjA1IEFNPGJyPg0KPGI+VG86PC9iPiBQYXVsIFZp eGllICZsdDtwYXVsQHJlZGJhcm4ub3JnJmd0Ozxicj4NCjxiPkNjOjwvYj4gU3RlcGhlbiBGYXJy ZWxsICZsdDtzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllJmd0OzsgZG9oQGlldGYub3JnOyBkbnNv cEBpZXRmLm9yZzsgQ2hyaXN0aWFuIEh1aXRlbWEgJmx0O2h1aXRlbWFAaHVpdGVtYS5uZXQmZ3Q7 OyBkbnMtcHJpdmFjeUBpZXRmLm9yZzsgVml0dG9yaW8gQmVydG9sYSAmbHQ7dml0dG9yaW8uYmVy dG9sYT00MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7OyBBY2tlcm1hbm4sIE1p Y2hhZWwgJmx0O21hY2tlcm1hbm5AYmNic20uY29tJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBS ZTogW2Rucy1wcml2YWN5XSBbRE5TT1BdIE5ldzogZHJhZnQtYmVydG9sYS1iY3AtZG9oLWNsaWVu dHM8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8dGFibGUgY2xhc3M9Ik1zb05vcm1hbFRhYmxl IiBib3JkZXI9IjEiIGNlbGxzcGFjaW5nPSIzIiBjZWxscGFkZGluZz0iMCIgc3R5bGU9ImJhY2tn cm91bmQ6I0YzRkYzMztib3JkZXI6c29saWQgIzlCOUE4NyAxLjVwdCI+DQo8dGJvZHk+DQo8dHI+ DQo8dGQgc3R5bGU9ImJvcmRlcjpub25lO3BhZGRpbmc6Ljc1cHQgLjc1cHQgLjc1cHQgLjc1cHQi Pg0KPHA+PHN0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojOUI4QjNFIj5DQVVUSU9OPC9zcGFuPjwvc3Ryb25nPjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5QjhC M0UiPjo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6YmxhY2siPiBFeHRlcm5hbCBlbWFpbC4gRG8gbm90IGNsaWNrIGxpbmtz IG9yIG9wZW4NCiBhdHRhY2htZW50cyB1bmxlc3MgeW91IHJlY29nbml6ZSB0aGUgc2VuZGVyIGFu ZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 L3RkPg0KPC90cj4NCjwvdGJvZHk+DQo8L3RhYmxlPg0KPGRpdiBjbGFzcz0iTXNvTm9ybWFsIiBh bGlnbj0iY2VudGVyIiBzdHlsZT0idGV4dC1hbGlnbjpjZW50ZXIiPg0KPGhyIHNpemU9IjMiIHdp ZHRoPSIxMDAlIiBhbGlnbj0iY2VudGVyIj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlBhdWwsPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZndDsgKHllcywgaSB3aWxsIGJlIHBhcnQgb2YgYSBt YWpvciBuZXcgcHJvamVjdCB0byBpZGVudGlmeSBhbmQgYmxvY2sgYWxsIERvSCBzZXJ2aWNlcywg c28mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jmd0 OyB0aGF0IGJlaGF2aW91cmFsIHNlY3VyaXR5IHBvbGljaWVzIGNhbiBzdGlsbCB3b3JrLCBiZWNh dXNlIHlvdSBtYXkgaGF2ZSZuYnNwOzxicj4NCiZndDsgbm90aWNlZCB0aGF0IHRoZSBpbnRlcm5l dCBoYXMgbmV2ZXIgYmVjb21lIE1PUkUgc2VjdXJlIGZyb20gbmV3IHRlY2gsJm5ic3A7PGJyPg0K Jmd0OyBidXQgaXQgb2NjYXNpb25hbGx5IGJlY29tZXMgTEVTUyBzZWN1cmUgbW9yZSBzbG93bHkg YmVjYXVzZSBvZiBwb2xpY3kuKTxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+SSB3b3VsZCBiZSB2ZXJ5IGludGVyZXN0ZWQsIGlmIHlvdSBhcmUgc28gaW5jbGlu ZWQsIHRvIGhlYXIgbW9yZSBvZiB3aGF0IHlvdSBhcmUgdGhpbmtpbmcuJm5ic3A7ICZuYnNwO0lz IHRoaXMgc29tZXRoaW5nIHlvdSBjYW4gKGFyZSB3aWxsaW5nIHRvKSB0YWxrIGFib3V0PyZuYnNw OyAmbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W1RSXSBFbnRlcnByaXNlIG5ldHdvcmtz IGFyZSBhbHJlYWR5IGFibGUgdG8gYmxvY2sgRG9IIHNlcnZpY2VzLCBpdCBpcyBjYXVzaW5nIHRo ZSBEb0ggY2xpZW50IHRvIGZhbGxiYWNrIHRvIGNsZWFyLXRleHQgRE5TIGNvbXByb21pc2luZyBl bmRwb2ludCBzZWN1cml0eSBhbmQgcHJpdmFjeS4gSW4gZHJhZnQNCjxzcGFuIGxhbmc9IkRFIj48 YSBocmVmPSJodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHktZHByaXZlLWJv b3RzdHJhcC1kbnMtc2VydmVyLTAxIj48c3BhbiBsYW5nPSJFTi1VUyI+aHR0cHM6Ly90b29scy5p ZXRmLm9yZy9odG1sL2RyYWZ0LXJlZGR5LWRwcml2ZS1ib290c3RyYXAtZG5zLXNlcnZlci0wMTwv c3Bhbj48L2E+PC9zcGFuPiB3ZSBhcmUgcHJvcG9zaW5nIG1lY2hhbmlzbXMgdG8gYXV0b21hdGlj YWxseSBib290c3RyYXANCiBlbmRwb2ludHMgdG8gZGlzY292ZXIgYW5kIGF1dGhlbnRpY2F0ZSBw cml2YWN5LWVuYWJsaW5nIEROUyBzZXJ2ZXJzIHByb3ZpZGVkIGJ5IHRoZSBFbnRlcnByaXNlIG5l dHdvcmsuDQo8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIHVzZXIgYWxzbyBnZXRzIHRvIGtu b3cgdGhlIHByaXZhY3kgcHJlc2VydmluZyBkYXRhIHBvbGljeSBieSB0aGUgRE5TIHNlcnZlciBh bmQgY2FuIGRlY2lkZSB3aGV0aGVyIHRvIHN3aXRjaCB0byBhbm90aGVyIG5ldHdvcmsgb3IgaWYg dGhlIHVzZXIgdHJ1c3RzIHRoZSBuZXR3b3JrIGFuZCBwcml2YWN5IHBvbGljeSwgdGhlIHVzZXIg Y2FuIGVuYWJsZSBzdHJpY3QgcHJpdmFjeSBwcm9maWxlIHdpdGggdGhlDQogcHJpdmFjeSBlbmFi bGluZyBETlMgc2VydmVyIGRpc2NvdmVyZWQgaW4gdGhlIEVudGVycHJpc2UgbmV0d29yayBpdHNl bGYgaW5zdGVhZCBvZiBkb3duZ3JhZGluZyB0byBvcHBvcnR1bmlzdGljIHByaXZhY3kgcHJvZmls ZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q2hlZXJzLDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LVRpcnU8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+SXQgc291bmRzIGxpa2UgYSB2ZXJ5IHRob3VnaHQtcHJvdm9raW5n IGluaXRpYXRpdmUuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlRoYW5rcyw8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk5hbGluaTxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIE1hciAxMSwgMjAxOSBhdCAxMDo1NSBBTSBQYXVsIFZp eGllICZsdDs8YSBocmVmPSJtYWlsdG86cGF1bEByZWRiYXJuLm9yZyI+cGF1bEByZWRiYXJuLm9y ZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBp biAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1ib3R0b206MTIuMHB0Ij48YnI+DQo8YnI+ DQpDaHJpc3RpYW4gSHVpdGVtYSB3cm90ZSBvbiAyMDE5LTAzLTEwIDIxOjE0Ojxicj4NCi4uLi48 YnI+DQomZ3Q7IFRoZXJlIGFyZSBhIGJ1bmNoIG9mIGNvbmZsaWN0aW5nIHJlcXVpcmVtZW50cyBo ZXJlLCBhbmQgaXQgd291bGQgYmUgZ29vZDxicj4NCiZndDsgdG8gdGVhc2Ugb3V0IHRoZSBjb250 cmFkaWN0aW9ucy4gQ29uc2lkZXIgdGhlIGZvbGxvd2luZyBjYXNlczo8YnI+DQomZ3Q7IDxicj4N CiZndDsgMSkgSSBhbSB1c2luZyBteSBwaG9uZSwgYW5kIHVzaW5nIGFwcGxpY2F0aW9uLVguPGJy Pg0KJmd0OyA8YnI+DQomZ3Q7IDIpIEkgYW0gYXQgaG9tZSwgdXNpbmcgYXBwbGljYXRpb24tWCBv biBteSBob21lIGNvbXB1dGVyLjxicj4NCiZndDsgPGJyPg0KJmd0OyAzKSBJIGFtIHVzaW5nIFdp LUZpIGluIGEgaG90ZWwsIGFuZCB1c2luZyBhcHBsaWNhdGlvbi1YLjxicj4NCiZndDsgPGJyPg0K Jmd0OyA0KSBJIGFtIHVzaW5nIG15IHdvcmsgbGFwdG9wIG9uIHRoZSBlbnRlcnByaXNlIG5ldHdv cmssIGFuZCB1c2luZzxicj4NCiZndDsgYXBwbGljYXRpb24tWDxicj4NCiZndDsgPGJyPg0KJmd0 OyA1KSBJIGFtIHVzaW5nIG15IHdvcmsgbGFwdG9wIGluIGEgaG90ZWwsIGFuZCB1c2luZyBhcHBs aWNhdGlvbi1YPGJyPg0KJmd0OyA8YnI+DQomZ3Q7IDYpIEkgYW0gdXNpbmcgbXkgd29yayBsYXB0 b3Agb24gdGhlIG5ldHdvcmsgb2YgYSBjdXN0b21lciwgYW5kIHVzaW5nPGJyPg0KJmd0OyBhcHBs aWNhdGlvbi1YLjxicj4NCjxicj4NCnRoaXMgZGlzdGluY3Rpb24gaXMgbm90IHVzZWZ1bC48YnI+ DQo8YnI+DQp0aGVyZSBhcmUgdHdvIGNhc2VzLjxicj4NCjxicj4NCmEgdXNlciBvciBhcHAgdHJ1 c3RzIGl0cyBuZXR3b3JrLjxicj4NCjxicj4NCm9yIG5vdC48YnI+DQo8YnI+DQppbiB0aGUgZmly c3QgY2FzZSwgeW91J2xsIHVzZSBhbiBSRE5TIHNlcnZpY2Ugd2hpY2ggaXMgaW4gdGhlIHNldCA8 YnI+DQooYWxsb3dlZCAocHJlZmVycmVkKSkuIHRoYXQgaXMsIHlvdSdsbCB1c2UgdGhlIHNlcnZl ciB5b3UgZGVzaXJlIG1vc3QgPGJyPg0Kb3V0IG9mIHRoZSBzZXQgdGhhdCB5b3VyIG5ldHdvcmsg b3BlcmF0b3IgYWxsb3dzIHlvdSB0byByZWFjaC48YnI+DQo8YnI+DQppbiB0aGUgc2Vjb25kIGNh c2UsIHlvdSdsbCB1c2UgYSBWUE4sIGZvciBhbGwgb2YgeW91ciB0cmFmZmljLCBub3QganVzdCA8 YnI+DQpmb3IgRE5TLCBiZWNhdXNlIGlmIHlvdSBoaWRlIHlvdXIgRE5TIGJ1dCBub3QgdGhlIGNv bm5lY3Rpb25zIHdoaWNoIDxicj4NCnJlc3VsdCBmcm9tIHN1Y2ggaGlkaW5nLCBpdCB3aWxsIGFk ZCBubyBtZWFzdXJhYmxlIHByaXZhY3kuPGJyPg0KPGJyPg0KJmd0OyBUb2RheSwgcGxlbnR5IG9m IHBlb3BsZSBjbGFpbSB0aGUgcmlnaHQgdG8gY29udHJvbCBob3cgSSB1c2UgdGhlIEROUzogbXk8 YnI+DQomZ3Q7IHBob25lIGNhcnJpZXIsIG15IElTUCBhdCBob21lLCB0aGUgY29tcGFueSB0aGF0 IGdvdCB0aGUgY29udHJhY3QgdG88YnI+DQomZ3Q7IG1hbmFnZSB0aGUgaG90ZWwncyBXaS1GaSwg dGhlIElUIG1hbmFnZXIgZm9yIG15IGNvbXBhbnkncyBsYXB0b3AsIHRoZSBJVDxicj4NCiZndDsg bWFuYWdlciBmb3IgdGhlIGNvbXBhbnkgdGhhdCBJIGFtIHZpc2l0aW5nLiBPdXQgb2YgdGhvc2Us IHRoZXJlIGlzIGp1c3Q8YnI+DQomZ3Q7IG9uZSBzY2VuYXJpbyBmb3Igd2hpY2ggdGhlIGNsYWlt IGhhcyBzb21lIGxlZ2l0aW1hY3k6IGlmIHRoZSBjb21wYW55PGJyPg0KJmd0OyBwYXlzIGZvciBt eSBsYXB0b3AgYW5kIG93biB0aGUgbGFwdG9wLCB5ZXMgb2YgY291cnNlIGl0IGhhcyBhIGxlZ2l0 aW1hdGU8YnI+DQomZ3Q7IGNsYWltIHRvIGNvbnRyb2wgaG93IEkgYW0gdXNpbmcgaXQuIE90aGVy d2lzZSwgSSwgdGhlIHVzZXIsIGdldCB0bzxicj4NCiZndDsgZGVjaWRlLiBJZiBJIGxpa2UgdGhl IGFwcGxpY2F0aW9uJ3Mgc2V0dGluZyBiZXR0ZXIgdGhhbiB0aGUgbmV0d29yaydzPGJyPg0KJmd0 OyBkZWZhdWx0LCB0aGVuIG9mIGNvdXJzZSBJIGV4cGVjdCB0aG9zZSBzZXR0aW5ncyB0byBzdGlj ay48YnI+DQo8YnI+DQp0aGlzIGRpc3RpbmN0aW9uIGlzIGFsc28gZmFsc2UuPGJyPg0KPGJyPg0K aWYgeW91IGFyZSB1c2luZyBteSBuZXR3b3JrLCB0aGVuIGl0IG1ha2VzIG5vIGRpZmZlcmVuY2Ug d2hpY2ggb2YgdXMgPGJyPg0KYm91Z2h0IHlvdSB0aGF0IGxhcHRvcC4geW91IHdpbGwgdXNlIHRo ZSBSRE5TIGkgYWxsb3cgeW91IHRvIHVzZS4gUkROUyA8YnI+DQppcyBwYXJ0IG9mIHRoZSBjb250 cm9sIHBsYW5lLCBhbmQgaSB1c2UgaXQgZm9yIGJvdGggbW9uaXRvcmluZyBhbmQgPGJyPg0KY29u dHJvbC4gc29tZXRpbWVzIHRoYXQncyBzbyB0aGF0IGkgY2FuIHNlZSBtYWx3YXJlIGJlYWNvbiB0 byBpdHMgQyZhbXA7Qy4gPGJyPg0Kc29tZXRpbWVzIHRoYXQncyBzbyB0aGF0IGkgY2FuIGluc3Rp dHV0ZSBwYXJlbnRhbCBjb250cm9scy48YnI+DQo8YnI+DQppZiB5b3UgZG9uJ3QgbGlrZSBteSBy dWxlcywgeW91IHNob3VsZCB2b3RlIHdpdGggeW91ciBmZWV0LCBhbmQgbm90IDxicj4NCnZpc2l0 IG1lLiBiZWNhdXNlIHRoYXQgaXMgdGhlIG9ubHkgY2hvaWNlIHlvdSB3aWxsIGhhdmUuICh5ZXMs IGkgd2lsbCBiZSA8YnI+DQpwYXJ0IG9mIGEgbWFqb3IgbmV3IHByb2plY3QgdG8gaWRlbnRpZnkg YW5kIGJsb2NrIGFsbCBEb0ggc2VydmljZXMsIHNvIDxicj4NCnRoYXQgYmVoYXZpb3VyYWwgc2Vj dXJpdHkgcG9saWNpZXMgY2FuIHN0aWxsIHdvcmssIGJlY2F1c2UgeW91IG1heSBoYXZlIDxicj4N Cm5vdGljZWQgdGhhdCB0aGUgaW50ZXJuZXQgaGFzIG5ldmVyIGJlY29tZSBNT1JFIHNlY3VyZSBm cm9tIG5ldyB0ZWNoLCA8YnI+DQpidXQgaXQgb2NjYXNpb25hbGx5IGJlY29tZXMgTEVTUyBzZWN1 cmUgbW9yZSBzbG93bHkgYmVjYXVzZSBvZiBwb2xpY3kuKTxicj4NCjxicj4NCnF1b3RpbmcgYWdh aW4gdGhlIHNhbGllbnQgcGFzc2FnZSBvZiBSRkMgODQ4NCdzIHNlbGYtZGFtbmluZyBpbnRyb2R1 Y3Rpb246PGJyPg0KPGJyPg0KJmd0OyAuLi4gVHdvIHByaW1hcnkgdXNlIGNhc2VzIHdlcmUgY29u c2lkZXJlZCBkdXJpbmcgdGhpcyBwcm90b2NvbCdzIDxicj4NCiZndDsgZGV2ZWxvcG1lbnQuIFRo ZXNlIHVzZSBjYXNlcyBhcmUgcHJldmVudGluZyBvbi1wYXRoIGRldmljZXMgZnJvbSA8YnI+DQom Z3Q7IGludGVyZmVyaW5nIHdpdGggRE5TIG9wZXJhdGlvbnMsIC4uLjxicj4NCjxicj4NCmxldCBt ZSBnaXZlIHlvdSBhZHZhbmNlIG5vdGljZTogJnF1b3Q7aSBhaW0gdG8gbWlzYmVoYXZlLiZxdW90 O1sxXSB0aGF0IGlzLCBfaSBhbSA8YnI+DQpvbi1wYXRoLCBhbmQgaSBpbnRlbmQgdG8gaW50ZXJm ZXJlLl8gd2h5IG9uIGVhcnRoIHRoZSBJRVRGIGRlY2lkZWQgdG8gPGJyPg0KZXF1YXRlIGRpc3Np ZGVudHMgKG9mIHdob20gdGhlcmUgYXJlIHRlbnMgb2YgdGhvdXNhbmRzLCBhbGwgb2Ygd2hpY2gg PGJyPg0KbmVlZCBmdWxsIFZQTidzIG5vdCBqdXN0IERvSCBmb3IgYWN0dWFsIHNhZmV0eSkgd2l0 aCBib3RzIChvZiB3aGljaCA8YnI+DQp0aGVyZSBhcmUgdGVucyBvZiBtaWxsaW9ucyksIGFuZCBz ZXQgdXAgYSB3YXIgYmV0d2VlbiBlbmQgdXNlcnMgYW5kIDxicj4NCm5ldHdvcmsgb3BlcmF0b3Jz LCBpIHdpbGwgbmV2ZXIgdW5kZXJzdGFuZCwgb3IgdHJ5IHRvLiBub3csIHdlIGZpZ2h0Ljxicj4N Cjxicj4NCi0tIDxicj4NClAgVml4aWU8bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGJyIGNsZWFyPSJhbGwiPg0KPG86cD48L286cD48 L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tIDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxk aXY+DQo8ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuNXB0Ij5UaGFua3MsPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVw dCI+TmFsaW5pIEVsa2luczxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQiPlByZXNpZGVu dDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS41cHQiPkVudGVycHJpc2UgRGF0YSBDZW50ZXIg T3BlcmF0b3JzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjVwdCI+PGEgaHJlZj0iaHR0cDov L3d3dy5lLWRjby5jb20iIHRhcmdldD0iX2JsYW5rIj53d3cuZS1kY28uY29tPC9hPjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_BYAPR16MB279065EE519680E7FC9A637CEA480BYAPR16MB2790namp_-- From nobody Mon Mar 11 09:58:26 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 321C4127962; Mon, 11 Mar 2019 09:58:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VWMO_OHfG8aQ; Mon, 11 Mar 2019 09:58:16 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4B58127963; Mon, 11 Mar 2019 09:58:15 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id D2A94280285; Mon, 11 Mar 2019 17:58:13 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id CBB742801B1; Mon, 11 Mar 2019 17:58:13 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id C7D86663E080; Mon, 11 Mar 2019 17:58:13 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id BF70F4023A; Mon, 11 Mar 2019 17:58:13 +0100 (CET) Date: Mon, 11 Mar 2019 17:58:13 +0100 From: Stephane Bortzmeyer To: doh@ietf.org, dprive@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <20190311165813.ilrz5ocxomraavbq@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 16:58:19 -0000 [Sorry for the long list of working groups but the discussion already started in different places.] There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484) deployment and the risk of centralization of Internet services. (See for instance drafts [this is not an endorsement] draft-bertola-bcp-doh-clients, draft-reid-doh-operator and draft-livingood-doh-implementation-risks-issues.) It was suggested Reference necessary to have a side meeting in Prague at IETF 104. I propose monday, 1400-1600 in Tyrolka. The proposal is at . You are welcome to agree/disagree/meet in a bar instead. From nobody Mon Mar 11 10:02:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B2FC12AF7E; Mon, 11 Mar 2019 10:02:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gtQVw_P68zdf; Mon, 11 Mar 2019 10:02:32 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B6B9C13114F; Mon, 11 Mar 2019 10:02:19 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 3F3FF280102; Mon, 11 Mar 2019 18:02:18 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id 396B12802E1; Mon, 11 Mar 2019 18:02:18 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 31C09280102; Mon, 11 Mar 2019 18:02:18 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 2DD19663E080; Mon, 11 Mar 2019 18:02:18 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 264044023A; Mon, 11 Mar 2019 18:02:18 +0100 (CET) Date: Mon, 11 Mar 2019 18:02:18 +0100 From: Stephane Bortzmeyer To: doh@ietf.org, dns-privacy@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <20190311170218.o5hitvysuefhjjxk@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.001148, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.3.11.165116 Archived-At: Subject: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:02:35 -0000 [Resent with the correct list of working groups.] [Sorry for the long list of working groups but the discussion already started in different places.] There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484) deployment and the risk of centralization of Internet services. (See for instance drafts [this is not an endorsement] draft-bertola-bcp-doh-clients, draft-reid-doh-operator and draft-livingood-doh-implementation-risks-issues.) It was suggested Reference necessary to have a side meeting in Prague at IETF 104. I propose monday, 1400-1600 in Tyrolka. The proposal is at . You are welcome to agree/disagree/meet in a bar instead. From nobody Mon Mar 11 10:05:39 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 964DD131168; Mon, 11 Mar 2019 10:03:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id L9NaYsJ9E4Sl; Mon, 11 Mar 2019 10:03:36 -0700 (PDT) Received: from mail-it1-x135.google.com (mail-it1-x135.google.com [IPv6:2607:f8b0:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D68B131182; Mon, 11 Mar 2019 10:03:25 -0700 (PDT) Received: by mail-it1-x135.google.com with SMTP id m137so8455363ita.0; Mon, 11 Mar 2019 10:03:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Yd6n3AAmFUFkezRkU9KLl+BvfOV+kL1KlVMPVmrG6VQ=; b=eegCwYijw1iW8v2FxoduBdLswu5LrNzBoQFSejjbnmUSaRJhe8ONfsyJ1Ll/wxcYRY thlqQqs33oqXWvK6VQe+G1lXmfbWOQ/gE+/aReb/gnpqy1KEkAV/2kxJAw2oQSAu45Et Ph9EN/PM8fASHXInmXFmMMK/sTSbwthD8Qv2bfPc8v5LKXygxbVg5V11PKDZvjPY53q3 0qrE+Ub/vH995cdMxtywGQFOiAMj/NZ9zO5335l1wjSX5WAwD5es1Sq1lgdlDKDWpesd jJ4hAD5M4FK66eXjID3yMEeUiojIzoobGcoByNoo4b/KziXWDIVwhw1xFlDWaLAMe6YZ sQmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Yd6n3AAmFUFkezRkU9KLl+BvfOV+kL1KlVMPVmrG6VQ=; b=SVbzkUuaL4t3MFrT+MeWAUohHbr8XBiA5zRb+sUqwzIs7v1kZ2xnLG8PXKbLopqy0n 5/aAFgCk1RjvOaZGxB9OG60J9XktIAPsO4Kj4+SgSfjU137u1pVZsS7OEqpCha9RD5Bu bhMtZCTPW5KvGdylLjXUeY0pJ2NCsMVhMJOkyO6ahdyQ60Vc081vYR6BaugbFBC7mP7W 7eqwA+pB/6eSH3l8krzKO2qawEFpMr4UihJQxySFgiP3dMknMG/gd01iv9QDAcig1lNl lgvA0H3VxKw4RrQDiVdOPXyji8rcSC3Pwae7qtOh3v9EXcqX6uKmI/bA3XT4lQWWOosR 4Amw== X-Gm-Message-State: APjAAAWNgNG97Gp7cok5f55CyEERMB4F9598FWzn2m1ro57KTCQD5m7n p9WCmSLzn9UEmyeM+Ck/PJ1WzUsvIgW0B/xLY3pnSFWK X-Google-Smtp-Source: APXvYqyCmyBW/4MH8TdRnzsMzxlSk9p8pInoqNIXisfS1dnIv3OkWHqmGQKkL+oYJ5I2LVsMQAfZ8CtVxosrBKx4+t8= X-Received: by 2002:a24:7c0b:: with SMTP id a11mr7258itd.161.1552323804430; Mon, 11 Mar 2019 10:03:24 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <8855871d-c059-3938-12a1-62f21c089e1d@redbarn.org> In-Reply-To: <8855871d-c059-3938-12a1-62f21c089e1d@redbarn.org> From: Ted Hardie Date: Mon, 11 Mar 2019 10:02:58 -0700 Message-ID: To: Paul Vixie Cc: Warren Kumari , Jim Reid , DoH WG , dnsop Content-Type: multipart/alternative; boundary="000000000000f08c870583d48cbf" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:03:44 -0000 --000000000000f08c870583d48cbf Content-Type: text/plain; charset="UTF-8" On Sat, Mar 9, 2019 at 11:03 PM Paul Vixie wrote: > > > Warren Kumari wrote on 2019-03-09 22:48: > > [ + DNSOP] > > > > ... > > > > I think it would be very valuable to not conflate DNS-over-HTTPS (the > > protocol) with the "applications might choose to use their own > > resolvers" concerns. > > i disagree. as an example: > > > Two primary use cases were considered during this protocol's > > development. These use cases are preventing on-path devices from > > interfering with DNS operations, ... > > (from the Introduction of RFC 8484.) > > no other off-network RDNS is reachable by malware which somehow gets > into my network, I interpret this to mean that you have blocked DNS over TLS's well-known port (853), so that Quad 9 and other services offering it are not accessible. Is that correct, or do you mean something more extensive? As several other folks have pointed out, roll-your-own resolution is in some pretty widely used applications, but I'm not aware of any comprehensive list or any way to block that short of removing the applications once found. Is there a technique here I'm not aware of? Ted --000000000000f08c870583d48cbf Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, Mar 9, 2019 at 11:03 PM Paul Vixi= e <paul@redbarn.org> wrote:


Warren Kumari wrote on 2019-03-09 22:48:
> [=C2=A0+ DNSOP]
>
> ...
>
> I think it would be very valuable to not conflate DNS-over-HTTPS (the =
> protocol) with the "applications might choose to use their own > resolvers" concerns.

i disagree. as an example:

>=C2=A0 =C2=A0 Two primary use cases were considered during this protoco= l's
>=C2=A0 =C2=A0 development.=C2=A0 These use cases are preventing on-path= devices from
>=C2=A0 =C2=A0 interfering with DNS operations, ...

(from the Introduction of RFC 8484.)

no other off-network RDNS is reachable by malware which somehow gets
into my network,

I interpret this to mean t= hat you have blocked DNS over TLS's well-known port (853), so that Quad= 9 and other services offering it are not accessible.=C2=A0 Is that correct= , or do you mean something more extensive?

As seve= ral other folks have pointed out, roll-your-own resolution is in some prett= y widely used applications, but I'm not aware of any comprehensive list= or any way to block that short of removing the applications once found.=C2= =A0 Is there a technique here I'm not aware of?

Ted


=C2=A0

--000000000000f08c870583d48cbf-- From nobody Mon Mar 11 10:11:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6ADE1311DB; Mon, 11 Mar 2019 10:06:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2S4KnTkJS4hx; Mon, 11 Mar 2019 10:06:49 -0700 (PDT) Received: from mail-it1-x130.google.com (mail-it1-x130.google.com [IPv6:2607:f8b0:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3D5B131181; Mon, 11 Mar 2019 10:06:48 -0700 (PDT) Received: by mail-it1-x130.google.com with SMTP id v83so8478132itf.1; Mon, 11 Mar 2019 10:06:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lloyAYEnerfVQBMTLGoxgOebsS4/O9Dkcz+4WXVlSmA=; b=bsPWssH/1fVPzJR6/Vh7FhxviGclEcXT1YiotiJrQ9+pa7A5F6w4dSdexzlWNbhPgi 2hTSIMKccbq1Vdq+gRmhgGEZjsR5e28Vb8zqzg9+8kS2racXEwHVIXt34DGOAsPhv46+ W9wSTCEzuWbTHkq360iPTJGUNu6h6bm03Cu0syHNscW+YnlEzase6Gbngfn5gbTGJToE Li/tHdMRMS3QZ3aznv9bTCuVw7/AD0lxbajoFEUqz2AD59lsl7p1BwL0K4xdkKgbeeQC XTSLvyIP0Urujy2bK/YStvzSLm9QILr2v/qEs0NU4RSnHTJh9EWBekqhdw9ezMuILnW0 I5CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lloyAYEnerfVQBMTLGoxgOebsS4/O9Dkcz+4WXVlSmA=; b=M7ZljsmpcDnKdwS719do2U3yPk8EC/dlVOiDTDaz5/DZeAE6TF6bWRgkLJzomfcAbp e0cFKX8cPxGzkXolEbl8p4yBYO3XgnTOJAAccjuTqWQ4/qubZWy6ofQyxWBuUj3Ico3J QFZ6toFY+FHf4C3au4tp0AkbT/f8uuEAzC637ioQcaPjTGD5DsswmYsA2Zb0kYboDzc7 8z35H8Pwjj8NP00Xs5A4d7NfkR/0G8+ldff5i1nV2mJwfH4cPGogU/vlxjA7NAfji3q8 EOJsMwhpNY5yYhUv5DZ1nl3Uu4bbKPqKvmxroaXYc4l30C+OaZ26Sb0lNX5QNWZcR4qN riXQ== X-Gm-Message-State: APjAAAVsLIotk5MJRHFyfwXrbC8JDsv+sdTQzr+fKyBS7451Y2YgUiOy mZMvIjVl8PsaQbCbmVMQ8hICJHNCn5n9g8hy9MY= X-Google-Smtp-Source: APXvYqyAOmbvbSuToXEnwCPn8r/heteCoGX2iSB+fyCpruZ6MMzAOXy2Wt9G8+pm84MRt3OTDdTGDW5W/9yJrELMTYM= X-Received: by 2002:a24:7c0b:: with SMTP id a11mr19916itd.161.1552324007850; Mon, 11 Mar 2019 10:06:47 -0700 (PDT) MIME-Version: 1.0 References: <20190311165813.ilrz5ocxomraavbq@nic.fr> In-Reply-To: <20190311165813.ilrz5ocxomraavbq@nic.fr> From: Ted Hardie Date: Mon, 11 Mar 2019 10:06:21 -0700 Message-ID: To: Stephane Bortzmeyer Cc: DoH WG , dprive@ietf.org, dnsop , hrpc@irtf.org Content-Type: multipart/alternative; boundary="0000000000001079810583d499d8" Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:06:57 -0000 --0000000000001079810583d499d8 Content-Type: text/plain; charset="UTF-8" Hi Stephane, This conflicts with SECDISPATCH, which will have a pretty serious impact on who might attend. Scheduling these things is very hard, obviously. Given this topic, you may have to move outside the normal agenda time to get a reasonable shot at avoiding conflict. Ted On Mon, Mar 11, 2019 at 9:58 AM Stephane Bortzmeyer wrote: > [Sorry for the long list of working groups but the discussion already > started in different places.] > > There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484) > deployment and the risk of centralization of Internet services. (See > for instance drafts [this is not an endorsement] > draft-bertola-bcp-doh-clients, draft-reid-doh-operator and > draft-livingood-doh-implementation-risks-issues.) > > It was suggested Reference necessary to have a > side meeting in Prague at IETF 104. I propose monday, 1400-1600 in > Tyrolka. The proposal is at > . You > are welcome to agree/disagree/meet in a bar instead. > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000001079810583d499d8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Stephane,

This conflicts = with SECDISPATCH, which will have a pretty serious impact on who might atte= nd.=C2=A0 Scheduling these things is very hard, obviously. Given this topic= , you may have to move outside the normal agenda time to get a reasonable s= hot at avoiding conflict.

Ted

<= div class=3D"gmail_quote">
On Mon, Mar= 11, 2019 at 9:58 AM Stephane Bortzmeyer <bortzmeyer@nic.fr> wrote:
[Sorry for the long list of working groups but the = discussion already
started in different places.]

There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484)
deployment and the risk of centralization of Internet services. (See
for instance drafts [this is not an endorsement]
draft-bertola-bcp-doh-clients, draft-reid-doh-operator and
draft-livingood-doh-implementation-risks-issues.)

It was suggested <wikipedia>Reference necessary</wikipedia> to = have a
side meeting in Prague at IETF 104. I propose monday, 1400-1600 in
Tyrolka. The proposal is at
<https://trac.ietf.org/trac/ietf/meet= ing/wiki/104sidemeetings>. You
are welcome to agree/disagree/meet in a bar instead.

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--0000000000001079810583d499d8-- From nobody Mon Mar 11 10:13:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04EB9131148; Mon, 11 Mar 2019 10:13:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cGCUXXqqZX98; Mon, 11 Mar 2019 10:13:40 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4223A131104; Mon, 11 Mar 2019 10:13:40 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id B8F74280151; Mon, 11 Mar 2019 18:13:38 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id B1987280285; Mon, 11 Mar 2019 18:13:38 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id A9DCB280151; Mon, 11 Mar 2019 18:13:38 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id A3F2A663E080; Mon, 11 Mar 2019 18:13:38 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 9CE714023A; Mon, 11 Mar 2019 18:13:38 +0100 (CET) Date: Mon, 11 Mar 2019 18:13:38 +0100 From: Stephane Bortzmeyer To: Ted Hardie Cc: Stephane Bortzmeyer , DoH WG , dns-privacy@ietf.org, dnsop , hrpc@irtf.org Message-ID: <20190311171338.kusmt6q2z7mx6dww@nic.fr> References: <20190311165813.ilrz5ocxomraavbq@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000001, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.3.11.170316 Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:13:42 -0000 On Mon, Mar 11, 2019 at 10:06:21AM -0700, Ted Hardie wrote a message of 76 lines which said: > This conflicts with SECDISPATCH, which will have a pretty serious impact on > who might attend. Scheduling these things is very hard, obviously. Given > this topic, you may have to move outside the normal agenda time to get a > reasonable shot at avoiding conflict. I avoided conflicts with doh, dprive, dnsop and hrpc but avoiding all conflicts is close-to-impossible. In the evening, people have meetings, too. I admit I'm not sure that Secdispatch is so important here. The subject of the side meeting is not security-specific. From nobody Mon Mar 11 10:19:16 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91062131170; Mon, 11 Mar 2019 10:18:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p2PBxwxZzh-Z; Mon, 11 Mar 2019 10:18:55 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBB741311C3; Mon, 11 Mar 2019 10:18:47 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id x3so4725205ior.6; Mon, 11 Mar 2019 10:18:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hBL+pZn6F+etxZjx/nvsHmqsNO1Pb/kvX4kq+ad6fGA=; b=veCzGN1quZRq5+NnH+J9YKPz20TBTWoq1dHtoVvSlcSI2r7LZgvtNXmKZ6lHXZGkuf jEexW3VqxNR0tLjhudA5o8OMy+THIRafemE47vP0P+KxSJGKCXIeFDU2eNuUNeTqPuKC tZbosyp30r7Y78IvowIvX6sj1qcZ2wA4b00GENi+adL5ojtHWDkicOObPMpWr/Gg4R5w 6R4DnFq9ly2MH9ZpTqyR9sXNUmdk1eyVPwqwQQnC0tT0kXIY8VIngwI2hRdIHnrJoUou pFLeq9m6ofKb40AF+AlGBT/6VLxRrvnw3OvFi34a6QFcCU6py3Wic+KdI7z5bOlxlmd6 cv7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hBL+pZn6F+etxZjx/nvsHmqsNO1Pb/kvX4kq+ad6fGA=; b=PAWPPEawTm4mLonLjQKFqKoKHwRE98kwM2pnQvdTul9+Vz8ErlfVr/cKpltGJC6HZk mr0/W0iYlfNupVkaK9YXOWfnxJgL/Xugeu8y5UmR8Oh8gWiQQ7PwgCeBgtY6FhgkvXwi 6OrW8HGFGY2exjqaQOJakMO9Yr7H6wmoQK3E2ID0NE2zKN09wrGKNuXvtU1HaQprIf82 CboSIqLQHfTUOckGEefCRZUUCX7fz9TEpFNAIAJk26eX/2TmkeRJM/QhFClFQmhEwpbf Mm2wioStEWI0fG01P12mhY5Tw+1Glpv27r3y7l6DOdLXpQdv+gz9OQ95MGo1nyY0K1p9 ygfQ== X-Gm-Message-State: APjAAAU8r8sG7AhcgoQ0MH1VdBh0HBTbrM2jipyKp9uvJBYDn99hNtHt mDFkxei+mH+U3ySMbYBzBNq3eBG2TREvu2RT1FTkpusn X-Google-Smtp-Source: APXvYqyngtt2zQCvIFtjSBOWpfiHBD93OCmMKPE9kYlnk+JYTMCsrg6vubm2uvf5vClgwW12tGiC71+0ML3AdeglJFI= X-Received: by 2002:a6b:c543:: with SMTP id v64mr17872643iof.6.1552324727096; Mon, 11 Mar 2019 10:18:47 -0700 (PDT) MIME-Version: 1.0 References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <20190311171338.kusmt6q2z7mx6dww@nic.fr> In-Reply-To: <20190311171338.kusmt6q2z7mx6dww@nic.fr> From: Ted Hardie Date: Mon, 11 Mar 2019 10:18:21 -0700 Message-ID: To: Stephane Bortzmeyer Cc: DoH WG , dns-privacy@ietf.org, dnsop , hrpc@irtf.org Content-Type: multipart/alternative; boundary="000000000000ef78d00583d4c3c2" Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:19:01 -0000 --000000000000ef78d00583d4c3c2 Content-Type: text/plain; charset="UTF-8" On Mon, Mar 11, 2019 at 10:13 AM Stephane Bortzmeyer wrote: > On Mon, Mar 11, 2019 at 10:06:21AM -0700, > Ted Hardie wrote > a message of 76 lines which said: > > > This conflicts with SECDISPATCH, which will have a pretty serious impact > on > > who might attend. Scheduling these things is very hard, obviously. Given > > this topic, you may have to move outside the normal agenda time to get a > > reasonable shot at avoiding conflict. > > I avoided conflicts with doh, dprive, dnsop and hrpc but avoiding all > conflicts is close-to-impossible. In the evening, people have > meetings, too. > > I admit I'm not sure that Secdispatch is so important here. The > subject of the side meeting is not security-specific. > It is certainly not only about security, but there are several important security trade-offs in play with these choices. Secdispatch pulls pretty much the entire Security Area, and a conflict seems to me personally very unfortunate in its scope. regards, Ted --000000000000ef78d00583d4c3c2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Mar 11, 2019 at 10:13 AM Stephane= Bortzmeyer <bortzmeyer@nic.fr&= gt; wrote:
On Mon, Mar 11, 2019 at 10:06:21AM -0700,
=C2=A0Ted Hardie <ted.ietf@gmail.com> wrote
=C2=A0a message of 76 lines which said:

> This conflicts with SECDISPATCH, which will have a pretty serious impa= ct on
> who might attend.=C2=A0 Scheduling these things is very hard, obviousl= y. Given
> this topic, you may have to move outside the normal agenda time to get= a
> reasonable shot at avoiding conflict.

I avoided conflicts with doh, dprive, dnsop and hrpc but avoiding all
conflicts is close-to-impossible. In the evening, people have
meetings, too.

I admit I'm not sure that Secdispatch is so important here. The
subject of the side meeting is not security-specific.
=
It is certainly not only about security, but there are sever= al important security trade-offs in play with these choices.=C2=A0 Secdispa= tch pulls pretty much the entire Security Area, and a conflict seems to me = personally very unfortunate in its scope.=C2=A0

regards,

Ted
=C2=A0
--000000000000ef78d00583d4c3c2-- From nobody Mon Mar 11 10:22:28 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BA6213117D for ; Mon, 11 Mar 2019 10:22:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=nomountain-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ka5XHjli_e2p for ; Mon, 11 Mar 2019 10:22:08 -0700 (PDT) Received: from mail-it1-x133.google.com (mail-it1-x133.google.com [IPv6:2607:f8b0:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53F841277DE for ; Mon, 11 Mar 2019 10:22:06 -0700 (PDT) Received: by mail-it1-x133.google.com with SMTP id l15so8540009iti.4 for ; Mon, 11 Mar 2019 10:22:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nomountain-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=9iZLq83FGWc79Jl5xRu6MrzORv7/E+je+4nILePnD/U=; b=m7Ff5vsrZk3w6Dvr/vARcvgPyFWLxPL6NFJsup9IawO44Ob73AfOusMHRnIW/zno2A rfQ5TRQ7VQCUm2LvTiNb6YcHbEo/fQOHa9f6L2zbhFKCQ2pSNIh85WbTi7RhpK4DNDDZ nnfYcm6kFnjcncR44ubLzO5VBPl74ADWNXRz3mTRakZnPUTAPH35CacOeghrDNVhECuQ auDlgOgRloICYwc6CdjyDV2EDVWfkMn+drh6kmcTUhUlSPh4UatragKSsRgCufvRDVAF U5uAFLmhJF4Xf2m5+5fJSAdu+OvXfyEtgRSl9y6oT48+oV2rxmDwb1gr7Dg60OiDTBEc YoVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=9iZLq83FGWc79Jl5xRu6MrzORv7/E+je+4nILePnD/U=; b=AkFSzYeWf8ssQZrth22hGm6IGxpmBgIoyXJj6pFhFauKkJO8AiOZZnJ2aWiMlywEWb POxKj2EbmDvm7FuYUFEqC4/ZgMIVb/cUjuZA8vJr4RLKnX1/yURhxyyv6S4wUT/eIviB pIQPiK/VvGLJmldB0gX82NdJrSlPON4OPcwNzqL4N9gTh81ADG5veQoHKZWIuEEHiLph VFMq9L77Axgi/33+z7WeLvCaFOgA9hawoVWaQxydeaV+Q/lhk8lWcZ8WDyENWGAnAKk/ nnbXlkYkQ97EkKFZf2oqMYN1R3EeynxVYTj9xhhpA5LghvqbwPYEqEu/t0mf1uR7A2Tl eQwA== X-Gm-Message-State: APjAAAUt8q7VrZJQ+PHnep7W+4Qzu00IYA0WGFQ/51a1I3f2yjUSAQ8z zOYes4UM++JUl1jgpgShZPci X-Google-Smtp-Source: APXvYqzal1DRiGijF6rgukHJVPzu9sDyPoWIclfvl+lcf/deY08WydF5xElJvvKR17ut0ixJhyoN5Q== X-Received: by 2002:a24:6f82:: with SMTP id x124mr125951itb.14.1552324925511; Mon, 11 Mar 2019 10:22:05 -0700 (PDT) Received: from Melindas-MacBook-Pro.local (68-64-217-58.static.forethought.net. [68.64.217.58]) by smtp.gmail.com with ESMTPSA id 14sm8521867ity.24.2019.03.11.10.22.04 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 11 Mar 2019 10:22:05 -0700 (PDT) To: Stephane Bortzmeyer , Ted Hardie Cc: dns-privacy@ietf.org, DoH WG , dnsop , hrpc@irtf.org References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <20190311171338.kusmt6q2z7mx6dww@nic.fr> From: Melinda Shore Message-ID: Date: Mon, 11 Mar 2019 11:22:05 -0600 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 MIME-Version: 1.0 In-Reply-To: <20190311171338.kusmt6q2z7mx6dww@nic.fr> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:22:14 -0000 On 3/11/19 9:13 AM, Stephane Bortzmeyer wrote: > I admit I'm not sure that Secdispatch is so important here. The > subject of the side meeting is not security-specific. It also conflicts with irtfopen, which may impact the availability of pearg people, hrpc folk, etc. Melinda -- Software longa, hardware brevis PGP key fingerprint 4F68 2D93 2A17 96F8 20F2 34C0 DFB8 9172 9A76 DB8F From nobody Mon Mar 11 10:26:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B7BD1311F7 for ; Mon, 11 Mar 2019 10:26:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5jfBLL-0S47h for ; Mon, 11 Mar 2019 10:26:29 -0700 (PDT) Received: from mail-lj1-x230.google.com (mail-lj1-x230.google.com [IPv6:2a00:1450:4864:20::230]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 441401311D4 for ; Mon, 11 Mar 2019 10:26:27 -0700 (PDT) Received: by mail-lj1-x230.google.com with SMTP id l5so4835917lje.1 for ; Mon, 11 Mar 2019 10:26:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sbWgaFPI1pXEidCx2FRBhXM7a4sOgGvVd19I9XFuPyM=; b=e/aA7HuTDK6WnGezDkgLG/JeOSgOHg9zMxZZ98qdKbTNvLb3GXS8MfLaltJq50JQvl 0dwc1hVxfhthqkFZXjZHZT4m+BTmystMJjyw4lpprS35dRaV6Kxk90kEAzYCI2LPNQQx D95jO9ytS5bPgVkyXjKofWOMTU8Yi0nu51IIM6lYgLV/Qc52xpfOYq5Opt09AM/b3bnE scdSkkctiuUcjiFEG4imIHYyuCJT/b2PzoJSEy6cgNMqS2uaMSkr0GQIO6WHRRGtGXEd DCc3qS6NYQeZaxSlo0NrTRserE/FGAdewqOion9gMIGp5RbV+CX5roS8RiMJhqENZbW5 Bpjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sbWgaFPI1pXEidCx2FRBhXM7a4sOgGvVd19I9XFuPyM=; b=Td2V/j9UDpJWLzrAYIgtnIZqLNNbj1ipkuTB4uHCMusiWOAalMU9QyNhydGOHlt5kr DiSeZmZiLiw3jU8pgSWv2D2kPdyjznb86oKoYqazid1GMGbwgEAzzWeGJeCXq7yVWLoM oP5doPSHpEw++S/EdeIqdAtVa6wUqU+D624+/JZdfBBC54YTGbzUwDM79Anp1YuCHrBT 26Q26aXAqX6fMGEdrOpIvhAzcG2zQK+zYjymh/XwMfGIUtzlxlUM1TAqNmIV8tARkZRW xkVunDsGL7qjr6yijgE1cFYcuRDxQ0KPhMYTycbsX3l9/NODFlb8FVI8vPXuFvP7GCMe rncw== X-Gm-Message-State: APjAAAUvGKDp+mHAZ/EWY0NbDJjBlHnz2GaBi0kugnQgftAKxBH/YrUy 9lTe+RZJXCIhUHLtuXxw5ZCpguNch63IJh5lRkUwtQ== X-Google-Smtp-Source: APXvYqyXevmlgaG8ZaSgJcQg/XPeDXldnwLMOlMJTf7ZV9e8eS4Xn9h98FcBcANPbK9UPkiQqkP3q8xRhqCR7eAH4XE= X-Received: by 2002:a2e:7a03:: with SMTP id v3mr17364097ljc.22.1552325185205; Mon, 11 Mar 2019 10:26:25 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> In-Reply-To: From: nalini elkins Date: Mon, 11 Mar 2019 22:56:14 +0530 Message-ID: To: "Konda, Tirumaleswar Reddy" Cc: Paul Vixie , Stephen Farrell , "doh@ietf.org" , "dnsop@ietf.org" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" Content-Type: multipart/alternative; boundary="0000000000003d9edd0583d4df90" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:26:37 -0000 --0000000000003d9edd0583d4df90 Content-Type: text/plain; charset="UTF-8" Tiru, Thanks for your comments. > Enterprise networks are already able to block DoH services, We are also concerned about getting threat intelligence so that would impact DoH on the Internet. We are also concerned about being able to block malware, etc. inside the enterprise. Thank you for doing your draft. I look forward to understanding it better. I believe it is a good start to address some of our potential problems. I am thinking over what the deployment and roll out strategies might be in various topologies. I will say more once I have thought it out. Nalini On Mon, Mar 11, 2019 at 8:37 PM Konda, Tirumaleswar Reddy < TirumaleswarReddy_Konda@mcafee.com> wrote: > Please see inline [TR] > > > > *From:* dns-privacy *On Behalf Of *nalini > elkins > *Sent:* Monday, March 11, 2019 11:05 AM > *To:* Paul Vixie > *Cc:* Stephen Farrell ; doh@ietf.org; > dnsop@ietf.org; Christian Huitema ; > dns-privacy@ietf.org; Vittorio Bertola 40open-xchange.com@dmarc.ietf.org>; Ackermann, Michael < > mackermann@bcbsm.com> > *Subject:* Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients > > > > *CAUTION*: External email. Do not click links or open attachments unless > you recognize the sender and know the content is safe. > ------------------------------ > > Paul, > > > > > (yes, i will be part of a major new project to identify and block all > DoH services, so > > > that behavioural security policies can still work, because you may have > > noticed that the internet has never become MORE secure from new tech, > > but it occasionally becomes LESS secure more slowly because of policy.) > > > > I would be very interested, if you are so inclined, to hear more of what > you are thinking. Is this something you can (are willing to) talk about? > > > > > [TR] Enterprise networks are already able to block DoH services, it is > causing the DoH client to fallback to clear-text DNS compromising endpoint > security and privacy. In draft > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-01 we > are proposing mechanisms to automatically bootstrap endpoints to discover > and authenticate privacy-enabling DNS servers provided by the Enterprise > network. > > > > The user also gets to know the privacy preserving data policy by the DNS > server and can decide whether to switch to another network or if the user > trusts the network and privacy policy, the user can enable strict privacy > profile with the privacy enabling DNS server discovered in the Enterprise > network itself instead of downgrading to opportunistic privacy profile. > > > > Cheers, > > -Tiru > > > > It sounds like a very thought-provoking initiative. > > > > Thanks, > > Nalini > > > > On Mon, Mar 11, 2019 at 10:55 AM Paul Vixie wrote: > > > > Christian Huitema wrote on 2019-03-10 21:14: > .... > > There are a bunch of conflicting requirements here, and it would be good > > to tease out the contradictions. Consider the following cases: > > > > 1) I am using my phone, and using application-X. > > > > 2) I am at home, using application-X on my home computer. > > > > 3) I am using Wi-Fi in a hotel, and using application-X. > > > > 4) I am using my work laptop on the enterprise network, and using > > application-X > > > > 5) I am using my work laptop in a hotel, and using application-X > > > > 6) I am using my work laptop on the network of a customer, and using > > application-X. > > this distinction is not useful. > > there are two cases. > > a user or app trusts its network. > > or not. > > in the first case, you'll use an RDNS service which is in the set > (allowed (preferred)). that is, you'll use the server you desire most > out of the set that your network operator allows you to reach. > > in the second case, you'll use a VPN, for all of your traffic, not just > for DNS, because if you hide your DNS but not the connections which > result from such hiding, it will add no measurable privacy. > > > Today, plenty of people claim the right to control how I use the DNS: my > > phone carrier, my ISP at home, the company that got the contract to > > manage the hotel's Wi-Fi, the IT manager for my company's laptop, the IT > > manager for the company that I am visiting. Out of those, there is just > > one scenario for which the claim has some legitimacy: if the company > > pays for my laptop and own the laptop, yes of course it has a legitimate > > claim to control how I am using it. Otherwise, I, the user, get to > > decide. If I like the application's setting better than the network's > > default, then of course I expect those settings to stick. > > this distinction is also false. > > if you are using my network, then it makes no difference which of us > bought you that laptop. you will use the RDNS i allow you to use. RDNS > is part of the control plane, and i use it for both monitoring and > control. sometimes that's so that i can see malware beacon to its C&C. > sometimes that's so that i can institute parental controls. > > if you don't like my rules, you should vote with your feet, and not > visit me. because that is the only choice you will have. (yes, i will be > part of a major new project to identify and block all DoH services, so > that behavioural security policies can still work, because you may have > noticed that the internet has never become MORE secure from new tech, > but it occasionally becomes LESS secure more slowly because of policy.) > > quoting again the salient passage of RFC 8484's self-damning introduction: > > > ... Two primary use cases were considered during this protocol's > > development. These use cases are preventing on-path devices from > > interfering with DNS operations, ... > > let me give you advance notice: "i aim to misbehave."[1] that is, _i am > on-path, and i intend to interfere._ why on earth the IETF decided to > equate dissidents (of whom there are tens of thousands, all of which > need full VPN's not just DoH for actual safety) with bots (of which > there are tens of millions), and set up a war between end users and > network operators, i will never understand, or try to. now, we fight. > > -- > P Vixie > > > > > -- > > Thanks, > > Nalini Elkins > > President > > Enterprise Data Center Operators > > www.e-dco.com > > > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --0000000000003d9edd0583d4df90 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Tiru,

Thanks for your commen= ts.

> Enterprise networks are already able to b= lock DoH services,=C2=A0=C2=A0

We are also concern= ed about getting threat intelligence so that would impact DoH on the Intern= et.=C2=A0 =C2=A0We are also concerned about being able to block malware, et= c. inside the enterprise.=C2=A0=C2=A0

Thank you fo= r doing your draft.=C2=A0 I look forward to understanding it better.=C2=A0 = I believe it is a good start to address some of our potential problems.=C2= =A0 I am thinking over what the deployment and roll out strategies might be= in various topologies.=C2=A0 I will say more once I have thought it out.

Nalini

On Mon, Mar 11, 2019 at 8:37 PM Kon= da, Tirumaleswar Reddy <TirumaleswarReddy_Konda@mcafee.com> wrote:

Please see inline [TR]

=C2=A0

From: dns-privacy <dns-privacy-bounces@ietf.org= > On Behalf Of nalini elkins
Sent: Monday, March 11, 2019 11:05 AM
To: Paul Vixie <paul@redbarn.org>
Cc: Stephen Farrell <stephen.farrell@cs.tcd.ie>; doh@ietf.org; dnsop@ietf.org; Christian Huitema <huitema@huitema.net&g= t;; dns-privacy@i= etf.org; Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.i= etf.org>; Ackermann, Michael <mackermann@bcbsm.com>
Subject: Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-client= s

=C2=A0

CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.<= /span>

Paul,

=C2=A0

> (yes, i will be part of a major new project to = identify and block all DoH services, so=C2=A0

> that behavioural security policies can still wo= rk, because you may have=C2=A0
> noticed that the internet has never become MORE secure from new tech,= =C2=A0
> but it occasionally becomes LESS secure more slowly because of policy.= )

=C2=A0

I would be very interested, if you are so inclined, = to hear more of what you are thinking.=C2=A0 =C2=A0Is this something you ca= n (are willing to) talk about?=C2=A0 =C2=A0

=C2=A0

[TR] Enterprise networks are already able to block D= oH services, it is causing the DoH client to fallback to clear-text DNS com= promising endpoint security and privacy. In draft https://to= ols.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-01 we are proposing mechanisms to automatically bootstrap endpoints to discover and authenticate privacy-enabling DNS servers provid= ed by the Enterprise network.

=C2=A0

The user also gets to know the privacy preserving da= ta policy by the DNS server and can decide whether to switch to another net= work or if the user trusts the network and privacy policy, the user can ena= ble strict privacy profile with the privacy enabling DNS server discovered in the Enterprise network itself in= stead of downgrading to opportunistic privacy profile.

=C2=A0

Cheers,

-Tiru

=C2=A0

It sounds like a very thought-provoking initiative.<= u>

=C2=A0

Thanks,

Nalini

=C2=A0

On Mon, Mar 11, 2019 at 10:55 AM Paul Vixie <paul@redbarn.org> = wrote:



Christian Huitema wrote on 2019-03-10 21:14:
....
> There are a bunch of conflicting requirements here, and it would be go= od
> to tease out the contradictions. Consider the following cases:
>
> 1) I am using my phone, and using application-X.
>
> 2) I am at home, using application-X on my home computer.
>
> 3) I am using Wi-Fi in a hotel, and using application-X.
>
> 4) I am using my work laptop on the enterprise network, and using
> application-X
>
> 5) I am using my work laptop in a hotel, and using application-X
>
> 6) I am using my work laptop on the network of a customer, and using > application-X.

this distinction is not useful.

there are two cases.

a user or app trusts its network.

or not.

in the first case, you'll use an RDNS service which is in the set
(allowed (preferred)). that is, you'll use the server you desire most <= br> out of the set that your network operator allows you to reach.

in the second case, you'll use a VPN, for all of your traffic, not just=
for DNS, because if you hide your DNS but not the connections which
result from such hiding, it will add no measurable privacy.

> Today, plenty of people claim the right to control how I use the DNS: = my
> phone carrier, my ISP at home, the company that got the contract to > manage the hotel's Wi-Fi, the IT manager for my company's lapt= op, the IT
> manager for the company that I am visiting. Out of those, there is jus= t
> one scenario for which the claim has some legitimacy: if the company > pays for my laptop and own the laptop, yes of course it has a legitima= te
> claim to control how I am using it. Otherwise, I, the user, get to
> decide. If I like the application's setting better than the networ= k's
> default, then of course I expect those settings to stick.

this distinction is also false.

if you are using my network, then it makes no difference which of us
bought you that laptop. you will use the RDNS i allow you to use. RDNS
is part of the control plane, and i use it for both monitoring and
control. sometimes that's so that i can see malware beacon to its C&= ;C.
sometimes that's so that i can institute parental controls.

if you don't like my rules, you should vote with your feet, and not visit me. because that is the only choice you will have. (yes, i will be part of a major new project to identify and block all DoH services, so
that behavioural security policies can still work, because you may have noticed that the internet has never become MORE secure from new tech,
but it occasionally becomes LESS secure more slowly because of policy.)

quoting again the salient passage of RFC 8484's self-damning introducti= on:

> ... Two primary use cases were considered during this protocol's <= br> > development. These use cases are preventing on-path devices from
> interfering with DNS operations, ...

let me give you advance notice: "i aim to misbehave."[1] that is,= _i am
on-path, and i intend to interfere._ why on earth the IETF decided to
equate dissidents (of whom there are tens of thousands, all of which
need full VPN's not just DoH for actual safety) with bots (of which there are tens of millions), and set up a war between end users and
network operators, i will never understand, or try to. now, we fight.

--
P Vixie


=C2=A0

--

Thanks,

Nalini Elkins=

President<= /u>

Enterprise Data Cent= er Operators

=C2=A0



--
Thanks,
Nalini = Elkins
President
Enterprise Data Center Operators

--0000000000003d9edd0583d4df90-- From nobody Mon Mar 11 10:32:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 01A3912008A; Mon, 11 Mar 2019 10:32:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YNbh7IVyQFrY; Mon, 11 Mar 2019 10:31:59 -0700 (PDT) Received: from mail-pf1-x42c.google.com (mail-pf1-x42c.google.com [IPv6:2607:f8b0:4864:20::42c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BF24127817; Mon, 11 Mar 2019 10:31:59 -0700 (PDT) Received: by mail-pf1-x42c.google.com with SMTP id i19so4205610pfd.0; Mon, 11 Mar 2019 10:31:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=yUz8jL3RpBC0z9cxuvI5IuS5Xuvyws83qQVEKrtf+6o=; b=TioiWaBqnQKKb1E6nY5Py1V78/8nNgx+zj7PqRSMbcP0UMLeSNfKvzvKitNOtCbk8f slb79BPvTen0a8ddtczTvefDDDOGA65B7sbkp11rj3qI9bWiktcVOlVKLr8tVzC7WdYK Sr1FqG6dXeqxXXPrlOvfYYP44yTDhry/21gOmgK4Zu5omZLfYpNEQoTwFFlHu3pB+x1z W+LR3mZ2JOw0x8AKgAzySfSNWfZAqXi26kFTQe52HG4IFFBqjiJSmoWBt0un1/nv1d+p HinugNIRuGX9eWvGfXL9F9fQ2R/VKY4cxivPF4UBF/MOIwc0VzS2muIZVzW3WXO+nY0I PJOg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yUz8jL3RpBC0z9cxuvI5IuS5Xuvyws83qQVEKrtf+6o=; b=cCmjRfTiHHgjZEDGsQxPxtnc+ko4HSfFLQDeHQBD0iGZl7YCCT+LivKK37EIMsQten o0sP/bWFUvgv/uF6aqO9Vbw9Ss1QQVFmGmQc5OS2a6NsncZi6i7CjfPPP8x7E+oo2ELu rvmo88wdn5gxmv/SNpqDivb+lt+jJ81/dypJBS6NvGKF0LsmPXjFLkNHHFnboGgHjUEu 7Fkqha7ERQ6Psy2NWR1lNLfNT0D2iFLpqd/WnpMooVUlaM/PlglKgLIUYbykijTq2m+h SuGR1SI2H8XgoW8OYev2FTns4tudyzFmQN89/twhfyEpt/T0nh1q3M/5xOe72yrHosjg FaRA== X-Gm-Message-State: APjAAAWVAFzHV6Frn487m0Ij0oonxh1DqHTMU9fsv3VX7oAr5mcBpLNQ mYGbqOvYxNifwBuxsSrhRjkhPZs41YcjVPzCgsY= X-Google-Smtp-Source: APXvYqz0kjbr4Zbc5yk7AIZ4dzKOdR3BE70th1dEHu1s28h9V/aikJwujOlrOKHCM5IGU9MF8eHsI4QB7nRUNU8eKDY= X-Received: by 2002:aa7:9141:: with SMTP id 1mr33901596pfi.38.1552325518501; Mon, 11 Mar 2019 10:31:58 -0700 (PDT) MIME-Version: 1.0 References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <20190311171338.kusmt6q2z7mx6dww@nic.fr> In-Reply-To: From: Allison Mankin Date: Mon, 11 Mar 2019 13:32:20 -0400 Message-ID: To: Melinda Shore Cc: Stephane Bortzmeyer , Ted Hardie , DPRIVE WG , DoH WG , dnsop , hrpc@irtf.org Content-Type: multipart/alternative; boundary="0000000000001b2c4c0583d4f315" Archived-At: Subject: Re: [Doh] [dns-privacy] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:32:02 -0000 --0000000000001b2c4c0583d4f315 Content-Type: text/plain; charset="UTF-8" I'd appreciate it not conflicting with IRTFOPEN. The ANRP topics include how Facebook manipulates routing and a big study on QUIC, and I think there should be participant overlap. On Mon, 11 Mar 2019 at 13:22, Melinda Shore wrote: > On 3/11/19 9:13 AM, Stephane Bortzmeyer wrote: > > I admit I'm not sure that Secdispatch is so important here. The > > subject of the side meeting is not security-specific. > > It also conflicts with irtfopen, which may impact the > availability of pearg people, hrpc folk, etc. > > Melinda > > -- > Software longa, hardware brevis > > PGP key fingerprint 4F68 2D93 2A17 96F8 20F2 > 34C0 DFB8 9172 9A76 DB8F > > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy > --0000000000001b2c4c0583d4f315 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'd appreciate it not conflicting with IRTFOPEN.=C2= =A0 The ANRP topics include how Facebook manipulates routing and a big stud= y on QUIC, and I think there should be participant overlap.
=
On Mon= , 11 Mar 2019 at 13:22, Melinda Shore <melinda.shore@nomountain.net> wrote:
On 3/11/19 9:13 AM, Stephane Bor= tzmeyer wrote:
> I admit I'm not sure that Secdispatch is so important here. The > subject of the side meeting is not security-specific.

It also conflicts with irtfopen, which may impact the
availability of pearg people, hrpc folk, etc.

Melinda

--
Software longa, hardware brevis

PGP key fingerprint=C2=A0 4F68 2D93 2A17 96F8 20F2
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A034C0 DFB8 9172 9A76 DB8F

_______________________________________________
dns-privacy mailing list
dns-privacy@ietf.= org
https://www.ietf.org/mailman/listinfo/dns-privacy
--0000000000001b2c4c0583d4f315-- From nobody Mon Mar 11 10:57:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6E57A1311B8; Mon, 11 Mar 2019 10:57:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NoqPkzFGk8i5; Mon, 11 Mar 2019 10:57:06 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A774131172; Mon, 11 Mar 2019 10:57:06 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 3927C6A233; Mon, 11 Mar 2019 18:57:04 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552327024; bh=Cr2+/+O0KXHWArKL7PokaY1KG5gmsHe/KBNKFF7uGE4=; h=Date:From:To:In-Reply-To:References:Subject:From; b=spzXFlaVY/IW8NINBcfvwHuoZH8/SN5hzKAa3XvNs5U6l4jFxI8weWQXYZW1wtFr9 HFCpmW5HABqW/M//HTO3q2g94UZp0Vti9Ac9M8z+Cweuz1H7RxME1VlT4J8gfKRm5l pGxWQ0SE/XyI6qM5/EqjMJA9kufk9lT1h+USfacyyOPdT+1g3RaSE6AmLat1wd0f/y Ph0ZH4OAQyUYc7kQykPAtpCyNZr522D7arNUc9VqMzxCh2Vg9HLjsiW0b5LTRFVLDH 8JNOD+TwPgVh8Iyeht96kHam6P8bN7ENnQXi0/YZG17GhCMCXWqmAjz+GGExZZpRDM myGcUhDR1fpQA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 191853C06FD; Mon, 11 Mar 2019 18:57:04 +0100 (CET) Date: Mon, 11 Mar 2019 18:57:03 +0100 (CET) From: Vittorio Bertola To: Stephane Bortzmeyer , doh@ietf.org, dns-privacy@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <1829067625.16839.1552327024048@appsuite.open-xchange.com> In-Reply-To: <20190311170218.o5hitvysuefhjjxk@nic.fr> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:57:17 -0000 > Il 11 marzo 2019 alle 18.02 Stephane Bortzmeyer ha scritto: > > It was suggested Reference necessary to have a > side meeting in Prague at IETF 104. I propose monday, 1400-1600 in > Tyrolka. The proposal is at > . You > are welcome to agree/disagree/meet in a bar instead. Why not in the Wednesday timeslot that was specifically set aside for side meetings? Also, I'm wondering whether a 40-people room is enough (may be, may be not). Moreover, centralization is not the only Do*-related problem category that has been raised (my draft alone lists eight others). So the focus of the meeting should be on whether, where and how to deal with all of them, though some of them may later be deemed off mission for the IETF. But first of all we need to agree on a venue and process. Ciao, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Mon Mar 11 10:59:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 87B101286E7; Mon, 11 Mar 2019 10:59:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vv6yt_gbyq04; Mon, 11 Mar 2019 10:59:07 -0700 (PDT) Received: from mail-pg1-x534.google.com (mail-pg1-x534.google.com [IPv6:2607:f8b0:4864:20::534]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26E6D131172; Mon, 11 Mar 2019 10:59:04 -0700 (PDT) Received: by mail-pg1-x534.google.com with SMTP id r124so4619816pgr.3; Mon, 11 Mar 2019 10:59:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SJaJNUXmvW08NGFs5aA2jLNMGfk0Tz7Thl4ZUp1w8qw=; b=WcxocDioU3shjo9TXInycno9oP4a0l1K4M/L33KWhEqnaRwIvBdPQulRArHbdJVLEf dN/dYV4dpMkPCMzHe7MTwPE6VY26Gx0/WA0oAv34r546QNjDl2hEd2bG4UC9bo+Rii1M WNkZdwRMZsxRsyAjvoVV8rBZ/1KDxaBZx9KsAi3bZnN2JveGkpxJtLry/0M7U87U+B3A jnwR2Ngavr4PnUkvCTP6uel0mdrYY1RFpCrClH59m7G9lHnMDg1cTcvf10LfdaefAv90 3oUreZ3JCJHxo9WF11eAPIwMFukgr79aMf6ZP7aqAIT4+4T1W3pHplybKPJ2/03RdWKb jtiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SJaJNUXmvW08NGFs5aA2jLNMGfk0Tz7Thl4ZUp1w8qw=; b=N+edrZbzRBsw2XwEvKxuYRGiziP0U51N6hjqfvLjGrv8Xu6iTxk4fLoL6wQuFozdUr LqjU3jyKLdkPX1VE45aiEeQtBHddsdle9rSHe5B6TZysOwQ4iccox1JxtsnvQfHkSa4P FlhqZLo+kuBYjJRSsPtQnxr8lW2JK58wBBgEDNROtzqwg9fWRtgm3r4Jr0qr22OM6Odg GdR9ajlgFKKVyFbQh4j7JsmXyD73Xaz1dIclxOlZEn5AHENu1SR5/1ZEr0cJvcFtaHZP 8ImpSXDY58GaZvNvb5tN6Qq926jzpevhQ8BCGM4NFzCevXkpmeivj65Ez1A4AYE/ZXCn Ee7A== X-Gm-Message-State: APjAAAWUJ53LBIr1boYbdrMnh2GuX8uEe8czGWzNre++pGiV17KlJx0H IfAKmNsXLnr3RghUYMHPjDKTQRLC6Sip0xO6KzY= X-Google-Smtp-Source: APXvYqzBQ2S001H9FN9mbIz0GOUeuPDcD6sm2lN+0/RBM4EJMfKt+lMOLAsIIB9/6f7xWSVa5OJRrDNhvqQoNuISgiE= X-Received: by 2002:a63:d442:: with SMTP id i2mr30782281pgj.246.1552327143549; Mon, 11 Mar 2019 10:59:03 -0700 (PDT) MIME-Version: 1.0 References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> In-Reply-To: <1829067625.16839.1552327024048@appsuite.open-xchange.com> From: Allison Mankin Date: Mon, 11 Mar 2019 13:59:25 -0400 Message-ID: To: Vittorio Bertola Cc: Stephane Bortzmeyer , DoH WG , DPRIVE WG , dnsop , hrpc@irtf.org Content-Type: multipart/alternative; boundary="000000000000f7719c0583d553cb" Archived-At: Subject: Re: [Doh] [hrpc] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 17:59:17 -0000 --000000000000f7719c0583d553cb Content-Type: text/plain; charset="UTF-8" Perfect idea, very good use of the Wednesday slot. On Mon, 11 Mar 2019 at 13:57, Vittorio Bertola wrote: > > Il 11 marzo 2019 alle 18.02 Stephane Bortzmeyer ha > scritto: > > > > It was suggested Reference necessary to have a > > side meeting in Prague at IETF 104. I propose monday, 1400-1600 in > > Tyrolka. The proposal is at > > . You > > are welcome to agree/disagree/meet in a bar instead. > > Why not in the Wednesday timeslot that was specifically set aside for side > meetings? Also, I'm wondering whether a 40-people room is enough (may be, > may be not). > > Moreover, centralization is not the only Do*-related problem category that > has been raised (my draft alone lists eight others). So the focus of the > meeting should be on whether, where and how to deal with all of them, > though some of them may later be deemed off mission for the IETF. But first > of all we need to agree on a venue and process. > > Ciao, > -- > > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange > vittorio.bertola@open-xchange.com > Office @ Via Treviso 12, 10144 Torino, Italy > > _______________________________________________ > hrpc mailing list > hrpc@irtf.org > https://www.irtf.org/mailman/listinfo/hrpc > --000000000000f7719c0583d553cb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Perfect idea, very good use of the Wednesday slot.
<= /div>



On Mon, 11 Mar 2019 at 13:57, Vittorio Berto= la <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:
> Il 11 marzo 2019 alle 18.02 Steph= ane Bortzmeyer <b= ortzmeyer@nic.fr> ha scritto:
>
> It was suggested <wikipedia>Reference necessary</wikipedia>= ; to have a
> side meeting in Prague at IETF 104. I propose monday, 1400-1600 in
> Tyrolka. The proposal is at
> <https://trac.ietf.org/trac/ietf= /meeting/wiki/104sidemeetings>. You
> are welcome to agree/disagree/meet in a bar instead.

Why not in the Wednesday timeslot that was specifically set aside for side = meetings? Also, I'm wondering whether a 40-people room is enough (may b= e, may be not).

Moreover, centralization is not the only Do*-related problem category that = has been raised (my draft alone lists eight others). So the focus of the me= eting should be on whether, where and how to deal with all of them, though = some of them may later be deemed off mission for the IETF. But first of all= we need to agree on a venue and process.

Ciao,
--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vitt= orio.bertola@open-xchange.com
Office @ Via Treviso 12, 10144 Torino, Italy

_______________________________________________
hrpc mailing list
hrpc@irtf.org
https://www.irtf.org/mailman/listinfo/hrpc
--000000000000f7719c0583d553cb-- From nobody Mon Mar 11 11:07:15 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 28E6F1277D8; Mon, 11 Mar 2019 11:07:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LxfClxhhGPzR; Mon, 11 Mar 2019 11:07:06 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2DD61311C7; Mon, 11 Mar 2019 11:06:58 -0700 (PDT) Received: from [IPv6:2001:559:8000:c9:6529:414d:1c66:203e] (unknown [IPv6:2001:559:8000:c9:6529:414d:1c66:203e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 9BB00892C6; Mon, 11 Mar 2019 18:06:58 +0000 (UTC) To: Ted Hardie Cc: Warren Kumari , Jim Reid , DoH WG , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <8855871d-c059-3938-12a1-62f21c089e1d@redbarn.org> From: Paul Vixie Message-ID: <5456b9d9-844f-f410-3935-2b2d3ae22745@redbarn.org> Date: Mon, 11 Mar 2019 11:06:56 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.11 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 18:07:08 -0000 Ted Hardie wrote on 2019-03-11 10:02: ... > no other off-network RDNS is reachable by malware which somehow gets > into my network, > > > I interpret this to mean that you have blocked DNS over TLS's well-known > port (853), so that Quad 9 and other services offering it are not > accessible.  Is that correct, or do you mean something more extensive? that's it. because before DoH, it was possible to outlaw off-net 53 and 853 except when coming from my local RDNS servers. because unlike DoH, those protocols are not designed to prevent on-path interference. > As several other folks have pointed out, roll-your-own resolution is in > some pretty widely used applications, but I'm not aware of any > comprehensive list or any way to block that short of removing the > applications once found.  Is there a technique here I'm not aware of? famously, my chromecast ultra would not let itself out of setup mode until it was allowed to reach 8.8.8.8 on UDP/53. https://www.businessinsider.com/paul-vixie-blasts-google-chromecast-2019-2 my solution was to operate a server on 8.8.8.8 (and 8.8.4.4, and 9.9.9.9, and 1.1.1.1) locally. DoH will moot that approach. (by design.) i'm studying my alternatives, since i also use 'dnstap' to detect behavioural abnormalities, and DNS RPZ for parental (and botnet, and IoT) controls. it won't be pretty and it won't be cheap. (by design.) -- P Vixie From nobody Mon Mar 11 11:12:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E48C13108C; Mon, 11 Mar 2019 11:12:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A-5M4Od_k-L1; Mon, 11 Mar 2019 11:12:48 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4EBFB1310F4; Mon, 11 Mar 2019 11:12:45 -0700 (PDT) Received: from [IPv6:2001:559:8000:c9:6529:414d:1c66:203e] (unknown [IPv6:2001:559:8000:c9:6529:414d:1c66:203e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 1F755892C6; Mon, 11 Mar 2019 18:12:45 +0000 (UTC) To: nalini elkins Cc: "Konda, Tirumaleswar Reddy" , Stephen Farrell , "doh@ietf.org" , "dnsop@ietf.org" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> From: Paul Vixie Message-ID: <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> Date: Mon, 11 Mar 2019 11:12:43 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.11 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 18:12:50 -0000 nalini elkins wrote on 2019-03-11 10:26: > Tiru, > > Thanks for your comments. > > > Enterprise networks are already able to block DoH services, i wonder if everyone here knows that TLS 1.3 and encrypted headers is going to push a SOCKS agenda onto enterprises that had not previously needed one, and that simply blocking every external endpoint known or tested to support DoH will be the cheaper alternative, even if that makes millions of other endpoints at google, cloudflare, cisco, and ibm unreachable as a side effect? CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24, which i blocked already (before DoH) so that's not a problem. but if google decides to support DoH on the same IP addresses and port numbers that are used for some API or web service i depend on, that web service is going to be either blocked, or forced to go through SOCKS. this will add considerable cost to my network policy. (by design.) -- P Vixie From nobody Mon Mar 11 11:31:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 635A512426A; Mon, 11 Mar 2019 11:31:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KDKICxcMeTZ1; Mon, 11 Mar 2019 11:31:19 -0700 (PDT) Received: from mail-it1-x132.google.com (mail-it1-x132.google.com [IPv6:2607:f8b0:4864:20::132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E788912008A; Mon, 11 Mar 2019 11:31:18 -0700 (PDT) Received: by mail-it1-x132.google.com with SMTP id x189so244534itd.3; Mon, 11 Mar 2019 11:31:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hWGZlDLKR9JKzQMJ70ShZyTWab3KvsS0TXowASobETc=; b=jakMVrJ6am05CGh1aCEAQsyZhwbFerrkb3cER2tJ2EVALT1A8CGYwrc+9SAlBE+gSu AvhBISUMrD5BdSU3eVFA8YNF8dTw1E2o90JGr5TX5ZqVJPq+RwAG6qoMiiJa/yjTnEJU 7PNSzpyPDX/wTO3yasl4gPA026PPlWaKI/eLRYVaCj2b0eO05rq30vypyeqn/uImx+YU ijovNpfXC30oeexa3iTrxPn12HoXhV+9TmfMjJMlnF4+MPEFkXeSR8MFFWM8mGNHQJ85 GCq3hfpIwayD98HbToDUyurLoCJOe9rz7sWntB5SI/i4ZdBQ4fGG6Awr50de4o/j2iQ7 jV4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hWGZlDLKR9JKzQMJ70ShZyTWab3KvsS0TXowASobETc=; b=U3RAU1En0c38OdyZq9EY6v++1BOKJEHlJtBPxT6ilZvg5qlW9njgdIOD3JT5wR5eAR 7cazPegzgKQ68jQse0+ulrgxZuiYvRfZ5W165N35Nw7RQnUHrv1+itLcOvY1xVwfsmvD 14FJWjfRXPUMy/ADcLziOK4kjVbQVe2/QIXf7XVEvRXZhunf8f8AymnO5Cs3PmPIp81/ KcWu2EL2mj8JQpRpb3Kl031SaGoDJtJUch+Sa76urMQt1lqf95/1PNxPg3aHrOd3/Zan iZmSCLHiHOZH3gHk6czdvO98CM85JGlGff8VIhXyQllT/JwoYoMgD8e0wWX4GhczqxoA OQDg== X-Gm-Message-State: APjAAAXoBwi+SYQnNE7k8/gq0ZgQnKpWM9SuezB1wBrHinx6DGqBWAh2 D3PNCRT56okiww/NOoLsgbVTnIoYFyDm7R6gFQcWLxP/ X-Google-Smtp-Source: APXvYqxTGk30btX/QmYMz1FoCgDjUcyoDBUDkMaYCOctcMGjyuhuXE6IUtDyyCuNicCM9n/AAxfoTjn1Vh5+jk+qbnM= X-Received: by 2002:a24:1745:: with SMTP id 66mr106131ith.96.1552329078109; Mon, 11 Mar 2019 11:31:18 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <8855871d-c059-3938-12a1-62f21c089e1d@redbarn.org> <5456b9d9-844f-f410-3935-2b2d3ae22745@redbarn.org> In-Reply-To: <5456b9d9-844f-f410-3935-2b2d3ae22745@redbarn.org> From: Ted Hardie Date: Mon, 11 Mar 2019 11:30:51 -0700 Message-ID: To: Paul Vixie Cc: Warren Kumari , Jim Reid , DoH WG , dnsop Content-Type: multipart/alternative; boundary="000000000000467e0c0583d5c7df" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 18:31:20 -0000 --000000000000467e0c0583d5c7df Content-Type: text/plain; charset="UTF-8" On Mon, Mar 11, 2019 at 11:06 AM Paul Vixie wrote: > > DoH will moot that approach. > Any system that actually checks the credentials presented by the responding server will also moot that approach. Given how easy it is to pin credential characteristics in applications distributed as binaries, this seems to mean that your method will either continue to permit applications other than browsers to use their own resolution systems or it will hard fail all such applications it can identify. No pass through will work, as far as I can tell, in that scenario. Perhaps, though, I am missing something about your intent. Ted Hardie -- > P Vixie > > --000000000000467e0c0583d5c7df Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Mar 11, 2019 at 11:06 AM Paul Vix= ie <paul@redbarn.org> wrote:<= br>

DoH will moot that approach.

Any syste= m that actually checks the credentials presented by the responding server w= ill also moot that approach.=C2=A0 Given how easy it is to pin credential c= haracteristics in applications distributed as binaries, this seems to mean = that your method will either continue to permit applications other than bro= wsers to use their own resolution systems or it will hard fail all such app= lications it can identify.=C2=A0 No pass through will work, as far as I can= tell, in that scenario.

Perhaps, though, I am mis= sing something about your intent.

Ted Hardie



--
P Vixie

--000000000000467e0c0583d5c7df-- From nobody Mon Mar 11 13:43:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDAB01311D9 for ; Mon, 11 Mar 2019 13:43:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xmzu5IXUbDJe for ; Mon, 11 Mar 2019 13:43:47 -0700 (PDT) Received: from mail-lj1-x242.google.com (mail-lj1-x242.google.com [IPv6:2a00:1450:4864:20::242]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 55F191311C4 for ; Mon, 11 Mar 2019 13:43:43 -0700 (PDT) Received: by mail-lj1-x242.google.com with SMTP id v16so288796ljg.13 for ; Mon, 11 Mar 2019 13:43:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xt4Iw//cVRXManG4BIdxrjJe1wpkbP7taIrKwMF0WRk=; b=mkbBsGSNYJqvcZrqNdMVlNrLI2dLtg3Esky9pRICaeAdioN0atKG0rg8wzBpXHwpre wqZqNhZICxt0mG9bxy+lC/kv3D/iFgtf6Zgz287HpzsCEd8W0zAGquYAn7G2eVAauS4+ HAux/2LTIHOinRrjaA0Xys/+P+NSHtYmFNjA/xf3aF65T4PvXskIsGYf8a7dlfWXMe2r Ptc2W7jTLK1eUcb8op7ck98r1JVKzc4Xjf7H13d69zdF7Nzc9lGlHqmZInUDZuvIAfkQ inEeOggn25BK+bfkyuHBnPTZLkZarPEB4vrYqPEsAFClclytYZe1wbFkfqzgzcOnDblh +SOw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xt4Iw//cVRXManG4BIdxrjJe1wpkbP7taIrKwMF0WRk=; b=XQOZ8c4wuMOcT7jg0LboXDO0jhqoiFoesRn/VaUrV0BrhfkUQ79iKlR2+PTAnUGYUg LImNIcmy/5s3wV4RXSQwSmalTyPi34PZ0T2M3Qz8mPf1CJb+BnR0t+fIC0IMli9Pc4xm mMDGMVQXWmfARReEL7U2GBZF0PjDB/58/5zn7TaLJXzyItyfgNMDDWW/nowLiH4sxQNg BnGBnxUeYw4orTHJANHKn3Yb727ACOt7xPBn3cETpiwPNE3abtZxHlz6/LEjz7MdZVyp 6O9yuVHRLktg/wPUIP/I8P1LFkjnAJvsFufdrBoTDSSczFBBIx+qqwptQ59QTdoRlSpA 8JAw== X-Gm-Message-State: APjAAAULpTZ48EkGGYdpBY7vTe7l89pRj4/pLRhrXGTOg11os/f2CEQM 0Bbbid9MxLRuDAMPhfbqIoA3Ml5gFWVzsNPur/nM5w== X-Google-Smtp-Source: APXvYqwSlIGicz6r+XCYz1p03I/bdXCAf4G1RV0C/pVMDx5gMOKpbmbk28Pxem/iuYFi0P/x1hz10jHCR1Nwuq+kR3s= X-Received: by 2002:a2e:a28f:: with SMTP id k15mr17962255lja.160.1552337021307; Mon, 11 Mar 2019 13:43:41 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> From: nalini elkins Date: Tue, 12 Mar 2019 02:13:30 +0530 Message-ID: To: Paul Vixie Cc: "Konda, Tirumaleswar Reddy" , Stephen Farrell , "doh@ietf.org" , "dnsop@ietf.org" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" Content-Type: multipart/alternative; boundary="000000000000ba2bff0583d7a0f2" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 20:43:53 -0000 --000000000000ba2bff0583d7a0f2 Content-Type: text/plain; charset="UTF-8" >i wonder if everyone here knows that TLS 1.3 and encrypted headers is >going to push a SOCKS agenda onto enterprises that had not previously >needed one I have, ahem, some familiarity with the enterprises and TLS1.3 issue. (These past few years have aged me terribly!) I frankly feel that we have at the IETF a problem with the how we do conflict resolution and the process of consensus itself. In fact, I co-authored a draft on this topic: https://tools.ietf.org/html/draft-elkschul-conflict-problem-00 I feel that until we fix these fundamental issues, we will find ourselves in this place again and again. The next time will be with QUIC (as Paul points out in his mention of encrypted headers). I actually have some suggestions as to how we might better work with each other. But, I do not want to sidetrack into a much larger issue. At a minimum, I think that some relatively neutral arbiter, say CERT, might provide an after the fact impact assessment that certain changes such as DoH and TLS1.3 will have on enterprises, the home user, and so on. Of course, it would be better if such a neutral assessment were done BEFORE the draft becomes final. This is similar to what is done in California on ballot initiatives. When we get our voting pamphlet, it tells us for each issue, what impact a pro or con vote will have on various aspects such as increased taxes, and so forth. Nalini On Mon, Mar 11, 2019 at 11:42 PM Paul Vixie wrote: > > > nalini elkins wrote on 2019-03-11 10:26: > > Tiru, > > > > Thanks for your comments. > > > > > Enterprise networks are already able to block DoH services, > i wonder if everyone here knows that TLS 1.3 and encrypted headers is > going to push a SOCKS agenda onto enterprises that had not previously > needed one, and that simply blocking every external endpoint known or > tested to support DoH will be the cheaper alternative, even if that > makes millions of other endpoints at google, cloudflare, cisco, and ibm > unreachable as a side effect? > > CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24, which i > blocked already (before DoH) so that's not a problem. but if google > decides to support DoH on the same IP addresses and port numbers that > are used for some API or web service i depend on, that web service is > going to be either blocked, or forced to go through SOCKS. this will add > considerable cost to my network policy. (by design.) > > -- > P Vixie > > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --000000000000ba2bff0583d7a0f2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
>i wonder if everyone here knows that = TLS 1.3 and encrypted headers is=C2=A0
>going to push a SOCKS agenda = onto enterprises that had not previously=C2=A0
>needed one
I have, ahem, some familiarity with the enterprises and TLS1.3= issue.=C2=A0 (These
past few years have aged me terribly!)=C2=A0= I frankly feel that we have at the IETF
a problem with the how w= e do conflict resolution and the process of consensus
itself.=C2= =A0 In fact, I co-authored a draft on this topic:

= = https://tools.ietf.org/html/draft-elkschul-conflict-problem-00

I feel that until we fix these fundamental issues, we = will find ourselves in this
place again and again.=C2=A0 =C2=A0Th= e next time will be with QUIC (as Paul points out
in his mention = of encrypted headers).=C2=A0 I actually have some suggestions as
= to how we might better work with each other.=C2=A0 But, I do not want to si= detrack
into a much larger issue.

At a m= inimum, I think that some relatively neutral arbiter, say CERT, might
=
provide an after the fact impact assessment that certain changes such = as=C2=A0
DoH and TLS1.3 will have on enterprises, the home user, = and so on.=C2=A0 =C2=A0Of=C2=A0
course, it would be better if suc= h a neutral assessment were done BEFORE
the draft becomes final.<= /div>

This is similar to what is done in California on b= allot initiatives.=C2=A0 When we get our
voting pamphlet, it tell= s us for each issue, what impact a pro or con vote will have
on v= arious aspects such as increased taxes, and so forth.

<= div>Nalini

On Mon, Mar 11, 2019 at 11:42 PM Paul Vixie <paul@redbarn.org> wrote:


nalini elkins wrote on 2019-03-11 10:26:
> Tiru,
>
> Thanks for your comments.
>
>=C2=A0 > Enterprise networks are already able to block DoH services,=
i wonder if everyone here knows that TLS 1.3 and encrypted headers is
going to push a SOCKS agenda onto enterprises that had not previously
needed one, and that simply blocking every external endpoint known or
tested to support DoH will be the cheaper alternative, even if that
makes millions of other endpoints at google, cloudflare, cisco, and ibm unreachable as a side effect?

CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24, which i
blocked already (before DoH) so that's not a problem. but if google decides to support DoH on the same IP addresses and port numbers that
are used for some API or web service i depend on, that web service is
going to be either blocked, or forced to go through SOCKS. this will add considerable cost to my network policy. (by design.)

--
P Vixie



--
Thanks,
Nalini = Elkins
President
Enterprise Data Center Operators

--000000000000ba2bff0583d7a0f2-- From nobody Mon Mar 11 14:34:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE91813117E; Mon, 11 Mar 2019 14:33:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fGRHFBtcJWhz; Mon, 11 Mar 2019 14:33:51 -0700 (PDT) Received: from mail-qt1-x844.google.com (mail-qt1-x844.google.com [IPv6:2607:f8b0:4864:20::844]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D80A131161; Mon, 11 Mar 2019 14:33:50 -0700 (PDT) Received: by mail-qt1-x844.google.com with SMTP id x20so342560qto.1; Mon, 11 Mar 2019 14:33:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=N8PrV1BYWjXpqUfvPxKM/Uu7Nto79uANGe/F64yWMm0=; b=b152w5kotoKV2U9ysZgQ0k5gH9y1Atr82UMJTLDN2q4F2Mc6s2rFaVDdesC1kGx6Si ZpqkkSWBm5V30bqldtZKGNDqJvkWDoRlAuno+0kis1UhQ8SjxRfz0sO61C3ftBxyzy5D HQ5qNPibL0i3eE4Esex9CEXL+M0rXJhrCCnFGDlAGkDZwD6aflIowUoEYk7tR8ztaGX3 TusoX0XIb8wc25WTQ0PPgJS6z3jowLGStIFni28vrFq1xdHRPtbt9ihRvJtzrTyTu7z0 3tUNsO/gziWUX3x6XupcsXBtu1Da5Wx6YmKscc3p3Zyjl84WKQ5Q28XNo2IzITbGTjDx Nahw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=N8PrV1BYWjXpqUfvPxKM/Uu7Nto79uANGe/F64yWMm0=; b=N+OyCOWMHD78w5VOry6VQU80hyW8mxjzIA3x+GWpTjvsG/o5uI0R76UOdrC7Wq349d 0H06aX3H3KTPrpobU+KdP9pG1YpilX4zr90bJbFkxE7aUTDeRXTNhSrxFOGzoo8Igeva 2D/3QbkSeeA9pHRUwubiVbikGBOc1chWWOfKGY37qnK/rz1bd4pZKxLj2JynBC3pRVAB o3cVGXiapa486Bi7eXDao0p+IJ01nkD/m11BLKEyIZ0KNCXRxY7Gyh0fFlrciMv0K1yd 8vFDFXNehopYzkS2oZrGfFBxc6P3qBoHBhx16hPczTQ21GGwFfAxfVMwjew3+cviKFac 6Urg== X-Gm-Message-State: APjAAAUjTeL3JsVGMClBc/sVkLeJzhMdxNG/2dFnP4upggQW2L/U0Sw/ A/ORTC1LDXyen74sa3kmk1H+QhOMdmZpN9WIxH5mFg== X-Google-Smtp-Source: APXvYqyIRMM+/IdJcb8KND7Vw2NzrovqtQQgN4AlJgJ3PA/czdtsIoTCGp7wyu2bZzoNp7wRQ53h5NijygroQ9sgpCU= X-Received: by 2002:a0c:d413:: with SMTP id t19mr529147qvh.8.1552340029421; Mon, 11 Mar 2019 14:33:49 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> In-Reply-To: <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> From: Brian Dickson Date: Mon, 11 Mar 2019 14:33:38 -0700 Message-ID: To: Paul Vixie Cc: Christian Huitema , doh@ietf.org, "dnsop@ietf.org WG" , "Ackermann, Michael" , nalini elkins , dns-privacy@ietf.org, Stephen Farrell , Vittorio Bertola Content-Type: multipart/alternative; boundary="000000000000063da90583d85495" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 21:33:54 -0000 --000000000000063da90583d85495 Content-Type: text/plain; charset="UTF-8" (Apologies for top-replying) I think, from squinting at this a bit, that what is missing is some kind of policy/service discovery, and coming to some kind of agreement (between DNSOP and DOH, and any/all other interested parties) on what default behavior should be (and under what conditions/circumstances), e.g. with respect to opt-in vs opt-out. E.g. If the local network operator is giving out addresses using DHCP or the equivalent, then the presence/absence of DNS options in the answers, should to some degree dictate (permitted) behavior. And similarly, having some kind of DoH signaling incorporated in the DHCP options, would be a sensible analogous mechanism. E.g. "I will allow you to request DoH using providers X, Y, and Z, but insist on being a MITM for those connections", or "Go ahead and do DoH to any of these providers X, Y, Z, but no others", or "DoH is prohibited here, use DNS", or "You can use DoT to these providers, DoH with me as MITM, or this DNS resolver, but you can't run your own resolver". Not sure what other mechanisms might be worth considering as alternatives (dns-sd of some flavor)... The mechanisms definitely to be a lot cleaner, more transparent, and configurable, for both clients, network operators, and possibly DoT/DoH operators. (Did we learn nothing from the dial-up ISP early days, with mailing out physical CD ROMs with phone numbers in lists and browsers included?) Brian On Sun, Mar 10, 2019 at 11:17 PM Paul Vixie wrote: > > > Christian Huitema wrote on 2019-03-10 23:05: > > On 3/10/2019 10:24 PM, Paul Vixie wrote: > > > >> if you are using my network, then it makes no difference which of us > >> bought you that laptop. you will use the RDNS i allow you to use. RDNS > >> is part of the control plane, and i use it for both monitoring and > >> control. sometimes that's so that i can see malware beacon to its C&C. > >> sometimes that's so that i can institute parental controls. > >> > >> if you don't like my rules, you should vote with your feet, and not > >> visit me. because that is the only choice you will have. (yes, i will > >> be part of a major new project to identify and block all DoH services, > >> so that behavioural security policies can still work, because you may > >> have noticed that the internet has never become MORE secure from new > >> tech, but it occasionally becomes LESS secure more slowly because of > >> policy.) > > > > > > "Use a VPN, or use the local defaults". > > that is not what i said. > > > Well, there are plenty of > > in-between. > > yes, and i gave examples. > > see above. > > > You claim the right to impose your rules, because it is "your network". > > Yet you have to define ownership. You are providing network services > > under some contractual terms. There are cases where an imperial network > > can dictate those terms, but there are also many cases in which the > > contractual power of the network is limited -- thinks like fair access, > > network neutrality, etc. Just claiming an empire does not automatically > > make you the emperor. > > my network, my rules. your provider's network, their rules. they are > more likely to have to follow their government's laws of commerce and > privacy than i am likely to have to follow mine. but if the rules your > network operator can make allow you to do what you want, use that > network. that's invariant, for all networks, and for all instances of you. > > -- > P Vixie > > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy > --000000000000063da90583d85495 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
(Apologies for top-replying)

I think, f= rom squinting at this a bit, that what is missing is some kind of policy/se= rvice discovery, and coming to some kind of agreement (between DNSOP and DO= H, and any/all other interested parties) on what default behavior should be= (and under what conditions/circumstances), e.g. with respect to opt-in vs = opt-out.

E.g. If the local network operator is giv= ing out addresses using DHCP or the equivalent, then the presence/absence o= f DNS options in the answers, should to some degree dictate (permitted) beh= avior.
And similarly, having some kind of DoH signaling incorpora= ted in the DHCP options, would be a sensible analogous mechanism.
E.g. "I will allow you to request DoH using providers X, Y, and Z, bu= t insist on being a MITM for those connections", or "Go ahead and= do DoH to any of these providers X, Y, Z, but no others", or "Do= H is prohibited here, use DNS", or "You can use DoT to these prov= iders, DoH with me as MITM, or this DNS resolver, but you can't run you= r own resolver".

Not sure what other mechanis= ms might be worth considering as alternatives (dns-sd of some flavor)...

The mechanisms definitely to be a lot cleaner, more = transparent, and configurable, for both clients, network operators, and pos= sibly DoT/DoH operators.

(Did we learn nothing fro= m the dial-up ISP early days, with mailing out physical CD ROMs with phone = numbers in lists and browsers included?)

Brian

On Sun, Mar 10, 2019 at 11:17 PM Paul Vixie <paul@redbarn.org> wrote:


Christian Huitema wrote on 2019-03-10 23:05:
> On 3/10/2019 10:24 PM, Paul Vixie wrote:
>
>> if you are using my network, then it makes no difference which of = us
>> bought you that laptop. you will use the RDNS i allow you to use. = RDNS
>> is part of the control plane, and i use it for both monitoring and=
>> control. sometimes that's so that i can see malware beacon to = its C&C.
>> sometimes that's so that i can institute parental controls. >>
>> if you don't like my rules, you should vote with your feet, an= d not
>> visit me. because that is the only choice you will have. (yes, i w= ill
>> be part of a major new project to identify and block all DoH servi= ces,
>> so that behavioural security policies can still work, because you = may
>> have noticed that the internet has never become MORE secure from n= ew
>> tech, but it occasionally becomes LESS secure more slowly because = of
>> policy.)
>
>
> "Use a VPN, or use the local defaults".

that is not what i said.

> Well, there are plenty of
> in-between.

yes, and i gave examples.

see above.

> You claim the right to impose your rules, because it is "your net= work".
> Yet you have to define ownership. You are providing network services > under some contractual terms. There are cases where an imperial networ= k
> can dictate those terms, but there are also many cases in which the > contractual power of the network is limited=C2=A0 -- thinks like fair = access,
> network neutrality, etc. Just claiming an empire does not automaticall= y
> make you the emperor.

my network, my rules. your provider's network, their rules. they are more likely to have to follow their government's laws of commerce and <= br> privacy than i am likely to have to follow mine. but if the rules your
network operator can make allow you to do what you want, use that
network. that's invariant, for all networks, and for all instances of y= ou.

--
P Vixie

_______________________________________________
dns-privacy mailing list
dns-privacy@ietf.= org
https://www.ietf.org/mailman/listinfo/dns-privacy
--000000000000063da90583d85495-- From nobody Mon Mar 11 17:00:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C36C8131297; Mon, 11 Mar 2019 17:00:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t3s10c7QoXz7; Mon, 11 Mar 2019 17:00:20 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 86594131263; Mon, 11 Mar 2019 17:00:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AE628BE6F; Tue, 12 Mar 2019 00:00:16 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8A2k_BcIoX5i; Tue, 12 Mar 2019 00:00:15 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id EE53FBE64; Tue, 12 Mar 2019 00:00:14 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552348815; bh=iJgkRKptNHacyfU1AsAa9p+q+yiRcIQQ3JJzqnwtrKs=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=ZZFqwIxb3I3jxCYhMrIxS5aW8LH6gRYubG1aN6rOQzECkw9UG5ErCSoPcwSjZV5Mt lt2hmMTbC+/WLdtxkWDEc7gR6JfO599f0G4+QClhaq5/6SCEHaI1TtypJ1KJgLCEzo B4C3BgWSNPwV9OGhnfEyEPlb/XVpKY+zCA95FTGM= To: Paul Vixie , "doh@ietf.org" Cc: nalini elkins , "Konda, Tirumaleswar Reddy" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 12 Mar 2019 00:00:13 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="rXW8fFgh4OP6TDlwu0GRy0bpQAdlPdclk" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 00:00:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --rXW8fFgh4OP6TDlwu0GRy0bpQAdlPdclk Content-Type: multipart/mixed; boundary="sM9c2ZdF0p7sUDI9Xb2uqbSJ0mcv2vLfb"; protected-headers="v1" From: Stephen Farrell To: Paul Vixie , "doh@ietf.org" Cc: nalini elkins , "Konda, Tirumaleswar Reddy" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola Message-ID: Subject: Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: --sM9c2ZdF0p7sUDI9Xb2uqbSJ0mcv2vLfb Content-Type: multipart/mixed; boundary="------------74DACE90A60478219CE5A59C" Content-Language: en-GB This is a multi-part message in MIME format. --------------74DACE90A60478219CE5A59C Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable (This distribution list is too scattered and diverse. Be great if some AD or someone just picked one list for this. In the meantime...) On 11/03/2019 20:43, nalini elkins wrote: > impact assessment that certain changes such as > DoH and TLS1.3 will have on enterprises, TLS1.3 will, I expect, noticeably improve security for an awful lot of enterprises in time. As for DoH, I wonder has anyone done studies on how split-horizon names and access patterns leak today? I don't recall having read that kind of study. I can imagine many ways in which that kind of stuff would leak. I'd be very surprised if it never happens. I don't know how often it does. For names, leaking once is kinda fatal. For access patterns, I guess one leak exposes an IP address that's interested in a name (e.g. secret-project.example.com) but more would be needed for broader access patterns to be exposed to "foreign" recursives and/or in-band networks. ISTM that it is quite possible that enterprises that deploy their own DoH services could potentially reduce such leakage and gain overall. (I'm assuming here that sensible browser-makers will end up providing something that works for browsers running in networks with split-horizon setups before those browsers turn on DoH as a default at scale.) Cheers, S. --------------74DACE90A60478219CE5A59C Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------74DACE90A60478219CE5A59C-- --sM9c2ZdF0p7sUDI9Xb2uqbSJ0mcv2vLfb-- --rXW8fFgh4OP6TDlwu0GRy0bpQAdlPdclk Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyG9o4ACgkQWrL68XsX K+qj+Q/+POeigncexL1+NYsMxJ2G5AK3FTFRvgaG0rxt4eoDxvunoJnGpjsuweTu IcpU4SHbzd+/LpYB8Am74V6bTPZ7hK/XUGr/xUYiirOhLpzhIh0PqseMEiiODnAX T4jyEp8LpnfMcCiH3h7N33PrpEXWert/WQBGV2XdwM84NQrJ/VWcXDXMGLMxznHc 7aLpw6sLgxKzeyBShVcpnNZWqTdyetBsD4wd/AeXtx3aGL1KGdHaRM5qXcXwO0fe JlsQcalahcaskOZGjDLBrP8regv8CC07/1+TRYJOBFXDUal0d0w+KPyh2gugS5t1 Mv0k5UbRHcCL3ojo7e6yr1MVdBooqffrUDdCoK+yJSFU2EP1InHaeLpd0c1oSM/k MhVPuNXJ5MaCHR2Tzj+RI7MjVNUtktmWmu6cFZZJVL85+JXw+1ZRP9z5YGuUWkeD iPCvg7hdaSZnBTAAQ0Uhpy4qYHchSuBeOZVf2ZG7AQSCGRpobOW12YffvMIqyVgA Nu5G+ANuD1UxGy/xJPVR1FRotGPznL0J3vhIdpfgONETFClMmNFcodtas/GDZtHN b0gDYZeosycMvE/6Y3UwuL+BrAUS+DX732oV3U8J0v3UusXlCTQDTM4w7QNg/8no ffWZ06YQOvOkF4xE6bq+8F2sshCzb9V4ojCZBO5r74QF2c7YmXs= =zZWK -----END PGP SIGNATURE----- --rXW8fFgh4OP6TDlwu0GRy0bpQAdlPdclk-- From nobody Mon Mar 11 18:54:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1A2E712D826 for ; Mon, 11 Mar 2019 18:54:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H1iP-fPaYGIm for ; Mon, 11 Mar 2019 18:54:41 -0700 (PDT) Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 498C912D550 for ; Mon, 11 Mar 2019 18:54:41 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id a17so850937ljd.4 for ; Mon, 11 Mar 2019 18:54:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Yu9wpMac0qPy1t2fHsCOu1V6EC+oYiTi6mZWH3usOlo=; b=1sHRCyu7zlw4/V2tR7FsBzFoUhObKXi0mIYmJCr4r35tOfcCwOvKQqf1ypn4nbI8IB WWZY2zZ7EINgyLj5Z9SLMmRJL1VhNSL/Bb75VnFJ01XHQao3kTQ1jO31q+7AMQoNsJhi bF9fZImOCi8KlOmGMRyCyr3bshWo4ndqHAchUaDYNTEmFNEAY/h2HWwxisHR1DRxC/tw WpQ//hTjBvgBVxHHXiioL55HBMUxu3k49dqm3Ohpc1eadaNmlcbKhEspmUwcPGXFknzu 8XOy7G3oWDozdHGLDmA0OFtvkYR/Kr/dcE+46tjs/mTFHrfsq3AF6TsuEkCFkPl5liS0 HPpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Yu9wpMac0qPy1t2fHsCOu1V6EC+oYiTi6mZWH3usOlo=; b=P4OqBLgTjInN5/ofL1cm9iA3SiPSPZaTAkA5uOUzJmM7lT/QOl854jnXtJgPMHoggR y2hVasbK1ZCWdXUmgeuizEqRkF9sq7wkqCGTkYW7jy6oT7FtBRkyDvd0+dVn9RICnfCg 4VmvW1SQgiuxsq2ReBNXRWW/s8UUQLNFBDVsqG/mOJ0/qwYdokYW3sVSZdHfZL6AzDsS jUyC9IkDGLYf4m63EtlhRhJqEzoM2kOFDef286COCGzUaHRzSnV77Lk/KGSetK1B6JGr 1GgOgpCdEaDzA833PyYwDdyIrmXDIvNbi2qLeAiJFGSIzehnhc3vzvtk3aPJmBnhuAA7 eZ4Q== X-Gm-Message-State: APjAAAV++1JQ4eQFWhGSe1utIvyPvj4sOOwUGYWMFTtEKmJXBQ65xFZG 69cdrQvD0jSGHc27hvWy3BEtSAlbsDa0UvGkf2Y1sQ== X-Google-Smtp-Source: APXvYqzLQS/P1I/0IA1NDx7r4WqCZafy5vmwdJnCsNTpOH6vwtRVF6snT5AeaIyMKL7onjngu9r4BYGN7hiFpJMbuA4= X-Received: by 2002:a2e:87cf:: with SMTP id v15mr818835ljj.22.1552355679295; Mon, 11 Mar 2019 18:54:39 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: From: nalini elkins Date: Tue, 12 Mar 2019 07:24:29 +0530 Message-ID: To: Stephen Farrell Cc: Paul Vixie , "doh@ietf.org" , "Konda, Tirumaleswar Reddy" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola Content-Type: multipart/alternative; boundary="000000000000d470610583dbf824" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 01:54:44 -0000 --000000000000d470610583dbf824 Content-Type: text/plain; charset="UTF-8" Stephen, > TLS1.3 will, I expect, noticeably improve security for an awful lot of enterprises in time. I am sure you are right. There is also likely to be quite a bit of pain ahead for many. Also, this is exactly why I propose a neutral observer who might tease out the nuances. Or say something along the lines of "if you do x, you will need to do y". It may also be needed to have subtopics. And, the pro and con sides could also provide a writeup. The write up could also propose transition strategies. I am trying to make it so that people, including enterprises, can better decide the merits of the situation for themselves. Many people do not have the time, expertise or energy to follow these discussions which have gone on for a number of years. I have also seen assessments of protocol changes from people who have "a dog in the hunt" so to speak. That is, vendors who provide an assessment which (shockingly enough) results in their own products (which again shockingly, cost money) being the best solution. There is much hyperbole on all sides of not just the TLS1.3 issue but DoH also. I compliment the authors of the current drafts on DoH deployment drafts for good efforts to bring light to this subject. Having said that, I would like to see IETF work with a neutral third party, maybe an academic institution, or CERT, or someone else help people, including enterprise operators, who have to make decisions to implement these protocols and possibly change their architecture strategies. Even if we manage to come to consensus on an IETF draft and create an RFC on DoH deployment, many enterprises do not keep up with all RFCs nor do they always have the time to evaluate everything properly because they are so busy with the fires of the current day. I worked for large enterprises for many years doing network design and troubleshooting. I was always extremely busy fighting the issues of the day. Enterprises, and many others, do pay attention to what NIST or CERT says. Just my 2 cents to try to find a long term solution to what has been a contentious and exhausting multi-year set of discussions for all involved and which seems set to rekindle with DoH. Nalini On Tue, Mar 12, 2019 at 5:30 AM Stephen Farrell wrote: > > (This distribution list is too scattered and diverse. Be > great if some AD or someone just picked one list for this. > In the meantime...) > > On 11/03/2019 20:43, nalini elkins wrote: > > impact assessment that certain changes such as > > DoH and TLS1.3 will have on enterprises, > > TLS1.3 will, I expect, noticeably improve security for an awful > lot of enterprises in time. > > As for DoH, I wonder has anyone done studies on how split-horizon > names and access patterns leak today? > > I don't recall having read that kind of study. I can imagine > many ways in which that kind of stuff would leak. I'd be very > surprised if it never happens. I don't know how often it does. > > For names, leaking once is kinda fatal. For access patterns, > I guess one leak exposes an IP address that's interested in a > name (e.g. secret-project.example.com) but more would be > needed for broader access patterns to be exposed to "foreign" > recursives and/or in-band networks. > > ISTM that it is quite possible that enterprises that deploy their > own DoH services could potentially reduce such leakage and gain > overall. (I'm assuming here that sensible browser-makers will > end up providing something that works for browsers running in > networks with split-horizon setups before those browsers turn > on DoH as a default at scale.) > > Cheers, > S. > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --000000000000d470610583dbf824 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Stephen,

> TLS1.3 will, I expe= ct, noticeably improve security for an awful=C2=A0lot of enterprises in tim= e.=C2=A0=C2=A0

I am sure you are right.=C2=A0 =C2=A0= There is also likely to be quite a bit of pain ahead for many.=C2=A0 Also,= =C2=A0
this is exactly why I propose a neutral observer who might= tease out the nuances.=C2=A0 =C2=A0Or
say something along the li= nes of "if you do x, you will need to do y".=C2=A0 It may also be=
needed to have subtopics.=C2=A0 =C2=A0And, the pro and con sides= could also provide a writeup.=C2=A0=C2=A0
The write up could als= o propose transition strategies.

I am trying to ma= ke it so that people, including enterprises, can better decide the merits o= f the
situation for themselves.

Many peo= ple do not have the time, expertise or energy to follow these discussions w= hich
have gone on for a number of years.=C2=A0 I have also seen a= ssessments of protocol changes from people
who have "a dog i= n the hunt" so to speak.=C2=A0 That is, vendors who provide an assessm= ent which=C2=A0
(shockingly enough) results in their own products= (which again shockingly, cost money) being the best=C2=A0
soluti= on.=C2=A0 There is much hyperbole on all sides of not just the TLS1.3 issue= but DoH also.=C2=A0=C2=A0

I compliment the author= s of the current drafts on DoH deployment drafts for good efforts to bring<= /div>
light to this subject.

Having said that,= I would like to see IETF work with a neutral third party, maybe an academi= c institution,
or CERT, or someone else help people, including en= terprise operators, who have to make decisions to
implement these= protocols and possibly change their architecture strategies.=C2=A0 Even if= we manage to
come to consensus on an IETF draft and create an RF= C on DoH deployment, many enterprises do not
keep up with all RFC= s nor do they always have the time to evaluate everything properly because = they=C2=A0
are so busy with the fires of the current day.=C2=A0 = =C2=A0I worked for large enterprises for many years doing network
design and troubleshooting.=C2=A0 I was always extremely busy fighting the= issues of the day.

Enterprises, and many others, = do pay attention to what NIST or CERT says.=C2=A0 =C2=A0Just my 2 cents to = try
to find a long term solution to what has been a contentious a= nd exhausting multi-year set of discussions
for all involved and = which seems set to rekindle with DoH.

Nalini
=

= On Tue, Mar 12, 2019 at 5:30 AM Stephen Farrell <stephen.farrell@cs.tcd.ie> w= rote:

(This distribution list is too scattered and diverse. Be
great if some AD or someone just picked one list for this.
In the meantime...)

On 11/03/2019 20:43, nalini elkins wrote:
>=C2=A0 impact assessment that certain changes such as
> DoH and TLS1.3 will have on enterprises,

TLS1.3 will, I expect, noticeably improve security for an awful
lot of enterprises in time.

As for DoH, I wonder has anyone done studies on how split-horizon
names and access patterns leak today?

I don't recall having read that kind of study. I can imagine
many ways in which that kind of stuff would leak. I'd be very
surprised if it never happens. I don't know how often it does.

For names, leaking once is kinda fatal. For access patterns,
I guess one leak exposes an IP address that's interested in a
name (e.g. secret-project.example.com) but more would be
needed for broader access patterns to be exposed to "foreign"
recursives and/or in-band networks.

ISTM that it is quite possible that enterprises that deploy their
own DoH services could potentially reduce such leakage and gain
overall. (I'm assuming here that sensible browser-makers will
end up providing something that works for browsers running in
networks with split-horizon setups before those browsers turn
on DoH as a default at scale.)

Cheers,
S.


--
Thanks,
Nalini Elkins
Pr= esident
Enterprise Data Center Operato= rs

--000000000000d470610583dbf824-- From nobody Mon Mar 11 19:34:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37C5B129A86; Mon, 11 Mar 2019 19:34:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zW66LLNt_nvB; Mon, 11 Mar 2019 19:34:16 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2142C1286CD; Mon, 11 Mar 2019 19:34:16 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 54F7ABE8A; Tue, 12 Mar 2019 02:34:13 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sDbm3DfD0Di5; Tue, 12 Mar 2019 02:34:11 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 22344BE50; Tue, 12 Mar 2019 02:34:11 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552358051; bh=XOzjFjiq25ZTlSAkRCJ2QoZZI3foJ9DbYn9X2HvtMQ4=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=4UVt8AQo+iH42arOjzTupJ41BSXWeiemBVqB/1zcni4ZCedcDR/ys1JvaHzV6cHwE b7T0fJ1OcuFkMOAosMewQxGG5svz7UcOeReqXeFkdkAzFyWC/+Agl7rSHDtE5odAA5 ihDszCBsVHNTdfcx7gxEwyPn64KM3oF+Ir2NqeFM= To: nalini elkins Cc: "Konda, Tirumaleswar Reddy" , "doh@ietf.org" , "dnsop@ietf.org" , Paul Vixie , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 12 Mar 2019 02:34:09 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="PwaTV0h67mgFITQ1of00qsE7hqGaYjDvM" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 02:34:21 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --PwaTV0h67mgFITQ1of00qsE7hqGaYjDvM Content-Type: multipart/mixed; boundary="hm5fbaRGpaLhcMLhgm3HrpUrAupojrMR9"; protected-headers="v1" From: Stephen Farrell To: nalini elkins Cc: "Konda, Tirumaleswar Reddy" , "doh@ietf.org" , "dnsop@ietf.org" , Paul Vixie , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" Message-ID: Subject: Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: --hm5fbaRGpaLhcMLhgm3HrpUrAupojrMR9 Content-Type: multipart/mixed; boundary="------------3D25BAD0CDF65E6B2CFE45E1" Content-Language: en-GB This is a multi-part message in MIME format. --------------3D25BAD0CDF65E6B2CFE45E1 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 12/03/2019 01:54, nalini elkins wrote: > Stephen, >=20 >> TLS1.3 will, I expect, noticeably improve security for an awful lot of= >> enterprises in time. >=20 > I am sure you are right.=20 Great. > There is also likely to be quite a bit of pain > ahead for many.=20 I don't agree at all about that, despite claims to the contrary from you and some others. But that topic was debated at length already. (Seriously, do you expect some other outcome if you re-start that debate?) > Also, > this is exactly why I propose a neutral observer who might tease out th= e > nuances. =20 I think that's an outstandingly bad idea. The IETF has no voting and hence no electorate nor constituency and hence no identifiable non-voting population from whom ostensibly neutral observers could be chosen via some (currently non-existent) IETF process. In addition to be just being a bad idea, what you appear to be suggesting seems to me like it'd require fundamental change to the core of the IETF and to also be entirely off topic for the subject line of this mail. S. > Or > say something along the lines of "if you do x, you will need to do y". = It > may also be > needed to have subtopics. And, the pro and con sides could also provi= de a > writeup. > The write up could also propose transition strategies. >=20 > I am trying to make it so that people, including enterprises, can bette= r > decide the merits of the > situation for themselves. >=20 > Many people do not have the time, expertise or energy to follow these > discussions which > have gone on for a number of years. I have also seen assessments of > protocol changes from people > who have "a dog in the hunt" so to speak. That is, vendors who provide= an > assessment which > (shockingly enough) results in their own products (which again shocking= ly, > cost money) being the best > solution. There is much hyperbole on all sides of not just the TLS1.3 > issue but DoH also. >=20 > I compliment the authors of the current drafts on DoH deployment drafts= for > good efforts to bring > light to this subject. >=20 > Having said that, I would like to see IETF work with a neutral third pa= rty, > maybe an academic institution, > or CERT, or someone else help people, including enterprise operators, w= ho > have to make decisions to > implement these protocols and possibly change their architecture > strategies. Even if we manage to > come to consensus on an IETF draft and create an RFC on DoH deployment,= > many enterprises do not > keep up with all RFCs nor do they always have the time to evaluate > everything properly because they > are so busy with the fires of the current day. I worked for large > enterprises for many years doing network > design and troubleshooting. I was always extremely busy fighting the > issues of the day. >=20 > Enterprises, and many others, do pay attention to what NIST or CERT say= s. > Just my 2 cents to try > to find a long term solution to what has been a contentious and exhaust= ing > multi-year set of discussions > for all involved and which seems set to rekindle with DoH. >=20 > Nalini >=20 > On Tue, Mar 12, 2019 at 5:30 AM Stephen Farrell > wrote: >=20 >> >> (This distribution list is too scattered and diverse. Be >> great if some AD or someone just picked one list for this. >> In the meantime...) >> >> On 11/03/2019 20:43, nalini elkins wrote: >>> impact assessment that certain changes such as >>> DoH and TLS1.3 will have on enterprises, >> >> TLS1.3 will, I expect, noticeably improve security for an awful >> lot of enterprises in time. >> >> As for DoH, I wonder has anyone done studies on how split-horizon >> names and access patterns leak today? >> >> I don't recall having read that kind of study. I can imagine >> many ways in which that kind of stuff would leak. I'd be very >> surprised if it never happens. I don't know how often it does. >> >> For names, leaking once is kinda fatal. For access patterns, >> I guess one leak exposes an IP address that's interested in a >> name (e.g. secret-project.example.com) but more would be >> needed for broader access patterns to be exposed to "foreign" >> recursives and/or in-band networks. >> >> ISTM that it is quite possible that enterprises that deploy their >> own DoH services could potentially reduce such leakage and gain >> overall. (I'm assuming here that sensible browser-makers will >> end up providing something that works for browsers running in >> networks with split-horizon setups before those browsers turn >> on DoH as a default at scale.) >> >> Cheers, >> S. >> >=20 >=20 >=20 > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy >=20 --------------3D25BAD0CDF65E6B2CFE45E1 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------3D25BAD0CDF65E6B2CFE45E1-- --hm5fbaRGpaLhcMLhgm3HrpUrAupojrMR9-- --PwaTV0h67mgFITQ1of00qsE7hqGaYjDvM Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyHGqEACgkQWrL68XsX K+rHbhAAyC4vUPlkc80FOVLsFn1DubJtS9kf76/nYQgMn1wEzT+QdDLw+uiFmust W78pqKIx84VN9Qzqk1Q20OySA65hzOILy/J0oCm9Y1EjZbDvnFErmgvVqiyK5Hzy u6iojPOtXzbKnA3KGXhr78ubEQIGN6E/q85vBcOwC1VXYTfBoFdzClTgfOteVaL1 08U5zJASTf5myUBXn11u7Yfh3Lbvw07HSWvhoWgqaeArZhF4zQQ8WYZs3i6oTAFn Kxfk0uRNTN/ApNpnNEtv7+p+unkLrAf0pX+84elE+cv6ese8ZSdI2+FdsaEJ4lHI 8GMJGh/VT8lgVT6M4sgUi+lbsQoCR/HgL8wveYhtVNtxIGQyYsmExUHHsmYPGWDN NJmI3Zy/z66fsOG+Fn5Hg0k/oLQANr/MjCIPQ7IoLCgaTYbWIxUnC1+7EvNIb0HW mRlPgNuv0hBak1anx/FmfxOiqhGiNCxX83Nk1XBiV5+dC5vc9eSo9JPjMFVn8/RA zaC5BBNWk7e0zcPdaREplYRld7EF46cAVWcoalw4yfAyVaUIAmjgVVveBJO1n17W jqBAwYDwHG26wxhe3YglamgMEJEPyluV4w3OK2Kka8s/fFaVZKVcsqhMev5oMzAE Fn6unn5QnwfLaZPDj4VXVSkawp1ZsWXTr5X/Bpp03JSUTDtt+s8= =EdP7 -----END PGP SIGNATURE----- --PwaTV0h67mgFITQ1of00qsE7hqGaYjDvM-- From nobody Mon Mar 11 19:45:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 37B4E127817; Mon, 11 Mar 2019 11:18:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3JDjCD1zumkE; Mon, 11 Mar 2019 11:18:46 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 515F7124BF6; Mon, 11 Mar 2019 11:18:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1823; q=dns/txt; s=iport; t=1552328325; x=1553537925; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=9mPEcRMiekLBZECWcZaKEmPMlpeC/M66XkfYVe+320o=; b=Br5lY4mUur1RCrpJxTZ8ZifyCV/B9hmuPPf3aojWvokEe9y+aWiUS51T zz15zMjeKQMbqjKnGy8edsyPmlLvqTQzVqvBMFUOLQ5a4tbzxMzOEbmdf vKstG8hux6txXpX8CLIV1af6DU/Z3ZG72uC5b7xYMf3tgNVpOnwuFWaYN s=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A+AAAFpYZc/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYNpEieECYh5jDwlmiEIAwEBhGwChFw4EgEBAwEBBwE?= =?us-ascii?q?DAm0ohUoBAQEBAgEjVgULCxgqAgJXBhODIgGBbQiwSIEvhUWEYQ+BL4FJiUc?= =?us-ascii?q?0gX+BOAwTgkyICzGCJgOMIIUckmUJhFmOMxmTOppRgm4CBAYFAhWBXiE1gSE?= =?us-ascii?q?zGggbFWUBgkE+kA4+AzCQQAEB?= X-IronPort-AV: E=Sophos;i="5.58,468,1544486400"; d="asc'?scan'208";a="10678156" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 11 Mar 2019 18:18:43 +0000 Received: from ams3-vpn-dhcp7163.cisco.com (ams3-vpn-dhcp7163.cisco.com [10.61.91.250]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2BIIdwW030066 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 11 Mar 2019 18:18:40 GMT From: Eliot Lear Message-Id: <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_295A2059-7727-4DA6-A31E-32969A940D0C"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Mon, 11 Mar 2019 19:18:38 +0100 In-Reply-To: <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> Cc: nalini elkins , "Konda, Tirumaleswar Reddy" , "doh@ietf.org" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell To: Paul Vixie References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.91.250, ams3-vpn-dhcp7163.cisco.com X-Outbound-Node: aer-core-1.cisco.com Archived-At: X-Mailman-Approved-At: Mon, 11 Mar 2019 19:45:46 -0700 Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 18:18:47 -0000 --Apple-Mail=_295A2059-7727-4DA6-A31E-32969A940D0C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Paul, > On 11 Mar 2019, at 19:12, Paul Vixie wrote: >=20 >=20 >=20 > nalini elkins wrote on 2019-03-11 10:26: >> Tiru, >> Thanks for your comments. >> > Enterprise networks are already able to block DoH services, > i wonder if everyone here knows that TLS 1.3 and encrypted headers is = going to push a SOCKS agenda onto enterprises that had not previously = needed one, and that simply blocking every external endpoint known or = tested to support DoH will be the cheaper alternative, even if that = makes millions of other endpoints at google, cloudflare, cisco, and ibm = unreachable as a side effect? That or it will require a bit more management at the MDM level. I=E2=80=99= m hoping the latter. And I hope that one output of all of these = documents will be a recommendation regarding MDM interfaces. Eliot --Apple-Mail=_295A2059-7727-4DA6-A31E-32969A940D0C Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyGpn4ACgkQh7ZrRtnS ejOXDwf+JLxwoL+WdL5njykl2Id+3sG+17whlGNw1IepBJzKpPpCJLxNvfmMqfEW QjfPhPT+egQg2VxlAmFpJMgLH2P1QjsfWRRbtbZsw6M+rYjXLr9tafWdSEiaUIS2 CGIPI7fQXlc1zCsi5ESUSRVLgAC+4ZuzU+dLJBPKbBqgi7KCnzvsghWkJtGTXnJe EmH0ej8qXTvq5nk7DPfwh8uKEEgy6s/CKH+72fSiWmYKF5eiY3yWq56skSvktQYY Vv/Lh8rJRQD2jifxC3zUEqtYmsxojYfSUKgXg8t1ORE7Md08PSCyTPCU1wTh3g7X exHndU0wrSTcnHwcBxSsK4+KhmXERg== =4m6f -----END PGP SIGNATURE----- --Apple-Mail=_295A2059-7727-4DA6-A31E-32969A940D0C-- From nobody Mon Mar 11 19:45:54 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6F8C131161; Mon, 11 Mar 2019 14:20:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bOAcI-46-V16; Mon, 11 Mar 2019 14:20:35 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A9376131036; Mon, 11 Mar 2019 14:20:34 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x2BLKJob023088 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 11 Mar 2019 22:20:19 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x2BLKGUZ023066; Mon, 11 Mar 2019 22:20:17 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Mon, 11 Mar 2019 22:20:16 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Paul Vixie cc: nalini elkins , "Konda, Tirumaleswar Reddy" , "doh@ietf.org" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell In-Reply-To: <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset=US-ASCII Archived-At: X-Mailman-Approved-At: Mon, 11 Mar 2019 19:45:46 -0700 Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 21:20:37 -0000 On Mon, 11 Mar 2019, Paul Vixie wrote: > CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24 If that's what you believe and block, then you're not blocking Cloudflare DoH very effectively... =) -- / daniel.haxx.se From nobody Mon Mar 11 19:46:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 76D1F1311B0 for ; Mon, 11 Mar 2019 14:44:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J8IN72Pes-s2 for ; Mon, 11 Mar 2019 14:44:47 -0700 (PDT) Received: from mail-lj1-x241.google.com (mail-lj1-x241.google.com [IPv6:2a00:1450:4864:20::241]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1454E1311A3 for ; Mon, 11 Mar 2019 14:44:45 -0700 (PDT) Received: by mail-lj1-x241.google.com with SMTP id v10so474251lji.3 for ; Mon, 11 Mar 2019 14:44:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Sam505zgsCd4xS0GDxc95SdRRrIiEzBvkZxClj8SJM8=; b=PX4xJSz19ZfjXdUd1A3RlzN6snHwtwMusqu49PW+0QVlM87e7vQ2qCAx6aIq9NR+Aj nI6fjjSSU9efseOW+8Dt2fL2d8Rn7zs9jYtJtZL181PYXVmbVJn6PdY21M9hrIdNfs8w zItowLEBban6O67HTLM8ufsJgFbBEatsGEXHHZiPCoyumzUxXgeuplilcWlDPg1eGfmB hrKrdQktRvYnzmCQmM8O/8bYZkgtwEWqPCWDkNovc0si0olFgkw3OkuPWxmHjZW3k/1j 0hAlLkQTDqXql7ywX5812CFjMATMUuSp+zgUhnYUVTp6cAr5OkKl0zZsr64pJMsSvgUX PZ6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Sam505zgsCd4xS0GDxc95SdRRrIiEzBvkZxClj8SJM8=; b=GLROGWPUP4KNSl8XGBSq+L0s5r/crkHi1bFhLP5E9CT0DATeOR5oXKWHRquxRWeJyL o0oSAHKfXqZUxS3x6gWBnvjAqdJjZN4cQUwNsG5237lQEJKkLvRHdqSgh3Xm8WZs7K9e jqtwD2lZNta9WJkP0sDz+kxjG1Tmu8euv2lGOxStz+zE7bLU20+XRdGdIPKRnehviU3M sRb2CLfA0CQnuOK3iDgwG2Qntp6MaeHeYivipEe9Dwp9P5kfxG8zZ+NwA4EH7iWKGduP 8ojdHK2MFCYtfM3QuCbuDG4Y3ijcULHi/f7Lqzv4BqvHmba+Dln5XmGhoVlBBPSKTT4A ANkA== X-Gm-Message-State: APjAAAVEOACEQeVIfZPybQ8G9MCCm8ni5Nx7Itl0ITAgLzdeRKhTpwIF /F031QVwlfQXjQevlz7kemei+HWY8yH3/sNfwtzERw== X-Google-Smtp-Source: APXvYqxd4PhGkBRB2L2/BsARmjVc3HmD76PqpPA6wzAuaeYWmTOs7hOBMeuU4yxhVwE0+Z6n8ZEUg3DIB/8t6ZhOaNo= X-Received: by 2002:a2e:3c19:: with SMTP id j25mr18007587lja.72.1552340683124; Mon, 11 Mar 2019 14:44:43 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> From: Eric Rescorla Date: Mon, 11 Mar 2019 14:44:06 -0700 Message-ID: To: Paul Vixie Cc: nalini elkins , "Konda, Tirumaleswar Reddy" , "doh@ietf.org" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000fd036c0583d87ac0" Archived-At: X-Mailman-Approved-At: Mon, 11 Mar 2019 19:45:46 -0700 Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 21:44:49 -0000 --000000000000fd036c0583d87ac0 Content-Type: text/plain; charset="UTF-8" On Mon, Mar 11, 2019 at 11:13 AM Paul Vixie wrote: > > > nalini elkins wrote on 2019-03-11 10:26: > > Tiru, > > > > Thanks for your comments. > > > > > Enterprise networks are already able to block DoH services, > i wonder if everyone here knows that TLS 1.3 and encrypted headers is > going to push a SOCKS agenda onto enterprises that had not previously > needed one, I'm pretty familiar with TLS 1.3, but I don't know what this means. TLS 1.3 doesn't generally encrypt headers any more than TLS 1.2 did, except for the content type byte, which isn't that useful for inspection anyway. Are you perchance referring to encrypted SNI? Something else? -Ekr and that simply blocking every external endpoint known or > tested to support DoH will be the cheaper alternative, even if that > makes millions of other endpoints at google, cloudflare, cisco, and ibm > unreachable as a side effect? > > CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24, which i > blocked already (before DoH) so that's not a problem. but if google > decides to support DoH on the same IP addresses and port numbers that > are used for some API or web service i depend on, that web service is > going to be either blocked, or forced to go through SOCKS. this will add > considerable cost to my network policy. (by design.) > > -- > P Vixie > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000fd036c0583d87ac0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Mar 11, 2019 at 11:13 AM Paul= Vixie <paul@redbarn.org> wro= te:


nalini elkins wrote on 2019-03-11 10:26:
> Tiru,
>
> Thanks for your comments.
>
>=C2=A0 > Enterprise networks are already able to block DoH services,=
i wonder if everyone here knows that TLS 1.3 and encrypted headers is
going to push a SOCKS agenda onto enterprises that had not previously
needed one,

I'm pretty familiar with TL= S 1.3, but I don't know what this means. TLS 1.3
doesn't = generally encrypt headers any more than TLS 1.2 did, except for
= the content type byte, which isn't that useful for inspection anyway.
Are you perchance referring to encrypted SNI? Something else?
<= /div>

-Ekr

and that simply blocking every external endpoint = known or
tested to support DoH will be the cheaper alternative, even if that
makes millions of other endpoints at google, cloudflare, cisco, and ibm unreachable as a side effect?

CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24, which i
blocked already (before DoH) so that's not a problem. but if google decides to support DoH on the same IP addresses and port numbers that
are used for some API or web service i depend on, that web service is
going to be either blocked, or forced to go through SOCKS. this will add considerable cost to my network policy. (by design.)

--
P Vixie

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000fd036c0583d87ac0-- From nobody Mon Mar 11 19:46:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 62B1F131083; Mon, 11 Mar 2019 15:23:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C6QQQaXwkTwU; Mon, 11 Mar 2019 15:23:47 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2776C1279B1; Mon, 11 Mar 2019 15:23:47 -0700 (PDT) Received: from [172.16.28.163] (104-59-120-116.lightspeed.sntcca.sbcglobal.net [104.59.120.116]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id A27F3892C6; Mon, 11 Mar 2019 22:23:46 +0000 (UTC) In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> X-Referenced-Uid: 735271 Thread-Topic: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients User-Agent: Android X-Is-Generated-Message-Id: true MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----RINFI2OEIMYGFX25YGMV08HSKDTZU4" Content-Transfer-Encoding: 7bit From: Paul Vixie Date: Mon, 11 Mar 2019 15:23:42 -0700 To: Daniel Stenberg CC: nalini elkins , "Konda, Tirumaleswar Reddy" , "doh@ietf.org" ,"dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Message-ID: Archived-At: X-Mailman-Approved-At: Mon, 11 Mar 2019 19:45:46 -0700 Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 22:23:48 -0000 ------RINFI2OEIMYGFX25YGMV08HSKDTZU4 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 That's what they told me=2E On Mar 11, 2019, 14:20, at 14:20, Daniel Stenb= erg wrote: >On Mon, 11 Mar 2019, Paul Vixie wrote: > >> = CF has so far only supported DoH on 1=2E1=2E1=2E0/24 and 1=2E0=2E1=2E0/24 >= >If that's what you believe and block, then you're not blocking >Cloudflar= e DoH >very effectively=2E=2E=2E =3D) > >-- > > / daniel=2Ehaxx=2Ese ------RINFI2OEIMYGFX25YGMV08HSKDTZU4 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
That's what they told me=2E
On Mar 11, 2019, at 14:20, Daniel Stenberg &l= t;daniel@haxx=2Ese> wrote:
On Mon, 11 Mar 2019, Paul Vixie wrote:

CF has so far only supported DoH on = 1=2E1=2E1=2E0/24 and 1=2E0=2E1=2E0/24

If that's wh= at you believe and block, then you're not blocking Cloudflare DoH
very = effectively=2E=2E=2E =3D)
------RINFI2OEIMYGFX25YGMV08HSKDTZU4-- From nobody Mon Mar 11 22:15:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81A47131290; Mon, 11 Mar 2019 22:15:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RFbAaA8OvC8U; Mon, 11 Mar 2019 22:15:18 -0700 (PDT) Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AE93213128F; Mon, 11 Mar 2019 22:15:17 -0700 (PDT) X-NAI-Header: Modified by McAfee Email Gateway (5500) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552367518; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-microsoft-exchange-diagnostics:x-microsoft-antispam-prvs: x-forefront-prvs:x-forefront-antispam-report: received-spf:x-ms-exchange-senderadcheck:x-microsoft-antispam-message-info: Content-Type:Content-Transfer-Encoding:MIME-Version: X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=8apUTQ2Rg2TuPm6eDGJC7S1cpxXConzm3seeit 3Vpjs=; b=Vezmk/YUGZoCaO4S4tkzW0GdzwhZnmKeNzkqTic+ Mg/FaHLBLXdccYl1BKB9+Cy9QLnBFRxeQP/ORh20/bPqjQOM/e Cu/EIkPqsiwAv33WNBkGuJQPr0aduQin69QHwv4VNDturEwzEB /cYCWCXVfXKr1nB7JxRtSSXgIP/rZq4= Received: from DNVEXAPP1N05.corpzone.internalzone.com (DNVEXAPP1N05.corpzone.internalzone.com [10.44.48.89]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 21f1_7bb6_a793184e_2323_4c6e_9224_3f1dcdf25a14; Mon, 11 Mar 2019 23:11:58 -0600 Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 23:14:47 -0600 Received: from DNVO365EDGE1.corpzone.internalzone.com (10.44.176.66) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 11 Mar 2019 23:14:47 -0600 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (10.44.176.240) by edge.mcafee.com (10.44.176.66) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 23:14:45 -0600 Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2743.namprd16.prod.outlook.com (20.178.232.141) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.18; Tue, 12 Mar 2019 05:14:43 +0000 Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1686.021; Tue, 12 Mar 2019 05:14:43 +0000 From: "Konda, Tirumaleswar Reddy" To: Stephen Farrell , Paul Vixie , "doh@ietf.org" CC: nalini elkins , "dnsop@ietf.org" , "Ackermann, Michael" , "Christian Huitema" , "dns-privacy@ietf.org" , Vittorio Bertola Thread-Topic: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2C+f7jidn2WHF0WeuF/A93J/OKYGu6uAgAAqIQCAADb2gIAASnQQ Date: Tue, 12 Mar 2019 05:14:42 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com; x-originating-ip: [103.245.47.20] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5c11c847-5046-46ed-5c19-08d6a6a9a2d1 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB2743; x-ms-traffictypediagnostic: BYAPR16MB2743: x-microsoft-exchange-diagnostics: =?utf-8?B?MTtCWUFQUjE2TUIyNzQzOzIzOkVBQmlWNWZNK0g1a0tOdGFSbXlNVlJtcHU0?= =?utf-8?B?UTZlNk0wYWU2amhiSXl0QmFLQ3NPcDhacjI0SFN4TGFIeWx1OVN4UHFWK2JR?= =?utf-8?B?N3liSGVsOG1kWlZnallVcS82Uys4N3hhY2pjaGMzZXRnUHVUU3pVaUtzYlhB?= =?utf-8?B?THVUTVd4ZWpzWU1CSVVnYi9iVDQyb0JFZlZsaWxPWnk3STdhVmhJeUp3L2xL?= =?utf-8?B?ZEoydTJ6REpyTllWOWU5bHBuT0FvUks0TDZTS1g5L255ckFwVWdXRzI3dzYy?= =?utf-8?B?cTBXOU5kdDU4OEtJekVwTmVwbXRBRzdVYTNTY0RyZ2dVbzBWZU1EdFB3U2g5?= =?utf-8?B?RERRT09GTjViMjgwbGJCZWZ3ZG84aStyTmRTeHBES3N2Qjd1cGh1SlpUZU1O?= =?utf-8?B?VXZaSXBTeDRkUEpWZjQyWDdwRDRrUFloamhyTUR6VUhESWx5TFNhV20xbW1n?= =?utf-8?B?OHIxS3FVWjExQWZDeXZhazJhcTNjQVJlRHlkeFVFbk1BR2R2UTlCMkdlY0RS?= =?utf-8?B?aTg5cWpDK1RSK3VheGQySmhyc3BEYks3bDQxNEIzNkZhOUdaRVgwNStYTFR1?= =?utf-8?B?cVFhekpNNUM4VG03NFhFelNHL0JkVUJzUi9LM2NnTE1ndnFTVUQ2aWxmQlh0?= =?utf-8?B?b0NNUUFWY0hNUUZva0IvbE1WQTdYeXQ1OHJvTmVDNWhkcWlpbXFiWXY1K2p1?= =?utf-8?B?MWdaK2wxcVArOXBRWlV5dGlpWU5RWVEwTmwzUGp0aGFwRHQxRS80em1kRnFO?= =?utf-8?B?N2w5dlR0T1FaNzhSZWJVSklSejljSjFyRlBHbzdZWHl6ZElUZmJFNUR0TGVj?= =?utf-8?B?YW0zRzAwNVN2WDVMaVErMGc5czUyTmFwTHJzYjl2Ykdna2RLWEIyQzlUVkNi?= =?utf-8?B?c3pjL25hSXBZWS9hTnAwMEtrSmZmYjN6YmZaR21TaHF2cmZmelllSG9XeXlt?= =?utf-8?B?RUo3VVFBVzJVM1UrQkFmcDJnSkF4SVY4eHlWWTZtMnNrWkV1bjFacHpXQVl1?= =?utf-8?B?dVFkU1JheW9OajZWNmhyZWs0cTdwdU9YWGtvMG94YmQwRjdhbG9SNzZIekdI?= =?utf-8?B?ZWNXZkhVWWR1RXVXUW40WTlOVEMyVnRxUk9YbXY0c0pXN2dTRjVEaXJVSFhr?= =?utf-8?B?cTQ4d0F3OVM1aGoyT0puK1BXOUJ3Yml2S3ZzaGpkR3U2REFXUUlQMDV4ZUhI?= =?utf-8?B?MU5IVFVnL2tHZFRRYWxEa1lkMFArZUlqTGFDRmlXVG52TTBhUnordlhvZ2VM?= =?utf-8?B?ak9tS2ZvRENndDFJSHRld0NhL3lrVnQzSDlEYVh3YkZ4ZTR1eFdpREJXcERn?= =?utf-8?B?S0ZGeFNZZGg2RWQwYmZwcXVveGFhVjkyTldvUGtyVlhWMlhYMTVydlBEekNs?= =?utf-8?B?TDNITFJCSEZ1S3BWS0JUVzdHVlljMEl1ZzRERlYwU0dlMXVrcFFnOGRROCtF?= =?utf-8?B?VTdPR0FHVWUzRHRhWENrcTFsVSsvV0RZYnRZOHQ3SU9jaXhxVUp1Tkh0d2hy?= =?utf-8?B?RVkxT1E3cnZyR0s1Wk1tTnlIeEJVWnEza3ZnTUdydEFuY1pxSHdRdFppRnFa?= =?utf-8?B?aHpQV0lzeGhlTk9mMGNuY1NZUFo5ZTF0bGJ0WUdpZFNIVXMrTHBwOGJDd3JT?= =?utf-8?B?TkcyT2RKbHNoQ09KS0FSSUZWOUFnNVpUYVBYQm8rOFJBaUZVMElUdkgrcTV3?= =?utf-8?B?cHJENEx3eXRxNW1haUVIWVZiaTF3MmN0d012LzJwTGZSSXUySmhYMVkySHBt?= =?utf-8?B?alg2Z2FFUXFjbHBpeHpXc1RjMktXNzRRaCtvcmpjaEhRSnNnU3BxQ3ZjQnl5?= =?utf-8?B?My9RZlJ4czhTQVNNT1ZvWnZsWFJaSWNRZXM3elB4TWlNaGUzRlZTcU9WSEI4?= =?utf-8?B?Y3Buc20vcnQ4bEJia2dzNWdyazV1bXMvakNqb3pucUw0Z1FxcThvREFheTFW?= =?utf-8?B?Vy9sRVVYWndmYmUrNHA2bmw5UVk4VVFKQlRrbjFFK2l0TERkUm5TTVhaQWxJ?= =?utf-8?Q?99wkEV?= x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(366004)(39860400002)(136003)(396003)(189003)(199004)(55674003)(32952001)(13464003)(97736004)(186003)(80792005)(53936002)(316002)(93886005)(6436002)(53546011)(6246003)(296002)(26005)(6506007)(81156014)(76176011)(66574012)(5660300002)(102836004)(2501003)(66066001)(81166006)(8936002)(7696005)(72206003)(8676002)(14454004)(99286004)(478600001)(52536013)(305945005)(11346002)(74316002)(7736002)(486006)(106356001)(9686003)(54906003)(2906002)(105586002)(476003)(446003)(4326008)(86362001)(68736007)(55016002)(33656002)(71190400001)(229853002)(71200400001)(3846002)(110136005)(6116002)(256004)(25786009)(14444005)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2743; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: sNSFFo1p13BhpSX0//h0GCVDaBV3QE37qqnyqamWX56jhbU187YuxWlW7XRIXQvJT0Y0XEwbPhnXUrLAACNjBITj+JLAGpGmuQCWYkQtQo/s6/WJDeVKaqhsjN+HKP9h0S3Y3odJgn1zY3tdwXuMcP2+9xa5C4Z9uQQoNkWhvllLo2wiEngWUxT7aZ/b3ZiEAil+taC/WMhAoueAMLvQCRjnW3J9pknTfKkhVAYSVGHewuFSJUjzSpQwjaPYA6bzhXCnfwSBaay9+FVY/D2R1Wz08ZNthkqtfCCUgeoFH3dT9RSLxkKqmgoPLFKyuaFTyjqe1QsnNMEFKL1L5y2dMXAEhmLnD4QjBpwJ2WB9yjv0DHVEV+9dj/aaL5iCjBpeuEmpaQ8REr0AYx76dfYD+zYhfXhKjltcdCffP+fmjTc= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 5c11c847-5046-46ed-5c19-08d6a6a9a2d1 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 05:14:42.9686 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2743 X-OriginatorOrg: mcafee.com X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 15 X-NAI-Spam-Score: 0.1 X-NAI-Spam-Version: 2.3.0.9418 : core <6500> : inlines <7031> : streams <1815460> : uri <2811186> Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 05:15:21 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBTdGVwaGVuIEZhcnJlbGwgPHN0 ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWU+DQo+IFNlbnQ6IFR1ZXNkYXksIE1hcmNoIDEyLCAyMDE5 IDU6MzAgQU0NCj4gVG86IFBhdWwgVml4aWUgPHBhdWxAcmVkYmFybi5vcmc+OyBkb2hAaWV0Zi5v cmcNCj4gQ2M6IG5hbGluaSBlbGtpbnMgPG5hbGluaS5lbGtpbnNAZS1kY28uY29tPjsgS29uZGEs IFRpcnVtYWxlc3dhciBSZWRkeQ0KPiA8VGlydW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNv bT47IGRuc29wQGlldGYub3JnOyBBY2tlcm1hbm4sDQo+IE1pY2hhZWwgPG1hY2tlcm1hbm5AYmNi c20uY29tPjsgQ2hyaXN0aWFuIEh1aXRlbWENCj4gPGh1aXRlbWFAaHVpdGVtYS5uZXQ+OyBkbnMt cHJpdmFjeUBpZXRmLm9yZzsgVml0dG9yaW8gQmVydG9sYQ0KPiA8dml0dG9yaW8uYmVydG9sYT00 MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmc+DQo+IFN1YmplY3Q6IFJlOiBbZG5zLXBy aXZhY3ldIFtETlNPUF0gTmV3OiBkcmFmdC1iZXJ0b2xhLWJjcC1kb2gtY2xpZW50cw0KPiANCj4g DQo+IChUaGlzIGRpc3RyaWJ1dGlvbiBsaXN0IGlzIHRvbyBzY2F0dGVyZWQgYW5kIGRpdmVyc2Uu IEJlIGdyZWF0IGlmIHNvbWUgQUQgb3INCj4gc29tZW9uZSBqdXN0IHBpY2tlZCBvbmUgbGlzdCBm b3IgdGhpcy4NCj4gSW4gdGhlIG1lYW50aW1lLi4uKQ0KPiANCj4gT24gMTEvMDMvMjAxOSAyMDo0 MywgbmFsaW5pIGVsa2lucyB3cm90ZToNCj4gPiAgaW1wYWN0IGFzc2Vzc21lbnQgdGhhdCBjZXJ0 YWluIGNoYW5nZXMgc3VjaCBhcyBEb0ggYW5kIFRMUzEuMyB3aWxsDQo+ID4gaGF2ZSBvbiBlbnRl cnByaXNlcywNCj4gDQo+IFRMUzEuMyB3aWxsLCBJIGV4cGVjdCwgbm90aWNlYWJseSBpbXByb3Zl IHNlY3VyaXR5IGZvciBhbiBhd2Z1bCBsb3Qgb2YNCj4gZW50ZXJwcmlzZXMgaW4gdGltZS4NCj4g DQo+IEFzIGZvciBEb0gsIEkgd29uZGVyIGhhcyBhbnlvbmUgZG9uZSBzdHVkaWVzIG9uIGhvdyBz cGxpdC1ob3Jpem9uIG5hbWVzDQo+IGFuZCBhY2Nlc3MgcGF0dGVybnMgbGVhayB0b2RheT8NCj4g DQo+IEkgZG9uJ3QgcmVjYWxsIGhhdmluZyByZWFkIHRoYXQga2luZCBvZiBzdHVkeS4gSSBjYW4g aW1hZ2luZSBtYW55IHdheXMgaW4NCj4gd2hpY2ggdGhhdCBraW5kIG9mIHN0dWZmIHdvdWxkIGxl YWsuIEknZCBiZSB2ZXJ5IHN1cnByaXNlZCBpZiBpdCBuZXZlciBoYXBwZW5zLg0KPiBJIGRvbid0 IGtub3cgaG93IG9mdGVuIGl0IGRvZXMuDQo+IA0KPiBGb3IgbmFtZXMsIGxlYWtpbmcgb25jZSBp cyBraW5kYSBmYXRhbC4gRm9yIGFjY2VzcyBwYXR0ZXJucywgSSBndWVzcyBvbmUgbGVhaw0KPiBl eHBvc2VzIGFuIElQIGFkZHJlc3MgdGhhdCdzIGludGVyZXN0ZWQgaW4gYSBuYW1lIChlLmcuIHNl Y3JldC0NCj4gcHJvamVjdC5leGFtcGxlLmNvbSkgYnV0IG1vcmUgd291bGQgYmUgbmVlZGVkIGZv ciBicm9hZGVyIGFjY2Vzcw0KPiBwYXR0ZXJucyB0byBiZSBleHBvc2VkIHRvICJmb3JlaWduIg0K PiByZWN1cnNpdmVzIGFuZC9vciBpbi1iYW5kIG5ldHdvcmtzLg0KPiANCj4gSVNUTSB0aGF0IGl0 IGlzIHF1aXRlIHBvc3NpYmxlIHRoYXQgZW50ZXJwcmlzZXMgdGhhdCBkZXBsb3kgdGhlaXIgb3du IERvSA0KPiBzZXJ2aWNlcyBjb3VsZCBwb3RlbnRpYWxseSByZWR1Y2Ugc3VjaCBsZWFrYWdlIGFu ZCBnYWluIG92ZXJhbGwuIChJJ20NCj4gYXNzdW1pbmcgaGVyZSB0aGF0IHNlbnNpYmxlIGJyb3dz ZXItbWFrZXJzIHdpbGwgZW5kIHVwIHByb3ZpZGluZw0KPiBzb21ldGhpbmcgdGhhdCB3b3JrcyBm b3IgYnJvd3NlcnMgcnVubmluZyBpbiBuZXR3b3JrcyB3aXRoIHNwbGl0LWhvcml6b24NCj4gc2V0 dXBzIGJlZm9yZSB0aG9zZSBicm93c2VycyB0dXJuIG9uIERvSCBhcyBhIGRlZmF1bHQgYXQgc2Nh bGUuKQ0KDQpJZiBFbnRlcnByaXNlIG5ldHdvcmsgcHJvdmlkZXMgYSBEb1QvRG9IIHNlcnZlciwg YnJvd3NlciBzaG91bGQgYmUgYWJsZSB0byBkaXNjb3ZlciBhbmQgdXNlIHRoZSBFbnRlcnByaXNl IERvVC9Eb0ggc2VydmVyLg0KDQotVGlydQ0KDQo+IA0KPiBDaGVlcnMsDQo+IFMuDQo= From nobody Mon Mar 11 23:46:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0348D130EFE for ; Mon, 11 Mar 2019 23:46:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=kumari-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U_36boLFso8I for ; Mon, 11 Mar 2019 23:46:07 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E21A130EE7 for ; Mon, 11 Mar 2019 23:46:04 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id h39so1409958qte.2 for ; Mon, 11 Mar 2019 23:46:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kumari-net.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AqmHjIPTnUAl/Mmw23DMC2cMJW0QSG41wd4hQ7gkgVo=; b=moyT4JswzISnJnPhXDCByq2zptf5w1bF1D3nbKeP16B1+EQI0WAUtoCYhu2PVCYl8S JRAJ50PddWhVf37LUotinAiWjB7gpclZobm/GZ/TGtOkoAsAZznlhPKLrjZ6aimmjvg7 otbqzar9woLNSFXPKXpHqcSSRSAw2L5MeXYFAAWy+vUBH5MN6jP3SyDPbV54TpOMH5Pp VuVnhhEdhweMZ0hZUCB4LY1GyWe784lqeV37VobqdquBeg7b5Ueh31j5TtD+4m7RKo1I Oic7pE/ncoonC4RVZ6d9P5NTVKeSpC43GBQixBPyF9A775om3ZrsQ7HE2JIt9Li6Imwr TF2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AqmHjIPTnUAl/Mmw23DMC2cMJW0QSG41wd4hQ7gkgVo=; b=hBW3FSkU3JY3BhAS6mHO5Ekf/hXGe45N+0q1gNvFQ0YwR2sYpo4lYxxNesfvsWA7LI jeUKyFIg/dTkmqzd/KDBry0ziGdU3wK+XIdiRgFP+Sw1dmjyMX5D0JUF7E+x2fr/FeVY jIQBfA6qeFWgu1JOsV9psOowqP0eyca+rFgjdgPD5BBauGBjMgDovITvF22l5xy90OgH /IISi9h09/GmsQubg1L3pZL7QDlBOLodH8A13AGrDej8VZNC1R41OsbMquTvzgN1KjQp 4HrBpTrCcbQ2x6dkUyhno7cvTjfxuZ3OfxjZF5TkmDHuElZV2Umfz4ytbWavqIF6yLcx W2sg== X-Gm-Message-State: APjAAAX+MZn+INqgJVFzgXkofPWfd750rbEH2AFS2QmhsI5XxLY8GZzQ nQUVURK9kpNWa46+QLZwylF+5I17zOSzxoXNxDFyog== X-Google-Smtp-Source: APXvYqyRgLZbTXRBWmuFuSpIdAUc+Yh6R8MpnLuKf6uEa6Yn6sRZY2isQ1yd6zDbR/VKOnD9NvjIW7aA1bJmoC9DO4s= X-Received: by 2002:ac8:2945:: with SMTP id z5mr28763391qtz.100.1552373163197; Mon, 11 Mar 2019 23:46:03 -0700 (PDT) MIME-Version: 1.0 References: <20190311165813.ilrz5ocxomraavbq@nic.fr> In-Reply-To: <20190311165813.ilrz5ocxomraavbq@nic.fr> From: Warren Kumari Date: Tue, 12 Mar 2019 15:45:24 +0900 Message-ID: To: Stephane Bortzmeyer Cc: DoH WG , dprive@ietf.org, dnsop , hrpc@irtf.org Content-Type: multipart/alternative; boundary="000000000000f391f30583e00a22" Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 06:46:09 -0000 --000000000000f391f30583e00a22 Content-Type: text/plain; charset="UTF-8" On Tue, Mar 12, 2019 at 1:58 AM Stephane Bortzmeyer wrote: > [Sorry for the long list of working groups but the discussion already > started in different places.] > > There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484) > deployment and the risk of centralization of Internet services. (See > for instance drafts [this is not an endorsement] > draft-bertola-bcp-doh-clients, draft-reid-doh-operator and > draft-livingood-doh-implementation-risks-issues.) > > It was suggested Reference necessary to have a > side meeting in Prague at IETF 104. I propose monday, 1400-1600 in > Tyrolka. The proposal is at > . You > are welcome to agree/disagree/meet in a bar instead. > [ Replying here instead of bottom of thread ] Thank you for proposing / organizing this - there has been a lot of discussions, but (as demonstrated by the list of WGs in the To: line) it is somewhat unclear where the discussions should happen -- I'm planning on asking the secretariat to please make us a mailing list to better focus the discussions -- does anyone have a strong objection to this? (also, a good suggestion for a name would be helpful :-)) W > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > -- I don't think the execution is relevant when it was obviously a bad idea in the first place. This is like putting rabid weasels in your pants, and later expressing regret at having chosen those particular rabid weasels and that pair of pants. ---maf --000000000000f391f30583e00a22 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Tue, Mar 12, 2019 at 1:58 AM Stephane= Bortzmeyer <bortzmeyer@nic.fr&= gt; wrote:
[Sorr= y for the long list of working groups but the discussion already
started in different places.]

There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484)
deployment and the risk of centralization of Internet services.=C2=A0
(See
for instance drafts [this is not an endorsement]
draft-bertola-bcp-doh-clients, draft-reid-doh-operator and
draft-livingood-doh-implementation-risks-issues.)

It was suggested <wikipedia>Reference necessary</wikipedia> to = have a
side meeting in Prague at IETF 104. I propose monday, 1400-1600 in
Tyrolka. The proposal is at
<https://trac.ietf.org/trac/ietf/meet= ing/wiki/104sidemeetings>. You
are welcome to agree/disagree/meet in a bar instead.
<= br>
[ Replying here instead of bottom of thread ]

Thank you for p= roposing / organizing this - there has been a lot of discussions, but (as d= emonstrated by the list of WGs in the To: line) it is somewhat unclear wher= e the discussions should happen -- I'm planning on asking the secretari= at to please make us a mailing list to better focus the discussions -- does= anyone have a strong objection to this?=C2=A0

(also, a good suggestio= n for a name would be helpful :-))

W

=C2=A0
=

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh


--
I don't think the execution is relevant when= it was obviously a bad idea in the first place.
This is like putting ra= bid weasels in your pants, and later expressing regret at having chosen tho= se particular rabid weasels and that pair of pants.
=C2=A0 =C2=A0---maf<= /div>
--000000000000f391f30583e00a22-- From nobody Tue Mar 12 00:19:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AD3B4130E64; Tue, 12 Mar 2019 00:19:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RXMy9M1zIX2A; Tue, 12 Mar 2019 00:19:44 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5459F130EB1; Tue, 12 Mar 2019 00:19:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=9316; q=dns/txt; s=iport; t=1552375183; x=1553584783; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=OAX5Avaf+yd9RZdaqF53t6qQ3ruZZbH1B5u2l7M74Pc=; b=SB0rWEt6gBW+ii2lDXFsEIcIZExAqEKPaf8YLb2fU+lTLjesl/y03GU+ spio2M/YXqbLk67gWOmzq7W2CYHZq/bMxwYhLryBzqMI0xGfj09TNpfZi UjpYTu9Whjvr4/3mii+DPwwa9tzzW36lS8ZzQlb6fRbbkl5ejx7k2gXWX A=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AEAAAjXYdc/xbLJq1kGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBUQUBAQEBCwGCd1AhEieECogaX4xAJZI1hXWBewgDAQEYAQq?= =?us-ascii?q?ESQKEYzQJDQEBAwEBCQEDAm0cDIVKAQEBAwEBASFLCwULCxgnAwICJx8RBhO?= =?us-ascii?q?DIgGBbQgPsAqBL4QwAYEUhHAKBYEvAYFIiXuBf4E4DBOCHi6BQYFdAQGEazG?= =?us-ascii?q?CJgOQdEySaQmEWoJ5iz4ZgXmFZotckGKJd4JuAgQGBQIVgUc4gVYzGggbFTs?= =?us-ascii?q?qAYJBPoFYDAsTiEyFQD4DMJBDAQE?= X-IronPort-AV: E=Sophos;i="5.58,470,1544486400"; d="asc'?scan'208,217";a="10628282" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 12 Mar 2019 07:19:40 +0000 Received: from ams3-vpn-dhcp7163.cisco.com (ams3-vpn-dhcp7163.cisco.com [10.61.91.250]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x2C7Jcqq023512 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 12 Mar 2019 07:19:39 GMT From: Eliot Lear Message-Id: <001FFADB-4095-471A-9A4C-61AC8B3799AB@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_F174B714-4C01-45BD-A3E5-8063E847EB76"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 12 Mar 2019 08:19:37 +0100 In-Reply-To: Cc: Stephane Bortzmeyer , dnsop , DoH WG , hrpc@irtf.org, dprive@ietf.org To: Warren Kumari References: <20190311165813.ilrz5ocxomraavbq@nic.fr> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.91.250, ams3-vpn-dhcp7163.cisco.com X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Doh] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 07:19:48 -0000 --Apple-Mail=_F174B714-4C01-45BD-A3E5-8063E847EB76 Content-Type: multipart/alternative; boundary="Apple-Mail=_C6E902E4-B9CD-490B-8DEF-4A467F264B5F" --Apple-Mail=_C6E902E4-B9CD-490B-8DEF-4A467F264B5F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Warren, I would suggest that you wait on creating a new list. I think Stephane was proposing an *in person* meeting, using the = 104sidemeetings Wiki, and I=E2=80=99d like to see that happen first. = That also gives time for the dust from the release of these new drafts = to settle a bit, so that the contours of what can be reasonably = accomplished becomes more clear. Eliot > On 12 Mar 2019, at 07:45, Warren Kumari wrote: >=20 >=20 > On Tue, Mar 12, 2019 at 1:58 AM Stephane Bortzmeyer > wrote: > [Sorry for the long list of working groups but the discussion already > started in different places.] >=20 > There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484) > deployment and the risk of centralization of Internet services. > (See > for instance drafts [this is not an endorsement] > draft-bertola-bcp-doh-clients, draft-reid-doh-operator and > draft-livingood-doh-implementation-risks-issues.) >=20 > It was suggested Reference necessary to have a > side meeting in Prague at IETF 104. I propose monday, 1400-1600 in > Tyrolka. The proposal is at > >. You > are welcome to agree/disagree/meet in a bar instead. >=20 > [ Replying here instead of bottom of thread ] >=20 > Thank you for proposing / organizing this - there has been a lot of = discussions, but (as demonstrated by the list of WGs in the To: line) it = is somewhat unclear where the discussions should happen -- I'm planning = on asking the secretariat to please make us a mailing list to better = focus the discussions -- does anyone have a strong objection to this? >=20 > (also, a good suggestion for a name would be helpful :-)) >=20 > W >=20 >=20 >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh = >=20 >=20 > -- > I don't think the execution is relevant when it was obviously a bad = idea in the first place. > This is like putting rabid weasels in your pants, and later expressing = regret at having chosen those particular rabid weasels and that pair of = pants. > ---maf > _______________________________________________ > hrpc mailing list > hrpc@irtf.org > https://www.irtf.org/mailman/listinfo/hrpc --Apple-Mail=_C6E902E4-B9CD-490B-8DEF-4A467F264B5F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Warren,

I = would suggest that you wait on creating a new list.

I think Stephane was = proposing an *in person* meeting, using the 104sidemeetings Wiki, and = I=E2=80=99d like to see that happen first.  That also gives time = for the dust from the release of these new drafts to settle a bit, so = that the contours of what can be reasonably accomplished becomes more = clear.

Eliot


On 12 Mar 2019, at 07:45, = Warren Kumari <warren@kumari.net> wrote:


On Tue, Mar 12, 2019 at 1:58 AM Stephane Bortzmeyer = <bortzmeyer@nic.fr> wrote:
[Sorry for the long list of working = groups but the discussion already
started in different places.]

There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484)
deployment and the risk of centralization of Internet = services. 
(See
for instance drafts [this is not an endorsement]
draft-bertola-bcp-doh-clients, draft-reid-doh-operator and
draft-livingood-doh-implementation-risks-issues.)

It was suggested <wikipedia>Reference necessary</wikipedia> = to have a
side meeting in Prague at IETF 104. I propose monday, 1400-1600 in
Tyrolka. The proposal is at
<https://trac.ietf.org/trac/ietf/meeting/wiki/104sidemeetings>. You
are welcome to agree/disagree/meet in a bar instead.

[ Replying here instead of = bottom of thread ]

Thank = you for proposing / organizing this - there has been a lot of = discussions, but (as demonstrated by the list of WGs in the To: line) it = is somewhat unclear where the discussions should happen -- I'm planning = on asking the secretariat to please make us a mailing list to better = focus the discussions -- does anyone have a strong objection to = this? 

(also, = a good suggestion for a name would be helpful :-))

W

 

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh


--
I don't think the execution is relevant when = it was obviously a bad idea in the first place.
This is = like putting rabid weasels in your pants, and later expressing regret at = having chosen those particular rabid weasels and that pair of pants.
   ---maf
_______________________________________________
hrpc = mailing list
hrpc@irtf.org
https://www.irtf.org/mailman/listinfo/hrpc

= --Apple-Mail=_C6E902E4-B9CD-490B-8DEF-4A467F264B5F-- --Apple-Mail=_F174B714-4C01-45BD-A3E5-8063E847EB76 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyHXYkACgkQh7ZrRtnS ejNUEwf/fbwzgjBClFP2ncHEg2hPTYt9O52nDAgHhvibv7y4CRix9uc7QKQb/x/Q iIy1Z3tKGEvYuoIMNbw8cecNIsft2eGC9H3XJ8x6cdw9sebZc5EDCIhPVnITr7Qu Rcocs/xqaqtcn/roc/cvvmuPB504FEn6XWHRWU30vWLwRCn24LmwT2PlipgTAT9e JmSb6x7rgNMu0tJTzFkLzQ1Lra8QWA0XTxX8cLaYe+KtrxuPF3LS5yfZf+PtLly8 q6wU2GWcre6Rt4Cs6GwryTSWRgVPXcn5k0a7uxwh2oo+psBVXbd7WoVD3oOpioER Ky1ENnXEb/w5yFKfe3wP4yZAyvh6Wg== =Oex6 -----END PGP SIGNATURE----- --Apple-Mail=_F174B714-4C01-45BD-A3E5-8063E847EB76-- From nobody Tue Mar 12 01:58:16 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B31B130F09; Tue, 12 Mar 2019 01:58:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wTXvbrnjvcbn; Tue, 12 Mar 2019 01:58:01 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1D5D130F06; Tue, 12 Mar 2019 01:58:01 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id E10AE2802D6; Tue, 12 Mar 2019 09:57:59 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id DA599280298; Tue, 12 Mar 2019 09:57:59 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id C2E42642C581; Tue, 12 Mar 2019 09:57:59 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id BA17A40235; Tue, 12 Mar 2019 09:57:59 +0100 (CET) Date: Tue, 12 Mar 2019 09:57:59 +0100 From: Stephane Bortzmeyer To: DoH WG , DPRIVE WG , dnsop , hrpc@irtf.org Message-ID: <20190312085759.3mdmx2knbliu6i7t@nic.fr> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 08:58:05 -0000 On Mon, Mar 11, 2019 at 01:59:25PM -0400, Allison Mankin wrote a message of 94 lines which said: > Perfect idea, very good use of the Wednesday slot. New date and place registered at , wednesday, Karlin 1/2, 1500 to 1700. (Note there is registry lock side meeting just before, for domain name industry people.) From nobody Tue Mar 12 02:01:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D157128678; Tue, 12 Mar 2019 02:01:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gyMI9hm94GJp; Tue, 12 Mar 2019 02:01:44 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59CD312B001; Tue, 12 Mar 2019 02:01:44 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id D5F3A280298; Tue, 12 Mar 2019 10:01:42 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id CEA4628033B; Tue, 12 Mar 2019 10:01:42 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id C6AB5280298; Tue, 12 Mar 2019 10:01:42 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id C0930663E720; Tue, 12 Mar 2019 10:01:42 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id B0C9840235; Tue, 12 Mar 2019 10:01:42 +0100 (CET) Date: Tue, 12 Mar 2019 10:01:42 +0100 From: Stephane Bortzmeyer To: Vittorio Bertola Cc: Stephane Bortzmeyer , doh@ietf.org, dns-privacy@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <20190312090142.s32hdimbozsrbovt@nic.fr> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1829067625.16839.1552327024048@appsuite.open-xchange.com> X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000004, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.3.12.85117 Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 09:01:47 -0000 On Mon, Mar 11, 2019 at 06:57:03PM +0100, Vittorio Bertola wrote a message of 18 lines which said: > Moreover, centralization is not the only Do*-related problem > category that has been raised (my draft alone lists eight others). IMHO, this is precisely the biggest problem with these three drafts: they accumulate a lot of unrelated rants, and it is important to split between issues that are really DoH-specific from more general issues. Warren Kumari did a good job of sorting that out in . I quote him: 1: the protocol, 2: the deployment concerns, 3: "resolverless DNS", 4: the loss of visibility from encrypting the DNS IMHO, this makes several side meetings. People are welcome to organize more. From nobody Tue Mar 12 02:05:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A628E130E64; Tue, 12 Mar 2019 02:05:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HMpEqB6lDYkD; Tue, 12 Mar 2019 02:05:34 -0700 (PDT) Received: from mail-yw1-xc30.google.com (mail-yw1-xc30.google.com [IPv6:2607:f8b0:4864:20::c30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F274512B001; Tue, 12 Mar 2019 02:05:33 -0700 (PDT) Received: by mail-yw1-xc30.google.com with SMTP id 189so1467560ywi.3; Tue, 12 Mar 2019 02:05:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=7Wcjv+T/yIisw08QJdZc88Vs7QBXjyX8EFofXSJgCnE=; b=ZKFl24IUoTFJtD0I15KimC93ZHw1+3uv6OpGZSlVmtGtJ6uvkXKKcH2hw8+ns13TE5 aFiSPMqSODXZwuQjTbsSSufuiBeoUAjjyvb6XpLDYesIqR6a6xU79Pz8CEbkFCrTObQh NtEJo7XVhMEq4QXsEibi5TwGamVVKqtVCLfauS0m3czYo3e2IMSGa88EDqH/i7hPvaCZ c8cDIO7MWtUzFDIwehGhRUrOZAxPDHfR623ibdNXTX9bjC4XApcmkLQwGMsBl/ql2huC zKKh8topGkzF8KaYZSLuSeAhZmQ6fswEI1Q30IbvO2yidRKlNFO45SehYyYho8DiPZvx +Zzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=7Wcjv+T/yIisw08QJdZc88Vs7QBXjyX8EFofXSJgCnE=; b=WSSEzGMR9wLhn79W9eJhJlitHY4Ixx1lDe0fEJMxlfMJGIWPM4ze/RjZ0SMat0G0Tf lUo34f+2a6XVIxQl3yMA3TbqL4xij2sB59zQ4M3ZVClTKohVLHG/lTiqT0+DhRUKnTER QOBn8OGyPaYR4pTBJDG+SCzNluV0ycMC2WRkm1drK/teTg1rF3ko7230FUmSVaSkeiYJ d+Ml9UxXcc+mNOk1P3XyYnXRJATUT3y7EEO4EVZtGSZgFM6T7iLE5+mE489h7KTNGm7s GfI7OzLZ8geIzKNrN6zAMK50VuX55re3Z03TPi42sPq40kOqkNQ0reTmnEBUpa8/KdAw mI0g== X-Gm-Message-State: APjAAAUi5vqcIZ67nU1YBdAX2DjSt+d+9w2ZwQcc38527gdMerzGdiDi /5AhPoO+LvPceLjGzLSIWqLjUs+HMP4Eaa71zI8= X-Google-Smtp-Source: APXvYqyw8vYIBzovKrQzeAinSvWWWaniXME8vbYoQoRNCuQoUGcYpMvEtm9KOY6IuEWnwWjOkh87/+R2ju/KNa9frZc= X-Received: by 2002:a25:38d3:: with SMTP id f202mr30305242yba.111.1552381532802; Tue, 12 Mar 2019 02:05:32 -0700 (PDT) MIME-Version: 1.0 References: <20190311165813.ilrz5ocxomraavbq@nic.fr> In-Reply-To: From: =?UTF-8?Q?T=C3=B6ma_Gavrichenkov?= Date: Tue, 12 Mar 2019 12:05:12 +0300 Message-ID: To: Warren Kumari Cc: Stephane Bortzmeyer , dnsop , DoH WG , hrpc@irtf.org, dprive@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 09:05:36 -0000 On Tue, Mar 12, 2019 at 9:46 AM Warren Kumari wrote: > also, a good suggestion for a name would be helpful :-) That is, aside from "scent" which is as obvious, as it is weird? -- T=C3=B6ma From nobody Tue Mar 12 02:15:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F483130F06; Tue, 12 Mar 2019 02:15:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=LzWuWzNA; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=s7QOMMGn Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3Ulk_8fpavGu; Tue, 12 Mar 2019 02:14:58 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 589A1128678; Tue, 12 Mar 2019 02:14:58 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.nyi.internal (Postfix) with ESMTP id 7C39D21D12; Tue, 12 Mar 2019 05:14:57 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute3.internal (MEProxy); Tue, 12 Mar 2019 05:14:57 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=fm2; bh=s 3heWnMiEn6AYNrk+gz+kJHR1KzuRwKMpJ9GhsDUlIA=; b=LzWuWzNAjVqGV57pu wyc7sbxaca9T85wpkaIfd7eFJuZQq4Fk2V6GVE/gqY83n6OCV5XYUpNPtqnH0XQh 0UwpfPPqHCP4ldW4A7eoj4LgwC1BNPxE8tVcIfYzbEYJF0wzd0h5Eb1gr/GADSIR +eyJZEN1TMaqilQIY0OW4xi0UzRWBK8twmdG16AZuwdhH4QKl9qlSII8GdnpTbop XNdaozdFo7PwuKyGn6r5hOQAAB/23k/gxNS3izhY7nL4Umghn0aV8VibzG4WuJK1 ySPQN3qacOzbgN4IJymidP34AO2E+LafHHcedW0mOvDxFGXEHPv2+XAy+bwzKhJj TIu1A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=s3heWnMiEn6AYNrk+gz+kJHR1KzuRwKMpJ9GhsDUl IA=; b=s7QOMMGnJVzZy2sqEoq74qWAe8UchHxknl02oyUkM29hyHvnUZ/Rbzd3V b9uMVrJgI2lTqwvuReBZzktQkafqc0jXkPoL1U3XSrijz2W+aEI9CS4AuvvWM70r T8MFUu97VMt0rtx55CRZhtN0ZEHHKZC+8uump1LR2B3o5/KAVF8yrcPrvf3Ryx3L 9yILjWAI9bCh2BYE2wiM1qA4a+UiAqcuRTF21MhuZ2NkJLvGOuzWoSbYDrTe0OqB HNfM9Jq5G1Bt1EZPnX/nVUIoxRJJfZwOV9hwETBM4qBRPQCSUB4SvpO5adkAsJnz 7eSv/6yJsvX8VyY4qNtBtELzCYkGQ== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrgeekgddtudcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpegtggfuhfgjfffgkfhfvffosehtqhhmtdhhtddvnecuhfhrohhmpeforghrkhcu pfhothhtihhnghhhrghmuceomhhnohhtsehmnhhothdrnhgvtheqnecuffhomhgrihhnpe hivghtfhdrohhrghdpmhhnohhtrdhnvghtnecukfhppedugeegrddufeeirddujeehrddv keenucfrrghrrghmpehmrghilhhfrhhomhepmhhnohhtsehmnhhothdrnhgvthenucevlh hushhtvghrufhiiigvpedt X-ME-Proxy: Received: from attitudadjuster.mnot.net (unknown [144.136.175.28]) by mail.messagingengine.com (Postfix) with ESMTPA id 42B7910319; Tue, 12 Mar 2019 05:14:52 -0400 (EDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Mark Nottingham In-Reply-To: <20190312085759.3mdmx2knbliu6i7t@nic.fr> Date: Tue, 12 Mar 2019 20:14:49 +1100 Cc: DoH WG , DPRIVE WG , dnsop , hrpc@irtf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312085759.3mdmx2knbliu6i7t@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 09:15:02 -0000 Hi, I'm already starting to pile up conflicts on Wednesday. I'm also very = conscious that we had a side meeting about similar issues in Singapore = (IIRC), and didn't make much progress at all in that time. Are we going = to be able to productively use two hours for this? Could we come up with = a more focused agenda and just use an hour? Cheers, =20 > On 12 Mar 2019, at 7:57 pm, Stephane Bortzmeyer = wrote: >=20 > On Mon, Mar 11, 2019 at 01:59:25PM -0400, > Allison Mankin wrote=20 > a message of 94 lines which said: >=20 >> Perfect idea, very good use of the Wednesday slot. >=20 > New date and place registered at > , > wednesday, Karlin 1/2, 1500 to 1700. (Note there is registry lock side > meeting just before, for domain name industry people.) >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh -- Mark Nottingham https://www.mnot.net/ From nobody Tue Mar 12 02:18:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A6DC130F0E; Tue, 12 Mar 2019 02:17:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IeTdXqZC82rz; Tue, 12 Mar 2019 02:17:47 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 92F3D12B001; Tue, 12 Mar 2019 02:17:47 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id E1C45280298; Tue, 12 Mar 2019 10:17:45 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id DA04F280285; Tue, 12 Mar 2019 10:17:45 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id D2EE9663E720; Tue, 12 Mar 2019 10:17:45 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id C425040235; Tue, 12 Mar 2019 10:17:45 +0100 (CET) Date: Tue, 12 Mar 2019 10:17:45 +0100 From: Stephane Bortzmeyer To: Mark Nottingham Cc: Stephane Bortzmeyer , DoH WG , DPRIVE WG , dnsop , hrpc@irtf.org Message-ID: <20190312091745.b24b457h4nu4xfj4@nic.fr> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312085759.3mdmx2knbliu6i7t@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 09:17:50 -0000 On Tue, Mar 12, 2019 at 08:14:49PM +1100, Mark Nottingham wrote a message of 32 lines which said: > I'm also very conscious that we had a side meeting about similar > issues in Singapore (IIRC), and didn't make much progress at all in > that time. This time, we have drafts (poor ones, IMHO, but it's better than a discussion without written proposals). > Are we going to be able to productively use two hours for this? > Could we come up with a more focused agenda and just use an hour? You are the first to suggest to focus, until now, all remarks (both on and off-list) have been people asking to *enlarge* the agenda :-) From nobody Tue Mar 12 02:46:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73964130F11; Tue, 12 Mar 2019 02:46:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ki5ahyI1bKdr; Tue, 12 Mar 2019 02:46:39 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEA94130F0F; Tue, 12 Mar 2019 02:46:38 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id DA3006A28D; Tue, 12 Mar 2019 10:46:35 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552383995; bh=TP9yq2gZMoox0YxccLcBnj0mMVksv/MgOvU9HmGFVgI=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=nfpuaOM6bVkUTgC6Qm5xnRYtw/RjPYSqv7jS6oImitoEGSDrtc8chOWfYLnhqbdY7 Kh/m+eJKJxpDv85/E29BYQX6vuMzX2c480+7CEW81r33p55PAkKEjoUfe2L+PA59aN D8RReo/sFxTbpsMj1WImzAooE1ym6SrjEzxIbCidlkga4lJg0cu8s3EAhEXwita/FY iXRlK8GedOHWMpvy9Dzo0zx7O4wvg1aexXbtve71DIG3ekINVNLXMnMWfEl7FXHd3z s8owO/iErn7MUwczvfbtL4TnaN/JcDJAia4ymSCBrdulRXtoa8y3zpGGM453hhAxz1 j+RR+cb3mE4mw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id CD76A3C06E4; Tue, 12 Mar 2019 10:46:35 +0100 (CET) Date: Tue, 12 Mar 2019 10:46:35 +0100 (CET) From: Vittorio Bertola To: Stephane Bortzmeyer Cc: doh@ietf.org, dns-privacy@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <124222807.17968.1552383995792@appsuite.open-xchange.com> In-Reply-To: <20190312090142.s32hdimbozsrbovt@nic.fr> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 09:46:40 -0000 > Il 12 marzo 2019 alle 10.01 Stephane Bortzmeyer ha scritto: > > > On Mon, Mar 11, 2019 at 06:57:03PM +0100, > Vittorio Bertola wrote > a message of 18 lines which said: > > > Moreover, centralization is not the only Do*-related problem > > category that has been raised (my draft alone lists eight others). > > IMHO, this is precisely the biggest problem with these three drafts: > they accumulate a lot of unrelated rants, They are not unrelated, they are all effects of the same thing and you cannot deal with them separately, as some practices that would address one of the problems could worsen some of the others. Also, the fact that some of these are not problems for you does not imply that they are not problems for others, and if you want to get consensus, you have to address everyone's concerns and not just yours. Also, the reason why this is a difficult problem is exactly that it affects many things at once. It is fine to break down the analysis into single issues, but when it comes to what to do next, if you start several parallel work threads without any clear coordination plan, you will just end up with several conflicting proposals. So, rather than focusing on any specific entry of the list of issues, I think that the most urgent thing to discuss would be where to have the discussion (so that we can stop crossposting entire threads to four groups) and how to organize it (objectives, working items etc.). Ciao, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Mar 12 07:04:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04AAE130F04; Tue, 12 Mar 2019 07:04:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -12.511 X-Spam-Level: X-Spam-Status: No, score=-12.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DlBAlW6GDuZQ; Tue, 12 Mar 2019 07:04:29 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C21C1130DCB; Tue, 12 Mar 2019 07:04:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=18892; q=dns/txt; s=iport; t=1552399469; x=1553609069; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=SDpsdnUnoiR2VskE0HTwttpQ+OLYp01wBwtWH5/ndd8=; b=QAx83JTptCTTeN11dS9dGehmWdQbaHHMNxX+xKzBq95jg9bJdWK+Xedb M5JwlPnVOW3cQynUZdtF0zG6h/1oNNj3oDknbq82h1bQOEe+uoIwdMV/N o0piq8wONraQ/8Ywq0KVQnAaaAqEUTIUCaJOsq4eXrJJGO7yfr/nT1NVd g=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0ApAABHu4dc/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYFhgRdQIRInhAqIeYxAJZI2hgmBZwgDAQEYAQmBD12?= =?us-ascii?q?CXgKEWzgSAQEDAQEJAQMCbRwMhUoBAQEDAQEBIUsDCAUHBAsRBAEBARUVAgI?= =?us-ascii?q?nKAgGExuDAgQBAYFdAw0ID65agSaBL4VFglADghoKBYEvgUmJRw4mgX+BESc?= =?us-ascii?q?ME4FOfoMeAQECGIECCAEJAQsHAQkEPhOCSzGCJgOKAQEZAw6HFpJsCYRbgnq?= =?us-ascii?q?JFYIrGYF5hWaLXZpfgm4CBAYFAhWBXiENGw0wcTMaCBsVOyoBgkETK4FTg2e?= =?us-ascii?q?FFIVAPgMwAQEBAY5uDxeBOlcWAQE?= X-IronPort-AV: E=Sophos;i="5.58,471,1544486400"; d="asc'?scan'208,217";a="10636995" Received: from aer-iport-nat.cisco.com (HELO aer-core-2.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 12 Mar 2019 14:04:25 +0000 Received: from ams3-vpn-dhcp7163.cisco.com (ams3-vpn-dhcp7163.cisco.com [10.61.91.250]) by aer-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x2CE4Oh1023542 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 12 Mar 2019 14:04:25 GMT From: Eliot Lear Message-Id: <2F7920EE-F04C-43E9-8194-B0000A0756F7@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_102A3198-12FB-4AFD-8E99-693AD8F24FF5"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 12 Mar 2019 15:04:23 +0100 In-Reply-To: <2D9C1616-EF47-4685-8155-99A718806EE9@sky.uk> Cc: "doh@ietf.org" , "dnsop@ietf.org" , "dns-privacy@ietf.org" To: "Winfield, Alister" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> <2D9C1616-EF47-4685-8155-99A718806EE9@sky.uk> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.91.250, ams3-vpn-dhcp7163.cisco.com X-Outbound-Node: aer-core-2.cisco.com Archived-At: Subject: Re: [Doh] [EXTERNAL] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 14:04:33 -0000 --Apple-Mail=_102A3198-12FB-4AFD-8E99-693AD8F24FF5 Content-Type: multipart/alternative; boundary="Apple-Mail=_66F11327-C5D1-4454-A4C4-E030BC2F5109" --Apple-Mail=_66F11327-C5D1-4454-A4C4-E030BC2F5109 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, > On 12 Mar 2019, at 14:11, Winfield, Alister = wrote: >=20 > MDM is also a red-herring given >90% of devices world-wide aren't = managed so anyone talking of MDM riding to the rescue of DoH client = configuration is walking around with blinkers on. Firefox has published a specific policy interface just for this purpose. = I think the point, and perhaps others could correct me, is that the MDM = serves as evidence that the owner of the device is authorizing a = configuration change. And the use case I am discussing is the = enterprise use case. Your #s do not take that into account. > Even inside company networks there are servers not under MDM; Servers seem an unlikely use of DoH from an application in particular. > locally developed applications that might in future pull in a DoH = resolver; In that case, the enterprise administrator is aiming the shotgun at his = or her own foot. I propose not to solve that problem, but rather to = help them with tools to do the right thing. > BYOD; visitors; malware and so on. It is certainly not best practice for visitors to be granted access to = internal access; instead they typically are given guest access. BYOD is a different story. Here DoH may add pressure on those bringing = their own devices to have to place them under MDM control. That = pressure already exists, by the way. DoH just adds to it. > So whatever you think a reasonable solution for client configuration = has to start with unmanaged clients. That last one malware is why the = corporate response may well be 'MITM' the traffic so we can protect the = data, people and systems using our network. >=20 > What DoH discovery and presentation looks like is complex issue that = will take some discussion. Just one small example, I might want to use = the local networks DNS if and only if it provides anti-malware = protection and has a reasonable privacy policy but use a static one if = not. Or perhaps on a child's device it's okay if there is filtering in = place suitable for children. I have previously written here that meaningful consent (a=E2=80=99la = Sasse, Acquisti, et al) is a key issue. With your example, Alister, you = are essentially asking about number of attributes from the DNS server; = some of which would have to be ascribed by others rather than simply = self-asserted. And then you have to make all of that information = consumable and actionable by a normal person. Good luck. Just establishing an operational model in which split DNS is handled = correctly will be enough of a challenge, but is worth exploring. And that is why much of this smells like research to me. If there are = willing partners, I think that would be a great avenue to tread down. Eliot >=20 > Alister >=20 > =EF=BB=BFOn 12/03/2019, 05:43, "dns-privacy on behalf of Konda, = Tirumaleswar Reddy" wrote: >=20 >> -----Original Message----- >> From: Eliot Lear >> Sent: Monday, March 11, 2019 11:49 PM >> To: Paul Vixie >> Cc: nalini elkins ; Konda, Tirumaleswar = Reddy >> ; doh@ietf.org; dnsop@ietf.org; >> Ackermann, Michael ; Christian Huitema >> ; dns-privacy@ietf.org; Vittorio Bertola >> ; Stephen = Farrell >> >> Subject: Re: [Doh] [dns-privacy] [DNSOP] New: = draft-bertola-bcp-doh-clients >>=20 >> Hi Paul, >>=20 >>> On 11 Mar 2019, at 19:12, Paul Vixie wrote: >>>=20 >>>=20 >>>=20 >>> nalini elkins wrote on 2019-03-11 10:26: >>>> Tiru, >>>> Thanks for your comments. >>>>> Enterprise networks are already able to block DoH services, >>> i wonder if everyone here knows that TLS 1.3 and encrypted headers = is >> going to push a SOCKS agenda onto enterprises that had not previously >> needed one, and that simply blocking every external endpoint known or >> tested to support DoH will be the cheaper alternative, even if that = makes >> millions of other endpoints at google, cloudflare, cisco, and ibm = unreachable >> as a side effect? >>=20 >> That or it will require a bit more management at the MDM level. = I=E2=80=99m hoping >> the latter. And I hope that one output of all of these documents = will be a >> recommendation regarding MDM interfaces. >=20 > I don't think MDM is required to use the DoT/DoH servers provided = by the local network. >=20 > -Tiru >=20 >>=20 >> Eliot > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > = https://emea01.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fwww.i= etf.org%2Fmailman%2Flistinfo%2Fdns-privacy&data=3D02%7C01%7Calister.wi= nfield%40sky.uk%7Cab5faa933f374ae7b72c08d6a6ada348%7C68b865d5cf184b2b82a4a= 4eddb9c5237%7C0%7C0%7C636879662059337184&sdata=3Dbba3bapIO3ffilylhoIj0= x3zVkHYlNC4Gid96Ybx9Xo%3D&reserved=3D0 > = -------------------------------------------------------------------- > This email is from an external source. Please do not open = attachments or click links from an unknown or suspicious origin. = Phishing attempts can be reported by sending them to phishing@sky.uk as = attachments. Thank you > = -------------------------------------------------------------------- >=20 >=20 >=20 > Information in this email including any attachments may be privileged, = confidential and is intended exclusively for the addressee. The views = expressed may not be official policy, but the personal views of the = originator. If you have received it in error, please notify the sender = by return e-mail and delete it from your system. You should not = reproduce, distribute, store, retransmit, use or disclose its contents = to anyone. Please note we reserve the right to monitor all e-mail = communication through our internal and external networks. SKY and the = SKY marks are trademarks of Sky Limited and Sky International AG and are = used under licence. >=20 > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited = (Registration No. 2067075), Sky Subscribers Services Limited = (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) = are direct or indirect subsidiaries of Sky Limited (Registration No. = 2247735). All of the companies mentioned in this paragraph are = incorporated in England and Wales and share the same registered office = at Grant Way, Isleworth, Middlesex TW7 5QD --Apple-Mail=_66F11327-C5D1-4454-A4C4-E030BC2F5109 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi,

On 12 Mar 2019, at 14:11, Winfield, Alister = <Alister.Winfield@sky.uk> wrote:

MDM = is also a red-herring given >90% of devices world-wide aren't managed = so anyone talking of MDM riding to the rescue of DoH client = configuration is walking around with blinkers on. =

Firefox has = published a specific policy interface just for this purpose.  I = think the point, and perhaps others could correct me, is that the MDM = serves as evidence that the owner of the device = is authorizing a configuration change.  And the use case I am = discussing is the enterprise use case.  Your #s do not take that = into account.

Even inside company networks = there are servers not under MDM;

Servers seem an unlikely use of DoH from an application = in particular.

locally developed = applications that might in future pull in a DoH resolver; =

In that case, = the enterprise administrator is aiming the shotgun at his or her own = foot.  I propose not to solve that problem, but rather to help them = with tools to do the right thing.

BYOD; visitors; = malware and so on.

It is certainly not best practice for visitors to = be granted access to internal access; instead they typically are given = guest access.  

BYOD is a = different story.  Here DoH may add pressure on those bringing their = own devices to have to place them under MDM control.  That pressure = already exists, by the way.  DoH just adds to it.


So whatever you think a reasonable solution = for client configuration has to start with unmanaged clients. That last = one malware is why the corporate response may well be 'MITM' the traffic = so we can protect the data, people and systems using our network.

What DoH discovery and presentation looks like = is complex issue that will take some discussion. Just one small example, = I might want to use the local networks DNS if and only if it provides = anti-malware protection and has a reasonable privacy policy but use a = static one if not. Or perhaps on a child's device it's okay if there is = filtering in place suitable for = children.

I have = previously written here that meaningful consent = (a=E2=80=99la Sasse, Acquisti, et al) is a key issue.  With your = example, Alister, you are essentially asking about number of attributes = from the DNS server; some of which would have to be ascribed by others = rather than simply self-asserted.  And then you have to make all of = that information consumable and actionable by a normal person. =  Good luck.

Just establishing = an operational model in which split DNS is handled correctly will be = enough of a challenge, but is worth exploring.

And that is why much of this smells like research = to me.  If there are willing partners, I think that would be a = great avenue to tread down.

Eliot


Alister

=EF=BB=BFOn 12/03/2019, 05:43, "dns-privacy on behalf of = Konda, Tirumaleswar Reddy" <dns-privacy-bounces@ietf.org on behalf of TirumaleswarReddy_Konda@McAfee.com> wrote:

-----Original Message-----
From: Eliot Lear = <lear@cisco.com>Sent: Monday, March 11, 2019 11:49 PM
To: Paul = Vixie <paul@redbarn.org>
Cc: nalini elkins = <nalini.elkins@e-dco.com>; Konda, Tirumaleswar Reddy
<TirumaleswarReddy_Konda@McAfee.com>; doh@ietf.org; dnsop@ietf.org;
Ackermann, Michael <mackermann@bcbsm.com>; Christian Huitema
<huitema@huitema.net>; dns-privacy@ietf.org; = Vittorio Bertola
<vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org>; = Stephen Farrell
<stephen.farrell@cs.tcd.ie>
Subject: Re: = [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients

Hi Paul,

On 11 Mar 2019, at = 19:12, Paul Vixie <paul@redbarn.org> wrote:



nalini elkins wrote on = 2019-03-11 10:26:
Tiru,
Thanks for your comments.
Enterprise networks are = already able to block DoH services,
i wonder if everyone here knows = that TLS 1.3 and encrypted headers is
going = to push a SOCKS agenda onto enterprises that had not previously
needed one, and that simply blocking every external endpoint = known or
tested to support DoH will be the cheaper = alternative, even if that makes
millions of other = endpoints at google, cloudflare, cisco, and ibm unreachable
as a side effect?

That or it = will require a bit more management at the MDM level.  I=E2=80=99m = hoping
the latter.  And I hope that one output of all = of these documents will be a
recommendation regarding MDM = interfaces.

=    I don't think MDM is required to use the DoT/DoH = servers provided by the local network.

=    -Tiru


Eliot
=    _______________________________________________
   dns-privacy mailing list
=    dns-privacy@ietf.org
   https://emea01.safelinks.protection.outlook.com/?url=3Dhttps%3A= %2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fdns-privacy&amp;data=3D02%7C= 01%7Calister.winfield%40sky.uk%7Cab5faa933f374ae7b72c08d6a6ada348%7C68b865= d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C636879662059337184&amp;sdata=3Dbb= a3bapIO3ffilylhoIj0x3zVkHYlNC4Gid96Ybx9Xo%3D&amp;reserved=3D0
=    --------------------------------------------------------= ------------
   This email is from an = external source. Please do not open attachments or click links from an = unknown or suspicious origin. Phishing attempts can be reported by = sending them to phishing@sky.uk as attachments. Thank you
=    --------------------------------------------------------= ------------



Information in this email including any attachments may be = privileged, confidential and is intended exclusively for the addressee. = The views expressed may not be official policy, but the personal views = of the originator. If you have received it in error, please notify the = sender by return e-mail and delete it from your system. You should not = reproduce, distribute, store, retransmit, use or disclose its contents = to anyone. Please note we reserve the right to monitor all e-mail = communication through our internal and external networks. SKY and the = SKY marks are trademarks of Sky Limited and Sky International AG and are = used under licence.

Sky UK Limited = (Registration No. 2906991), Sky-In-Home Service Limited (Registration = No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or = indirect subsidiaries of Sky Limited (Registration No. 2247735). All of = the companies mentioned in this paragraph are incorporated in England = and Wales and share the same registered office at Grant Way, Isleworth, = Middlesex TW7 5QD

= --Apple-Mail=_66F11327-C5D1-4454-A4C4-E030BC2F5109-- --Apple-Mail=_102A3198-12FB-4AFD-8E99-693AD8F24FF5 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyHvGcACgkQh7ZrRtnS ejMJmAf+IIR7TIDeQl60FDnO1RXptfb1XGc9pW3UV/G1DiCGAmUkRbR2B3oqlpaf 9ocXzu/yZWfA3iLMo0PLBWEZvGuK3B0KXAuDyPYPPxCdSIe4soD52yeu4B4RZ7/1 1uwVH2XtRybGx1XY/jZ9uztk0hEBdGHe/uCBGNnqMUzgVzut4y8f2BVAN7licjQX zn31raQ/KoHosnpyzqyvW9mQIfW7urwUMyqF/ZBgf0BBF+JWRDLSIMiHjay+XQOs /OVnfdXsjv/y/3zxr6EE+6Dn8J8Y+DP3qG63AnitxEqWh14zszHpa7WOiTnUs4it 2RGRqdWXRwbn8K6mj+/AnT7WNvvZmg== =StF6 -----END PGP SIGNATURE----- --Apple-Mail=_102A3198-12FB-4AFD-8E99-693AD8F24FF5-- From nobody Tue Mar 12 08:09:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 951A4130E77 for ; Tue, 12 Mar 2019 08:09:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xT9VsmKgEwZf for ; Tue, 12 Mar 2019 08:09:18 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E079E130E46 for ; Tue, 12 Mar 2019 08:09:17 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 1771C28033B; Tue, 12 Mar 2019 16:09:16 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id 10E3B28011C; Tue, 12 Mar 2019 16:09:16 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 0A001663E080; Tue, 12 Mar 2019 16:09:16 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id EF8B540235; Tue, 12 Mar 2019 16:09:15 +0100 (CET) Date: Tue, 12 Mar 2019 16:09:15 +0100 From: Stephane Bortzmeyer To: Ralf Weber Cc: Stephane Bortzmeyer , "Livingood, Jason" , DoH WG Message-ID: <20190312150915.slfq3bgxhuw2uv4t@nic.fr> References: <20190309182857.GA29321@laperouse.bortzmeyer.org> <6ED365D5-8717-46A6-B75E-A628753C2979@fl1ger.de> <20190310073306.GA10396@laperouse.bortzmeyer.org> <5FE94C8C-158D-43AD-86B6-1949A8F740EC@fl1ger.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <5FE94C8C-158D-43AD-86B6-1949A8F740EC@fl1ger.de> X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:09:21 -0000 On Mon, Mar 11, 2019 at 09:47:03AM +0100, Ralf Weber wrote a message of 48 lines which said: > Most jurisdictions though have something from the old roman law “Ignorantia > legis non excusat” meaning not knowning the law doesn’t protect you from > punishment. « Nul n'est censé ignorer la loi » in french. In the cases I mentioned, the people know the law and never pretended they were not aware of it. But there is a difference between the law, which applies automatically to all residents, and the court decisions, which apply only to the parties involved. Also, in the case of the police blacklist, as I said, it is secret, even if people want to enforce it, they cannot. > Good, but even not for profit need money from someone and I doubt > that we can supply DoH service for large portion of the Internet > using non profit organisations. But the goal is not to provide services to "a large portion". There is no point in creating a "not-for-profit GAFA". Quite the contrary. What I would like to see is a lot of small DoH resolvers, each with its own group of users. > You didn’t mention an alternative or do you really think a lot of > different non profit organisations will provide resolving for the > Internet? Yes. Like they provide most of the interesting stuff on the Internet. From nobody Tue Mar 12 08:14:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 288D5130FB8; Tue, 12 Mar 2019 08:14:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FKsLXxY7rfxg; Tue, 12 Mar 2019 08:14:26 -0700 (PDT) Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 35E68130F04; Tue, 12 Mar 2019 08:14:25 -0700 (PDT) X-NAI-Header: Modified by McAfee Email Gateway (5500) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552403469; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-ms-exchange-purlcount:x-microsoft-antispam-prvs: x-forefront-prvs:x-forefront-antispam-report: received-spf:x-ms-exchange-senderadcheck:x-microsoft-antispam-message-info: Content-Type:MIME-Version:X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Threshold: X-NAI-Spam-Score:X-NAI-Spam-Version; bh=4 frP5tCxjKkJaoyVfyPYo7aOLdn+aDiC4nv76q6HMr c=; b=Cvaz2/Iildm5QOVQQJ8q+n/eFarh8mKD0sfeKET0+C7v 9ucJUDkYlsNtY98d+MQh6zw8DRk5FY/ITrJ0B9ErklPv4gp1oa mGbcdQKcoo7y7g0pQ/HzC6VtHXf94Yg00jX+radC8C7E4PxECL GCqVMDKev3b4nsZ9aA9Rmja01Dc= Received: from DNVEXAPP1N06.corpzone.internalzone.com (unknown [10.44.48.90]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 0729_5df1_7980db65_f632_4099_adf0_fe01e5083251; Tue, 12 Mar 2019 09:11:08 -0600 Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N06.corpzone.internalzone.com (10.44.48.90) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 09:13:54 -0600 Received: from DNVO365EDGE2.corpzone.internalzone.com (10.44.176.74) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Tue, 12 Mar 2019 09:13:54 -0600 Received: from NAM03-CO1-obe.outbound.protection.outlook.com (10.44.176.240) by edge.mcafee.com (10.44.176.74) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 09:13:49 -0600 Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2710.namprd16.prod.outlook.com (20.178.232.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.13; Tue, 12 Mar 2019 15:13:49 +0000 Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1709.011; Tue, 12 Mar 2019 15:13:49 +0000 From: "Konda, Tirumaleswar Reddy" To: Neil Cook CC: "doh@ietf.org" , "dnsop@ietf.org" , "Paul Vixie" Thread-Topic: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2NXrAignavqBHk2zotAw7nV7baYIGTiw Date: Tue, 12 Mar 2019 15:13:49 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <2508EF3D-F82D-4BA5-A2FC-6287A76724BA@noware.co.uk> In-Reply-To: <2508EF3D-F82D-4BA5-A2FC-6287A76724BA@noware.co.uk> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com; x-originating-ip: [49.37.203.5] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 302892e2-b59e-496f-4268-08d6a6fd5491 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB2710; x-ms-traffictypediagnostic: BYAPR16MB2710: x-ms-exchange-purlcount: 3 x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(39860400002)(396003)(376002)(366004)(346002)(189003)(13464003)(199004)(32952001)(55674003)(11346002)(446003)(6306002)(68736007)(476003)(93886005)(52536013)(5660300002)(8936002)(3846002)(186003)(54906003)(6246003)(33656002)(316002)(6116002)(486006)(790700001)(53936002)(256004)(26005)(5024004)(14444005)(102836004)(9686003)(54896002)(236005)(2906002)(55016002)(71190400001)(71200400001)(229853002)(6436002)(53386004)(8676002)(14454004)(966005)(66066001)(106356001)(7736002)(6916009)(72206003)(99286004)(76176011)(6506007)(105586002)(53546011)(86362001)(97736004)(478600001)(81166006)(7696005)(81156014)(80792005)(74316002)(4326008)(25786009)(66574012)(606006)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2710; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 9AJ2HmtGJA5QEdNZvKM3CjMbUiQp79TuYwU8jpZtcKwfpNwBkpg2tLh2+D4yZzWuy8MsHAOoKqQVNiazpjJ2SaZjJ77QC8rcAXJltORDHoIuqf6BgjX8MAX0fXZpy3CeHsbIKzgG4Uco3D4OBc+oE2JvMPE9UHSw0ACLiXTNLnUXhFY/VYQct/VYNVM0EByn+S/kZyR/HDMDAQy1AkswF2Se4DjkBq0Rj4wNle/pjG7V5MdHMWwr95zgkqyxUgxkhy9xIoluJmZj/t4dpQJTS4zq+gHAOj8uOmc8TWSa07jO+VnCaHpZr9H7O/Acw4Vjgqor8EAReCGH3SFaNUaR2V1VFaMInMTXmo6MTee2nmMRU7VCUSgi0yLiLJE2nE4c6G+9bi/TFRO9Sn0v0kRuddzwEWMy/2yv/bmGl3oIjWk= Content-Type: multipart/alternative; boundary="_000_BYAPR16MB27905CEEB60A2B607E5B638CEA490BYAPR16MB2790namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 302892e2-b59e-496f-4268-08d6a6fd5491 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 15:13:49.3665 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2710 X-OriginatorOrg: mcafee.com X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 15 X-NAI-Spam-Score: 0 X-NAI-Spam-Version: 2.3.0.9418 : core <6501> : inlines <7032> : streams <1815500> : uri <2811440> Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:14:29 -0000 --_000_BYAPR16MB27905CEEB60A2B607E5B638CEA490BYAPR16MB2790namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UGxlYXNlIHNlZSBpbmxpbmUgW1RSXQ0KDQpGcm9tOiBkbnMtcHJpdmFjeSA8ZG5zLXByaXZhY3kt Ym91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIE5laWwgQ29vaw0KU2VudDogVHVlc2RheSwg TWFyY2ggMTIsIDIwMTkgNToxNCBQTQ0KVG86IEtvbmRhLCBUaXJ1bWFsZXN3YXIgUmVkZHkgPFRp cnVtYWxlc3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb20+DQpDYzogZG9oQGlldGYub3JnOyBWaXR0 b3JpbyBCZXJ0b2xhIDx2aXR0b3Jpby5iZXJ0b2xhPTQwb3Blbi14Y2hhbmdlLmNvbUBkbWFyYy5p ZXRmLm9yZz47IGRuc29wQGlldGYub3JnOyBQYXVsIFZpeGllIDxwYXVsQHJlZGJhcm4ub3JnPjsg Q2hyaXN0aWFuIEh1aXRlbWEgPGh1aXRlbWFAaHVpdGVtYS5uZXQ+OyBuYWxpbmkgZWxraW5zIDxu YWxpbmkuZWxraW5zQGUtZGNvLmNvbT47IGRucy1wcml2YWN5QGlldGYub3JnOyBBY2tlcm1hbm4s IE1pY2hhZWwgPG1hY2tlcm1hbm5AYmNic20uY29tPjsgU3RlcGhlbiBGYXJyZWxsIDxzdGVwaGVu LmZhcnJlbGxAY3MudGNkLmllPg0KU3ViamVjdDogUmU6IFtkbnMtcHJpdmFjeV0gW0ROU09QXSBO ZXc6IGRyYWZ0LWJlcnRvbGEtYmNwLWRvaC1jbGllbnRzDQoNCg0KQ0FVVElPTjogRXh0ZXJuYWwg ZW1haWwuIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcyB5b3Ug cmVjb2duaXplIHRoZSBzZW5kZXIgYW5kIGtub3cgdGhlIGNvbnRlbnQgaXMgc2FmZS4NCg0KDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSVNUTSB0aGF0IGl0IGlzIHF1aXRlIHBv c3NpYmxlIHRoYXQgZW50ZXJwcmlzZXMgdGhhdCBkZXBsb3kgdGhlaXIgb3duIERvSA0Kc2Vydmlj ZXMgY291bGQgcG90ZW50aWFsbHkgcmVkdWNlIHN1Y2ggbGVha2FnZSBhbmQgZ2FpbiBvdmVyYWxs LiAoSSdtDQphc3N1bWluZyBoZXJlIHRoYXQgc2Vuc2libGUgYnJvd3Nlci1tYWtlcnMgd2lsbCBl bmQgdXAgcHJvdmlkaW5nDQpzb21ldGhpbmcgdGhhdCB3b3JrcyBmb3IgYnJvd3NlcnMgcnVubmlu ZyBpbiBuZXR3b3JrcyB3aXRoIHNwbGl0LWhvcml6b24NCnNldHVwcyBiZWZvcmUgdGhvc2UgYnJv d3NlcnMgdHVybiBvbiBEb0ggYXMgYSBkZWZhdWx0IGF0IHNjYWxlLikNCg0KSWYgRW50ZXJwcmlz ZSBuZXR3b3JrIHByb3ZpZGVzIGEgRG9UL0RvSCBzZXJ2ZXIsIGJyb3dzZXIgc2hvdWxkIGJlIGFi bGUgdG8gZGlzY292ZXIgYW5kIHVzZSB0aGUgRW50ZXJwcmlzZSBEb1QvRG9IIHNlcnZlci4NCg0K V2VsbCB1bnRpbCBub3cgdGhlcmUgaGFzIGJlZW4gbm8gZGlzY292ZXJ5IG1lY2hhbmlzbSBmb3Ig RG9IIHNlcnZlcnMuIFRoZXJlIGlzIG5vdyBkcmFmdCBhZG9wdGVkIGJ5IHRoZSBEb0ggV0cgdGhh dCBwcm9wb3NlcyBhIGRpc2NvdmVyeSBtZWNoYW5pc20uIEhvd2V2ZXIgd2hldGhlciBicm93c2Vy cyBhY3R1YWxseSB1c2UgaXQgaXMgYW5vdGhlciBxdWVzdGlvbi4gSGVuY2UgdGhlIGRyYWZ0IGJ5 IFZJdHRvcmlvLg0KDQpbVFJdIERpc2NvdmVyeSBhbG9uZSB3aWxsIG5vdCBzb2x2ZSB0aGUgcHJv YmxlbSwgdGhlIERvSCBjbGllbnQgbmVlZHMgdG8gdHJ1c3QgdGhlIGRpc2NvdmVyZWQgRG9IIHNl cnZlcnMgKHNlZSBodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHktZHByaXZl LWJvb3RzdHJhcC1kbnMtc2VydmVyLTAxKS4NCg0KQ2hlZXJzLA0KLVRpcnUNCg0KTmVpbA0KDQoN Ck9uIDEyIE1hciAyMDE5LCBhdCAwNjoxNCwgS29uZGEsIFRpcnVtYWxlc3dhciBSZWRkeSA8VGly dW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbTxtYWlsdG86VGlydW1hbGVzd2FyUmVkZHlf S29uZGFATWNBZmVlLmNvbT4+IHdyb3RlOg0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0K RnJvbTogU3RlcGhlbiBGYXJyZWxsIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPG1haWx0bzpz dGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPj4NClNlbnQ6IFR1ZXNkYXksIE1hcmNoIDEyLCAyMDE5 IDU6MzAgQU0NClRvOiBQYXVsIFZpeGllIDxwYXVsQHJlZGJhcm4ub3JnPG1haWx0bzpwYXVsQHJl ZGJhcm4ub3JnPj47IGRvaEBpZXRmLm9yZzxtYWlsdG86ZG9oQGlldGYub3JnPg0KQ2M6IG5hbGlu aSBlbGtpbnMgPG5hbGluaS5lbGtpbnNAZS1kY28uY29tPG1haWx0bzpuYWxpbmkuZWxraW5zQGUt ZGNvLmNvbT4+OyBLb25kYSwgVGlydW1hbGVzd2FyIFJlZGR5DQo8VGlydW1hbGVzd2FyUmVkZHlf S29uZGFATWNBZmVlLmNvbTxtYWlsdG86VGlydW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNv bT4+OyBkbnNvcEBpZXRmLm9yZzxtYWlsdG86ZG5zb3BAaWV0Zi5vcmc+OyBBY2tlcm1hbm4sDQpN aWNoYWVsIDxtYWNrZXJtYW5uQGJjYnNtLmNvbTxtYWlsdG86bWFja2VybWFubkBiY2JzbS5jb20+ PjsgQ2hyaXN0aWFuIEh1aXRlbWENCjxodWl0ZW1hQGh1aXRlbWEubmV0PG1haWx0bzpodWl0ZW1h QGh1aXRlbWEubmV0Pj47IGRucy1wcml2YWN5QGlldGYub3JnPG1haWx0bzpkbnMtcHJpdmFjeUBp ZXRmLm9yZz47IFZpdHRvcmlvIEJlcnRvbGENCjx2aXR0b3Jpby5iZXJ0b2xhPTQwb3Blbi14Y2hh bmdlLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86dml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNo YW5nZS5jb21AZG1hcmMuaWV0Zi5vcmc+Pg0KU3ViamVjdDogUmU6IFtkbnMtcHJpdmFjeV0gW0RO U09QXSBOZXc6IGRyYWZ0LWJlcnRvbGEtYmNwLWRvaC1jbGllbnRzDQoNCg0KKFRoaXMgZGlzdHJp YnV0aW9uIGxpc3QgaXMgdG9vIHNjYXR0ZXJlZCBhbmQgZGl2ZXJzZS4gQmUgZ3JlYXQgaWYgc29t ZSBBRCBvcg0Kc29tZW9uZSBqdXN0IHBpY2tlZCBvbmUgbGlzdCBmb3IgdGhpcy4NCkluIHRoZSBt ZWFudGltZS4uLikNCg0KT24gMTEvMDMvMjAxOSAyMDo0MywgbmFsaW5pIGVsa2lucyB3cm90ZToN Cg0KaW1wYWN0IGFzc2Vzc21lbnQgdGhhdCBjZXJ0YWluIGNoYW5nZXMgc3VjaCBhcyBEb0ggYW5k IFRMUzEuMyB3aWxsDQpoYXZlIG9uIGVudGVycHJpc2VzLA0KDQpUTFMxLjMgd2lsbCwgSSBleHBl Y3QsIG5vdGljZWFibHkgaW1wcm92ZSBzZWN1cml0eSBmb3IgYW4gYXdmdWwgbG90IG9mDQplbnRl cnByaXNlcyBpbiB0aW1lLg0KDQpBcyBmb3IgRG9ILCBJIHdvbmRlciBoYXMgYW55b25lIGRvbmUg c3R1ZGllcyBvbiBob3cgc3BsaXQtaG9yaXpvbiBuYW1lcw0KYW5kIGFjY2VzcyBwYXR0ZXJucyBs ZWFrIHRvZGF5Pw0KDQpJIGRvbid0IHJlY2FsbCBoYXZpbmcgcmVhZCB0aGF0IGtpbmQgb2Ygc3R1 ZHkuIEkgY2FuIGltYWdpbmUgbWFueSB3YXlzIGluDQp3aGljaCB0aGF0IGtpbmQgb2Ygc3R1ZmYg d291bGQgbGVhay4gSSdkIGJlIHZlcnkgc3VycHJpc2VkIGlmIGl0IG5ldmVyIGhhcHBlbnMuDQpJ IGRvbid0IGtub3cgaG93IG9mdGVuIGl0IGRvZXMuDQoNCkZvciBuYW1lcywgbGVha2luZyBvbmNl IGlzIGtpbmRhIGZhdGFsLiBGb3IgYWNjZXNzIHBhdHRlcm5zLCBJIGd1ZXNzIG9uZSBsZWFrDQpl eHBvc2VzIGFuIElQIGFkZHJlc3MgdGhhdCdzIGludGVyZXN0ZWQgaW4gYSBuYW1lIChlLmcuIHNl Y3JldC0NCnByb2plY3QuZXhhbXBsZS5jb208aHR0cDovL3Byb2plY3QuZXhhbXBsZS5jb20+KSBi dXQgbW9yZSB3b3VsZCBiZSBuZWVkZWQgZm9yIGJyb2FkZXIgYWNjZXNzDQpwYXR0ZXJucyB0byBi ZSBleHBvc2VkIHRvICJmb3JlaWduIg0KcmVjdXJzaXZlcyBhbmQvb3IgaW4tYmFuZCBuZXR3b3Jr cy4NCg0KSVNUTSB0aGF0IGl0IGlzIHF1aXRlIHBvc3NpYmxlIHRoYXQgZW50ZXJwcmlzZXMgdGhh dCBkZXBsb3kgdGhlaXIgb3duIERvSA0Kc2VydmljZXMgY291bGQgcG90ZW50aWFsbHkgcmVkdWNl IHN1Y2ggbGVha2FnZSBhbmQgZ2FpbiBvdmVyYWxsLiAoSSdtDQphc3N1bWluZyBoZXJlIHRoYXQg c2Vuc2libGUgYnJvd3Nlci1tYWtlcnMgd2lsbCBlbmQgdXAgcHJvdmlkaW5nDQpzb21ldGhpbmcg dGhhdCB3b3JrcyBmb3IgYnJvd3NlcnMgcnVubmluZyBpbiBuZXR3b3JrcyB3aXRoIHNwbGl0LWhv cml6b24NCnNldHVwcyBiZWZvcmUgdGhvc2UgYnJvd3NlcnMgdHVybiBvbiBEb0ggYXMgYSBkZWZh dWx0IGF0IHNjYWxlLikNCg0KSWYgRW50ZXJwcmlzZSBuZXR3b3JrIHByb3ZpZGVzIGEgRG9UL0Rv SCBzZXJ2ZXIsIGJyb3dzZXIgc2hvdWxkIGJlIGFibGUgdG8gZGlzY292ZXIgYW5kIHVzZSB0aGUg RW50ZXJwcmlzZSBEb1QvRG9IIHNlcnZlci4NCg0KLVRpcnUNCg0KDQoNCkNoZWVycywNClMuDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KRE5TT1AgbWFp bGluZyBsaXN0DQpETlNPUEBpZXRmLm9yZzxtYWlsdG86RE5TT1BAaWV0Zi5vcmc+DQpodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Ruc29wDQoNCg== --_000_BYAPR16MB27905CEEB60A2B607E5B638CEA490BYAPR16MB2790namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OkhlbHZldGljYTsNCglwYW5vc2UtMToyIDExIDYgNCAyIDIgMiAyIDIg NDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpEZW5nWGlh bjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OiJcQERlbmdYaWFuIjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAx IDEgMSAxO30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9y bWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0 Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7 fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJ Y29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bh bi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6 cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLmFwcGxlLWNvbnZlcnRl ZC1zcGFjZQ0KCXttc28tc3R5bGUtbmFtZTphcHBsZS1jb252ZXJ0ZWQtc3BhY2U7fQ0Kc3Bhbi5F bWFpbFN0eWxlMjENCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQotLT48L3N0eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0 cyB2OmV4dD0iZWRpdCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRt YXAgdjpleHQ9ImVkaXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5k aWZdLS0+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1 cnBsZSI+DQo8ZGl2IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ UGxlYXNlIHNlZSBpbmxpbmUgW1RSXTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCBibHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4N CjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtw YWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206 PC9iPiBkbnMtcHJpdmFjeSAmbHQ7ZG5zLXByaXZhY3ktYm91bmNlc0BpZXRmLm9yZyZndDsgPGI+ T24gQmVoYWxmIE9mDQo8L2I+TmVpbCBDb29rPGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIE1h cmNoIDEyLCAyMDE5IDU6MTQgUE08YnI+DQo8Yj5Ubzo8L2I+IEtvbmRhLCBUaXJ1bWFsZXN3YXIg UmVkZHkgJmx0O1RpcnVtYWxlc3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb20mZ3Q7PGJyPg0KPGI+ Q2M6PC9iPiBkb2hAaWV0Zi5vcmc7IFZpdHRvcmlvIEJlcnRvbGEgJmx0O3ZpdHRvcmlvLmJlcnRv bGE9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnJmd0OzsgZG5zb3BAaWV0Zi5vcmc7 IFBhdWwgVml4aWUgJmx0O3BhdWxAcmVkYmFybi5vcmcmZ3Q7OyBDaHJpc3RpYW4gSHVpdGVtYSAm bHQ7aHVpdGVtYUBodWl0ZW1hLm5ldCZndDs7IG5hbGluaSBlbGtpbnMgJmx0O25hbGluaS5lbGtp bnNAZS1kY28uY29tJmd0OzsgZG5zLXByaXZhY3lAaWV0Zi5vcmc7IEFja2VybWFubiwNCiBNaWNo YWVsICZsdDttYWNrZXJtYW5uQGJjYnNtLmNvbSZndDs7IFN0ZXBoZW4gRmFycmVsbCAmbHQ7c3Rl cGhlbi5mYXJyZWxsQGNzLnRjZC5pZSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtkbnMt cHJpdmFjeV0gW0ROU09QXSBOZXc6IGRyYWZ0LWJlcnRvbGEtYmNwLWRvaC1jbGllbnRzPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2Pg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVy PSIxIiBjZWxsc3BhY2luZz0iMyIgY2VsbHBhZGRpbmc9IjAiIHN0eWxlPSJiYWNrZ3JvdW5kOiNG M0ZGMzM7Ym9yZGVyOnNvbGlkICM5QjlBODcgMS41cHQiPg0KPHRib2R5Pg0KPHRyPg0KPHRkIHN0 eWxlPSJib3JkZXI6bm9uZTtwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij4NCjxwPjxz dHJvbmc+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzlCOEIzRSI+Q0FVVElPTjwvc3Bhbj48L3N0cm9uZz48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOUI4QjNFIj46PC9z cGFuPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlm O2NvbG9yOmJsYWNrIj4gRXh0ZXJuYWwgZW1haWwuIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVu DQogYXR0YWNobWVudHMgdW5sZXNzIHlvdSByZWNvZ25pemUgdGhlIHNlbmRlciBhbmQga25vdyB0 aGUgY29udGVudCBpcyBzYWZlLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7 QXJpYWwmcXVvdDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC90ZD4NCjwv dHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxkaXYgY2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNl bnRlciIgc3R5bGU9InRleHQtYWxpZ246Y2VudGVyIj4NCjxociBzaXplPSIzIiB3aWR0aD0iMTAw JSIgYWxpZ249ImNlbnRlciI+DQo8L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1h cmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUg c3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj5JU1RNIHRoYXQgaXQgaXMgcXVpdGUgcG9zc2libGUgdGhhdCBlbnRlcnByaXNl cyB0aGF0IGRlcGxveSB0aGVpciBvd24gRG9IPGJyPg0Kc2VydmljZXMgY291bGQgcG90ZW50aWFs bHkgcmVkdWNlIHN1Y2ggbGVha2FnZSBhbmQgZ2FpbiBvdmVyYWxsLiAoSSdtPGJyPg0KYXNzdW1p bmcgaGVyZSB0aGF0IHNlbnNpYmxlIGJyb3dzZXItbWFrZXJzIHdpbGwgZW5kIHVwIHByb3ZpZGlu Zzxicj4NCnNvbWV0aGluZyB0aGF0IHdvcmtzIGZvciBicm93c2VycyBydW5uaW5nIGluIG5ldHdv cmtzIHdpdGggc3BsaXQtaG9yaXpvbjxicj4NCnNldHVwcyBiZWZvcmUgdGhvc2UgYnJvd3NlcnMg dHVybiBvbiBEb0ggYXMgYSBkZWZhdWx0IGF0IHNjYWxlLik8bzpwPjwvbzpwPjwvcD4NCjwvYmxv Y2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCklmIEVudGVycHJpc2UgbmV0d29y ayBwcm92aWRlcyBhIERvVC9Eb0ggc2VydmVyLCBicm93c2VyIHNob3VsZCBiZSBhYmxlIHRvIGRp c2NvdmVyIGFuZCB1c2UgdGhlIEVudGVycHJpc2UgRG9UL0RvSCBzZXJ2ZXIuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+V2VsbCB1 bnRpbCBub3cgdGhlcmUgaGFzIGJlZW4gbm8gZGlzY292ZXJ5IG1lY2hhbmlzbSBmb3IgRG9IIHNl cnZlcnMuIFRoZXJlIGlzIG5vdyBkcmFmdCBhZG9wdGVkIGJ5IHRoZSBEb0ggV0cgdGhhdCBwcm9w b3NlcyBhIGRpc2NvdmVyeSBtZWNoYW5pc20uIEhvd2V2ZXIgd2hldGhlciBicm93c2VycyBhY3R1 YWxseSB1c2UgaXQgaXMgYW5vdGhlciBxdWVzdGlvbi4gSGVuY2UgdGhlIGRyYWZ0IGJ5IFZJdHRv cmlvLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5bVFJdIERpc2NvdmVyeSBhbG9uZSB3aWxsIG5v dCBzb2x2ZSB0aGUgcHJvYmxlbSwgdGhlIERvSCBjbGllbnQgbmVlZHMgdG8gdHJ1c3QgdGhlIGRp c2NvdmVyZWQgRG9IIHNlcnZlcnMgKHNlZQ0KPGEgaHJlZj0iaHR0cHM6Ly90b29scy5pZXRmLm9y Zy9odG1sL2RyYWZ0LXJlZGR5LWRwcml2ZS1ib290c3RyYXAtZG5zLXNlcnZlci0wMSI+DQpodHRw czovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtcmVkZHktZHByaXZlLWJvb3RzdHJhcC1kbnMt c2VydmVyLTAxPC9hPikuIDxvOnA+DQo8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkNoZWVycyw8bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi1UaXJ1PG86cD48L286cD48L3A+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5OZWlsPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90 ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAxMiBNYXIgMjAxOSwgYXQgMDY6MTQsIEtvbmRhLCBUaXJ1 bWFsZXN3YXIgUmVkZHkgJmx0OzxhIGhyZWY9Im1haWx0bzpUaXJ1bWFsZXN3YXJSZWRkeV9Lb25k YUBNY0FmZWUuY29tIj5UaXJ1bWFsZXN3YXJSZWRkeV9Lb25kYUBNY0FmZWUuY29tPC9hPiZndDsg d3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2lu LXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0O2ZvbnQtdmFyaWFudC1jYXBzOiBub3JtYWw7 b3JwaGFuczogYXV0bzt0ZXh0LWFsaWduOnN0YXJ0O3dpZG93czogYXV0bzstd2Via2l0LXRleHQt c2l6ZS1hZGp1c3Q6IGF1dG87LXdlYmtpdC10ZXh0LXN0cm9rZS13aWR0aDogMHB4O3dvcmQtc3Bh Y2luZzowcHgiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+LS0tLS1P cmlnaW5hbCBNZXNzYWdlLS0tLS08YnI+DQpGcm9tOiBTdGVwaGVuIEZhcnJlbGwgJmx0OzxhIGhy ZWY9Im1haWx0bzpzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllIj5zdGVwaGVuLmZhcnJlbGxAY3Mu dGNkLmllPC9hPiZndDs8YnI+DQpTZW50OiBUdWVzZGF5LCBNYXJjaCAxMiwgMjAxOSA1OjMwIEFN PGJyPg0KVG86IFBhdWwgVml4aWUgJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsQHJlZGJhcm4ub3Jn Ij5wYXVsQHJlZGJhcm4ub3JnPC9hPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1z cGFjZSI+Jm5ic3A7PC9zcGFuPjxhIGhyZWY9Im1haWx0bzpkb2hAaWV0Zi5vcmciPmRvaEBpZXRm Lm9yZzwvYT48YnI+DQpDYzogbmFsaW5pIGVsa2lucyAmbHQ7PGEgaHJlZj0ibWFpbHRvOm5hbGlu aS5lbGtpbnNAZS1kY28uY29tIj5uYWxpbmkuZWxraW5zQGUtZGNvLmNvbTwvYT4mZ3Q7OyBLb25k YSwgVGlydW1hbGVzd2FyIFJlZGR5PGJyPg0KJmx0OzxhIGhyZWY9Im1haWx0bzpUaXJ1bWFsZXN3 YXJSZWRkeV9Lb25kYUBNY0FmZWUuY29tIj5UaXJ1bWFsZXN3YXJSZWRkeV9Lb25kYUBNY0FmZWUu Y29tPC9hPiZndDs7PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+Jm5ic3A7PC9z cGFuPjxhIGhyZWY9Im1haWx0bzpkbnNvcEBpZXRmLm9yZyI+ZG5zb3BAaWV0Zi5vcmc8L2E+OyBB Y2tlcm1hbm4sPGJyPg0KTWljaGFlbCAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1hY2tlcm1hbm5AYmNi c20uY29tIj5tYWNrZXJtYW5uQGJjYnNtLmNvbTwvYT4mZ3Q7OyBDaHJpc3RpYW4gSHVpdGVtYTxi cj4NCiZsdDs8YSBocmVmPSJtYWlsdG86aHVpdGVtYUBodWl0ZW1hLm5ldCI+aHVpdGVtYUBodWl0 ZW1hLm5ldDwvYT4mZ3Q7OzxzcGFuIGNsYXNzPSJhcHBsZS1jb252ZXJ0ZWQtc3BhY2UiPiZuYnNw Ozwvc3Bhbj48YSBocmVmPSJtYWlsdG86ZG5zLXByaXZhY3lAaWV0Zi5vcmciPmRucy1wcml2YWN5 QGlldGYub3JnPC9hPjsgVml0dG9yaW8gQmVydG9sYTxicj4NCiZsdDs8YSBocmVmPSJtYWlsdG86 dml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmciPnZpdHRv cmlvLmJlcnRvbGE9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDs8YnI+ DQpTdWJqZWN0OiBSZTogW2Rucy1wcml2YWN5XSBbRE5TT1BdIE5ldzogZHJhZnQtYmVydG9sYS1i Y3AtZG9oLWNsaWVudHM8YnI+DQo8YnI+DQo8YnI+DQooVGhpcyBkaXN0cmlidXRpb24gbGlzdCBp cyB0b28gc2NhdHRlcmVkIGFuZCBkaXZlcnNlLiBCZSBncmVhdCBpZiBzb21lIEFEIG9yPGJyPg0K c29tZW9uZSBqdXN0IHBpY2tlZCBvbmUgbGlzdCBmb3IgdGhpcy48YnI+DQpJbiB0aGUgbWVhbnRp bWUuLi4pPGJyPg0KPGJyPg0KT24gMTEvMDMvMjAxOSAyMDo0MywgbmFsaW5pIGVsa2lucyB3cm90 ZTo8YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0i bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0 aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPmltcGFjdCBhc3Nlc3NtZW50IHRoYXQgY2VydGFpbiBjaGFu Z2VzIHN1Y2ggYXMgRG9IIGFuZCBUTFMxLjMgd2lsbDxicj4NCmhhdmUgb24gZW50ZXJwcmlzZXMs PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRp Y2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KVExTMS4zIHdpbGwsIEkgZXhwZWN0LCBub3RpY2Vh Ymx5IGltcHJvdmUgc2VjdXJpdHkgZm9yIGFuIGF3ZnVsIGxvdCBvZjxicj4NCmVudGVycHJpc2Vz IGluIHRpbWUuPGJyPg0KPGJyPg0KQXMgZm9yIERvSCwgSSB3b25kZXIgaGFzIGFueW9uZSBkb25l IHN0dWRpZXMgb24gaG93IHNwbGl0LWhvcml6b24gbmFtZXM8YnI+DQphbmQgYWNjZXNzIHBhdHRl cm5zIGxlYWsgdG9kYXk/PGJyPg0KPGJyPg0KSSBkb24ndCByZWNhbGwgaGF2aW5nIHJlYWQgdGhh dCBraW5kIG9mIHN0dWR5LiBJIGNhbiBpbWFnaW5lIG1hbnkgd2F5cyBpbjxicj4NCndoaWNoIHRo YXQga2luZCBvZiBzdHVmZiB3b3VsZCBsZWFrLiBJJ2QgYmUgdmVyeSBzdXJwcmlzZWQgaWYgaXQg bmV2ZXIgaGFwcGVucy48YnI+DQpJIGRvbid0IGtub3cgaG93IG9mdGVuIGl0IGRvZXMuPGJyPg0K PGJyPg0KRm9yIG5hbWVzLCBsZWFraW5nIG9uY2UgaXMga2luZGEgZmF0YWwuIEZvciBhY2Nlc3Mg cGF0dGVybnMsIEkgZ3Vlc3Mgb25lIGxlYWs8YnI+DQpleHBvc2VzIGFuIElQIGFkZHJlc3MgdGhh dCdzIGludGVyZXN0ZWQgaW4gYSBuYW1lIChlLmcuIHNlY3JldC08YnI+DQo8YSBocmVmPSJodHRw Oi8vcHJvamVjdC5leGFtcGxlLmNvbSI+cHJvamVjdC5leGFtcGxlLmNvbTwvYT4pIGJ1dCBtb3Jl IHdvdWxkIGJlIG5lZWRlZCBmb3IgYnJvYWRlciBhY2Nlc3M8YnI+DQpwYXR0ZXJucyB0byBiZSBl eHBvc2VkIHRvICZxdW90O2ZvcmVpZ24mcXVvdDs8YnI+DQpyZWN1cnNpdmVzIGFuZC9vciBpbi1i YW5kIG5ldHdvcmtzLjxicj4NCjxicj4NCklTVE0gdGhhdCBpdCBpcyBxdWl0ZSBwb3NzaWJsZSB0 aGF0IGVudGVycHJpc2VzIHRoYXQgZGVwbG95IHRoZWlyIG93biBEb0g8YnI+DQpzZXJ2aWNlcyBj b3VsZCBwb3RlbnRpYWxseSByZWR1Y2Ugc3VjaCBsZWFrYWdlIGFuZCBnYWluIG92ZXJhbGwuIChJ J208YnI+DQphc3N1bWluZyBoZXJlIHRoYXQgc2Vuc2libGUgYnJvd3Nlci1tYWtlcnMgd2lsbCBl bmQgdXAgcHJvdmlkaW5nPGJyPg0Kc29tZXRoaW5nIHRoYXQgd29ya3MgZm9yIGJyb3dzZXJzIHJ1 bm5pbmcgaW4gbmV0d29ya3Mgd2l0aCBzcGxpdC1ob3Jpem9uPGJyPg0Kc2V0dXBzIGJlZm9yZSB0 aG9zZSBicm93c2VycyB0dXJuIG9uIERvSCBhcyBhIGRlZmF1bHQgYXQgc2NhbGUuKTxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7 LHNhbnMtc2VyaWYiPjxicj4NCklmIEVudGVycHJpc2UgbmV0d29yayBwcm92aWRlcyBhIERvVC9E b0ggc2VydmVyLCBicm93c2VyIHNob3VsZCBiZSBhYmxlIHRvIGRpc2NvdmVyIGFuZCB1c2UgdGhl IEVudGVycHJpc2UgRG9UL0RvSCBzZXJ2ZXIuPGJyPg0KPGJyPg0KLVRpcnU8YnI+DQo8YnIgc3R5 bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7Zm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDt0 ZXh0LWFsaWduOnN0YXJ0Oy13ZWJraXQtdGV4dC1zdHJva2Utd2lkdGg6IDBweDt3b3JkLXNwYWNp bmc6MHB4Ij4NCjxicj4NCjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxl PSJtYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2 ZXRpY2EmcXVvdDssc2Fucy1zZXJpZiI+PGJyPg0KQ2hlZXJzLDxicj4NClMuPG86cD48L286cD48 L3NwYW4+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVvdDssc2Fu cy1zZXJpZiI+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX188 YnI+DQpETlNPUCBtYWlsaW5nIGxpc3Q8YnI+DQo8L3NwYW4+PGEgaHJlZj0ibWFpbHRvOkROU09Q QGlldGYub3JnIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90 O0hlbHZldGljYSZxdW90OyxzYW5zLXNlcmlmIj5ETlNPUEBpZXRmLm9yZzwvc3Bhbj48L2E+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtIZWx2ZXRpY2EmcXVv dDssc2Fucy1zZXJpZiI+PGJyPg0KPC9zcGFuPjxhIGhyZWY9Imh0dHBzOi8vd3d3LmlldGYub3Jn L21haWxtYW4vbGlzdGluZm8vZG5zb3AiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7SGVsdmV0aWNhJnF1b3Q7LHNhbnMtc2VyaWYiPmh0dHBzOi8vd3d3Lmll dGYub3JnL21haWxtYW4vbGlzdGluZm8vZG5zb3A8L3NwYW4+PC9hPjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_BYAPR16MB27905CEEB60A2B607E5B638CEA490BYAPR16MB2790namp_-- From nobody Tue Mar 12 08:16:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A0AFE131000 for ; Tue, 12 Mar 2019 08:16:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qImb3nKhaeLb for ; Tue, 12 Mar 2019 08:16:41 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30C04130FC4 for ; Tue, 12 Mar 2019 08:16:41 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 714F428011C; Tue, 12 Mar 2019 16:16:39 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id 6B47E28038C; Tue, 12 Mar 2019 16:16:39 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 631DA28011C; Tue, 12 Mar 2019 16:16:39 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 5CC50663E080; Tue, 12 Mar 2019 16:16:39 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 5542640235; Tue, 12 Mar 2019 16:16:39 +0100 (CET) Date: Tue, 12 Mar 2019 16:16:39 +0100 From: Stephane Bortzmeyer To: "Livingood, Jason" Cc: Stephane Bortzmeyer , DoH WG Message-ID: <20190312151639.oqgwgdficezoygfr@nic.fr> References: <20190309182857.GA29321@laperouse.bortzmeyer.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.107364, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.3.12.150616 Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:16:42 -0000 On Mon, Mar 11, 2019 at 01:49:31AM +0000, Livingood, Jason wrote a message of 64 lines which said: > But I certainly think you can concede generally speaking that > networks (of all types) strive to maximize performance & > reliability, and this usually includes good DNS services. I certainly hope it is the case. But not all the things I hope for materialize. > > > Loss of Parental Controls or other Content Controls > Many people have young children and may want to filter what content > they have access to at home. And some have children and never deployed any sort of technical parental control. (Or not using the DNS.) It seems to me there is a more profound issue here: should we (the IETF), when creating new protocols, ensure that *all* previous usages continue to work? Even if we never condoned them? Replying Yes to this question would put a severe burden on IETF shoulders; there are so many "creative" uses of the TCP/IP technologies that it is impossible to guarantee that everything will continue to work as before. Creating new protocols or new variants of old protocols will certainly disrupt things. Is it always bad? I don't think so. From nobody Tue Mar 12 08:26:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 845FA130E70 for ; Tue, 12 Mar 2019 08:26:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oRZnTjdyB21N for ; Tue, 12 Mar 2019 08:25:59 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6654C130E46 for ; Tue, 12 Mar 2019 08:25:59 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id D4FBE28033B; Tue, 12 Mar 2019 16:25:56 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id CF1E32804D4; Tue, 12 Mar 2019 16:25:56 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id C76A928033B; Tue, 12 Mar 2019 16:25:56 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id C19BD663E080; Tue, 12 Mar 2019 16:25:56 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id B6D8540235; Tue, 12 Mar 2019 16:25:56 +0100 (CET) Date: Tue, 12 Mar 2019 16:25:56 +0100 From: Stephane Bortzmeyer To: Jim Reid Cc: Stephane Bortzmeyer , DoH WG Message-ID: <20190312152556.ivzzvz6kcexkkxhq@nic.fr> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> <1964B641-FA66-4245-82B4-1351AA042BD2@rfc1035.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1964B641-FA66-4245-82B4-1351AA042BD2@rfc1035.com> X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.3.12.151815 Archived-At: Subject: [Doh] GDPR and IETF protocols (Was: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:26:02 -0000 On Sun, Mar 10, 2019 at 12:54:18PM +0000, Jim Reid wrote a message of 29 lines which said: > GDPR is a huge, sprawling issue that cannot possibly be addressed in > one over-arching framework for esch IETF protocol. So IMO it's best > to approach that on a procotol-by-protpcol (or WG-by-WG) > basis. YMMV. It makes sense to do so if there is some specificity of the protocol that makes it different from other protocols (a good example could be WebRTC when a client does not disclose its source IP address just to a known server but also to potentially unknown other clients). But in the case of DoH, I'm not sure it is the case. The GDPR issues seem very close to the issues of HTTP. From nobody Tue Mar 12 08:30:32 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 82B2E13106C for ; Tue, 12 Mar 2019 08:30:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XrhH8-ceDN3C for ; Tue, 12 Mar 2019 08:30:29 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 138BE13103D for ; Tue, 12 Mar 2019 08:30:29 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 9646A280298; Tue, 12 Mar 2019 16:30:27 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id 90043280285; Tue, 12 Mar 2019 16:30:27 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 89CE8663E720; Tue, 12 Mar 2019 16:30:27 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 853C940235; Tue, 12 Mar 2019 16:30:27 +0100 (CET) Date: Tue, 12 Mar 2019 16:30:27 +0100 From: Stephane Bortzmeyer To: "Livingood, Jason" Cc: Stephane Bortzmeyer , Jim Reid , DoH WG Message-ID: <20190312153027.pke5tn766uhh4ib4@nic.fr> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:30:31 -0000 On Mon, Mar 11, 2019 at 01:25:54AM +0000, Livingood, Jason wrote a message of 15 lines which said: > I think a slight difference is that with public DNS services, the > uptake occurs gradually as each individual user makes an explicit > choice. This isn't the case should large apps enable DoH. Hmmmm, usage of Google Public DNS or similar services is not always decided by the individual. A lot of WiFi hotspots, hotels, schools, even Internet access providers, configure the DHCP server to indicate Cisco OpenDNS or another public resolver as the DNS resolver to use. Also, applications talking directly to the DNS resolver, bypassing the system-wide configuration was possible even before DoH. From nobody Tue Mar 12 08:31:45 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB2351310BA; Tue, 12 Mar 2019 08:31:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c5ekruE620Zs; Tue, 12 Mar 2019 08:31:39 -0700 (PDT) Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3373413106C; Tue, 12 Mar 2019 08:31:38 -0700 (PDT) X-NAI-Header: Modified by McAfee Email Gateway (5500) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552404497; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-ms-exchange-purlcount:x-microsoft-antispam-prvs: x-forefront-prvs:x-forefront-antispam-report: received-spf:x-ms-exchange-senderadcheck:x-microsoft-antispam-message-info: Content-Type:MIME-Version:X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=aCaTgYhdkL9H96k2GKgBJFoW5Crd8hr1EfNElz ffUoY=; b=TVecrWjWnRenswgKAs/U5Y/QYb0bk51YZ3dVcugQ WxNeBSSHHDz7Dq95d4sqe3VM595CNCdkSPR1FoV/+lqyl8EYpg kI+Crin2M4P6+CVb4UuNj21mipKPsOOrDyFzKfhrzuBpzuyHig mYVfh+6FEGIfqvQHZgjjJffl+5tdd7A= Received: from DNVEXAPP1N05.corpzone.internalzone.com (unknown [10.44.48.89]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 0713_d065_6d26dfdb_15f9_41e8_b370_cd7052d7e84c; Tue, 12 Mar 2019 09:28:17 -0600 Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 09:31:14 -0600 Received: from DNVO365EDGE1.corpzone.internalzone.com (10.44.176.66) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Tue, 12 Mar 2019 09:31:14 -0600 Received: from NAM01-SN1-obe.outbound.protection.outlook.com (10.44.176.243) by edge.mcafee.com (10.44.176.66) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 09:31:12 -0600 Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2775.namprd16.prod.outlook.com (20.178.233.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.13; Tue, 12 Mar 2019 15:31:12 +0000 Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1709.011; Tue, 12 Mar 2019 15:31:12 +0000 From: "Konda, Tirumaleswar Reddy" To: Eliot Lear , "Winfield, Alister" CC: "dnsop@ietf.org" , "doh@ietf.org" , "dns-privacy@ietf.org" Thread-Topic: [dns-privacy] [EXTERNAL] [Doh] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2NykUOnXbuK5C0u7DjEHW45Cb6YIG/zg Date: Tue, 12 Mar 2019 15:31:12 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> <2D9C1616-EF47-4685-8155-99A718806EE9@sky.uk> <2F7920EE-F04C-43E9-8194-B0000A0756F7@cisco.com> In-Reply-To: <2F7920EE-F04C-43E9-8194-B0000A0756F7@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com; x-originating-ip: [49.37.203.5] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: bdf094dd-cb17-4180-9c8e-08d6a6ffc257 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB2775; x-ms-traffictypediagnostic: BYAPR16MB2775: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(346002)(39860400002)(136003)(376002)(32952001)(13464003)(199004)(189003)(54094003)(51444003)(790700001)(3846002)(6116002)(229853002)(316002)(93886005)(54906003)(110136005)(68736007)(26005)(476003)(25786009)(45080400002)(256004)(5024004)(14444005)(71200400001)(71190400001)(5660300002)(6436002)(6306002)(9686003)(55016002)(54896002)(4326008)(2906002)(52536013)(66574012)(236005)(53936002)(6246003)(53546011)(80792005)(6506007)(72206003)(14454004)(966005)(606006)(186003)(33656002)(7696005)(76176011)(99286004)(97736004)(478600001)(7736002)(446003)(102836004)(81166006)(81156014)(8676002)(106356001)(8936002)(74316002)(486006)(105586002)(11346002)(66066001)(86362001)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2775; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 9rl9RLrr5ci4kBhMTeP0XLIM1MYx84OapMvvIrx2a4iI0VoXCtAw7eLsf+BPunWp4wJPJlkYvt5X++9X3wdFSXLsCfs2amS4Gq784nTi+Zu0xKvHPlODKck0Zj5z2AK6UB9u5YerO76xRnTM7JmR+4FgGqJdPOBrKZydeO97sSMPtq2KF03N4kELJkXPhNtaRRi014QnC40jkwIO1/Qm2lbhEH7BT4CBthnk33eH/T4aVq6Y/8JZYByE6ssn36hXQO3LM+mcZbWv1BQWsjLJN/Aj94zqFxCzyYPeV+qHNkTP91W8cr9PYFFtFd15FhBZ210VyMheBIN6jjQePEaptQV6iE+PdkP+Uh6bWU0lTsj1gKl3Ccstlhp2z5t5/aSpngbiw3OH1r6GyfdugWiX+0cE0ajnB0A6qWdXI02oWEk= Content-Type: multipart/alternative; boundary="_000_BYAPR16MB2790DC9ABC4B4CF2ACC36638EA490BYAPR16MB2790namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: bdf094dd-cb17-4180-9c8e-08d6a6ffc257 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 15:31:12.4745 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2775 X-OriginatorOrg: mcafee.com X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 15 X-NAI-Spam-Score: 0.1 X-NAI-Spam-Version: 2.3.0.9418 : core <6501> : inlines <7032> : streams <1815501> : uri <2811445> Archived-At: Subject: Re: [Doh] [dns-privacy] [EXTERNAL] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:31:43 -0000 --_000_BYAPR16MB2790DC9ABC4B4CF2ACC36638EA490BYAPR16MB2790namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TURNIG1heSBvciBtYXkgbm90IGJlIGFjY2VwdGFibGUgZXZlbiBpbiBFbnRlcnByaXNlIG5ldHdv cmtzLiBGb3IgaW5zdGFuY2UsIHRvZGF5IG5ldHdvcmsgc2VjdXJpdHkgc2VydmljZXMgYXJlIHVz aW5nIE1MIHRlY2huaXF1ZXMgdG8gaWRlbnRpZnkgbWFsd2FyZSBmbG93cyB3aXRob3V0IGFjdGlu ZyBhcyBhIFRMUyBwcm94eS4gTURNIGlzIGFsc28gbm90IGFuIG9wdGlvbiB0byBzZWN1cmUgZGV2 aWNlcyBpbiB0aGUgaG9tZSBuZXR3b3JrcywgZXNwZWNpYWxseSBjb25zdW1lciBJb1QgZGV2aWNl cy4NCg0KQ2hlZXJzLA0KLVRpcnUNCg0KRnJvbTogZG5zLXByaXZhY3kgPGRucy1wcml2YWN5LWJv dW5jZXNAaWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBFbGlvdCBMZWFyDQpTZW50OiBUdWVzZGF5LCBN YXJjaCAxMiwgMjAxOSA3OjM0IFBNDQpUbzogV2luZmllbGQsIEFsaXN0ZXIgPEFsaXN0ZXIuV2lu ZmllbGRAc2t5LnVrPg0KQ2M6IGRuc29wQGlldGYub3JnOyBkb2hAaWV0Zi5vcmc7IGRucy1wcml2 YWN5QGlldGYub3JnDQpTdWJqZWN0OiBSZTogW2Rucy1wcml2YWN5XSBbRVhURVJOQUxdIFtEb2hd IFtETlNPUF0gTmV3OiBkcmFmdC1iZXJ0b2xhLWJjcC1kb2gtY2xpZW50cw0KDQpIaSwNCg0KDQpP biAxMiBNYXIgMjAxOSwgYXQgMTQ6MTEsIFdpbmZpZWxkLCBBbGlzdGVyIDxBbGlzdGVyLldpbmZp ZWxkQHNreS51azxtYWlsdG86QWxpc3Rlci5XaW5maWVsZEBza3kudWs+PiB3cm90ZToNCg0KTURN IGlzIGFsc28gYSByZWQtaGVycmluZyBnaXZlbiA+OTAlIG9mIGRldmljZXMgd29ybGQtd2lkZSBh cmVuJ3QgbWFuYWdlZCBzbyBhbnlvbmUgdGFsa2luZyBvZiBNRE0gcmlkaW5nIHRvIHRoZSByZXNj dWUgb2YgRG9IIGNsaWVudCBjb25maWd1cmF0aW9uIGlzIHdhbGtpbmcgYXJvdW5kIHdpdGggYmxp bmtlcnMgb24uDQoNCkZpcmVmb3ggaGFzIHB1Ymxpc2hlZCBhIHNwZWNpZmljIHBvbGljeSBpbnRl cmZhY2UganVzdCBmb3IgdGhpcyBwdXJwb3NlLiAgSSB0aGluayB0aGUgcG9pbnQsIGFuZCBwZXJo YXBzIG90aGVycyBjb3VsZCBjb3JyZWN0IG1lLCBpcyB0aGF0IHRoZSBNRE0gc2VydmVzIGFzIGV2 aWRlbmNlIHRoYXQgdGhlIG93bmVyIG9mIHRoZSBkZXZpY2UgaXMgYXV0aG9yaXppbmcgYSBjb25m aWd1cmF0aW9uIGNoYW5nZS4gIEFuZCB0aGUgdXNlIGNhc2UgSSBhbSBkaXNjdXNzaW5nIGlzIHRo ZSBlbnRlcnByaXNlIHVzZSBjYXNlLiAgWW91ciAjcyBkbyBub3QgdGFrZSB0aGF0IGludG8gYWNj b3VudC4NCg0KDQpFdmVuIGluc2lkZSBjb21wYW55IG5ldHdvcmtzIHRoZXJlIGFyZSBzZXJ2ZXJz IG5vdCB1bmRlciBNRE07DQoNClNlcnZlcnMgc2VlbSBhbiB1bmxpa2VseSB1c2Ugb2YgRG9IIGZy b20gYW4gYXBwbGljYXRpb24gaW4gcGFydGljdWxhci4NCg0KDQpsb2NhbGx5IGRldmVsb3BlZCBh cHBsaWNhdGlvbnMgdGhhdCBtaWdodCBpbiBmdXR1cmUgcHVsbCBpbiBhIERvSCByZXNvbHZlcjsN Cg0KSW4gdGhhdCBjYXNlLCB0aGUgZW50ZXJwcmlzZSBhZG1pbmlzdHJhdG9yIGlzIGFpbWluZyB0 aGUgc2hvdGd1biBhdCBoaXMgb3IgaGVyIG93biBmb290LiAgSSBwcm9wb3NlIG5vdCB0byBzb2x2 ZSB0aGF0IHByb2JsZW0sIGJ1dCByYXRoZXIgdG8gaGVscCB0aGVtIHdpdGggdG9vbHMgdG8gZG8g dGhlIHJpZ2h0IHRoaW5nLg0KDQoNCkJZT0Q7IHZpc2l0b3JzOyBtYWx3YXJlIGFuZCBzbyBvbi4N Cg0KSXQgaXMgY2VydGFpbmx5IG5vdCBiZXN0IHByYWN0aWNlIGZvciB2aXNpdG9ycyB0byBiZSBn cmFudGVkIGFjY2VzcyB0byBpbnRlcm5hbCBhY2Nlc3M7IGluc3RlYWQgdGhleSB0eXBpY2FsbHkg YXJlIGdpdmVuIGd1ZXN0IGFjY2Vzcy4NCg0KQllPRCBpcyBhIGRpZmZlcmVudCBzdG9yeS4gIEhl cmUgRG9IIG1heSBhZGQgcHJlc3N1cmUgb24gdGhvc2UgYnJpbmdpbmcgdGhlaXIgb3duIGRldmlj ZXMgdG8gaGF2ZSB0byBwbGFjZSB0aGVtIHVuZGVyIE1ETSBjb250cm9sLiAgVGhhdCBwcmVzc3Vy ZSBhbHJlYWR5IGV4aXN0cywgYnkgdGhlIHdheS4gIERvSCBqdXN0IGFkZHMgdG8gaXQuDQoNCg0K DQpTbyB3aGF0ZXZlciB5b3UgdGhpbmsgYSByZWFzb25hYmxlIHNvbHV0aW9uIGZvciBjbGllbnQg Y29uZmlndXJhdGlvbiBoYXMgdG8gc3RhcnQgd2l0aCB1bm1hbmFnZWQgY2xpZW50cy4gVGhhdCBs YXN0IG9uZSBtYWx3YXJlIGlzIHdoeSB0aGUgY29ycG9yYXRlIHJlc3BvbnNlIG1heSB3ZWxsIGJl ICdNSVRNJyB0aGUgdHJhZmZpYyBzbyB3ZSBjYW4gcHJvdGVjdCB0aGUgZGF0YSwgcGVvcGxlIGFu ZCBzeXN0ZW1zIHVzaW5nIG91ciBuZXR3b3JrLg0KDQpXaGF0IERvSCBkaXNjb3ZlcnkgYW5kIHBy ZXNlbnRhdGlvbiBsb29rcyBsaWtlIGlzIGNvbXBsZXggaXNzdWUgdGhhdCB3aWxsIHRha2Ugc29t ZSBkaXNjdXNzaW9uLiBKdXN0IG9uZSBzbWFsbCBleGFtcGxlLCBJIG1pZ2h0IHdhbnQgdG8gdXNl IHRoZSBsb2NhbCBuZXR3b3JrcyBETlMgaWYgYW5kIG9ubHkgaWYgaXQgcHJvdmlkZXMgYW50aS1t YWx3YXJlIHByb3RlY3Rpb24gYW5kIGhhcyBhIHJlYXNvbmFibGUgcHJpdmFjeSBwb2xpY3kgYnV0 IHVzZSBhIHN0YXRpYyBvbmUgaWYgbm90LiBPciBwZXJoYXBzIG9uIGEgY2hpbGQncyBkZXZpY2Ug aXQncyBva2F5IGlmIHRoZXJlIGlzIGZpbHRlcmluZyBpbiBwbGFjZSBzdWl0YWJsZSBmb3IgY2hp bGRyZW4uDQoNCkkgaGF2ZSBwcmV2aW91c2x5IHdyaXR0ZW4gaGVyZSB0aGF0IG1lYW5pbmdmdWwg Y29uc2VudCAoYeKAmWxhIFNhc3NlLCBBY3F1aXN0aSwgZXQgYWwpIGlzIGEga2V5IGlzc3VlLiAg V2l0aCB5b3VyIGV4YW1wbGUsIEFsaXN0ZXIsIHlvdSBhcmUgZXNzZW50aWFsbHkgYXNraW5nIGFi b3V0IG51bWJlciBvZiBhdHRyaWJ1dGVzIGZyb20gdGhlIEROUyBzZXJ2ZXI7IHNvbWUgb2Ygd2hp Y2ggd291bGQgaGF2ZSB0byBiZSBhc2NyaWJlZCBieSBvdGhlcnMgcmF0aGVyIHRoYW4gc2ltcGx5 IHNlbGYtYXNzZXJ0ZWQuICBBbmQgdGhlbiB5b3UgaGF2ZSB0byBtYWtlIGFsbCBvZiB0aGF0IGlu Zm9ybWF0aW9uIGNvbnN1bWFibGUgYW5kIGFjdGlvbmFibGUgYnkgYSBub3JtYWwgcGVyc29uLiAg R29vZCBsdWNrLg0KDQpKdXN0IGVzdGFibGlzaGluZyBhbiBvcGVyYXRpb25hbCBtb2RlbCBpbiB3 aGljaCBzcGxpdCBETlMgaXMgaGFuZGxlZCBjb3JyZWN0bHkgd2lsbCBiZSBlbm91Z2ggb2YgYSBj aGFsbGVuZ2UsIGJ1dCBpcyB3b3J0aCBleHBsb3JpbmcuDQoNCkFuZCB0aGF0IGlzIHdoeSBtdWNo IG9mIHRoaXMgc21lbGxzIGxpa2UgcmVzZWFyY2ggdG8gbWUuICBJZiB0aGVyZSBhcmUgd2lsbGlu ZyBwYXJ0bmVycywgSSB0aGluayB0aGF0IHdvdWxkIGJlIGEgZ3JlYXQgYXZlbnVlIHRvIHRyZWFk IGRvd24uDQoNCkVsaW90DQoNCg0KQWxpc3Rlcg0KDQrvu79PbiAxMi8wMy8yMDE5LCAwNTo0Mywg ImRucy1wcml2YWN5IG9uIGJlaGFsZiBvZiBLb25kYSwgVGlydW1hbGVzd2FyIFJlZGR5IiA8ZG5z LXByaXZhY3ktYm91bmNlc0BpZXRmLm9yZzxtYWlsdG86ZG5zLXByaXZhY3ktYm91bmNlc0BpZXRm Lm9yZz4gb24gYmVoYWxmIG9mIFRpcnVtYWxlc3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb208bWFp bHRvOlRpcnVtYWxlc3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb20+PiB3cm90ZToNCg0KDQotLS0t LU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogRWxpb3QgTGVhciA8bGVhckBjaXNjby5jb208 bWFpbHRvOmxlYXJAY2lzY28uY29tPj4NClNlbnQ6IE1vbmRheSwgTWFyY2ggMTEsIDIwMTkgMTE6 NDkgUE0NClRvOiBQYXVsIFZpeGllIDxwYXVsQHJlZGJhcm4ub3JnPG1haWx0bzpwYXVsQHJlZGJh cm4ub3JnPj4NCkNjOiBuYWxpbmkgZWxraW5zIDxuYWxpbmkuZWxraW5zQGUtZGNvLmNvbTxtYWls dG86bmFsaW5pLmVsa2luc0BlLWRjby5jb20+PjsgS29uZGEsIFRpcnVtYWxlc3dhciBSZWRkeQ0K PFRpcnVtYWxlc3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb208bWFpbHRvOlRpcnVtYWxlc3dhclJl ZGR5X0tvbmRhQE1jQWZlZS5jb20+PjsgZG9oQGlldGYub3JnPG1haWx0bzpkb2hAaWV0Zi5vcmc+ OyBkbnNvcEBpZXRmLm9yZzxtYWlsdG86ZG5zb3BAaWV0Zi5vcmc+Ow0KQWNrZXJtYW5uLCBNaWNo YWVsIDxtYWNrZXJtYW5uQGJjYnNtLmNvbTxtYWlsdG86bWFja2VybWFubkBiY2JzbS5jb20+Pjsg Q2hyaXN0aWFuIEh1aXRlbWENCjxodWl0ZW1hQGh1aXRlbWEubmV0PG1haWx0bzpodWl0ZW1hQGh1 aXRlbWEubmV0Pj47IGRucy1wcml2YWN5QGlldGYub3JnPG1haWx0bzpkbnMtcHJpdmFjeUBpZXRm Lm9yZz47IFZpdHRvcmlvIEJlcnRvbGENCjx2aXR0b3Jpby5iZXJ0b2xhPTQwb3Blbi14Y2hhbmdl LmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86dml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNoYW5n ZS5jb21AZG1hcmMuaWV0Zi5vcmc+PjsgU3RlcGhlbiBGYXJyZWxsDQo8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZTxtYWlsdG86c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT4+DQpTdWJqZWN0OiBS ZTogW0RvaF0gW2Rucy1wcml2YWN5XSBbRE5TT1BdIE5ldzogZHJhZnQtYmVydG9sYS1iY3AtZG9o LWNsaWVudHMNCg0KSGkgUGF1bCwNCg0KDQpPbiAxMSBNYXIgMjAxOSwgYXQgMTk6MTIsIFBhdWwg Vml4aWUgPHBhdWxAcmVkYmFybi5vcmc8bWFpbHRvOnBhdWxAcmVkYmFybi5vcmc+PiB3cm90ZToN Cg0KDQoNCm5hbGluaSBlbGtpbnMgd3JvdGUgb24gMjAxOS0wMy0xMSAxMDoyNjoNCg0KVGlydSwN ClRoYW5rcyBmb3IgeW91ciBjb21tZW50cy4NCg0KRW50ZXJwcmlzZSBuZXR3b3JrcyBhcmUgYWxy ZWFkeSBhYmxlIHRvIGJsb2NrIERvSCBzZXJ2aWNlcywNCmkgd29uZGVyIGlmIGV2ZXJ5b25lIGhl cmUga25vd3MgdGhhdCBUTFMgMS4zIGFuZCBlbmNyeXB0ZWQgaGVhZGVycyBpcw0KZ29pbmcgdG8g cHVzaCBhIFNPQ0tTIGFnZW5kYSBvbnRvIGVudGVycHJpc2VzIHRoYXQgaGFkIG5vdCBwcmV2aW91 c2x5DQpuZWVkZWQgb25lLCBhbmQgdGhhdCBzaW1wbHkgYmxvY2tpbmcgZXZlcnkgZXh0ZXJuYWwg ZW5kcG9pbnQga25vd24gb3INCnRlc3RlZCB0byBzdXBwb3J0IERvSCB3aWxsIGJlIHRoZSBjaGVh cGVyIGFsdGVybmF0aXZlLCBldmVuIGlmIHRoYXQgbWFrZXMNCm1pbGxpb25zIG9mIG90aGVyIGVu ZHBvaW50cyBhdCBnb29nbGUsIGNsb3VkZmxhcmUsIGNpc2NvLCBhbmQgaWJtIHVucmVhY2hhYmxl DQphcyBhIHNpZGUgZWZmZWN0Pw0KDQpUaGF0IG9yIGl0IHdpbGwgcmVxdWlyZSBhIGJpdCBtb3Jl IG1hbmFnZW1lbnQgYXQgdGhlIE1ETSBsZXZlbC4gIEnigJltIGhvcGluZw0KdGhlIGxhdHRlci4g IEFuZCBJIGhvcGUgdGhhdCBvbmUgb3V0cHV0IG9mIGFsbCBvZiB0aGVzZSBkb2N1bWVudHMgd2ls bCBiZSBhDQpyZWNvbW1lbmRhdGlvbiByZWdhcmRpbmcgTURNIGludGVyZmFjZXMuDQoNCiAgIEkg ZG9uJ3QgdGhpbmsgTURNIGlzIHJlcXVpcmVkIHRvIHVzZSB0aGUgRG9UL0RvSCBzZXJ2ZXJzIHBy b3ZpZGVkIGJ5IHRoZSBsb2NhbCBuZXR3b3JrLg0KDQogICAtVGlydQ0KDQoNCg0KRWxpb3QNCiAg IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICBkbnMt cHJpdmFjeSBtYWlsaW5nIGxpc3QNCiAgIGRucy1wcml2YWN5QGlldGYub3JnPG1haWx0bzpkbnMt cHJpdmFjeUBpZXRmLm9yZz4NCiAgIGh0dHBzOi8vZW1lYTAxLnNhZmVsaW5rcy5wcm90ZWN0aW9u Lm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJG bGlzdGluZm8lMkZkbnMtcHJpdmFjeSZhbXA7ZGF0YT0wMiU3QzAxJTdDYWxpc3Rlci53aW5maWVs ZCU0MHNreS51ayU3Q2FiNWZhYTkzM2YzNzRhZTdiNzJjMDhkNmE2YWRhMzQ4JTdDNjhiODY1ZDVj ZjE4NGIyYjgyYTRhNGVkZGI5YzUyMzclN0MwJTdDMCU3QzYzNjg3OTY2MjA1OTMzNzE4NCZhbXA7 c2RhdGE9YmJhM2JhcElPM2ZmaWx5bGhvSWoweDN6VmtIWWxOQzRHaWQ5NllieDlYbyUzRCZhbXA7 cmVzZXJ2ZWQ9MA0KICAgLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiAgIFRoaXMgZW1haWwgaXMgZnJvbSBhbiBleHRl cm5hbCBzb3VyY2UuIFBsZWFzZSBkbyBub3Qgb3BlbiBhdHRhY2htZW50cyBvciBjbGljayBsaW5r cyBmcm9tIGFuIHVua25vd24gb3Igc3VzcGljaW91cyBvcmlnaW4uIFBoaXNoaW5nIGF0dGVtcHRz IGNhbiBiZSByZXBvcnRlZCBieSBzZW5kaW5nIHRoZW0gdG8gcGhpc2hpbmdAc2t5LnVrPG1haWx0 bzpwaGlzaGluZ0Bza3kudWs+IGFzIGF0dGFjaG1lbnRzLiBUaGFuayB5b3UNCiAgIC0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tDQoNCg0KDQpJbmZvcm1hdGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1ZGluZyBhbnkgYXR0YWNo bWVudHMgbWF5IGJlIHByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCBhbmQgaXMgaW50ZW5kZWQgZXhj bHVzaXZlbHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSB2aWV3cyBleHByZXNzZWQgbWF5IG5vdCBi ZSBvZmZpY2lhbCBwb2xpY3ksIGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mgb2YgdGhlIG9yaWdpbmF0 b3IuIElmIHlvdSBoYXZlIHJlY2VpdmVkIGl0IGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBz ZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0ZW0uIFlv dSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNtaXQsIHVz ZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3ZSByZXNl cnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0aHJvdWdo IG91ciBpbnRlcm5hbCBhbmQgZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJr cyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcg YW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQoNClNreSBVSyBMaW1pdGVkIChSZWdpc3RyYXRp b24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJhdGlv biBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdpc3Ry YXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiA5 NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGltaXRl ZCAoUmVnaXN0cmF0aW9uIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlv bmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2Fs ZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNs ZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0KDQo= --_000_BYAPR16MB2790DC9ABC4B4CF2ACC36638EA490BYAPR16MB2790namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkRlbmdYaWFuOw0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAx IDE7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJpOw0KCXBhbm9zZS0xOjIgMTUg NSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6IlxARGVuZ1hpYW4i Ow0KCXBhbm9zZS0xOjIgMSA2IDAgMyAxIDEgMSAxIDE7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMg Ki8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBp bjsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQphOmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJ e21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1 bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1zb0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1z dHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJwbGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVy bGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21z by1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJn aW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0 OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5 Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7 fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1z aXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJ bWFyZ2luOjEuMGluIDEuMGluIDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxv OnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtl bmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJl ZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0 PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJs dWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk1ETSBtYXkgb3IgbWF5IG5vdCBiZSBhY2NlcHRhYmxlIGV2ZW4gaW4gRW50 ZXJwcmlzZSBuZXR3b3Jrcy4gRm9yIGluc3RhbmNlLCB0b2RheSBuZXR3b3JrIHNlY3VyaXR5IHNl cnZpY2VzIGFyZSB1c2luZyBNTCB0ZWNobmlxdWVzIHRvIGlkZW50aWZ5IG1hbHdhcmUgZmxvd3Mg d2l0aG91dCBhY3RpbmcgYXMgYSBUTFMgcHJveHkuIE1ETSBpcyBhbHNvIG5vdCBhbiBvcHRpb24g dG8gc2VjdXJlIGRldmljZXMgaW4NCiB0aGUgaG9tZSBuZXR3b3JrcywgZXNwZWNpYWxseSBjb25z dW1lciBJb1QgZGV2aWNlcy48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Q2hlZXJzLDxvOnA+PC9v OnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LVRpcnU8bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAxLjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQu MHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNF MUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48Yj5Gcm9tOjwvYj4gZG5zLXByaXZhY3kgJmx0O2Rucy1wcml2YWN5LWJvdW5jZXNAaWV0 Zi5vcmcmZ3Q7IDxiPk9uIEJlaGFsZiBPZg0KPC9iPkVsaW90IExlYXI8YnI+DQo8Yj5TZW50Ojwv Yj4gVHVlc2RheSwgTWFyY2ggMTIsIDIwMTkgNzozNCBQTTxicj4NCjxiPlRvOjwvYj4gV2luZmll bGQsIEFsaXN0ZXIgJmx0O0FsaXN0ZXIuV2luZmllbGRAc2t5LnVrJmd0Ozxicj4NCjxiPkNjOjwv Yj4gZG5zb3BAaWV0Zi5vcmc7IGRvaEBpZXRmLm9yZzsgZG5zLXByaXZhY3lAaWV0Zi5vcmc8YnI+ DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtkbnMtcHJpdmFjeV0gW0VYVEVSTkFMXSBbRG9oXSBbRE5T T1BdIE5ldzogZHJhZnQtYmVydG9sYS1iY3AtZG9oLWNsaWVudHM8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxicj4NCjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5 bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+T24gMTIgTWFyIDIwMTksIGF0IDE0OjExLCBXaW5maWVsZCwgQWxpc3Rl ciAmbHQ7PGEgaHJlZj0ibWFpbHRvOkFsaXN0ZXIuV2luZmllbGRAc2t5LnVrIj5BbGlzdGVyLldp bmZpZWxkQHNreS51azwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+TURNIGlzIGFsc28gYSByZWQtaGVycmluZyBnaXZlbiAmZ3Q7OTAl IG9mIGRldmljZXMgd29ybGQtd2lkZSBhcmVuJ3QgbWFuYWdlZCBzbyBhbnlvbmUgdGFsa2luZyBv ZiBNRE0gcmlkaW5nIHRvIHRoZSByZXNjdWUgb2YgRG9IIGNsaWVudCBjb25maWd1cmF0aW9uIGlz IHdhbGtpbmcgYXJvdW5kIHdpdGggYmxpbmtlcnMgb24uDQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5G aXJlZm94IGhhcyBwdWJsaXNoZWQgYSBzcGVjaWZpYyBwb2xpY3kgaW50ZXJmYWNlIGp1c3QgZm9y IHRoaXMgcHVycG9zZS4gJm5ic3A7SSB0aGluayB0aGUgcG9pbnQsIGFuZCBwZXJoYXBzIG90aGVy cyBjb3VsZCBjb3JyZWN0IG1lLCBpcyB0aGF0IHRoZSBNRE0gc2VydmVzIGFzIGV2aWRlbmNlIHRo YXQgdGhlDQo8Yj5vd25lcjwvYj4mbmJzcDtvZiB0aGUgZGV2aWNlIGlzIGF1dGhvcml6aW5nIGEg Y29uZmlndXJhdGlvbiBjaGFuZ2UuICZuYnNwO0FuZCB0aGUgdXNlIGNhc2UgSSBhbSBkaXNjdXNz aW5nIGlzIHRoZSBlbnRlcnByaXNlIHVzZSBjYXNlLiAmbmJzcDtZb3VyICNzIGRvIG5vdCB0YWtl IHRoYXQgaW50byBhY2NvdW50LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48YnI+DQo8YnI+DQo8bzpwPjwvbzpwPjwvcD4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5FdmVuIGluc2lkZSBjb21wYW55IG5ldHdvcmtzIHRoZXJlIGFyZSBz ZXJ2ZXJzIG5vdCB1bmRlciBNRE07DQo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlNlcnZlcnMgc2VlbSBhbiB1bmxp a2VseSB1c2Ugb2YgRG9IIGZyb20gYW4gYXBwbGljYXRpb24gaW4gcGFydGljdWxhci48bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4N CjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmxv Y2FsbHkgZGV2ZWxvcGVkIGFwcGxpY2F0aW9ucyB0aGF0IG1pZ2h0IGluIGZ1dHVyZSBwdWxsIGlu IGEgRG9IIHJlc29sdmVyOw0KPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gdGhhdCBjYXNlLCB0aGUg ZW50ZXJwcmlzZSBhZG1pbmlzdHJhdG9yIGlzIGFpbWluZyB0aGUgc2hvdGd1biBhdCBoaXMgb3Ig aGVyIG93biBmb290LiAmbmJzcDtJIHByb3Bvc2Ugbm90IHRvIHNvbHZlIHRoYXQgcHJvYmxlbSwg YnV0IHJhdGhlciB0byBoZWxwIHRoZW0gd2l0aCB0b29scyB0byBkbyB0aGUgcmlnaHQgdGhpbmcu PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCjxicj4N CjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJZ T0Q7IHZpc2l0b3JzOyBtYWx3YXJlIGFuZCBzbyBvbi4gPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+ Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SXQg aXMgY2VydGFpbmx5IG5vdCBiZXN0IHByYWN0aWNlIGZvciB2aXNpdG9ycyB0byBiZSBncmFudGVk IGFjY2VzcyB0byBpbnRlcm5hbCBhY2Nlc3M7IGluc3RlYWQgdGhleSB0eXBpY2FsbHkgYXJlIGdp dmVuIGd1ZXN0IGFjY2Vzcy4gJm5ic3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPkJZT0QgaXMgYSBkaWZmZXJlbnQgc3RvcnkuICZuYnNwO0hl cmUgRG9IIG1heSBhZGQgcHJlc3N1cmUgb24gdGhvc2UgYnJpbmdpbmcgdGhlaXIgb3duIGRldmlj ZXMgdG8gaGF2ZSB0byBwbGFjZSB0aGVtIHVuZGVyIE1ETSBjb250cm9sLiAmbmJzcDtUaGF0IHBy ZXNzdXJlIGFscmVhZHkgZXhpc3RzLCBieSB0aGUgd2F5LiAmbmJzcDtEb0gganVzdCBhZGRzIHRv IGl0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4N Cjxicj4NCjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4w cHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPlNvIHdoYXRldmVyIHlvdSB0aGluayBhIHJlYXNvbmFibGUgc29sdXRpb24gZm9yIGNsaWVu dCBjb25maWd1cmF0aW9uIGhhcyB0byBzdGFydCB3aXRoIHVubWFuYWdlZCBjbGllbnRzLiBUaGF0 IGxhc3Qgb25lIG1hbHdhcmUgaXMgd2h5IHRoZSBjb3Jwb3JhdGUgcmVzcG9uc2UgbWF5IHdlbGwg YmUgJ01JVE0nIHRoZSB0cmFmZmljIHNvIHdlIGNhbiBwcm90ZWN0IHRoZSBkYXRhLCBwZW9wbGUg YW5kIHN5c3RlbXMNCiB1c2luZyBvdXIgbmV0d29yay48YnI+DQo8YnI+DQpXaGF0IERvSCBkaXNj b3ZlcnkgYW5kIHByZXNlbnRhdGlvbiBsb29rcyBsaWtlIGlzIGNvbXBsZXggaXNzdWUgdGhhdCB3 aWxsIHRha2Ugc29tZSBkaXNjdXNzaW9uLiBKdXN0IG9uZSBzbWFsbCBleGFtcGxlLCBJIG1pZ2h0 IHdhbnQgdG8gdXNlIHRoZSBsb2NhbCBuZXR3b3JrcyBETlMgaWYgYW5kIG9ubHkgaWYgaXQgcHJv dmlkZXMgYW50aS1tYWx3YXJlIHByb3RlY3Rpb24gYW5kIGhhcyBhIHJlYXNvbmFibGUgcHJpdmFj eSBwb2xpY3kgYnV0IHVzZQ0KIGEgc3RhdGljIG9uZSBpZiBub3QuIE9yIHBlcmhhcHMgb24gYSBj aGlsZCdzIGRldmljZSBpdCdzIG9rYXkgaWYgdGhlcmUgaXMgZmlsdGVyaW5nIGluIHBsYWNlIHN1 aXRhYmxlIGZvciBjaGlsZHJlbi48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Js b2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkkgaGF2ZSBwcmV2aW91c2x5IHdyaXR0 ZW4gaGVyZSB0aGF0IDxiPm1lYW5pbmdmdWw8L2I+IGNvbnNlbnQgKGHigJlsYSBTYXNzZSwgQWNx dWlzdGksIGV0IGFsKSBpcyBhIGtleSBpc3N1ZS4gJm5ic3A7V2l0aCB5b3VyIGV4YW1wbGUsIEFs aXN0ZXIsIHlvdSBhcmUgZXNzZW50aWFsbHkgYXNraW5nIGFib3V0IG51bWJlciBvZiBhdHRyaWJ1 dGVzIGZyb20gdGhlIEROUyBzZXJ2ZXI7IHNvbWUgb2Ygd2hpY2ggd291bGQgaGF2ZQ0KIHRvIGJl IGFzY3JpYmVkIGJ5IG90aGVycyByYXRoZXIgdGhhbiBzaW1wbHkgc2VsZi1hc3NlcnRlZC4gJm5i c3A7QW5kIHRoZW4geW91IGhhdmUgdG8gbWFrZSBhbGwgb2YgdGhhdCBpbmZvcm1hdGlvbiBjb25z dW1hYmxlIGFuZCBhY3Rpb25hYmxlIGJ5IGEgbm9ybWFsIHBlcnNvbi4gJm5ic3A7R29vZCBsdWNr LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5K dXN0IGVzdGFibGlzaGluZyBhbiBvcGVyYXRpb25hbCBtb2RlbCBpbiB3aGljaCBzcGxpdCBETlMg aXMgaGFuZGxlZCBjb3JyZWN0bHkgd2lsbCBiZSBlbm91Z2ggb2YgYSBjaGFsbGVuZ2UsIGJ1dCBp cyB3b3J0aCBleHBsb3JpbmcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkFuZCB0aGF0IGlzIHdoeSBtdWNoIG9mIHRoaXMgc21lbGxzIGxpa2Ug cmVzZWFyY2ggdG8gbWUuICZuYnNwO0lmIHRoZXJlIGFyZSB3aWxsaW5nIHBhcnRuZXJzLCBJIHRo aW5rIHRoYXQgd291bGQgYmUgYSBncmVhdCBhdmVudWUgdG8gdHJlYWQgZG93bi48bzpwPjwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+RWxpb3Q8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6 NS4wcHQ7bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxicj4NCkFsaXN0ZXI8YnI+DQo8YnI+DQrvu79PbiAxMi8wMy8yMDE5LCAwNTo0Mywg JnF1b3Q7ZG5zLXByaXZhY3kgb24gYmVoYWxmIG9mIEtvbmRhLCBUaXJ1bWFsZXN3YXIgUmVkZHkm cXVvdDsgJmx0OzxhIGhyZWY9Im1haWx0bzpkbnMtcHJpdmFjeS1ib3VuY2VzQGlldGYub3JnIj5k bnMtcHJpdmFjeS1ib3VuY2VzQGlldGYub3JnPC9hPiBvbiBiZWhhbGYgb2YNCjxhIGhyZWY9Im1h aWx0bzpUaXJ1bWFsZXN3YXJSZWRkeV9Lb25kYUBNY0FmZWUuY29tIj5UaXJ1bWFsZXN3YXJSZWRk eV9Lb25kYUBNY0FmZWUuY29tPC9hPiZndDsgd3JvdGU6PGJyPg0KPGJyPg0KPGJyPg0KPG86cD48 L286cD48L3A+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90 dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0t LS0tPGJyPg0KRnJvbTogRWxpb3QgTGVhciAmbHQ7PGEgaHJlZj0ibWFpbHRvOmxlYXJAY2lzY28u Y29tIj5sZWFyQGNpc2NvLmNvbTwvYT4mZ3Q7PGJyPg0KU2VudDogTW9uZGF5LCBNYXJjaCAxMSwg MjAxOSAxMTo0OSBQTTxicj4NClRvOiBQYXVsIFZpeGllICZsdDs8YSBocmVmPSJtYWlsdG86cGF1 bEByZWRiYXJuLm9yZyI+cGF1bEByZWRiYXJuLm9yZzwvYT4mZ3Q7PGJyPg0KQ2M6IG5hbGluaSBl bGtpbnMgJmx0OzxhIGhyZWY9Im1haWx0bzpuYWxpbmkuZWxraW5zQGUtZGNvLmNvbSI+bmFsaW5p LmVsa2luc0BlLWRjby5jb208L2E+Jmd0OzsgS29uZGEsIFRpcnVtYWxlc3dhciBSZWRkeTxicj4N CiZsdDs8YSBocmVmPSJtYWlsdG86VGlydW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbSI+ VGlydW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFp bHRvOmRvaEBpZXRmLm9yZyI+ZG9oQGlldGYub3JnPC9hPjsgPGEgaHJlZj0ibWFpbHRvOmRuc29w QGlldGYub3JnIj5kbnNvcEBpZXRmLm9yZzwvYT47PGJyPg0KQWNrZXJtYW5uLCBNaWNoYWVsICZs dDs8YSBocmVmPSJtYWlsdG86bWFja2VybWFubkBiY2JzbS5jb20iPm1hY2tlcm1hbm5AYmNic20u Y29tPC9hPiZndDs7IENocmlzdGlhbiBIdWl0ZW1hPGJyPg0KJmx0OzxhIGhyZWY9Im1haWx0bzpo dWl0ZW1hQGh1aXRlbWEubmV0Ij5odWl0ZW1hQGh1aXRlbWEubmV0PC9hPiZndDs7IDxhIGhyZWY9 Im1haWx0bzpkbnMtcHJpdmFjeUBpZXRmLm9yZyI+DQpkbnMtcHJpdmFjeUBpZXRmLm9yZzwvYT47 IFZpdHRvcmlvIEJlcnRvbGE8YnI+DQombHQ7PGEgaHJlZj0ibWFpbHRvOnZpdHRvcmlvLmJlcnRv bGE9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnIj52aXR0b3Jpby5iZXJ0b2xhPTQw b3Blbi14Y2hhbmdlLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7OyBTdGVwaGVuIEZhcnJlbGw8 YnI+DQombHQ7PGEgaHJlZj0ibWFpbHRvOnN0ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWUiPnN0ZXBo ZW4uZmFycmVsbEBjcy50Y2QuaWU8L2E+Jmd0Ozxicj4NClN1YmplY3Q6IFJlOiBbRG9oXSBbZG5z LXByaXZhY3ldIFtETlNPUF0gTmV3OiBkcmFmdC1iZXJ0b2xhLWJjcC1kb2gtY2xpZW50czxicj4N Cjxicj4NCkhpIFBhdWwsPGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2tx dW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPk9uIDExIE1hciAyMDE5LCBhdCAxOToxMiwgUGF1bCBWaXhpZSAmbHQ7 PGEgaHJlZj0ibWFpbHRvOnBhdWxAcmVkYmFybi5vcmciPnBhdWxAcmVkYmFybi5vcmc8L2E+Jmd0 OyB3cm90ZTo8YnI+DQo8YnI+DQo8YnI+DQo8YnI+DQpuYWxpbmkgZWxraW5zIHdyb3RlIG9uIDIw MTktMDMtMTEgMTA6MjY6PGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8YmxvY2txdW90ZSBz dHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPlRpcnUsPGJyPg0KVGhhbmtzIGZvciB5b3VyIGNvbW1lbnRzLjxicj4NCjxicj4N CjxvOnA+PC9vOnA+PC9wPg0KPGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbi10b3A6NS4wcHQ7bWFy Z2luLWJvdHRvbTo1LjBwdCI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5FbnRlcnByaXNlIG5ldHdv cmtzIGFyZSBhbHJlYWR5IGFibGUgdG8gYmxvY2sgRG9IIHNlcnZpY2VzLDxvOnA+PC9vOnA+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPC9ibG9ja3F1b3RlPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+aSB3 b25kZXIgaWYgZXZlcnlvbmUgaGVyZSBrbm93cyB0aGF0IFRMUyAxLjMgYW5kIGVuY3J5cHRlZCBo ZWFkZXJzIGlzPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5nb2luZyB0byBwdXNoIGEgU09DS1MgYWdlbmRhIG9udG8gZW50ZXJwcmlzZXMgdGhhdCBo YWQgbm90IHByZXZpb3VzbHk8YnI+DQpuZWVkZWQgb25lLCBhbmQgdGhhdCBzaW1wbHkgYmxvY2tp bmcgZXZlcnkgZXh0ZXJuYWwgZW5kcG9pbnQga25vd24gb3I8YnI+DQp0ZXN0ZWQgdG8gc3VwcG9y dCBEb0ggd2lsbCBiZSB0aGUgY2hlYXBlciBhbHRlcm5hdGl2ZSwgZXZlbiBpZiB0aGF0IG1ha2Vz PGJyPg0KbWlsbGlvbnMgb2Ygb3RoZXIgZW5kcG9pbnRzIGF0IGdvb2dsZSwgY2xvdWRmbGFyZSwg Y2lzY28sIGFuZCBpYm0gdW5yZWFjaGFibGU8YnI+DQphcyBhIHNpZGUgZWZmZWN0Pzxicj4NCjxi cj4NClRoYXQgb3IgaXQgd2lsbCByZXF1aXJlIGEgYml0IG1vcmUgbWFuYWdlbWVudCBhdCB0aGUg TURNIGxldmVsLiAmbmJzcDtJ4oCZbSBob3Bpbmc8YnI+DQp0aGUgbGF0dGVyLiAmbmJzcDtBbmQg SSBob3BlIHRoYXQgb25lIG91dHB1dCBvZiBhbGwgb2YgdGhlc2UgZG9jdW1lbnRzIHdpbGwgYmUg YTxicj4NCnJlY29tbWVuZGF0aW9uIHJlZ2FyZGluZyBNRE0gaW50ZXJmYWNlcy48bzpwPjwvbzpw PjwvcD4NCjwvYmxvY2txdW90ZT4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCiZuYnNwOyZu YnNwOyZuYnNwO0kgZG9uJ3QgdGhpbmsgTURNIGlzIHJlcXVpcmVkIHRvIHVzZSB0aGUgRG9UL0Rv SCBzZXJ2ZXJzIHByb3ZpZGVkIGJ5IHRoZSBsb2NhbCBuZXR3b3JrLjxicj4NCjxicj4NCiZuYnNw OyZuYnNwOyZuYnNwOy1UaXJ1PGJyPg0KPGJyPg0KPGJyPg0KPG86cD48L286cD48L3A+DQo8Ymxv Y2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NCkVsaW90PG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVv dGU+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsmbmJzcDsmbmJzcDtfX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzxicj4NCiZuYnNwOyZuYnNwOyZuYnNw O2Rucy1wcml2YWN5IG1haWxpbmcgbGlzdDxicj4NCiZuYnNwOyZuYnNwOyZuYnNwOzxhIGhyZWY9 Im1haWx0bzpkbnMtcHJpdmFjeUBpZXRmLm9yZyI+ZG5zLXByaXZhY3lAaWV0Zi5vcmc8L2E+PGJy Pg0KJm5ic3A7Jm5ic3A7Jm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9lbWVhMDEuc2FmZWxpbmtzLnBy b3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5pZXRmLm9yZyUyRm1h aWxtYW4lMkZsaXN0aW5mbyUyRmRucy1wcml2YWN5JmFtcDthbXA7ZGF0YT0wMiU3QzAxJTdDYWxp c3Rlci53aW5maWVsZCU0MHNreS51ayU3Q2FiNWZhYTkzM2YzNzRhZTdiNzJjMDhkNmE2YWRhMzQ4 JTdDNjhiODY1ZDVjZjE4NGIyYjgyYTRhNGVkZGI5YzUyMzclN0MwJTdDMCU3QzYzNjg3OTY2MjA1 OTMzNzE4NCZhbXA7YW1wO3NkYXRhPWJiYTNiYXBJTzNmZmlseWxob0lqMHgzelZrSFlsTkM0R2lk OTZZYng5WG8lM0QmYW1wO2FtcDtyZXNlcnZlZD0wIj5odHRwczovL2VtZWEwMS5zYWZlbGlua3Mu cHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0dHBzJTNBJTJGJTJGd3d3LmlldGYub3JnJTJG bWFpbG1hbiUyRmxpc3RpbmZvJTJGZG5zLXByaXZhY3kmYW1wO2FtcDtkYXRhPTAyJTdDMDElN0Nh bGlzdGVyLndpbmZpZWxkJTQwc2t5LnVrJTdDYWI1ZmFhOTMzZjM3NGFlN2I3MmMwOGQ2YTZhZGEz NDglN0M2OGI4NjVkNWNmMTg0YjJiODJhNGE0ZWRkYjljNTIzNyU3QzAlN0MwJTdDNjM2ODc5NjYy MDU5MzM3MTg0JmFtcDthbXA7c2RhdGE9YmJhM2JhcElPM2ZmaWx5bGhvSWoweDN6VmtIWWxOQzRH aWQ5NllieDlYbyUzRCZhbXA7YW1wO3Jlc2VydmVkPTA8L2E+PGJyPg0KJm5ic3A7Jm5ic3A7Jm5i c3A7LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS08YnI+DQombmJzcDsmbmJzcDsmbmJzcDtUaGlzIGVtYWlsIGlzIGZyb20g YW4gZXh0ZXJuYWwgc291cmNlLiBQbGVhc2UgZG8gbm90IG9wZW4gYXR0YWNobWVudHMgb3IgY2xp Y2sgbGlua3MgZnJvbSBhbiB1bmtub3duIG9yIHN1c3BpY2lvdXMgb3JpZ2luLiBQaGlzaGluZyBh dHRlbXB0cyBjYW4gYmUgcmVwb3J0ZWQgYnkgc2VuZGluZyB0aGVtIHRvDQo8YSBocmVmPSJtYWls dG86cGhpc2hpbmdAc2t5LnVrIj5waGlzaGluZ0Bza3kudWs8L2E+IGFzIGF0dGFjaG1lbnRzLiBU aGFuayB5b3U8YnI+DQombmJzcDsmbmJzcDsmbmJzcDstLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTxicj4NCjxicj4NCjxi cj4NCjxicj4NCkluZm9ybWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2ht ZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNs dXNpdmVseSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJl IG9mZmljaWFsIHBvbGljeSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRv ci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZQ0KIG5vdGlmeSB0aGUg c2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZ b3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1 c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVz ZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3Vn aCBvdXIgaW50ZXJuYWwgYW5kDQogZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBt YXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwg QUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuPGJyPg0KPGJyPg0KU2t5IFVLIExpbWl0ZWQg KFJlZ2lzdHJhdGlvbiBOby4gMjkwNjk5MSksIFNreS1Jbi1Ib21lIFNlcnZpY2UgTGltaXRlZCAo UmVnaXN0cmF0aW9uIE5vLiAyMDY3MDc1KSwgU2t5IFN1YnNjcmliZXJzIFNlcnZpY2VzIExpbWl0 ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjM0MDE1MCkgYW5kIFNreSBDUCBMaW1pdGVkIChSZWdpc3Ry YXRpb24gTm8uIDk1MTMyNTkpIGFyZSBkaXJlY3Qgb3IgaW5kaXJlY3Qgc3Vic2lkaWFyaWVzIG9m IFNreSBMaW1pdGVkIChSZWdpc3RyYXRpb24NCiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29t cGFuaWVzIG1lbnRpb25lZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVu Z2xhbmQgYW5kIFdhbGVzIGFuZCBzaGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBH cmFudCBXYXksIElzbGV3b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQ8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4N Cg== --_000_BYAPR16MB2790DC9ABC4B4CF2ACC36638EA490BYAPR16MB2790namp_-- From nobody Tue Mar 12 08:36:54 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 262261310BA; Tue, 12 Mar 2019 08:36:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oRQvqWQiLUqj; Tue, 12 Mar 2019 08:36:37 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFDD5130DF6; Tue, 12 Mar 2019 08:36:37 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 3CE9F280298; Tue, 12 Mar 2019 16:36:36 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id 340CB280285; Tue, 12 Mar 2019 16:36:36 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 2F650663E720; Tue, 12 Mar 2019 16:36:36 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 1D1B640235; Tue, 12 Mar 2019 16:36:36 +0100 (CET) Date: Tue, 12 Mar 2019 16:36:36 +0100 From: Stephane Bortzmeyer To: nalini elkins Cc: Christian Huitema , doh@ietf.org, Vittorio Bertola , dnsop@ietf.org, dns-privacy@ietf.org, "Ackermann, Michael" , Stephen Farrell Message-ID: <20190312153636.qdsdne24vmi4xdoe@nic.fr> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:36:39 -0000 On Mon, Mar 11, 2019 at 08:55:18AM +0530, nalini elkins wrote a message of 202 lines which said: > The questions that the Fortune 50 company architect asked were something > like this: > > 1. You mean that DNS could be resolved outside my enterprise? I suggest to explain to this person that it was possible before, as any malware author discovered. > 2. So whoever that is that resolves my DNS sees the pattern and frequency > of what sites my company goes to? RFC 7626 :-) > It would be good to also discuss how to warn enterprises that this > is about to happen. I wonder if an announcement via CERT or another > group may be appropriate. If people responsible for networks of Fortune 50 company don't know that it is difficult to stop unwanted communication (except when you control all the endpoints, or when you airgap your network), then it is indeed a problem :-) From nobody Tue Mar 12 08:39:33 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 251AC1200B3; Tue, 12 Mar 2019 08:39:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xkFRvLGjfO9K; Tue, 12 Mar 2019 08:39:22 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A672126F72; Tue, 12 Mar 2019 08:39:22 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 9E58E28038C; Tue, 12 Mar 2019 16:39:20 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id 9532F28033B; Tue, 12 Mar 2019 16:39:20 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 91318663E720; Tue, 12 Mar 2019 16:39:20 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 8CD5440235; Tue, 12 Mar 2019 16:39:20 +0100 (CET) Date: Tue, 12 Mar 2019 16:39:20 +0100 From: Stephane Bortzmeyer To: Paul Vixie Cc: Christian Huitema , Stephen Farrell , doh@ietf.org, dnsop@ietf.org, nalini elkins , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" Message-ID: <20190312153920.4w4gmlrsglrvjt4p@nic.fr> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:39:24 -0000 On Sun, Mar 10, 2019 at 10:24:56PM -0700, Paul Vixie wrote a message of 82 lines which said: > set up a war between end users and network operators, Well, the tussle already exists. It does not depend on whether you like it or not, on whether the IETF approves it or not. When people have different interests, there is a tussle. What we can hope is to discuss it in civilized ways. But we cannot make it disappear. From nobody Tue Mar 12 08:44:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 293AF1277E7; Tue, 12 Mar 2019 08:44:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pxY_TxqOVBBG; Tue, 12 Mar 2019 08:44:39 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66E26130DF6; Tue, 12 Mar 2019 08:44:39 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id D282A28033B; Tue, 12 Mar 2019 16:44:37 +0100 (CET) Received: from relay01.prive.nic.fr (pa-th3.interco.nic.fr [192.134.4.74]) by mx4.nic.fr (Postfix) with ESMTP id C99D3280285; Tue, 12 Mar 2019 16:44:37 +0100 (CET) Received: from b12.nic.fr (b12.users.prive.nic.fr [10.10.86.133]) by relay01.prive.nic.fr (Postfix) with ESMTP id C5778663E720; Tue, 12 Mar 2019 16:44:37 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id BD36440235; Tue, 12 Mar 2019 16:44:37 +0100 (CET) Date: Tue, 12 Mar 2019 16:44:37 +0100 From: Stephane Bortzmeyer To: nalini elkins Cc: Christian Huitema , doh@ietf.org, Vittorio Bertola , dnsop@ietf.org, dns-privacy@ietf.org, "Ackermann, Michael" , Stephen Farrell Message-ID: <20190312154437.sefkyglilqvwexx7@nic.fr> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:44:41 -0000 On Mon, Mar 11, 2019 at 09:59:11AM +0530, nalini elkins wrote a message of 231 lines which said: > Companies also (validly, in my opinion) wish to know if their > employees are going to fantasyfootballgame.com while they are > supposedly doing work and of course, other sites which people should > not be going to during work time. If I am paying someone, I expect > them to do work that I wish them to do. Not all companies work that way. Some evaluate the work done by the results, not by the time spent at the desk. Please let's not discuss IETF protocols while assuming that all companies are the same, and that we have to endorse all their policies. From nobody Tue Mar 12 08:45:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FE4E13121C for ; Tue, 12 Mar 2019 08:44:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iDIa7dDOiE8j for ; Tue, 12 Mar 2019 08:44:52 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D630613118A for ; Tue, 12 Mar 2019 08:44:51 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 80AD924211EE; Tue, 12 Mar 2019 15:44:43 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190312152556.ivzzvz6kcexkkxhq@nic.fr> Date: Tue, 12 Mar 2019 15:44:42 +0000 Cc: DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <76DC1BD1-98A6-4F51-AB33-957061359099@rfc1035.com> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> <1964B641-FA66-4245-82B4-1351AA042BD2@rfc1035.com> <20190312152556.ivzzvz6kcexkkxhq@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] GDPR and IETF protocols X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:44:59 -0000 > On 12 Mar 2019, at 15:25, Stephane Bortzmeyer = wrote: >=20 > But in the case of DoH, I'm not sure it is the case. The GDPR issues > seem very close to the issues of HTTP. Some GDPR issues are the same for both DoH and HTTP. After all the = protocol for the former is a subset of the protocol for the latter. = However there are additional GDPR issues for DoH. An obvious one is the = underlying query data. From nobody Tue Mar 12 08:49:26 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C6661277E7; Tue, 12 Mar 2019 08:49:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q-JYVxva92TZ; Tue, 12 Mar 2019 08:49:15 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6EC05130E8C; Tue, 12 Mar 2019 08:49:15 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 036C4280285; Tue, 12 Mar 2019 16:49:14 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id EE9B2280522; Tue, 12 Mar 2019 16:49:13 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id E6559280285; Tue, 12 Mar 2019 16:49:13 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id E1CA8663E720; Tue, 12 Mar 2019 16:49:13 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id D29D440235; Tue, 12 Mar 2019 16:49:13 +0100 (CET) Date: Tue, 12 Mar 2019 16:49:13 +0100 From: Stephane Bortzmeyer To: Paul Vixie Cc: Christian Huitema , doh@ietf.org, dnsop@ietf.org, "Ackermann, Michael" , nalini elkins , dns-privacy@ietf.org, Stephen Farrell , Vittorio Bertola Message-ID: <20190312154913.4ch2bn6jyu53tfhl@nic.fr> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000000, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.3.12.153916 Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:49:17 -0000 On Sun, Mar 10, 2019 at 11:17:43PM -0700, Paul Vixie wrote a message of 36 lines which said: > > You claim the right to impose your rules, because it is "your network". > > Yet you have to define ownership. > my network, my rules. your provider's network, their rules. I clearly disagree. If the case of my home network (mine, my rules) is clear, the case of a corporate network is less clear (an employee is not a slave, and he/she has rights) and the case of a commercial Internet access provider is clear in the other direction: a client is not an employee, and is entitled to a free, open and neutral Internet access. From nobody Tue Mar 12 08:51:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42C0C130E77; Tue, 12 Mar 2019 08:51:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BSZF3xS_v6eB; Tue, 12 Mar 2019 08:51:31 -0700 (PDT) Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 25C51130E46; Tue, 12 Mar 2019 08:51:31 -0700 (PDT) X-NAI-Header: Modified by McAfee Email Gateway (5500) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552405685; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-ms-exchange-purlcount:x-microsoft-exchange-diagnostics: x-microsoft-antispam-prvs:x-forefront-prvs: x-forefront-antispam-report:received-spf:x-ms-exchange-senderadcheck: x-microsoft-antispam-message-info:Content-Type: MIME-Version:X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Threshold: X-NAI-Spam-Score:X-NAI-Spam-Version; bh=5 9AiTEiS4+9MT3ZAI2wccHo//QZqzSgpDVxQCAJSxE w=; b=T85NLJlkt/opAmwNP58D4Fnhy78pzIoA+CUBdJET/Sx4 yRpunRTOj+802Jmqi5Qo9CLrEcjnM/aXtfSox7xHzAmwpRuqD/ DnI78i9E82g0FD3NLjfizinDhwOW41kwMO3OFv20FezT0Mxtot 8S1rmLztpaixxE6z9Z0UCpNj/84= Received: from DNVEXAPP1N05.corpzone.internalzone.com (unknown [10.44.48.89]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 071f_ae20_24fbe854_7a6d_48c0_b88c_71918a126796; Tue, 12 Mar 2019 09:48:04 -0600 Received: from DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 09:50:42 -0600 Received: from DNVO365EDGE1.corpzone.internalzone.com (10.44.176.66) by DNVEXAPP1N05.corpzone.internalzone.com (10.44.48.89) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Tue, 12 Mar 2019 09:50:42 -0600 Received: from NAM02-CY1-obe.outbound.protection.outlook.com (10.44.176.240) by edge.mcafee.com (10.44.176.66) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 09:50:39 -0600 Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2454.namprd16.prod.outlook.com (20.177.226.217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.19; Tue, 12 Mar 2019 15:50:39 +0000 Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1709.011; Tue, 12 Mar 2019 15:50:39 +0000 From: "Konda, Tirumaleswar Reddy" To: Eric Rescorla CC: "doh@ietf.org" , "dnsop@ietf.org" , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Thread-Topic: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2C+f7jidn2WHF0WeuF/A93J/OKYGu6uAgAA7DwCAASpAQA== Date: Tue, 12 Mar 2019 15:50:39 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com; x-originating-ip: [49.37.203.5] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b568b25b-9e1c-4579-4e6f-08d6a7027a17 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB2454; x-ms-traffictypediagnostic: BYAPR16MB2454: x-ms-exchange-purlcount: 3 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtCWUFQUjE2TUIyNDU0OzIzOjBsakhIaEhtWHRzclhPR0NTSTcvR0lOUnhH?= =?utf-8?B?UFVGQkdvbG83WGRkeEc0dWtXc3A3aG9jN0hpU1hJWDl5dGlSYU9sSjYvWXQ3?= =?utf-8?B?eE1WTWhUcmJPMllMbzVnT05ZZmFEeWhsTndhbEM1Tmd3NGZEWGd5ZFU5QVpW?= =?utf-8?B?VkROdXhJMnNoZS9DQnlqVVMyTkRMcEtSZnlrelpBYVFtclNLTHZ5Y241aERX?= =?utf-8?B?ZEsxT2NYQmNCak9Nb0p2UVFnZHhSWCtaeGF2ZDc1SDd2Y0dKYzFONkUvWFZk?= =?utf-8?B?TVFpYlpVaEdlQXFYSmxlZTZkZG1RT0o3emovRVhNcFUyV3RVdWc5RXl2NnhJ?= =?utf-8?B?UWJvMzc2aHMybmExQWo2V1p2ZUR3SDFpaDkxSW05cWY1Rm1mcjVXWWM5SVpF?= =?utf-8?B?ZkhwaE5QUUFuUWJHQUIwYXlMTlhJMW8zYndKbUNRRURJR2hQdTNxWm5DY1BJ?= =?utf-8?B?SC9RU3ArVXdGK1FKTkdYK2h4Mm0zU1RMamh1S1BnbERhTnVYcjdBT0xsTWpO?= =?utf-8?B?ZHVSdjdqOFlPa1J6dENOZDVpa08xSG9MNXdDYXpxSEZ3YWJHckYzTVdCMi9y?= =?utf-8?B?cHRLZjFjbHlRdEJRLzQvS1ZFRlp2S2R3eWEveFpsY0o4RXJEMUsvSVZHWTVD?= =?utf-8?B?NWZoVzExMjJUdU50UnhRWnNjZ3I3ZG9jSUxxL2Vpb2VueDl6VkgrSjFEUW40?= =?utf-8?B?cXladG9NdXVxQ0tlVzZtTVFrdVdpMm5MKzJUckdaVmRCRUFSakdIeFFFQXdo?= =?utf-8?B?NGd0WFc2ZzFMb3BzaDBFYWg2TWNhTjZlLzREWWlzWmJSTTVYK0c4OVBBaS9D?= =?utf-8?B?dEovV0k2NFhXYlJ5blhTdVF3eGh2RTlLRGsxRzNxU3hoVlIzaVJsdTRhcnkw?= =?utf-8?B?YnNybHhLb3ZrMGdBaTIvV0lRd3I3WWtJTGtYa1duYXJFU0VGcEJxbUhrM2pk?= =?utf-8?B?bGl6NGhVbUt3bngrY01vazFmdFhzU2pjcVgxU2FmdEhmUXBLNmRyNVllWG9R?= =?utf-8?B?Wlp4Ry9ZK1Z4RmQ2ZFlMT2VIdDBZVlcwVkROZ1BVUUJPUlpJVzlwbklhRXF3?= =?utf-8?B?cmxGeU9qNDdHMDd2dy9seEVjYjNJeWpBYUpjU1gwN1lscGZHcFloT1hqYm8y?= =?utf-8?B?K0RkOW53NCtvYzNDc25pNFBzWStidVplR1c2V0ZJWFlnSkFvenU2WHk5dVZG?= =?utf-8?B?ZUJEWjVXZHpVQTEyeEZpR1pxWDByOWs4QVBCL2hWWjk2YmlqL3BCcDY1aFhL?= =?utf-8?B?TEJ1ZTllTTluRVJnTlVKZXdZS0JudFhLYjJXTlVmM3RWZEJHamNhM3RaUytl?= =?utf-8?B?cHpCQndMUS9WWjRBVzVFMDNFaVM4UTFOSU9ZNW96aDFuejMrS2YyV0pxRXRu?= =?utf-8?B?dENabisvcHo3d09EK1hmZ3hCanM2eDNlZFVvV3BhZDlMMndxeGsrNHR4OEF4?= =?utf-8?B?eFZTalhVYngrNXU0cFdwV1llNTE2RmFUSnFLdzNGTnFJbkEra3paYXlaUi9p?= =?utf-8?B?OTUrc1ZYd2Y5dHAwektBMFZyMlB4NEFuTlJqemRybmxoMnIxSjlLUXgzc0RT?= =?utf-8?B?eGhHZEFJTGMrRUZIcjdnT25MQ3hlKzlUZFFmY1Uvek9RUHd0WXJxQ3IySmx4?= =?utf-8?B?NUR0d2FobzNLMmJCK0twQjlBeVI1WG1CV3c2dHlXSUdZTW45VUxFR2xZZ2Zw?= =?utf-8?B?SG9aL1grQzNLdFMxRWFXWnB5RTFuNmVNcXJ4a2w0QmpTTU5lRmVBdWN1MnZo?= =?utf-8?B?N3FJZi9yNVhmd28wdjhBUGdwTERnc3JaTzJyRTdVdEJ4elU1djZFUlNmbURp?= =?utf-8?B?eVIwMloyUitaTmVxYlhiYk53c0t1bTYzNnNvNStCcVJSYXlGR1laNjVva3F1?= =?utf-8?B?Vkx0U2VLaVR5UzJDcTBMK3YxTVdVS3ZGYlBXbkJXTGoxcmUwcFVQU3VYcDRa?= =?utf-8?B?UnMwbWpROVVFTHM4L1FsaWlGQWZMYXNkbmJhWitHbTRKNFRFNk1KdElWbHRS?= =?utf-8?B?dlJtaU9ucjU1ZWpYTThIdW1qU3k1dm9KdURQc1dmQTRjQk5JWTBQSzNGS0RS?= =?utf-8?B?SVhxTzFvcDVkNGVxZlArMVROUFpIbXpXdlV3SXJ6eEtlNjlEOHJ5WUN5Q1RI?= =?utf-8?B?Wkx4Nk9SYytzSm9rNHp6ckFWQ3A5d28yQ0JpOEZMcDdFWVFPV3BQUnFwN1Vh?= =?utf-8?B?alRGY1VXUVBwZWlWRnN2dTc1RHpBPT0=?= x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6019001)(39860400002)(376002)(346002)(396003)(366004)(136003)(269900001)(189003)(199004)(54094003)(32952001)(99286004)(3846002)(966005)(476003)(66066001)(5024004)(9686003)(26005)(7696005)(68736007)(14444005)(6916009)(33656002)(6116002)(7736002)(106356001)(76176011)(186003)(5660300002)(105586002)(80792005)(6506007)(72206003)(53546011)(102836004)(790700001)(74316002)(229853002)(6246003)(316002)(6306002)(55016002)(54896002)(4326008)(53936002)(93886005)(6436002)(2906002)(8936002)(446003)(236005)(54906003)(14454004)(71200400001)(71190400001)(86362001)(8676002)(478600001)(9326002)(486006)(81156014)(52536013)(81166006)(97736004)(606006)(11346002)(25786009)(256004)(85282002)(256605007)(16193025007); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2454; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: oVGywpr25VU3Vte4Gw08ZurrSEctCBrQnK1fxESMWq2ShZCvQ15Hky53vyqGBh0zkh7P89CDvIZKub+opEbD9h8oAkpgxj4HsZYXwYENlMIkSRQB/4FGD/gIlouEtFM25I/51ZkFlRs4kkvdJnAywAhpkP/aavzQLQEAP0T5HXqC2OgoRoDK+afQnPgOIpx9ZXXymfOlRBSxf9ITSd5xvOq6mjZGeNgxVFrzQe/IBdjPUFxljhSZ7NEiY/CsCpgTc8y0Qgz/FBrZk01KDYiqDXuj2aG1netvLJAC+m3ECSI9mtRi6p3TcHfbfnZt3qSiQ9cFgeBqqtg3Oas8azDRvXTVVkyC/vAAdMSZQLSyCA+B5dPVslK+IozjjKddyj7Ov4r9cd5EmzTpfn3TRNxf7in+dQyDw1jrArJ9z2VcMZw= Content-Type: multipart/alternative; boundary="_000_BYAPR16MB2790E12D58E5ED2F58355CCDEA490BYAPR16MB2790namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b568b25b-9e1c-4579-4e6f-08d6a7027a17 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 15:50:39.7843 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2454 X-OriginatorOrg: mcafee.com X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 15 X-NAI-Spam-Score: 0 X-NAI-Spam-Version: 2.3.0.9418 : core <6501> : inlines <7032> : streams <1815502> : uri <2811454> Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:51:35 -0000 --_000_BYAPR16MB2790E12D58E5ED2F58355CCDEA490BYAPR16MB2790namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRXJpYywNCg0KSW4gVExTIDEuMiwgaXQgaXMgcG9zc2libGUgZm9yIGZpcmV3YWxscyB0byBp bnNwZWN0IHRoZSBUTFMgaGFuZHNoYWtlLCBhbmQgd2hpdGUtbGlzdCwgYmxhY2stbGlzdCBhbmQg Z3JleS1saXN0IFRMUyBzZXNzaW9uIGJhc2VkIG9uIHRoZSBzZXJ2ZXIgaWRlbnRpdHkuIEluIG90 aGVyIHdvcmRzLCBtaWRkbGVib3hlcyBhcmUgY29uZGl0aW9uYWxseSBhY3RpbmcgYXMgVExTIHBy b3hpZXMgdG8gc3BlY2lmaWMgc2VydmVycyAoY2F0ZWdvcml6ZWQgaW4gdGhlIGdyZXktbGlzdCku DQpXaXRoIFRMUyAxLjMgYW5kIGVuY3J5cHRlZCBTTkksIHRoZSBtaWRkbGUgYm94IG5vdyBoYXMg dG8gYWN0IGFzIGEgVExTIHByb3h5IGZvciBhbGwgdGhlIGZsb3dzLg0KDQotVGlydQ0KDQpGcm9t OiBFcmljIFJlc2NvcmxhIDxla3JAcnRmbS5jb20+DQpTZW50OiBUdWVzZGF5LCBNYXJjaCAxMiwg MjAxOSAzOjE0IEFNDQpUbzogUGF1bCBWaXhpZSA8cGF1bEByZWRiYXJuLm9yZz4NCkNjOiBuYWxp bmkgZWxraW5zIDxuYWxpbmkuZWxraW5zQGUtZGNvLmNvbT47IEtvbmRhLCBUaXJ1bWFsZXN3YXIg UmVkZHkgPFRpcnVtYWxlc3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb20+OyBkb2hAaWV0Zi5vcmc7 IGRuc29wQGlldGYub3JnOyBBY2tlcm1hbm4sIE1pY2hhZWwgPG1hY2tlcm1hbm5AYmNic20uY29t PjsgQ2hyaXN0aWFuIEh1aXRlbWEgPGh1aXRlbWFAaHVpdGVtYS5uZXQ+OyBkbnMtcHJpdmFjeUBp ZXRmLm9yZzsgVml0dG9yaW8gQmVydG9sYSA8dml0dG9yaW8uYmVydG9sYT00MG9wZW4teGNoYW5n ZS5jb21AZG1hcmMuaWV0Zi5vcmc+OyBTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW4uZmFycmVsbEBj cy50Y2QuaWU+DQpTdWJqZWN0OiBSZTogW0RvaF0gW2Rucy1wcml2YWN5XSBbRE5TT1BdIE5ldzog ZHJhZnQtYmVydG9sYS1iY3AtZG9oLWNsaWVudHMNCg0KDQpDQVVUSU9OOiBFeHRlcm5hbCBlbWFp bC4gRG8gbm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMgdW5sZXNzIHlvdSByZWNv Z25pemUgdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVudCBpcyBzYWZlLg0KDQoNCl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fDQoNCg0KT24gTW9uLCBNYXIgMTEsIDIwMTkgYXQg MTE6MTMgQU0gUGF1bCBWaXhpZSA8cGF1bEByZWRiYXJuLm9yZzxtYWlsdG86cGF1bEByZWRiYXJu Lm9yZz4+IHdyb3RlOg0KDQoNCm5hbGluaSBlbGtpbnMgd3JvdGUgb24gMjAxOS0wMy0xMSAxMDoy NjoNCj4gVGlydSwNCj4NCj4gVGhhbmtzIGZvciB5b3VyIGNvbW1lbnRzLg0KPg0KPiAgPiBFbnRl cnByaXNlIG5ldHdvcmtzIGFyZSBhbHJlYWR5IGFibGUgdG8gYmxvY2sgRG9IIHNlcnZpY2VzLA0K aSB3b25kZXIgaWYgZXZlcnlvbmUgaGVyZSBrbm93cyB0aGF0IFRMUyAxLjMgYW5kIGVuY3J5cHRl ZCBoZWFkZXJzIGlzDQpnb2luZyB0byBwdXNoIGEgU09DS1MgYWdlbmRhIG9udG8gZW50ZXJwcmlz ZXMgdGhhdCBoYWQgbm90IHByZXZpb3VzbHkNCm5lZWRlZCBvbmUsDQoNCkknbSBwcmV0dHkgZmFt aWxpYXIgd2l0aCBUTFMgMS4zLCBidXQgSSBkb24ndCBrbm93IHdoYXQgdGhpcyBtZWFucy4gVExT IDEuMw0KZG9lc24ndCBnZW5lcmFsbHkgZW5jcnlwdCBoZWFkZXJzIGFueSBtb3JlIHRoYW4gVExT IDEuMiBkaWQsIGV4Y2VwdCBmb3INCnRoZSBjb250ZW50IHR5cGUgYnl0ZSwgd2hpY2ggaXNuJ3Qg dGhhdCB1c2VmdWwgZm9yIGluc3BlY3Rpb24gYW55d2F5Lg0KQXJlIHlvdSBwZXJjaGFuY2UgcmVm ZXJyaW5nIHRvIGVuY3J5cHRlZCBTTkk/IFNvbWV0aGluZyBlbHNlPw0KDQotRWtyDQoNCmFuZCB0 aGF0IHNpbXBseSBibG9ja2luZyBldmVyeSBleHRlcm5hbCBlbmRwb2ludCBrbm93biBvcg0KdGVz dGVkIHRvIHN1cHBvcnQgRG9IIHdpbGwgYmUgdGhlIGNoZWFwZXIgYWx0ZXJuYXRpdmUsIGV2ZW4g aWYgdGhhdA0KbWFrZXMgbWlsbGlvbnMgb2Ygb3RoZXIgZW5kcG9pbnRzIGF0IGdvb2dsZSwgY2xv dWRmbGFyZSwgY2lzY28sIGFuZCBpYm0NCnVucmVhY2hhYmxlIGFzIGEgc2lkZSBlZmZlY3Q/DQoN CkNGIGhhcyBzbyBmYXIgb25seSBzdXBwb3J0ZWQgRG9IIG9uIDEuMS4xLjAvMjQ8aHR0cDovLzEu MS4xLjAvMjQ+IGFuZCAxLjAuMS4wLzI0PGh0dHA6Ly8xLjAuMS4wLzI0Piwgd2hpY2ggaQ0KYmxv Y2tlZCBhbHJlYWR5IChiZWZvcmUgRG9IKSBzbyB0aGF0J3Mgbm90IGEgcHJvYmxlbS4gYnV0IGlm IGdvb2dsZQ0KZGVjaWRlcyB0byBzdXBwb3J0IERvSCBvbiB0aGUgc2FtZSBJUCBhZGRyZXNzZXMg YW5kIHBvcnQgbnVtYmVycyB0aGF0DQphcmUgdXNlZCBmb3Igc29tZSBBUEkgb3Igd2ViIHNlcnZp Y2UgaSBkZXBlbmQgb24sIHRoYXQgd2ViIHNlcnZpY2UgaXMNCmdvaW5nIHRvIGJlIGVpdGhlciBi bG9ja2VkLCBvciBmb3JjZWQgdG8gZ28gdGhyb3VnaCBTT0NLUy4gdGhpcyB3aWxsIGFkZA0KY29u c2lkZXJhYmxlIGNvc3QgdG8gbXkgbmV0d29yayBwb2xpY3kuIChieSBkZXNpZ24uKQ0KDQotLQ0K UCBWaXhpZQ0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xw0KRG9oIG1haWxpbmcgbGlzdA0KRG9oQGlldGYub3JnPG1haWx0bzpEb2hAaWV0Zi5vcmc+DQpo dHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RvaA0K --_000_BYAPR16MB2790E12D58E5ED2F58355CCDEA490BYAPR16MB2790namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpEZW5nWGlhbjsNCglwYW5vc2UtMToy IDEgNiAwIDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OiJcQERlbmdYaWFuIjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCi8qIFN0 eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9y bWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFu Lk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0 ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtG b2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQt ZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYu bXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3At YWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUyMA0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRT ZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4g MS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0 eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRp dCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVk aXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hl YWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2 IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgRXJpYyw8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gVExTIDEuMiwgaXQgaXMgcG9zc2libGUgZm9yIGZpcmV3 YWxscyB0byBpbnNwZWN0IHRoZSBUTFMgaGFuZHNoYWtlLCBhbmQgd2hpdGUtbGlzdCwgYmxhY2st bGlzdCBhbmQgZ3JleS1saXN0IFRMUyBzZXNzaW9uIGJhc2VkIG9uIHRoZSBzZXJ2ZXIgaWRlbnRp dHkuIEluIG90aGVyIHdvcmRzLCBtaWRkbGVib3hlcyBhcmUgY29uZGl0aW9uYWxseSBhY3Rpbmcg YXMgVExTIHByb3hpZXMgdG8gc3BlY2lmaWMgc2VydmVycw0KIChjYXRlZ29yaXplZCBpbiB0aGUg Z3JleS1saXN0KS4gJm5ic3A7PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5X aXRoIFRMUyAxLjMgYW5kIGVuY3J5cHRlZCBTTkksIHRoZSBtaWRkbGUgYm94IG5vdyBoYXMgdG8g YWN0IGFzIGEgVExTIHByb3h5IGZvciBhbGwgdGhlIGZsb3dzLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4tVGlydTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCBi bHVlIDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQiPg0KPGRpdj4NCjxkaXYgc3R5bGU9 ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0UxRTFFMSAxLjBwdDtwYWRkaW5nOjMuMHB0 IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBFcmljIFJl c2NvcmxhICZsdDtla3JAcnRmbS5jb20mZ3Q7IDxicj4NCjxiPlNlbnQ6PC9iPiBUdWVzZGF5LCBN YXJjaCAxMiwgMjAxOSAzOjE0IEFNPGJyPg0KPGI+VG86PC9iPiBQYXVsIFZpeGllICZsdDtwYXVs QHJlZGJhcm4ub3JnJmd0Ozxicj4NCjxiPkNjOjwvYj4gbmFsaW5pIGVsa2lucyAmbHQ7bmFsaW5p LmVsa2luc0BlLWRjby5jb20mZ3Q7OyBLb25kYSwgVGlydW1hbGVzd2FyIFJlZGR5ICZsdDtUaXJ1 bWFsZXN3YXJSZWRkeV9Lb25kYUBNY0FmZWUuY29tJmd0OzsgZG9oQGlldGYub3JnOyBkbnNvcEBp ZXRmLm9yZzsgQWNrZXJtYW5uLCBNaWNoYWVsICZsdDttYWNrZXJtYW5uQGJjYnNtLmNvbSZndDs7 IENocmlzdGlhbiBIdWl0ZW1hICZsdDtodWl0ZW1hQGh1aXRlbWEubmV0Jmd0OzsgZG5zLXByaXZh Y3lAaWV0Zi5vcmc7IFZpdHRvcmlvDQogQmVydG9sYSAmbHQ7dml0dG9yaW8uYmVydG9sYT00MG9w ZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7OyBTdGVwaGVuIEZhcnJlbGwgJmx0O3N0 ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWUmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbRG9o XSBbZG5zLXByaXZhY3ldIFtETlNPUF0gTmV3OiBkcmFmdC1iZXJ0b2xhLWJjcC1kb2gtY2xpZW50 czxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjx0YWJsZSBjbGFzcz0iTXNvTm9ybWFsVGFibGUi IGJvcmRlcj0iMSIgY2VsbHNwYWNpbmc9IjMiIGNlbGxwYWRkaW5nPSIwIiBzdHlsZT0iYmFja2dy b3VuZDojRjNGRjMzO2JvcmRlcjpzb2xpZCAjOUI5QTg3IDEuNXB0Ij4NCjx0Ym9keT4NCjx0cj4N Cjx0ZCBzdHlsZT0iYm9yZGVyOm5vbmU7cGFkZGluZzouNzVwdCAuNzVwdCAuNzVwdCAuNzVwdCI+ DQo8cD48c3Ryb25nPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiM5QjhCM0UiPkNBVVRJT048L3NwYW4+PC9zdHJvbmc+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzlCOEIz RSI+Ojwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjpibGFjayI+IEV4dGVybmFsIGVtYWlsLiBEbyBub3QgY2xpY2sgbGlua3Mg b3Igb3Blbg0KIGF0dGFjaG1lbnRzIHVubGVzcyB5b3UgcmVjb2duaXplIHRoZSBzZW5kZXIgYW5k IGtub3cgdGhlIGNvbnRlbnQgaXMgc2FmZS48L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5 OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWYiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv dGQ+DQo8L3RyPg0KPC90Ym9keT4NCjwvdGFibGU+DQo8ZGl2IGNsYXNzPSJNc29Ob3JtYWwiIGFs aWduPSJjZW50ZXIiIHN0eWxlPSJ0ZXh0LWFsaWduOmNlbnRlciI+DQo8aHIgc2l6ZT0iMyIgd2lk dGg9IjEwMCUiIGFsaWduPSJjZW50ZXIiPg0KPC9kaXY+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj5PbiBNb24sIE1hciAxMSwgMjAxOSBhdCAxMToxMyBBTSBQYXVsIFZp eGllICZsdDs8YSBocmVmPSJtYWlsdG86cGF1bEByZWRiYXJuLm9yZyI+cGF1bEByZWRiYXJuLm9y ZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHls ZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBp biAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PGJyPg0KPGJyPg0KbmFsaW5pIGVsa2lucyB3cm90ZSBvbiAyMDE5 LTAzLTExIDEwOjI2Ojxicj4NCiZndDsgVGlydSw8YnI+DQomZ3Q7IDxicj4NCiZndDsgVGhhbmtz IGZvciB5b3VyIGNvbW1lbnRzLjxicj4NCiZndDsgPGJyPg0KJmd0OyZuYnNwOyAmZ3Q7IEVudGVy cHJpc2UgbmV0d29ya3MgYXJlIGFscmVhZHkgYWJsZSB0byBibG9jayBEb0ggc2VydmljZXMsPGJy Pg0KaSB3b25kZXIgaWYgZXZlcnlvbmUgaGVyZSBrbm93cyB0aGF0IFRMUyAxLjMgYW5kIGVuY3J5 cHRlZCBoZWFkZXJzIGlzIDxicj4NCmdvaW5nIHRvIHB1c2ggYSBTT0NLUyBhZ2VuZGEgb250byBl bnRlcnByaXNlcyB0aGF0IGhhZCBub3QgcHJldmlvdXNseSA8YnI+DQpuZWVkZWQgb25lLDxvOnA+ PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ SSdtIHByZXR0eSBmYW1pbGlhciB3aXRoIFRMUyAxLjMsIGJ1dCBJIGRvbid0IGtub3cgd2hhdCB0 aGlzIG1lYW5zLiBUTFMgMS4zPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5kb2Vzbid0IGdlbmVyYWxseSBlbmNyeXB0IGhlYWRlcnMgYW55IG1vcmUg dGhhbiBUTFMgMS4yIGRpZCwgZXhjZXB0IGZvcjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+dGhlIGNvbnRlbnQgdHlwZSBieXRlLCB3aGljaCBpc24n dCB0aGF0IHVzZWZ1bCBmb3IgaW5zcGVjdGlvbiBhbnl3YXkuPG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5BcmUgeW91IHBlcmNoYW5jZSByZWZlcnJp bmcgdG8gZW5jcnlwdGVkIFNOST8gU29tZXRoaW5nIGVsc2U/PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi1Fa3I8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQg I0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0 O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+YW5kIHRoYXQgc2ltcGx5 IGJsb2NraW5nIGV2ZXJ5IGV4dGVybmFsIGVuZHBvaW50IGtub3duIG9yIDxicj4NCnRlc3RlZCB0 byBzdXBwb3J0IERvSCB3aWxsIGJlIHRoZSBjaGVhcGVyIGFsdGVybmF0aXZlLCBldmVuIGlmIHRo YXQgPGJyPg0KbWFrZXMgbWlsbGlvbnMgb2Ygb3RoZXIgZW5kcG9pbnRzIGF0IGdvb2dsZSwgY2xv dWRmbGFyZSwgY2lzY28sIGFuZCBpYm0gPGJyPg0KdW5yZWFjaGFibGUgYXMgYSBzaWRlIGVmZmVj dD88YnI+DQo8YnI+DQpDRiBoYXMgc28gZmFyIG9ubHkgc3VwcG9ydGVkIERvSCBvbiA8YSBocmVm PSJodHRwOi8vMS4xLjEuMC8yNCIgdGFyZ2V0PSJfYmxhbmsiPjEuMS4xLjAvMjQ8L2E+IGFuZA0K PGEgaHJlZj0iaHR0cDovLzEuMC4xLjAvMjQiIHRhcmdldD0iX2JsYW5rIj4xLjAuMS4wLzI0PC9h Piwgd2hpY2ggaSA8YnI+DQpibG9ja2VkIGFscmVhZHkgKGJlZm9yZSBEb0gpIHNvIHRoYXQncyBu b3QgYSBwcm9ibGVtLiBidXQgaWYgZ29vZ2xlIDxicj4NCmRlY2lkZXMgdG8gc3VwcG9ydCBEb0gg b24gdGhlIHNhbWUgSVAgYWRkcmVzc2VzIGFuZCBwb3J0IG51bWJlcnMgdGhhdCA8YnI+DQphcmUg dXNlZCBmb3Igc29tZSBBUEkgb3Igd2ViIHNlcnZpY2UgaSBkZXBlbmQgb24sIHRoYXQgd2ViIHNl cnZpY2UgaXMgPGJyPg0KZ29pbmcgdG8gYmUgZWl0aGVyIGJsb2NrZWQsIG9yIGZvcmNlZCB0byBn byB0aHJvdWdoIFNPQ0tTLiB0aGlzIHdpbGwgYWRkIDxicj4NCmNvbnNpZGVyYWJsZSBjb3N0IHRv IG15IG5ldHdvcmsgcG9saWN5LiAoYnkgZGVzaWduLik8YnI+DQo8YnI+DQotLSA8YnI+DQpQIFZp eGllPGJyPg0KPGJyPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX188YnI+DQpEb2ggbWFpbGluZyBsaXN0PGJyPg0KPGEgaHJlZj0ibWFpbHRvOkRvaEBpZXRm Lm9yZyIgdGFyZ2V0PSJfYmxhbmsiPkRvaEBpZXRmLm9yZzwvYT48YnI+DQo8YSBocmVmPSJodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RvaCIgdGFyZ2V0PSJfYmxhbmsiPmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZG9oPC9hPjxvOnA+PC9vOnA+PC9w Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+ DQo8L2h0bWw+DQo= --_000_BYAPR16MB2790E12D58E5ED2F58355CCDEA490BYAPR16MB2790namp_-- From nobody Tue Mar 12 08:55:30 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 04B91130E77; Tue, 12 Mar 2019 08:55:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v5MSo1wZXxat; Tue, 12 Mar 2019 08:55:20 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id 722FE1310D3; Tue, 12 Mar 2019 08:55:14 -0700 (PDT) Received: from [10.20.120.143] (unknown [86.107.204.117]) by mail.noware.co.uk (Postfix) with ESMTPSA id AABAE1C0206; Tue, 12 Mar 2019 15:51:55 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) From: Neil Cook In-Reply-To: <20190312153636.qdsdne24vmi4xdoe@nic.fr> Date: Tue, 12 Mar 2019 16:55:11 +0100 Cc: nalini elkins , Stephen Farrell , doh@ietf.org, dnsop@ietf.org, Christian Huitema , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" Content-Transfer-Encoding: quoted-printable Message-Id: <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.101.1) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: -100 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedutddrgeekgdekfecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffknfevqffqmfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurheptggguffhjgffgffkfhfvofesthhqmhdthhdtvdenucfhrhhomheppfgvihhlucevohhokhcuoehnvghilhdrtghoohhksehnohifrghrvgdrtghordhukheqnecukfhppeekiedruddtjedrvddtgedruddujeenucfrrghrrghmpehinhgvthepkeeirddutdejrddvtdegrdduudejpdhhvghloheplgdutddrvddtrdduvddtrddugeefngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopegsohhrthiimhgvhigvrhesnhhitgdrfhhrpdhrtghpthhtohepnhgrlhhinhhirdgvlhhkihhnshesvgdquggtohdrtghomhdprhgtphhtthhopehsthgvphhhvghnrdhfrghrrhgvlhhlsegtshdrthgtugdrihgvpdhrtghpthhtohepughohhesihgvthhfrdhorhhgpdhrtghpthhtohepughnshhophesihgvthhfrdhorhhgpdhrtghpthhtohephhhuihhtvghmrgeshhhuihhtvghmrgdrnhgvthdprhgtphhtthhopegunhhsqdhprhhivhgrtgihsehivghtfhdrohhrghdprhgtphhtthhopehvihhtthhorhhiohdrsggvrhhtohhlrgepgedtohhpvghnqdigtghhrghnghgv rdgtohhmsegumhgrrhgtrdhivghtfhdrohhrghdprhgtphhtthhopehmrggtkhgvrhhmrghnnhessggtsghsmhdrtghomhenucevlhhushhtvghrufhiiigvpedt Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:55:21 -0000 > On 12 Mar 2019, at 16:36, Stephane Bortzmeyer = wrote: >=20 > On Mon, Mar 11, 2019 at 08:55:18AM +0530, > nalini elkins wrote=20 > a message of 202 lines which said: >=20 >> The questions that the Fortune 50 company architect asked were = something >> like this: >>=20 >> 1. You mean that DNS could be resolved outside my enterprise? >=20 > I suggest to explain to this person that it was possible before, as > any malware author discovered. Actually many enterprises (particularly banks etc.) do not allow DNS = resolution directly from employee endpoints. Neil= From nobody Tue Mar 12 08:59:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 81475131071 for ; Tue, 12 Mar 2019 08:58:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9OlhFqVxpKXc for ; Tue, 12 Mar 2019 08:58:54 -0700 (PDT) Received: from mail-lf1-x143.google.com (mail-lf1-x143.google.com [IPv6:2a00:1450:4864:20::143]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9AAF2131132 for ; Tue, 12 Mar 2019 08:58:53 -0700 (PDT) Received: by mail-lf1-x143.google.com with SMTP id 10so2478623lfr.8 for ; Tue, 12 Mar 2019 08:58:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=2XWPs/NrlrFLV2YuUoaFlh6oxXyJg5mM/w8l0Mc2MTI=; b=mDXM0erPyJAI4/j59zM24Xcjfm1fjGffO7vhHMvtPrIQMQtxzQMUsB0CWZ8XlxPoYH nDOnUz8wJurQlNfATafMMIqz63WiLbPHAlUpqsPOADwXApGWp9aISoeWfGaAhe5msS2G xPsYclsE1gjhEF5gbcHDvbBlqbL+Jg7R5I+La4p68jUepm7mf1U5J0Pf29LrNLNF5K07 6b90u935/FERvlyoz/BmPgnSs43caYEtuSAt6um6mdHVDypxY60PPcZU2wYR7J/2zOrI W5+LaTD0kh2pNiv299aKDlMpsI2llsYjxn1ykBOvMUsOfxZqL1p8OUkYT1zKVZ2iydqf BmPw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=2XWPs/NrlrFLV2YuUoaFlh6oxXyJg5mM/w8l0Mc2MTI=; b=m+vItP3hzQ3eD755OGsgFWPUr5jQ+mBFJrQWJK34yqEbnl7Q8FErrBb5P/qPDM1R+u 2R64W/t+dhzlyLQSYuLg2WB7ayqr0YktZxawpx8qJBw/vXAP7juKb85PgOz8m0kd6pq0 SrUuIoMa7knZPm0HaH2m2amkL8+skC1E2KbTO/mOGKrb3oPNc+ABNuuqzvrR36DuVnOS pXtRCWq2n2ifZMexErkQd4qNeqfogt4q13nK76xjHX/+4HesOVPvVomNjB5aZ0xGjmAZ yHe64FbUCFR60PYNDTrX1V2M+u271dcd/HMsP01WO/JZNXoa1VV5btscTib/yBc1f2cH I5ew== X-Gm-Message-State: APjAAAXRFmWnaZAJ4rC7afHSALIy/ADplLXvb6n93/7lkfVVrCbB78gx lTT3KSgqaNqgwHQYeyzyG61ntSMGCbnFhmYQv2xoKw== X-Google-Smtp-Source: APXvYqxvo4o67J37RiFn6e5Nx056hMr6rLyoPp0a9mk9DoQAra8y8PrvLmKbr2G0JCSNh7crtdEqhwvse8xZxjs3fWU= X-Received: by 2002:a19:7516:: with SMTP id y22mr19179163lfe.106.1552406331571; Tue, 12 Mar 2019 08:58:51 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: From: Eric Rescorla Date: Tue, 12 Mar 2019 08:58:12 -0700 Message-ID: To: "Konda, Tirumaleswar Reddy" Cc: "doh@ietf.org" , "dnsop@ietf.org" , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000f0d6140583e7c31b" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 15:59:06 -0000 --000000000000f0d6140583e7c31b Content-Type: text/plain; charset="UTF-8" On Tue, Mar 12, 2019 at 8:51 AM Konda, Tirumaleswar Reddy < TirumaleswarReddy_Konda@mcafee.com> wrote: > Hi Eric, > > > > In TLS 1.2, it is possible for firewalls to inspect the TLS handshake, and > white-list, black-list and grey-list TLS session based on the server > identity. In other words, middleboxes are conditionally acting as TLS > proxies to specific servers (categorized in the grey-list). > With TLS 1.3 and encrypted SNI, the middle box now has to act as a TLS > proxy for all the flows. > It would be most useful not to conflate TLS 1.3 and ESNI. In ordinary TLS 1.3, the SNI is in the clear but the server cert is not. However, importantly, even in TLS 1.2, the server certificate is not verifiable, and therefore is not significantly more trustworthy than SNI. With ESNI, the SNI is encrypted (hence the name). However, the xpectation is that enterprises which want to do conditional inspection will disable ESNI on the client. This should not be problematic as they already need access to the client to install their own trust anchor. -Ekr > > -Tiru > > > > *From:* Eric Rescorla > *Sent:* Tuesday, March 12, 2019 3:14 AM > *To:* Paul Vixie > *Cc:* nalini elkins ; Konda, Tirumaleswar Reddy > ; doh@ietf.org; dnsop@ietf.org; > Ackermann, Michael ; Christian Huitema < > huitema@huitema.net>; dns-privacy@ietf.org; Vittorio Bertola > ; Stephen Farrell < > stephen.farrell@cs.tcd.ie> > *Subject:* Re: [Doh] [dns-privacy] [DNSOP] New: > draft-bertola-bcp-doh-clients > > > > *CAUTION*: External email. Do not click links or open attachments unless > you recognize the sender and know the content is safe. > ------------------------------ > > > > > > On Mon, Mar 11, 2019 at 11:13 AM Paul Vixie wrote: > > > > nalini elkins wrote on 2019-03-11 10:26: > > Tiru, > > > > Thanks for your comments. > > > > > Enterprise networks are already able to block DoH services, > i wonder if everyone here knows that TLS 1.3 and encrypted headers is > going to push a SOCKS agenda onto enterprises that had not previously > needed one, > > > > I'm pretty familiar with TLS 1.3, but I don't know what this means. TLS 1.3 > > doesn't generally encrypt headers any more than TLS 1.2 did, except for > > the content type byte, which isn't that useful for inspection anyway. > > Are you perchance referring to encrypted SNI? Something else? > > > > -Ekr > > > > and that simply blocking every external endpoint known or > tested to support DoH will be the cheaper alternative, even if that > makes millions of other endpoints at google, cloudflare, cisco, and ibm > unreachable as a side effect? > > CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24, which i > blocked already (before DoH) so that's not a problem. but if google > decides to support DoH on the same IP addresses and port numbers that > are used for some API or web service i depend on, that web service is > going to be either blocked, or forced to go through SOCKS. this will add > considerable cost to my network policy. (by design.) > > -- > P Vixie > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > > --000000000000f0d6140583e7c31b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 12, 2019 at 8:51 AM Konda= , Tirumaleswar Reddy <TirumaleswarReddy_Konda@mcafee.com> wrote:

Hi Eric,

=C2=A0

In TLS 1.2, it is possible for firewalls to inspect = the TLS handshake, and white-list, black-list and grey-list TLS session bas= ed on the server identity. In other words, middleboxes are conditionally ac= ting as TLS proxies to specific servers (categorized in the grey-list).

With TLS 1.3 and encrypted SNI, the middle box now h= as to act as a TLS proxy for all the flows.


It would be most useful not to conflate TLS = 1.3 and ESNI.

In ordinary TLS 1.3, the SNI is in t= he clear but the server cert is not. However, importantly, even in TLS 1.2,= the server certificate is not verifiable, and therefore is not significant= ly more trustworthy than SNI.

With ESNI, the SNI i= s encrypted (hence the name). However, the xpectation is that enterprises w= hich want to do conditional inspection will disable ESNI on the client. Thi= s should not be problematic as they already need access to the client to in= stall their own trust anchor.

-Ekr
<= br>

<= div lang=3D"EN-US">

=C2=A0

-Tiru

=C2=A0

From: Eric Rescorla <ekr@rtfm.com>
Sent: Tuesday, March 12, 2019 3:14 AM
To: Paul Vixie <paul@redbarn.org>
Cc: nalini elkins <nalini.elkins@e-dco.com>; Konda, Tirumaleswar Reddy &= lt;TirumaleswarReddy_Konda@McAfee.com>; doh@ietf.org; dnsop@ietf.org; Ackermann, Michael <mackermann@bcbsm.com>; Christ= ian Huitema <hu= itema@huitema.net>; dns-privacy@ietf.org; Vittorio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org>; Step= hen Farrell <stephen.farrell@cs.tcd.ie>
Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-= clients

=C2=A0

CAUTION: External email. Do not click links or op= en attachments unless you recognize the sender and know the content is safe.<= /span>

=C2=A0

=C2=A0

On Mon, Mar 11, 2019 at 11:13 AM Paul Vixie <paul@redbarn.org> = wrote:



nalini elkins wrote on 2019-03-11 10:26:
> Tiru,
>
> Thanks for your comments.
>
>=C2=A0 > Enterprise networks are already able to block DoH services,=
i wonder if everyone here knows that TLS 1.3 and encrypted headers is
going to push a SOCKS agenda onto enterprises that had not previously
needed one,

=C2=A0

I'm pretty familiar with TLS 1.3, but I don'= t know what this means. TLS 1.3

doesn't generally encrypt headers any more than = TLS 1.2 did, except for

the content type byte, which isn't that useful f= or inspection anyway.

Are you perchance referring to encrypted SNI? Someth= ing else?

=C2=A0

-Ekr

=C2=A0

and that simply blocking every external endpoint kno= wn or
tested to support DoH will be the cheaper alternative, even if that
makes millions of other endpoints at google, cloudflare, cisco, and ibm unreachable as a side effect?

CF has so far only supported DoH on 1.1.1.0/24 and 1.0.1.0/24, which i blocked already (before DoH) so that's not a problem. but if google decides to support DoH on the same IP addresses and port numbers that
are used for some API or web service i depend on, that web service is
going to be either blocked, or forced to go through SOCKS. this will add considerable cost to my network policy. (by design.)

--
P Vixie

_______________________________________________
Doh mailing list
Doh@ietf.org
htt= ps://www.ietf.org/mailman/listinfo/doh

--000000000000f0d6140583e7c31b-- From nobody Tue Mar 12 09:02:34 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DCF6C131128; Tue, 12 Mar 2019 09:02:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mQgpBuitq4TQ; Tue, 12 Mar 2019 09:02:16 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 43289131154; Tue, 12 Mar 2019 09:02:16 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 13B2E242109D; Tue, 12 Mar 2019 16:02:09 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190312154913.4ch2bn6jyu53tfhl@nic.fr> Date: Tue, 12 Mar 2019 16:02:08 +0000 Cc: DoH WG , dnsop WG , dns-privacy@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <2BA35B39-D6D7-43AD-A868-E59E4AD5F237@rfc1035.com> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> <20190312154913.4ch2bn6jyu53tfhl@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:02:25 -0000 > On 12 Mar 2019, at 15:49, Stephane Bortzmeyer = wrote: >=20 > the case of a commercial > Internet access provider is clear in the other direction: a client is > not an employee, and is entitled to a free, open and neutral Internet > access. Stephane, that=E2=80=99s simply not true. A client of an Internet access = provider is entitled to the service that they contractually agreed to = pay for. Check the small print. Or the T&Cs the next time you use some = coffeeshop=E2=80=99s wifi. Even if your ISP offers you =E2=80=9Cfree, = open and neutral Internet access=E2=80=9D (for some definition of that = phrase), I=E2=80=99m pretty sure they=E2=80=99ll drop your service if = you were damaging their network or or doing something else that was = illegal or otherwise in breach of their T&Cs. From nobody Tue Mar 12 09:13:38 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2A30D131059; Tue, 12 Mar 2019 09:13:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.106 X-Spam-Level: X-Spam-Status: No, score=-1.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RDNS_NONE=0.793, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xTNQqlV2ZlB7; Tue, 12 Mar 2019 09:13:27 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id F37CE131063; Tue, 12 Mar 2019 09:13:26 -0700 (PDT) Received: from [10.20.120.143] (unknown [86.107.204.117]) by mail.noware.co.uk (Postfix) with ESMTPSA id 4E3431D59C2; Tue, 12 Mar 2019 16:10:08 +0000 (UTC) From: Neil Cook Message-Id: <0E7EDEBB-DDA7-4AF1-8ED0-A65A224E08A7@noware.co.uk> Content-Type: multipart/alternative; boundary="Apple-Mail=_B3F2A400-7CA7-4CF4-8530-C4A8A8032819" Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Tue, 12 Mar 2019 17:13:23 +0100 In-Reply-To: <20190312160141.ibnjtdt5myntwiwk@nic.fr> Cc: nalini elkins , Stephen Farrell , doh@ietf.org, dnsop@ietf.org, Christian Huitema , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" To: Stephane Bortzmeyer References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> <20190312160141.ibnjtdt5myntwiwk@nic.fr> X-Mailer: Apple Mail (2.3445.101.1) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: -100 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedutddrgeekgdekiecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffknfevqffqmfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephffktgggufffjgfvfhfosegrtdhmrehhtdejnecuhfhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqeenucffohhmrghinhephihouhhtuhgsvgdrtghomhenucfkphepkeeirddutdejrddvtdegrdduudejnecurfgrrhgrmhepihhnvghtpeekiedruddtjedrvddtgedruddujedphhgvlhhopegluddtrddvtddruddvtddrudegfegnpdhmrghilhhfrhhomheppfgvihhlucevohhokhcuoehnvghilhdrtghoohhksehnohifrghrvgdrtghordhukheqpdhrtghpthhtohepsghorhhtiihmvgihvghrsehnihgtrdhfrhdprhgtphhtthhopehnrghlihhnihdrvghlkhhinhhssegvqdgutghordgtohhmpdhrtghpthhtohepshhtvghphhgvnhdrfhgrrhhrvghllhestghsrdhttggurdhivgdprhgtphhtthhopeguohhhsehivghtfhdrohhrghdprhgtphhtthhopegunhhsohhpsehivghtfhdrohhrghdprhgtphhtthhopehhuhhithgvmhgrsehhuhhithgvmhgrrdhnvghtpdhrtghpthhtohepughnshdqphhrihhvrggthiesihgvthhfrdhorhhgpdhrtghpthhtohepvhhithhtohhrihhordgsvghr thholhgrpeegtdhophgvnhdqgigthhgrnhhgvgdrtghomhesughmrghrtgdrihgvthhfrdhorhhgpdhrtghpthhtohepmhgrtghkvghrmhgrnhhnsegstggsshhmrdgtohhmnecuvehluhhsthgvrhfuihiivgeptd Archived-At: Subject: Re: [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:13:29 -0000 --Apple-Mail=_B3F2A400-7CA7-4CF4-8530-C4A8A8032819 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 12 Mar 2019, at 17:01, Stephane Bortzmeyer = wrote: >=20 > On Tue, Mar 12, 2019 at 04:55:11PM +0100, > Neil Cook wrote=20 > a message of 22 lines which said: >=20 >> Actually many enterprises (particularly banks etc.) do not allow DNS = resolution directly from employee endpoints. >=20 > They block UDP/53, which is not the same thing. Malware or > non-cooperating applications can do name resolution by other means. I > still do not understand why people have a problem with DoH whch did > not already exist before with > my-own-name-resolution-protocol-over-HTTPS. Sure, but the malware has to go to a specific server which can be = identified and blocked. For any companies implementing a = =E2=80=9Cwhitelist-only=E2=80=9D security-policy, this is = straightforward. Even without, these kinds of requests can be spotted as = anomalies etc. This is a different scenario then a DoH server co-located with e.g. = youtube.com or whatever, which is a little harder = to block (by design as P. Vixie has pointed out). Neil= --Apple-Mail=_B3F2A400-7CA7-4CF4-8530-C4A8A8032819 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 12 Mar 2019, at 17:01, Stephane Bortzmeyer <bortzmeyer@nic.fr> = wrote:

On Tue, Mar 12, 2019 at 04:55:11PM +0100,
Neil = Cook <neil.cook@noware.co.uk> wrote
a = message of 22 lines which said:

Actually many enterprises (particularly banks = etc.) do not allow DNS resolution directly from employee endpoints.

They block UDP/53, which is not = the same thing. Malware or
non-cooperating applications = can do name resolution by other means. I
still do not = understand why people have a problem with DoH whch did
not = already exist before with
my-own-name-resolution-protocol-over-HTTPS.

Sure, but = the malware has to go to a specific server which can be identified and = blocked. For any companies implementing a =E2=80=9Cwhitelist-only=E2=80=9D= security-policy, this is straightforward. Even without, these kinds of = requests can be spotted as anomalies etc.

This is a different scenario then a DoH server = co-located with e.g. youtube.com or whatever, which is a little harder to = block (by design as P. Vixie has pointed out).

Neil
= --Apple-Mail=_B3F2A400-7CA7-4CF4-8530-C4A8A8032819-- From nobody Tue Mar 12 09:15:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23C311310DF; Tue, 12 Mar 2019 09:14:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DogM5pwtpsDQ; Tue, 12 Mar 2019 09:14:51 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80E991310B7; Tue, 12 Mar 2019 09:14:51 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id A47C924211EE; Tue, 12 Mar 2019 16:14:49 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <20190312160141.ibnjtdt5myntwiwk@nic.fr> Date: Tue, 12 Mar 2019 16:14:48 +0000 Cc: DoH WG , dnsop WG , dns-privacy@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> <20190312160141.ibnjtdt5myntwiwk@nic.fr> To: Stephane Bortzmeyer X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:14:58 -0000 > On 12 Mar 2019, at 16:01, Stephane Bortzmeyer = wrote: >=20 > I still do not understand why people have a problem with DoH whch did > not already exist before with = my-own-name-resolution-protocol-over-HTTPS. It=E2=80=99s a question of scale/ubiquity. These =E2=80=9Calterate=E2=80=9D= resolution tricks have up until now been mostly confined to a small = number of clueful people. That is going to change dramatically once the = world=E2=80=99s web browsers and other web-based apps start using DoH. = More so if those platforms have DoH enabled by default. From nobody Tue Mar 12 09:55:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 66CE2129AA0 for ; Tue, 12 Mar 2019 09:55:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YnPCy653ByrK for ; Tue, 12 Mar 2019 09:55:32 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 037081277E7 for ; Tue, 12 Mar 2019 09:55:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552409729; x=2416323329; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=P9uzQ890ufpdRMdjxWYCI1rI0RB0+hjxsfb1TCuvp04=; b=1nGXuRggy4Zfgc2VtaZGiJmbAwfbDsHYVFjqnOrNt2tzGuko2dcTKlAxg202XKcm iXEK2p3ROQsso4BmGimVrpFvNaT7TY4fGW8RRDQl9otQ2ubKgrYoBdFmVaSZUvzw vLVgBozMLOw5z+9kyBFLb/WrehK8SeXqpKYbucQfnccRNnU5fjny9VoJMmHy8k2u cJ/byOrgFXlWJMcoK+/vJRHJlu7E7yzXkVIDfCXmJ5/JjpCjKI+iQvNas27VR39k oDuKXV9EmG8cVQrO3TPaJbBakfQS6ZdGesHrZgyGUwW3E3Cm4LlXR3Tf9lj+uBza 9VXUnfsOSCqJYtp/BbwfAn5i05wnY0WFXTPhg1OYSis0C5lbnORilUzpDX/wDnPc DzbMrEzBiZA5LJawqo3kypr6uddZocU9rv8eQuhjnp0iLHH14z1MCnBFgeh5CRxy fJdWaHO3C2Nuq7Gx10dbZU7qmO3LxVx0OW27FTpem4cXAfV2ibT1j4elHduIrXS/ bfZBaEi3c2YkMf4YNOdLsiXTXws7KlFKME7Bxl+1+IMz0ZkVkz4vcgZ5sJ1h2+wH Z8SHDpZFkoP6u6VUwjjecD+HwsvNEEJ/Jh3+DFP4pVBcBQs+wY2lffMJsuxYLYub TqrgGpmjnYctwYVb1g1Xf5bNleh5+RZ+H8FIph51AcM=; X-AuditID: a2962c47-fbdff7000001abb1-8f-5c87e48126bf Received: from COPDCEXC37.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 41.E0.43953.184E78C5; Tue, 12 Mar 2019 10:55:29 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC37.cable.comcast.com (147.191.125.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 12 Mar 2019 12:55:30 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Tue, 12 Mar 2019 12:55:30 -0400 From: "Livingood, Jason" To: Stephane Bortzmeyer CC: DoH WG Thread-Topic: [EXTERNAL] Re: [Doh] New: draft-livingood-doh-implementation-risks-issues Thread-Index: AQHU1hbDDNj2GhBc2k6lTCYNWHxRBaYD846AgAG5mICAArbogP//2I+A Date: Tue, 12 Mar 2019 16:55:29 +0000 Message-ID: <75FFED43-1525-49E1-B598-64969E34E96C@cable.comcast.com> References: <20190309182857.GA29321@laperouse.bortzmeyer.org> <20190312151639.oqgwgdficezoygfr@nic.fr> In-Reply-To: <20190312151639.oqgwgdficezoygfr@nic.fr> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [96.115.73.254] Content-Type: text/plain; charset="utf-8" Content-ID: <56367752B0D00C4B8768DAF60B2C2319@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrOKsWRmVeSWpSXmKPExsWSUDRnsm7jk/YYgwsvhS0mLHzJaHHt7kU2 ByaPJUt+MnlM/LeBKYApqoHRpiSjKDWxxCU1LTWvONWOSwED2CSlpuUXpbomFuVUBqXmpCZi VwZSmZKak1mWWqSP1Rh9rOYkdDFl9Ex4zVQwi7viYcs31gbGL1xdjJwcEgImEv8e/mUDsYUE djFJPHqa28XIBWS3MEn8WjWHESJxmlHieH8uiM0mYCZxd+EVZhBbREBbYvLNHrAaZgFJiUfH D7GD2MICERLNx5dC1URKXN0/nRHCdpNY87wNzGYRUJVYevgeWD2vgIvEurMTWSEW32OUuH/z LthFnAKmEmt3TmEFsRkFxCS+n1rDBLFMXOLWk/lMEB8ISCzZc54ZwhaVePn4H1i9qIC+xMZN R9kg4ooSv+ZdAbI5gHo1Jdbv0ocYYyXxc1IfC4StKDGl+yHUPYISJ2c+YYFoFZc4fGQH6wRG yVlINs9CmDQLyaRZSCbNQjJpASPrKkZeQzMjPUNTAz0TEz1zw02MwOSzaJqO+w7GD+djDzEK cDAq8fBOPN8eI8SaWFZcmXuIUYKDWUmE1yIHKMSbklhZlVqUH19UmpNafIhRmoNFSZxXaHNr jJBAemJJanZqakFqEUyWiYNTqoGxciNz1q9H8ec2pT2Z3ra08vKc+KnlXa079k1g9Fo1O+v6 1okTrc4ZHX+Rwj3thsg0H/v973fPdt+suE6ZmeXAcbHCqQZmP1NSdi3+obvAhbf1j/V8y50L dzw6vjNVb6/8slcX377sieJOaApX+FtZpv5Ya5GBVGTdag6NdI5Fs+aHJRyc/OVqnRJLcUai oRZzUXEiAFO7RzY6AwAA Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:55:34 -0000 T24gMy8xMi8xOSwgMTE6MTcgQU0sICJTdGVwaGFuZSBCb3J0em1leWVyIiA8Ym9ydHptZXllckBu aWMuZnI+IHdyb3RlOg0KDQo+ICAgIEl0IHNlZW1zIHRvIG1lIHRoZXJlIGlzIGEgbW9yZSBwcm9m b3VuZCBpc3N1ZSBoZXJlOiBzaG91bGQgd2UgKHRoZQ0KICAgIElFVEYpLCB3aGVuIGNyZWF0aW5n IG5ldyBwcm90b2NvbHMsIGVuc3VyZSB0aGF0ICphbGwqIHByZXZpb3VzIHVzYWdlcw0KICAgIGNv bnRpbnVlIHRvIHdvcms/IEV2ZW4gaWYgd2UgbmV2ZXIgY29uZG9uZWQgdGhlbT8NCiAgICANCj4g ICAgUmVwbHlpbmcgWWVzIHRvIHRoaXMgcXVlc3Rpb24gd291bGQgcHV0IGEgc2V2ZXJlIGJ1cmRl biBvbiBJRVRGDQogICAgc2hvdWxkZXJzOyB0aGVyZSBhcmUgc28gbWFueSAiY3JlYXRpdmUiIHVz ZXMgb2YgdGhlIFRDUC9JUA0KICAgIHRlY2hub2xvZ2llcyB0aGF0IGl0IGlzIGltcG9zc2libGUg dG8gZ3VhcmFudGVlIHRoYXQgZXZlcnl0aGluZyB3aWxsDQogICAgY29udGludWUgdG8gd29yayBh cyBiZWZvcmUuIENyZWF0aW5nIG5ldyBwcm90b2NvbHMgb3IgbmV3IHZhcmlhbnRzIG9mDQogICAg b2xkIHByb3RvY29scyB3aWxsIGNlcnRhaW5seSBkaXNydXB0IHRoaW5ncy4gSXMgaXQgYWx3YXlz IGJhZD8gSSBkb24ndA0KICAgIHRoaW5rIHNvLg0KDQpbSkxdIFRoZSB3YXkgeW91IGZyYW1lIGl0 LCBtb3N0IHBlb3BsZSB3b3VsZCBsaWtlIHRvIHNheSBOTyBvZiBjb3Vyc2UuIEJ1dCBpdCBpcyBu b3QgYSBiaW5hcnkgeWVzL25vIElNTy4gSW4gdGhpcyBjYXNlIHdl4oCZcmUgbm90IHNheWluZyBj b25zaWRlciBldmVyeSBzaW5nbGUgY29ybmVyIGNhc2UgLyB1c2UsIGJ1dCBjb25zaWRlciBvbmUg b2YgdGhlIHByaW1hcnkgdXNlIGNhc2VzLiBUbyBpZ25vcmUgaG93IGEgcHJvdG9jb2wgaXMgdXNl ZCBieSBsYXJnZSBudW1iZXJzIG9mIGltcGxlbWVudGVycyB3aGVuIHVwZGF0aW5nL2VuaGFuY2lu Zy9yZXBsYWNpbmcgdGhlIHByb3RvY29sIHNlZW1zIHNpbGx5IC0gd2UgYXQgdGhlIElFVEYgY2Fu IGRvIGJldHRlci4NCiAgICANCg0K From nobody Tue Mar 12 09:58:45 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 26804130EBC for ; Tue, 12 Mar 2019 09:58:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sAfgcAiX1w68 for ; Tue, 12 Mar 2019 09:58:41 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7428E130FC7 for ; Tue, 12 Mar 2019 09:58:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552409909; x=2416323509; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=Bi15RH5FisgrghSMxjyLW8rhKGmfSMB3Yd2d1QqTHxU=; b=nwg6/YuwTT7s3QGFsNYdSFHmi2Sg2K4VRgt5rEYM7+p+SSfI/IaXv1jHc9MKf17+ MeyWn7W7v8waqL2nxlyRP58ApzSpLJb5CneInN8ILW+JCaYU776hGFBJXUazNBXW teNkgV40eXnsKEVvgCb08sYUvtchgHI9bCui1Qc7gaSLrIzxEdK0E7cWY0q5znWk 4vHIX4W13jTiqqrcB7w2xw1LwnPZVXDr2VQCYiJIP+GOXBbKu0C+kBjFjWYZ/GRf 67FOYWCuIljMlWwdQxZBEm0qmsnRlQLgeCiD+C0gKiSQLEQJE+MJqRwiX+y+gLEd ajLxJS9utc/pYkTJHJpvydDRECmcadlyEKn1r9OXvFX9MkxMBTj82Y5sJGoRF137 lFgIKYDc+200vZYALwBB4GzRAtap/EKRg8nu42/yPhEWiMFefmonloM4oYTaXi91 a7yrukKmfGsI8OUwPsPgHGgNtnve2h0TzcHKKDSWnNUW+dI9c0iLmKt5uTLIv4h7 WBD8mt58yadWSC/u5C8Uzrm82QSsttId0Z4XvTG5PekBPqrKEcSTLhZaed38yoGN 1dDGUsePBnCy7+V+OaxDeF4UzEbJ7g7iX6s080Zoq18ebV9hDm4cP3L6jA5M72Nu XL61jS6eQpMchNjYbiCwKex4Qgx0M1DVwtTf/GLn8kQ=; X-AuditID: a2962c47-fa3ff7000001abb1-80-5c87e5344b2c Received: from COPDCEXC36.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 6D.11.43953.435E78C5; Tue, 12 Mar 2019 10:58:29 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC36.cable.comcast.com (147.191.125.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Tue, 12 Mar 2019 12:58:29 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Tue, 12 Mar 2019 12:58:30 -0400 From: "Livingood, Jason" To: Stephane Bortzmeyer CC: Jim Reid , DoH WG Thread-Topic: [Doh] New I-D: draft-reid-doh-operator Thread-Index: AQHU1vHKZEEzA1Fq+0maaOBX0/6/hKYEw/iAgADg4ICAAsFbgP//1YuA Date: Tue, 12 Mar 2019 16:58:29 +0000 Message-ID: <7D26BC78-9130-4314-83F1-447ED3F0A96D@cable.comcast.com> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <20190310080101.GA11452@laperouse.bortzmeyer.org> <20190312153027.pke5tn766uhh4ib4@nic.fr> In-Reply-To: <20190312153027.pke5tn766uhh4ib4@nic.fr> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [96.114.156.7] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrIKsWRmVeSWpSXmKPExsWSUDRnsq7p0/YYg/ZfjBYTFr5ktLh29yKb xblnCQ7MHkuW/GTymPhvA5PH6auvmAOYoxoYbUoyilITS1xS01LzilPtuBQwgE1Salp+Uapr YlFOZVBqTmoidmUglSmpOZllqUX6WI3Rx2pOQhdTxo3rHcwFb7gr1mw8yNbAeIS7i5GTQ0LA RGLrjPPMXYxcHEICu5gkbv1/xQLhtDBJrJy0B8o5zSjRdHsFG0gLm4CZxN2FV5hBbBEBbYnJ N3sYQWxmAVOJL1dvMYHYwgLGEod33maHqDGR2LhtOlAvB5DtJjHvrQxImEVAVeJP4zKwMbwC LhJPFn5mhdg1h0niw5H5YL2cQDOf9t0Hm8koICbx/dQaJohd4hK3nsxngnhBQGLJnvPMELao xMvH/1hBbFEBfYmNm46yQcQVJHomTGcGuYFZQFNi/S59iDFWElN7/kGNVJSY0v2QHeIeQYmT M5+wQLSKSxw+soN1AqPkLCSbZyFMmoVk0iwkk2YhmbSAkXUVI6+hmZGeoamBnomJnrnhJkZg Qlo0Tcd9B+OH87GHGAU4GJV4eCeeb48RYk0sK67MPcQowcGsJMJrkQMU4k1JrKxKLcqPLyrN SS0+xCjNwaIkziu0uTVGSCA9sSQ1OzW1ILUIJsvEwSnVwMgoeUnqzP0Ig0zvKq6ohauYbdZf fz75lmrTPMc5Pfx+1st26s65vONf1uH+B6qfrKrSn6/qFrPYd1Ik/pT4tpb6qxUHNMq2bJaT 9L1TdYXnxJ87Ta/nMIhs1THYMsvyWE7P5u+C2810iz+bznVqEbHWUott67waFZAqc/vQkYYu h4btv7Z1cSixFGckGmoxFxUnAgCFLZavRAMAAA== Archived-At: Subject: Re: [Doh] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:58:44 -0000 T24gMy8xMi8xOSwgMTE6MzAgQU0sICJEb2ggb24gYmVoYWxmIG9mIFN0ZXBoYW5lIEJvcnR6bWV5 ZXIiIDxkb2gtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2YgYm9ydHptZXllckBuaWMuZnI+ IHdyb3RlOg0KDQogICAgT24gTW9uLCBNYXIgMTEsIDIwMTkgYXQgMDE6MjU6NTRBTSArMDAwMCwN CiAgICAgTGl2aW5nb29kLCBKYXNvbiA8SmFzb25fTGl2aW5nb29kQGNvbWNhc3QuY29tPiB3cm90 ZSANCiAgICAgYSBtZXNzYWdlIG9mIDE1IGxpbmVzIHdoaWNoIHNhaWQ6DQogICAgDQo+ICAgID4g SSB0aGluayBhIHNsaWdodCBkaWZmZXJlbmNlIGlzIHRoYXQgd2l0aCBwdWJsaWMgRE5TIHNlcnZp Y2VzLCB0aGUNCj4gICAgPiB1cHRha2Ugb2NjdXJzIGdyYWR1YWxseSBhcyBlYWNoIGluZGl2aWR1 YWwgdXNlciBtYWtlcyBhbiBleHBsaWNpdA0KPiAgICA+IGNob2ljZS4gVGhpcyBpc24ndCB0aGUg Y2FzZSBzaG91bGQgbGFyZ2UgYXBwcyBlbmFibGUgRG9ILg0KICAgIA0KID4gICBIbW1tbSwgdXNh Z2Ugb2YgR29vZ2xlIFB1YmxpYyBETlMgb3Igc2ltaWxhciBzZXJ2aWNlcyBpcyBub3QgYWx3YXlz DQogICAgZGVjaWRlZCBieSB0aGUgaW5kaXZpZHVhbC4gQSBsb3Qgb2YgV2lGaSBob3RzcG90cywg aG90ZWxzLCBzY2hvb2xzLA0KICAgIGV2ZW4gSW50ZXJuZXQgYWNjZXNzIHByb3ZpZGVycywgY29u ZmlndXJlIHRoZSBESENQIHNlcnZlciB0byBpbmRpY2F0ZQ0KICAgIENpc2NvIE9wZW5ETlMgb3Ig YW5vdGhlciBwdWJsaWMgcmVzb2x2ZXIgYXMgdGhlIEROUyByZXNvbHZlciB0byB1c2UuDQoNCltK TF0gWWVzLCBvZiBjb3Vyc2UsIGJ1dCB0aGF0J3MgZ2VuZXJhbGx5IHRoZSBleGNlcHRpb24gdG8g dGhlIHJ1bGUuDQogICAgDQo+ICAgIEFsc28sIGFwcGxpY2F0aW9ucyB0YWxraW5nIGRpcmVjdGx5 IHRvIHRoZSBETlMgcmVzb2x2ZXIsIGJ5cGFzc2luZyB0aGUNCiAgICBzeXN0ZW0td2lkZSBjb25m aWd1cmF0aW9uIHdhcyBwb3NzaWJsZSBldmVuIGJlZm9yZSBEb0guDQoNCltKTF0gWWVzLCBidXQg dGhlIGVmZmVjdHMgb2YgY29uc29saWRhdGlvbiBoYXZlIGNoYW5nZWQgdGhlIG5hdHVyZSBvZiB0 aGlzIGVxdWF0aW9uIElNTy4NCiANCg0K From nobody Tue Mar 12 10:02:34 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E742E1310A0; Tue, 12 Mar 2019 10:02:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XIE1z4SBIWCC; Tue, 12 Mar 2019 10:02:21 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E87DA1310A2; Tue, 12 Mar 2019 10:02:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3925; q=dns/txt; s=iport; t=1552410123; x=1553619723; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=GQnZ5UcqWP/S+KCNRed1iukoVB1MUYUiqOGLy7SDXU4=; b=a7qp1BGY5y7a3C2e1xJ//gax9SBCQ4HbOt8i4lu7S/iiPTrDdCb+QtRL 1MC1Mo85odHnMpqO3rC/C+iLKMEtynBU3YcSDaE/9S7/S1o3cJzJlFJAJ HGK84qZutYnN/LdcppzDwK6gGKMXJJ2MBFQWQg298uBECQuTuN1nRjmFJ M=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BVAABW5Ydc/xbLJq1aChoBAQEBAQI?= =?us-ascii?q?BAQEBBwIBAQEBgWWBDoI6IRInhAqIeYxmkjaHcAgDAQGEbAKEWzgSAQEDAQE?= =?us-ascii?q?JAQMCbSiFSgEBAQMBI1YFCwsEFCoCAlcGE4MiAYFtCLBUgS+FRYRlD4EvgUm?= =?us-ascii?q?JVSaBf4E4H4JMhFaDNTGCJgOKTIZ2kmwJhFuOOhmTPJpfgm4CBAYFAhWBXiG?= =?us-ascii?q?BVjMaCBsVZQGCQT6BWBeOHz4DMJE/AQE?= X-IronPort-AV: E=Sophos;i="5.58,471,1544486400"; d="asc'?scan'208,217";a="10697671" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 12 Mar 2019 17:02:00 +0000 Received: from ams3-vpn-dhcp7163.cisco.com (ams3-vpn-dhcp7163.cisco.com [10.61.91.250]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x2CH1xXm009960 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 12 Mar 2019 17:02:00 GMT From: Eliot Lear Message-Id: <8F89C1CF-D75C-44D1-A8A0-79A464E23E2F@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_D9065ABA-CA90-40A1-A699-F2CEE714472C"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 12 Mar 2019 18:01:55 +0100 In-Reply-To: Cc: "Winfield, Alister" , "dnsop@ietf.org" , "doh@ietf.org" , "dns-privacy@ietf.org" To: "Konda, Tirumaleswar Reddy" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> <2D9C1616-EF47-4685-8155-99A718806EE9@sky.uk> <2F7920EE-F04C-43E9-8194-B0000A0756F7@cisco.com> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.91.250, ams3-vpn-dhcp7163.cisco.com X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [Doh] [dns-privacy] [EXTERNAL] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 17:02:23 -0000 --Apple-Mail=_D9065ABA-CA90-40A1-A699-F2CEE714472C Content-Type: multipart/alternative; boundary="Apple-Mail=_9B7164E1-FE61-491B-94C7-233E22C62D26" --Apple-Mail=_9B7164E1-FE61-491B-94C7-233E22C62D26 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Tiru, > On 12 Mar 2019, at 16:31, Konda, Tirumaleswar Reddy = wrote: >=20 > MDM may or may not be acceptable even in Enterprise networks. For = instance, today network security services are using ML techniques to = identify malware flows without acting as a TLS proxy. MDM is also not an = option to secure devices in the home networks, especially consumer IoT = devices. >=20 I agree that MDMs should not be viewed as a panacea. Just a tool in the = box. But this is why I wrote that text the way I did: there may be = other ways to express in some secure way evidence of the owner=E2=80=99s = intent. Eliot --Apple-Mail=_9B7164E1-FE61-491B-94C7-233E22C62D26 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Tiru,

On 12 Mar 2019, at 16:31, Konda, Tirumaleswar = Reddy <TirumaleswarReddy_Konda@McAfee.com> wrote:

MDM may = or may not be acceptable even in Enterprise networks. For instance, = today network security services are using ML techniques to identify = malware flows without acting as a TLS proxy. MDM is also not an option = to secure devices in the home networks, especially consumer IoT = devices.
 


I agree that MDMs should = not be viewed as a panacea.  Just a tool in the box.  But this = is why I wrote that text the way I did: there may be other ways to = express in some secure way evidence of the owner=E2=80=99s = intent.

Eliot

= --Apple-Mail=_9B7164E1-FE61-491B-94C7-233E22C62D26-- --Apple-Mail=_D9065ABA-CA90-40A1-A699-F2CEE714472C Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyH5gMACgkQh7ZrRtnS ejMihwgAy3jLrcwDJMcP/T1GLPVHkrt0AlMlkF8VIqdE9gRX3sY3AcDjoGsk8xw9 3quaygtluSlQ8vxMG1L6GWcOI5qyTobWtE25BCVwaWo0wPv7QRkJ5cnhU7ASdeBm HC/MHiPos48mPsrWybdQLbQcBKSQkq7xFFfF0BvGkrqJaIgHVjbUDdRTReslbaye dkEJHv5XWw390kVO+ILZne0Da6bvp5Iot48wlu06yYeflnQLTExa4VMzkkrIECPD L0gjyK9Disr8sfQoSYPhR0aBOwNsX457ffKWCOE7bCsRfp4XHIfdV8wFZjOkBO2D bPjBmLzKsCQZUzTZUujg9Tl8ZLCU3Q== =e2DE -----END PGP SIGNATURE----- --Apple-Mail=_D9065ABA-CA90-40A1-A699-F2CEE714472C-- From nobody Tue Mar 12 10:09:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF5FB131154 for ; Tue, 12 Mar 2019 10:09:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bv2E1f9zQLQp for ; Tue, 12 Mar 2019 10:09:15 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 80097131180 for ; Tue, 12 Mar 2019 10:09:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3103; q=dns/txt; s=iport; t=1552410554; x=1553620154; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=odlw4bHSqsI3KNah6CqITuUNskKeTU++8bEpXsLZOUQ=; b=Kmw/E3mj8wzLw/gkwcOAlHw7uVDwuzhHk9Tf8ps3JwGWirm9PgkuqovI 2Kr9N4CL0O508YQfDABOFM0QQ0DqddA74XL929eVfmwcVz335yfbMnZL+ HRWLFnK1SLzN3fX10Sh8BQU7Vn3vSKwcwGefFSc9WNFDqvsQQvM8hTrD5 Q=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AHAAAF54dc/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUwIBAQEBAQsBg0chEieNA4xBJZI2hXWBewgDAQGEbAK?= =?us-ascii?q?EWzYHDQEBAwEBCQEDAm0ohUoBAQEDAXkFCwsEARMuVwYTgyIBgW0IsX6FRYR?= =?us-ascii?q?lD4EvAYFIiXuBf4E4DBOCTIg8giYDkUKSbAmEW446GZM8ml+CbgIEBgUCFYF?= =?us-ascii?q?NATGBVjMaCBsVZQGCQT6QDj4DMJE/AQE?= X-IronPort-AV: E=Sophos;i="5.58,471,1544486400"; d="asc'?scan'208,217";a="10640170" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 12 Mar 2019 17:09:12 +0000 Received: from ams3-vpn-dhcp7163.cisco.com (ams3-vpn-dhcp7163.cisco.com [10.61.91.250]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2CH9BXN003236 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 12 Mar 2019 17:09:11 GMT From: Eliot Lear Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_82CE4DB0-9DBB-4290-893F-6779114381FF"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 12 Mar 2019 18:09:10 +0100 In-Reply-To: <20190312151639.oqgwgdficezoygfr@nic.fr> Cc: "Livingood, Jason" , DoH WG To: Stephane Bortzmeyer References: <20190309182857.GA29321@laperouse.bortzmeyer.org> <20190312151639.oqgwgdficezoygfr@nic.fr> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.91.250, ams3-vpn-dhcp7163.cisco.com X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Doh] New: draft-livingood-doh-implementation-risks-issues X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 17:09:20 -0000 --Apple-Mail=_82CE4DB0-9DBB-4290-893F-6779114381FF Content-Type: multipart/alternative; boundary="Apple-Mail=_42E0200C-0D54-4A53-A182-171DAC18498D" --Apple-Mail=_42E0200C-0D54-4A53-A182-171DAC18498D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 12 Mar 2019, at 16:16, Stephane Bortzmeyer = wrote: >=20 > It seems to me there is a more profound issue here: should we (the > IETF), when creating new protocols, ensure that *all* previous usages > continue to work? Even if we never condoned them? Wrong questions. Right questions: Should the IETF consider the world in which we live and how the = protocols we are creating might change that world? Should we propose mitigations for none, some, or all of the changes? Eliot --Apple-Mail=_42E0200C-0D54-4A53-A182-171DAC18498D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii

On 12 Mar 2019, at 16:16, Stephane Bortzmeyer <bortzmeyer@nic.fr> = wrote:

It seems to = me there is a more profound issue here: should we (the
IETF), when creating new protocols, ensure that *all* = previous usages
continue to work? Even if we never = condoned them?

Wrong questions.  Right questions:

  • Should = the IETF consider the world in which we live and how the protocols we = are creating might change that world?
  • Should we = propose mitigations for none, some, or all of the changes?

Eliot

= --Apple-Mail=_42E0200C-0D54-4A53-A182-171DAC18498D-- --Apple-Mail=_82CE4DB0-9DBB-4290-893F-6779114381FF Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyH57YACgkQh7ZrRtnS ejNMZQgAycbrbMBExIJcs28uRder0tkRzi5OH7ouOMl5m7mGsLRPTrAn9K4ozr1s hJPqQPebfli/himZBtLdFLKe5aIfwoBP7fz1XbTgaL+pmdzLRE6YuuJC8sZwD8Fg SBd5MAn00nhds8j8SwegPY5wFmfXbl8sGqubWbJY0nMb4LvBzjoRwfzdwa8aHXWh tnvgdS/NV6VaiHlxYIBp6qLkLIyQ0LRizfJkqOUr9uiWgPpF3tV6TmRI36i5dE4o KU9Zz4nK67Q8Cmcc0OZHJhvnHORLY9B6k7elw8WIRDBw4DT2iTeOflD6jaQI4ksM wjG+ndjPybIV9qtVU7XLCJTc2zrGyw== =FKk/ -----END PGP SIGNATURE----- --Apple-Mail=_82CE4DB0-9DBB-4290-893F-6779114381FF-- From nobody Tue Mar 12 11:27:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FB4613121E; Tue, 12 Mar 2019 11:27:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jDa0LMvk0can; Tue, 12 Mar 2019 11:27:12 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5375F131219; Tue, 12 Mar 2019 11:27:12 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 19AFF892C6; Tue, 12 Mar 2019 18:27:12 +0000 (UTC) From: Paul Vixie To: Ted Hardie Cc: Warren Kumari , Jim Reid , DoH WG , dnsop Date: Tue, 12 Mar 2019 18:27:11 +0000 Message-ID: <3457266.o2ixm6i3xM@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <5456b9d9-844f-f410-3935-2b2d3ae22745@redbarn.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 18:27:14 -0000 On Monday, 11 March 2019 18:30:51 UTC Ted Hardie wrote: > On Mon, Mar 11, 2019 at 11:06 AM Paul Vixie wrote: > > DoH will moot that approach. > > Any system that actually checks the credentials presented by the responding > server will also moot that approach. yes! but it will fail "closed". thus, no unauthorized exfiltration risk will exist. > Given how easy it is to pin > credential characteristics in applications distributed as binaries, this > seems to mean that your method will either continue to permit applications > other than browsers to use their own resolution systems or it will hard > fail all such applications it can identify. No pass through will work, as > far as I can tell, in that scenario. that's precisely the goal, because very few network operators can preordain the users and apps that will connect through their networks. to the extent that monitoring ('dnstap') and controlling (DNS RPZ) dns lookups by connected users and apps is considered a vital local security policy, attempts at such "pass through" must be made to fail. > > Perhaps, though, I am missing something about your intent. > i think you've restated some key points of my position with perfect accuracy. DoH wants to empower users and apps to make decisions about their RDNS which cannot be interfered with by on-path actors such as their own network operators. by doing this, DoH makes a false equivalence between a dissident (who may be considered a criminal in some places) and a criminal (who is always considered a criminal in most places) and private users in a hotel room or coffee shop or on their home broadband connection, and malware which gets inside a network and wants to avoid detection/mitigation while performing lookups or exfiltration. those are four very different things. demanding identical treatment for all of them is, in the best possible interpretation, naive. vixie From nobody Tue Mar 12 11:28:04 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0706128AFB for ; Tue, 12 Mar 2019 11:28:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HA3R7-ZqAP6m for ; Tue, 12 Mar 2019 11:28:02 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 172F51277DE for ; Tue, 12 Mar 2019 11:28:02 -0700 (PDT) Received: from xsmtp02.mail2web.com ([168.144.250.215]) by mx148.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3liY-000z4O-Gu for doh@ietf.org; Tue, 12 Mar 2019 19:01:40 +0100 Received: from [10.5.2.13] (helo=xmail03.myhosting.com) by xsmtp02.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3liT-0008OK-LE for doh@ietf.org; Tue, 12 Mar 2019 14:01:33 -0400 Received: (qmail 20481 invoked from network); 12 Mar 2019 18:01:25 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail03.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 12 Mar 2019 18:01:24 -0000 To: Jim Reid , Stephane Bortzmeyer Cc: dnsop WG , DoH WG , dns-privacy@ietf.org References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> <20190312154913.4ch2bn6jyu53tfhl@nic.fr> <2BA35B39-D6D7-43AD-A868-E59E4AD5F237@rfc1035.com> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Tue, 12 Mar 2019 11:01:22 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <2BA35B39-D6D7-43AD-A868-E59E4AD5F237@rfc1035.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US X-Originating-IP: 168.144.250.215 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: ham X-Spampanel-Outgoing-Evidence: Combined (0.10) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5rMB15UrZpv2PxHUVCcQA+B602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxZJHXXLQU7TVFJV/UcY14SEh5 mNm/WjPqhYqCeBiCKwwnRtk/d5gNfEtjtud5V8jpaWmuI1j60B6jdQGl4a3Z3x/TBCf6oYXAWGet lavcAjAiREicRPMV5adYQyNOvKmgwJpy2yi2NB5qsi4dVukIa9cV2Hz37FuQUlYMDMlHwjIJ0464 etNXHOU+5Kb0QuG3bATPP9eeLWC5kDweN7crsXBXvrLBlKCVRjjdPbjQ4HmidG0pg2HLuLsP3mPp isElTs5Ex5aNZlcgVQFtAhrEij3dKxLhoxcmaInYbR5vlqETd+klAX+KFYkIxu6zxdn+1QmdZsu6 kxo/qWEj6Z1d7VIcMSgqtcKbU9La+AHiCFB9vuYMeDoXsMJDD9CZFW2DHXeua4usuyudZl7ZJWmg 5a0jiD6XqsJZtjQxlyCdsewL0yqMWCU0hY07P3EHOJc8PwUimsNGvJJilSn4u6QSZFzAAI31h6Rl Boqx3DQFq6As95DGoDQyh90npG6wuAU16Y3oZJdQ0WXQEIKhyt8GANo5bn0tFTz4SVUdCy2MVE6+ P+NMWgh0hdHFCOgNkMJ392PNDpgLsd6Ddd/s7VM53mcGFxy0M5Q2RXlX/+X6wmXAMgFPp7+h3kLe NmBV53UGtqJLi+jgtmERIzmxdXxFeLclSarJ0Ys1WXjzKe+qcDpRXxKF5tPxTxfD0dMN+t5ZP6zO upSxHMPsAHfGhZAC/HMCgMVStxCO22NkyuIHHH77G3ch6MdB0XuALpEgtIRS6Y2WR4MiVFjj8UQT P/XooN40eTXlWiUAYdLmsJdAoPJHNvQfAjIDptXbNSradnS0Zqm0mOdPl1LeUTNmkYtBTuxv0/1e /nzlq13wYTxncOSJHdsd+cwIgRT6euCWiMrA+4FHNKsiy9wMVtQ6ai8zTQ== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 18:28:03 -0000 On 3/12/2019 9:02 AM, Jim Reid wrote: > >> On 12 Mar 2019, at 15:49, Stephane Bortzmeyer wrot= e: >> >> the case of a commercial >> Internet access provider is clear in the other direction: a client is >> not an employee, and is entitled to a free, open and neutral Internet >> access. > Stephane, that=E2=80=99s simply not true. A client of an Internet acces= s provider is entitled to the service that they contractually agreed to p= ay for. Check the small print. Or the T&Cs the next time you use some cof= feeshop=E2=80=99s wifi. Even if your ISP offers you =E2=80=9Cfree, open a= nd neutral Internet access=E2=80=9D (for some definition of that phrase),= I=E2=80=99m pretty sure they=E2=80=99ll drop your service if you were da= maging their network or or doing something else that was illegal or other= wise in breach of their T&Cs. Jim, you are just providing a different interpretation of "entitled". Your reading is that the fine print in the ISP contract limits what users are entitled to do. Stephane is pointing out that customers expect to be able to freely access whatever Internet resource they want, regardless of the fine print. Courts have been called to decide that sort of things, in particular for various "shrink wrap" software licenses. The results vary. Sometimes the courts let the fine print stand, some times they treat it as an abuse of power and nullify it. Which points exactly to Stephane's characterization: it is a tussle. -- Christian Huitema From nobody Tue Mar 12 11:36:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B67D131294; Mon, 11 Mar 2019 22:32:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FBDXlFc_LKvj; Mon, 11 Mar 2019 22:32:03 -0700 (PDT) Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0657913128C; Mon, 11 Mar 2019 22:32:02 -0700 (PDT) X-NAI-Header: Modified by McAfee Email Gateway (5500) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552368520; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-microsoft-exchange-diagnostics:x-microsoft-antispam-prvs: x-forefront-prvs:x-forefront-antispam-report: received-spf:x-ms-exchange-senderadcheck:x-microsoft-antispam-message-info: Content-Type:Content-Transfer-Encoding:MIME-Version: X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Level: X-NAI-Spam-Threshold:X-NAI-Spam-Score:X-NAI-Spam-Version; bh=ZCvE1pzJoyuWAerJeWKGBciwA2TuLJsO4hNXHK PjhsA=; b=etrplUfKFDfJfinEtGLRKc6xRBdiMAT865L21WPA JuAnl/Mk/qjS27LvnlPUTa3zWE/NrP8mE33vq+Ad1ZkeefZ3mw F+wPWA8ZvoWjY6Sdafu/krJdXytsK/kDI5zrtEogfKGv7UU/Wl gb+O0BUdyWpwwBoU2lUPR7T7iw3HF88= Received: from DNVEXAPP1N06.corpzone.internalzone.com (unknown [10.44.48.90]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 0729_13c9_a26d656e_308c_497f_b3fe_a01976d057b1; Mon, 11 Mar 2019 23:28:39 -0600 Received: from DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) by DNVEXAPP1N06.corpzone.internalzone.com (10.44.48.90) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 23:31:50 -0600 Received: from DNVO365EDGE1.corpzone.internalzone.com (10.44.176.66) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Mon, 11 Mar 2019 23:31:49 -0600 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (10.44.176.240) by edge.mcafee.com (10.44.176.66) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Mon, 11 Mar 2019 23:31:49 -0600 Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB3015.namprd16.prod.outlook.com (20.178.236.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.18; Tue, 12 Mar 2019 05:31:46 +0000 Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1686.021; Tue, 12 Mar 2019 05:31:46 +0000 From: "Konda, Tirumaleswar Reddy" To: Eliot Lear , Paul Vixie CC: nalini elkins , "doh@ietf.org" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Thread-Topic: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2C+f7jidn2WHF0WeuF/A93J/OKYGu6uAgAABpwCAALdfMA== Date: Tue, 12 Mar 2019 05:31:46 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> In-Reply-To: <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com; x-originating-ip: [103.245.47.20] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c68451ee-938c-4104-d358-08d6a6ac04b3 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB3015; x-ms-traffictypediagnostic: BYAPR16MB3015: x-microsoft-exchange-diagnostics: =?utf-8?B?MTtCWUFQUjE2TUIzMDE1OzIzOm51V2Fhdmx3L1dPblJ1OE1nR0lucEQvM0RG?= =?utf-8?B?TFFvZUQrZVQzTE95V1VaSktHcWNwQTRCdXlPbiswWk4yT3lVYzNrdXBYdFI5?= =?utf-8?B?K05rYU5wT3F3bzNXOGZBeXJMQklkSGwvZURwWE55dUJmcThOKzBnN0hjOEZ5?= =?utf-8?B?M1FHZ1g4WVhLajVjZXBwSXR0SWlIVzZuUHIvWTJaWU14OVdCbHFnQUxGd0FI?= =?utf-8?B?U1AxZ2FxYVVRVUFPUm5ubTdDYzNZMVVOc0pxZkpJK05ydnZpcFltbThxdmI1?= =?utf-8?B?NW5PNTY4Q3phYmJHUGVGaW8rNFdaMmxMSzlXWHNIdkYzWm50VmM1ZEhnMU1s?= =?utf-8?B?blczUU5hKy85d2xyS2lTVk5iTkE1YmNKMlJNa0xoYkIwVEtMcFlNakozYzJK?= =?utf-8?B?N3U5S2lFbzFwZUwwbGY2cXYxRkRKSHR6WENJaVJyWm9GVTlNSzJrU25hQWZz?= =?utf-8?B?VFRqemx4UWtueWhPWUV5OU96ckdyL3U3VnVEdVh1bW5xSnpJaDl6YnJFTGtl?= =?utf-8?B?czFZZ2pxbjNBK1B4ODAxZm0zUTJOMmxDajZtRTEvWXlxeEtydTN0WkdPZ1VZ?= =?utf-8?B?ZVJqNDlkdjZCMGx6VzhZYngyK0FGVlJacU9PNWRwNC9vV3ZlN1haSmR6VkxQ?= =?utf-8?B?VXBOTGNCZjN2YVhTbnA5WEdTZkw2Vjd0ODNmdUQ1dUI5UWNiclpFcDNTb1ZZ?= =?utf-8?B?N3U0eHpXUWtiLytDaDlrOTVaSk1OMU1PbUpVcVJ3UlR3cFp0Tm9GSDNGdTlk?= =?utf-8?B?RmhOckhKdkpNV2ovOVBxci93Q0dBLzJTSVVRM0VaRHhYRTh2S2x0ZHNLQTA3?= =?utf-8?B?d0hDTWhjelNXUzVKRHpBVXBEOU1qVmYxbG93bkN3eHFEejJLZDVyQW9ZRUtp?= =?utf-8?B?dk0rWDlZcjVLV1FNbHdjWG1wS0NFRmwzZDl0WDJaL0hKeUFqK0tZeUxDM2Ez?= =?utf-8?B?R0JBU09YMGNUVEdVbVNOY2pEZ2xmUlQ4d3E5SUwyalkydEsxZU52eXNXNjZL?= =?utf-8?B?WWJnWEQ2NkFWc215eUFQczdZQ2NQcHFLVW5nWS9OS25uWlpWUStBeXhpM0JN?= =?utf-8?B?WTlwRy9uUzEvcEVnaTVaRkVxZEs1K2RtRGk0RU9IWEZPSjgyRSt1YTdDMnRi?= =?utf-8?B?VWUxUWJkMzROYUZMV2t6N1l6QjJ2bHRUQ3h6WGdRYmpNRDBDbWFReDVWQ1Nr?= =?utf-8?B?T1EyaHpuemsyV3ZRSTFWN3lZa0djNWxwS3BMSlNIRis3MXkwNC8xeklkOS9h?= =?utf-8?B?TGxsUGoxWkZlajdhR2g3eVoxV1N5RXlCSkRBR3VSZS9GdFJJWmhmaEoyQ2JZ?= =?utf-8?B?cHhpRTg2Tkp1U01NYStESU1hWXUvQTFFNWt2ZkJmcDQrR1RIL0IydEhFMkZN?= =?utf-8?B?UExyNFNDak56VS8yYldaeEg3L3NZNm96enhzS2MxS3F2QUp4cTI1OEUveUNo?= =?utf-8?B?V2dISyszM0NteTlyODFEaE41WCtyQVJKbWtLRTJwY2s2UW9hbEtpYmxaMzhS?= =?utf-8?B?dWtYRm5aUDdRbFNuaGY3M1hFcUNWZ3kvd0JKSjVoNGRQTlEwR0RINDJiRVIx?= =?utf-8?B?UTVPTU1FeEdDRnlpd3RZa1RpODMybHVZMFd2T0lGODc1WER3ODFKR1FGQ0Qw?= =?utf-8?B?UVJUaWIxaDRuK2FObm9oYXdqTFRYNU1Pbm4ydFRoOGJUSHh0S1QvSmJ1ZmZP?= =?utf-8?B?eU9HRnFPS3YrWG5jdlQ4REYzQXhoOEFVLzkyelZwTm5pWm1Wc0FRTjhSWmFp?= =?utf-8?B?RFVaVWtIQ3h6c2xjRFZNSUI5ZS9TdXQ1MlA4a0d4NmhMa1MvUzdmY0FVWjJH?= =?utf-8?B?WVNkUTVpUjF2b0pRU2w2ZWFyNVViYVExa1pkSjIyWDNwNHhVRDJKNDA3bEpt?= =?utf-8?Q?OFXE220SA31K5So1rZLXzqETcIxMa9fn?= x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(346002)(376002)(39860400002)(136003)(32952001)(13464003)(189003)(199004)(54094003)(305945005)(8936002)(7696005)(66066001)(80792005)(99286004)(74316002)(81156014)(81166006)(478600001)(2906002)(11346002)(72206003)(5660300002)(6116002)(8676002)(52536013)(14454004)(446003)(7736002)(486006)(3846002)(33656002)(97736004)(476003)(54906003)(110136005)(102836004)(86362001)(9686003)(106356001)(316002)(229853002)(55016002)(93886005)(25786009)(68736007)(26005)(186003)(6436002)(256004)(6246003)(7416002)(76176011)(105586002)(71200400001)(71190400001)(4326008)(53546011)(53936002)(6506007)(85282002); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB3015; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: kX2753YEVReiV88UtB6HFyAHzySIhtle3ZBWiLj8b4EVr5lzjT4A96UnOhPjO46u17ePttgknla81qbf3EGTuAh4wUvS9sgNAIL9P8mvvhIr1JAFoyeGJcxQ2J5xvn69XZGpXwUO++NM9RaAj6U8hVbh/rREHOuwRkR11G3CDwVYAeC+81dtlHICi3Nij3LuZ5B42z7cP8vFFHEOJloXFGWOT5h+rF7+JcDPxe6RqbqussV4cF/RQLE3ZuNbFNx1oUIHlK7dgArOJRRCy1xYepcbiRXymGCfj8nSY59UKp02mj4X7ow7O4Srkk4R1rrw+bY1aFSwGFcSbOU4rdjbbvQVcdjSLE+fHk/dQy4q+RLWQfIFhL3fX4/WB5C/6Fwug+bBKxfRH1TJKJApNuY5GuwF6HEhFQ5Xkk/lFJyBQDw= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: c68451ee-938c-4104-d358-08d6a6ac04b3 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 05:31:46.1722 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB3015 X-OriginatorOrg: mcafee.com X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 15 X-NAI-Spam-Score: 0.1 X-NAI-Spam-Version: 2.3.0.9418 : core <6500> : inlines <7031> : streams <1815461> : uri <2811194> Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 11:36:43 -0700 Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 05:32:06 -0000 PiAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPiBGcm9tOiBFbGlvdCBMZWFyIDxsZWFyQGNp c2NvLmNvbT4NCj4gU2VudDogTW9uZGF5LCBNYXJjaCAxMSwgMjAxOSAxMTo0OSBQTQ0KPiBUbzog UGF1bCBWaXhpZSA8cGF1bEByZWRiYXJuLm9yZz4NCj4gQ2M6IG5hbGluaSBlbGtpbnMgPG5hbGlu aS5lbGtpbnNAZS1kY28uY29tPjsgS29uZGEsIFRpcnVtYWxlc3dhciBSZWRkeQ0KPiA8VGlydW1h bGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbT47IGRvaEBpZXRmLm9yZzsgZG5zb3BAaWV0Zi5v cmc7DQo+IEFja2VybWFubiwgTWljaGFlbCA8bWFja2VybWFubkBiY2JzbS5jb20+OyBDaHJpc3Rp YW4gSHVpdGVtYQ0KPiA8aHVpdGVtYUBodWl0ZW1hLm5ldD47IGRucy1wcml2YWN5QGlldGYub3Jn OyBWaXR0b3JpbyBCZXJ0b2xhDQo+IDx2aXR0b3Jpby5iZXJ0b2xhPTQwb3Blbi14Y2hhbmdlLmNv bUBkbWFyYy5pZXRmLm9yZz47IFN0ZXBoZW4gRmFycmVsbA0KPiA8c3RlcGhlbi5mYXJyZWxsQGNz LnRjZC5pZT4NCj4gU3ViamVjdDogUmU6IFtEb2hdIFtkbnMtcHJpdmFjeV0gW0ROU09QXSBOZXc6 IGRyYWZ0LWJlcnRvbGEtYmNwLWRvaC1jbGllbnRzDQo+IA0KPiBIaSBQYXVsLA0KPiANCj4gPiBP biAxMSBNYXIgMjAxOSwgYXQgMTk6MTIsIFBhdWwgVml4aWUgPHBhdWxAcmVkYmFybi5vcmc+IHdy b3RlOg0KPiA+DQo+ID4NCj4gPg0KPiA+IG5hbGluaSBlbGtpbnMgd3JvdGUgb24gMjAxOS0wMy0x MSAxMDoyNjoNCj4gPj4gVGlydSwNCj4gPj4gVGhhbmtzIGZvciB5b3VyIGNvbW1lbnRzLg0KPiA+ PiA+IEVudGVycHJpc2UgbmV0d29ya3MgYXJlIGFscmVhZHkgYWJsZSB0byBibG9jayBEb0ggc2Vy dmljZXMsDQo+ID4gaSB3b25kZXIgaWYgZXZlcnlvbmUgaGVyZSBrbm93cyB0aGF0IFRMUyAxLjMg YW5kIGVuY3J5cHRlZCBoZWFkZXJzIGlzDQo+IGdvaW5nIHRvIHB1c2ggYSBTT0NLUyBhZ2VuZGEg b250byBlbnRlcnByaXNlcyB0aGF0IGhhZCBub3QgcHJldmlvdXNseQ0KPiBuZWVkZWQgb25lLCBh bmQgdGhhdCBzaW1wbHkgYmxvY2tpbmcgZXZlcnkgZXh0ZXJuYWwgZW5kcG9pbnQga25vd24gb3IN Cj4gdGVzdGVkIHRvIHN1cHBvcnQgRG9IIHdpbGwgYmUgdGhlIGNoZWFwZXIgYWx0ZXJuYXRpdmUs IGV2ZW4gaWYgdGhhdCBtYWtlcw0KPiBtaWxsaW9ucyBvZiBvdGhlciBlbmRwb2ludHMgYXQgZ29v Z2xlLCBjbG91ZGZsYXJlLCBjaXNjbywgYW5kIGlibSB1bnJlYWNoYWJsZQ0KPiBhcyBhIHNpZGUg ZWZmZWN0Pw0KPiANCj4gVGhhdCBvciBpdCB3aWxsIHJlcXVpcmUgYSBiaXQgbW9yZSBtYW5hZ2Vt ZW50IGF0IHRoZSBNRE0gbGV2ZWwuICBJ4oCZbSBob3BpbmcNCj4gdGhlIGxhdHRlci4gIEFuZCBJ IGhvcGUgdGhhdCBvbmUgb3V0cHV0IG9mIGFsbCBvZiB0aGVzZSBkb2N1bWVudHMgd2lsbCBiZSBh DQo+IHJlY29tbWVuZGF0aW9uIHJlZ2FyZGluZyBNRE0gaW50ZXJmYWNlcy4NCg0KSSBkb24ndCB0 aGluayBNRE0gaXMgcmVxdWlyZWQgdG8gdXNlIHRoZSBEb1QvRG9IIHNlcnZlcnMgcHJvdmlkZWQg YnkgdGhlIGxvY2FsIG5ldHdvcmsuDQoNCi1UaXJ1DQoNCj4gDQo+IEVsaW90DQo= From nobody Tue Mar 12 11:36:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE7D8130F25; Tue, 12 Mar 2019 04:43:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.106 X-Spam-Level: X-Spam-Status: No, score=-1.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RDNS_NONE=0.793, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TCRDU9jzXJDR; Tue, 12 Mar 2019 04:43:35 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id B8ED2126C01; Tue, 12 Mar 2019 04:43:34 -0700 (PDT) Received: from [10.20.120.143] (unknown [86.107.204.117]) by mail.noware.co.uk (Postfix) with ESMTPSA id 071CB1C0206; Tue, 12 Mar 2019 11:40:15 +0000 (UTC) From: Neil Cook Message-Id: <2508EF3D-F82D-4BA5-A2FC-6287A76724BA@noware.co.uk> Content-Type: multipart/alternative; boundary="Apple-Mail=_4C0A1DF0-6BF5-480C-B9BC-52CC38D68A19" Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Tue, 12 Mar 2019 12:43:31 +0100 In-Reply-To: Cc: Stephen Farrell , Paul Vixie , "doh@ietf.org" , "dnsop@ietf.org" , Christian Huitema , nalini elkins , "dns-privacy@ietf.org" , "Ackermann, Michael" , Vittorio Bertola To: "Konda, Tirumaleswar Reddy" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> X-Mailer: Apple Mail (2.3445.101.1) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: -100 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedutddrgeekgdefvdcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffknfevqffqmfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmnecujfgurhephffktgggufffjgfvfhfosegrtdhmrehhtddvnecuhfhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqeenucffohhmrghinhepihgvthhfrdhorhhgpdgvgigrmhhplhgvrdgtohhmnecukfhppeekiedruddtjedrvddtgedruddujeenucfrrghrrghmpehinhgvthepkeeirddutdejrddvtdegrdduudejpdhhvghloheplgdutddrvddtrdduvddtrddugeefngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopefvihhruhhmrghlvghsfigrrhftvgguugihpgfmohhnuggrsefotgetfhgvvgdrtghomhdprhgtphhtthhopehsthgvphhhvghnrdhfrghrrhgvlhhlsegtshdrthgtugdrihgvpdhrtghpthhtohepphgruhhlsehrvggusggrrhhnrdhorhhgpdhrtghpthhtohepughohhesihgvthhfrdhorhhgpdhrtghpthhtohepughnshhophesihgvthhfrdhorhhgpdhrtghpthhtohephhhuihhtvghmrgeshhhuihhtvghmrgdrnhgvthdprhgtphhtthhopehnrghlihhnihdrvghlkhhinhhssegvqdgutghordgt ohhmpdhrtghpthhtohepughnshdqphhrihhvrggthiesihgvthhfrdhorhhgpdhrtghpthhtohepmhgrtghkvghrmhgrnhhnsegstggsshhmrdgtohhmpdhrtghpthhtohepvhhithhtohhrihhordgsvghrthholhgrpeegtdhophgvnhdqgigthhgrnhhgvgdrtghomhesughmrghrtgdrihgvthhfrdhorhhgnecuvehluhhsthgvrhfuihiivgeptd Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 11:36:43 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 11:43:37 -0000 --Apple-Mail=_4C0A1DF0-6BF5-480C-B9BC-52CC38D68A19 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii >> ISTM that it is quite possible that enterprises that deploy their own = DoH >> services could potentially reduce such leakage and gain overall. (I'm >> assuming here that sensible browser-makers will end up providing >> something that works for browsers running in networks with = split-horizon >> setups before those browsers turn on DoH as a default at scale.) >=20 > If Enterprise network provides a DoT/DoH server, browser should be = able to discover and use the Enterprise DoT/DoH server. Well until now there has been no discovery mechanism for DoH servers. = There is now draft adopted by the DoH WG that proposes a discovery = mechanism. However whether browsers actually use it is another question. = Hence the draft by VIttorio. Neil > On 12 Mar 2019, at 06:14, Konda, Tirumaleswar Reddy = wrote: >=20 >> -----Original Message----- >> From: Stephen Farrell > >> Sent: Tuesday, March 12, 2019 5:30 AM >> To: Paul Vixie >; = doh@ietf.org >> Cc: nalini elkins >; Konda, Tirumaleswar Reddy >> >; dnsop@ietf.org = ; Ackermann, >> Michael >; = Christian Huitema >> >; = dns-privacy@ietf.org ; Vittorio Bertola >> > >> Subject: Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients >>=20 >>=20 >> (This distribution list is too scattered and diverse. Be great if = some AD or >> someone just picked one list for this. >> In the meantime...) >>=20 >> On 11/03/2019 20:43, nalini elkins wrote: >>> impact assessment that certain changes such as DoH and TLS1.3 will >>> have on enterprises, >>=20 >> TLS1.3 will, I expect, noticeably improve security for an awful lot = of >> enterprises in time. >>=20 >> As for DoH, I wonder has anyone done studies on how split-horizon = names >> and access patterns leak today? >>=20 >> I don't recall having read that kind of study. I can imagine many = ways in >> which that kind of stuff would leak. I'd be very surprised if it = never happens. >> I don't know how often it does. >>=20 >> For names, leaking once is kinda fatal. For access patterns, I guess = one leak >> exposes an IP address that's interested in a name (e.g. secret- >> project.example.com) but more would be needed for broader access >> patterns to be exposed to "foreign" >> recursives and/or in-band networks. >>=20 >> ISTM that it is quite possible that enterprises that deploy their own = DoH >> services could potentially reduce such leakage and gain overall. (I'm >> assuming here that sensible browser-makers will end up providing >> something that works for browsers running in networks with = split-horizon >> setups before those browsers turn on DoH as a default at scale.) >=20 > If Enterprise network provides a DoT/DoH server, browser should be = able to discover and use the Enterprise DoT/DoH server. >=20 > -Tiru >=20 >>=20 >> Cheers, >> S. > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop = --Apple-Mail=_4C0A1DF0-6BF5-480C-B9BC-52CC38D68A19 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
ISTM that it is quite = possible that enterprises that deploy their own DoH
services= could potentially reduce such leakage and gain overall. (I'm
assuming here that sensible browser-makers will end up = providing
something that works for browsers running in = networks with split-horizon
setups before those browsers = turn on DoH as a default at scale.)

If Enterprise network provides a DoT/DoH server, browser = should be able to discover and use the Enterprise DoT/DoH = server.

Well until now there has been no discovery mechanism = for DoH servers. There is now draft adopted by the DoH WG that proposes = a discovery mechanism. However whether browsers actually use it is = another question. Hence the draft by VIttorio.

Neil

On 12 = Mar 2019, at 06:14, Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com> wrote:

-----Original Message-----
From: Stephen = Farrell <stephen.farrell@cs.tcd.ie>
Sent: = Tuesday, March 12, 2019 5:30 AM
To: Paul Vixie <paul@redbarn.org>; doh@ietf.org
Cc:= nalini elkins <nalini.elkins@e-dco.com>; Konda, Tirumaleswar Reddy
<TirumaleswarReddy_Konda@McAfee.com>; dnsop@ietf.org; = Ackermann,
Michael <mackermann@bcbsm.com>; Christian Huitema
<huitema@huitema.net>; dns-privacy@ietf.org; = Vittorio Bertola
<vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org>Subject: Re: [dns-privacy] [DNSOP] New: = draft-bertola-bcp-doh-clients


(This distribution list is too scattered and diverse. Be = great if some AD or
someone just picked one list for = this.
In the meantime...)

On = 11/03/2019 20:43, nalini elkins wrote:
impact assessment that certain changes such as = DoH and TLS1.3 will
have on enterprises,

TLS1.3 will, I expect, noticeably = improve security for an awful lot of
enterprises in = time.

As for DoH, I wonder has anyone done = studies on how split-horizon names
and access patterns = leak today?

I don't recall having read that = kind of study. I can imagine many ways in
which that kind = of stuff would leak. I'd be very surprised if it never happens.
I don't know how often it does.

For names, leaking once is kinda fatal. For access patterns, = I guess one leak
exposes an IP address that's interested = in a name (e.g. secret-
project.example.com) = but more would be needed for broader access
patterns to be = exposed to "foreign"
recursives and/or in-band = networks.

ISTM that it is quite possible = that enterprises that deploy their own DoH
services could = potentially reduce such leakage and gain overall. (I'm
assuming here that sensible browser-makers will end up = providing
something that works for browsers running in = networks with split-horizon
setups before those browsers = turn on DoH as a default at scale.)

If Enterprise network provides a = DoT/DoH server, browser should be able to discover and use the = Enterprise DoT/DoH server.

-Tiru


Cheers,
S.
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop

= --Apple-Mail=_4C0A1DF0-6BF5-480C-B9BC-52CC38D68A19-- From nobody Tue Mar 12 11:36:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 29D0C130F70; Tue, 12 Mar 2019 06:12:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MQIxtFbcSmz3; Tue, 12 Mar 2019 06:11:53 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140055.outbound.protection.outlook.com [40.107.14.55]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE31A130F35; Tue, 12 Mar 2019 06:11:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uHbKhlgD5omKeRvHRn8qlEDTwUphYf+VQst64ZsnpZQ=; b=a0UgMB+vx7HjEBzL8sdPHXJkTY0HLt23k/DjCnh3Kh0kNurf65vJiR0M/FALb97Lnm3DTZwkEiNmlUS3ekIecqAiYwKKxcLH/BbYJws5/XTLahbKPxFg347tBiOjy4c2dJh91Xa85ccz84AH/lVH+q5hJsSjlIas4N4RcI4WdV0= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2550.eurprd06.prod.outlook.com (10.168.85.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.20; Tue, 12 Mar 2019 13:11:48 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::8c80:1afb:fea:cc15]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::8c80:1afb:fea:cc15%8]) with mapi id 15.20.1686.021; Tue, 12 Mar 2019 13:11:48 +0000 From: "Winfield, Alister" To: "Konda, Tirumaleswar Reddy" , Eliot Lear , Paul Vixie CC: Stephen Farrell , "doh@ietf.org" , "dnsop@ietf.org" , Christian Huitema , nalini elkins , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" Thread-Topic: [EXTERNAL] Re: [dns-privacy] [Doh] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2Gr4XDJqk3hV/02W+IJ09qeodKYHeO4AgACAQYA= Date: Tue, 12 Mar 2019 13:11:48 +0000 Message-ID: <2D9C1616-EF47-4685-8155-99A718806EE9@sky.uk> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e20a:2d00:9d9d:fd66:5606:8247] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 78c08c9b-8142-4240-5f60-08d6a6ec48bf x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2550; x-ms-traffictypediagnostic: DB6PR0601MB2550: x-ms-exchange-purlcount: 1 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtEQjZQUjA2MDFNQjI1NTA7MjM6YXhqR0NqWWdWZzUxYVNzMXRzRmtQSEVM?= =?utf-8?B?N0xkUWZjK2xEZDBtVlZBbkFwUVdjdGh6UDk5bndsdjJMKytlMHNWVVJ2SEpP?= =?utf-8?B?VlVLdURsU3pQL0tvbDFGejBrZzdtVGVaZjcwTnVENnRtL2lwUUJXMzkvaTU1?= =?utf-8?B?eFJCU3JxS1N6QlFLMEs5M0hxMklSMktZZGlYL0c5TVprc1p1TzVhT1NNQ3h4?= =?utf-8?B?MUF1K3ExbVpxS1IrMkNHdVJhUzBYenNiYlhsRnRpVXdndENBOThkc2czZk5Q?= =?utf-8?B?cTBHblA3OC9VWGlBMWNVOXFYWU96d1QrV1l3NkZ6dW9DUnhueUdOa2FWYkVN?= =?utf-8?B?WDlKcVRIWTExTEIycm5CUGF5ZnpIMSszSHVGSXVhRzVMZ1Y5THFtZnhWV3ln?= =?utf-8?B?VnE5YklDNHFNeU5UaWtTN1NXeTVXc055Y1JYUHhaQXcwTElxMkxhZDdqUFkw?= =?utf-8?B?eERkejdCVk10MFBtVE1VcEw3WENDbmNvbi9YVHRyMng3KzBGb0Y4WGdFM2cv?= =?utf-8?B?U2dlU0hLVlJTQ0hoZll2MlNDcWJNalRVVHZPeDgxdmNJQVhlVUwweWVGMHlQ?= =?utf-8?B?NksrWnA5Z2wySE5TNWtyR3VOWUoxTEMyYjE1YUliSmZPYldtOEhmR0pCVnli?= =?utf-8?B?ZDRKblZCZWpiZ1cwb2gvbng4RWVEL0RZRXorNDBuTjFwaFY2ZE9wV3JRZ0JN?= =?utf-8?B?bjJOSEJ3UWNZOFVhSmFIblE3cTlzMmFySkRKMm4rNUdhU3daY1dFd2JZTXhR?= =?utf-8?B?OGt0K1ZvUk1LVGw2cXZ6MVdMMEk2eTFhRWUyWjVOc0Q5WXc2TUtzTnBjYlVM?= =?utf-8?B?cHpvNFE2RWRydUUrRnlPVWplY25oVjlsTTA5VFc3ZGZRdzNYaGJVYmVQYkta?= =?utf-8?B?SnpEakVSVmJUNm1lNlVFSmQzLzZuNU03b1ZJYkw0OU1Ma21mamx5N0lXV2s2?= =?utf-8?B?MGJ5L1VzSlhnQkJGek1KY2Z0b0w3R0lXRWNIV2ZQTk0xUm1EN1FyUnkxaEE2?= =?utf-8?B?d1JmYVNaWlBCM2k0NjJ5b0pucEthVUxYY3NjdWZJUU42NTZrQXBHeEZKRlB4?= =?utf-8?B?TFNDZzRGbmNkaWpvenI0ajlGZFpuQjJmWG1hM0IreVhxQmhQU0NZZUlDYlpB?= =?utf-8?B?a0ZMeFZ1UHVCa2RBZ2R0azU1QlN2V0NHbTEySVpmNStNMSszbGRNckJtQ05R?= =?utf-8?B?WTV2TmY3OWRQMUloa1hBOGo3OFRpRU5DamNnQWVlbmtqbVU0UnE1RzZyUlZC?= =?utf-8?B?QXdJeXhUNmg3TjQyZmpQdS9nKzhsWVNPU1VMSE5aQlEvVElBWUdVSFhqOW50?= =?utf-8?B?REh4NXJRZEROaTJSZFZEZmRyMWg3T0hDM0w3cDZXaXhlRGhneUZGRzJSSE9q?= =?utf-8?B?RjV6OVFQS09vMW9kclIxQi9zRUlwc1FqZmNHRFNSUUF0N251ZVV4d1BRRWxn?= =?utf-8?B?c1JYMlozL0x1aGlUdTZ5ODFPSlhoRXZ6T3FCd3JFbmZFNFNleExwMFNrMXZ5?= =?utf-8?B?cVJJVHVOUWF4aGNGeFdQN1AyL2tLN0hieUdMSllIUGFWTHF6c01FRFhrTW95?= =?utf-8?B?aTJ2am5NR0ZYbEc4SlJqQ2VFcHFBTkR4MUZ2QXJucG0zOGY0NXNZUmpBMGNS?= =?utf-8?B?eWgxWmtOeVhrQVdDR0tZUXo1d0hFNVVidEMrc0JiYmd0N2FqeVNsL2FjZDVw?= =?utf-8?B?WG50V2x3RzA2UDY2L1JUSUovTEFhcWozUElUS2xLY1pUVHZHMVMzWEVaVll4?= =?utf-8?B?cmNPMWo4Tnd2b1dWUDQ4MmkyMktPS0xhdlhjeDJsR1hhS0xJMWFpcUZtVE9C?= =?utf-8?B?VjFBcGgzUE9YTnVRMHR2QVhlamRZMXNHaWVlcTYzZTgvNm9mWnN3dmRSd2xq?= =?utf-8?B?amdqYWdaKzNvbExPTGdGSUJwa3d2ZHZhTUlVZXR6N05oQjBGU01ET2UzM1Bo?= =?utf-8?B?RDhHaml3ZGdFYmlSNzVWMjRNNDJ6RG1vcWlJUXk5LzNNQzdMRFhGYzZvcnFH?= =?utf-8?B?MUlGUEV5Wjh0UCtwcVQ1ZjFxdnVTMzVYM1hCRWpnPT0=?= x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(376002)(366004)(39860400002)(136003)(346002)(13464003)(199004)(54094003)(189003)(53936002)(229853002)(7736002)(99286004)(66574012)(5660300002)(54906003)(4326008)(6506007)(53546011)(58126008)(102836004)(186003)(74482002)(14454004)(110136005)(478600001)(76176011)(71200400001)(82746002)(305945005)(316002)(36756003)(2616005)(25786009)(71190400001)(966005)(97736004)(486006)(6486002)(6246003)(8676002)(81166006)(7416002)(81156014)(93886005)(46003)(476003)(11346002)(8936002)(45080400002)(6116002)(83716004)(446003)(105586002)(86362001)(2906002)(5024004)(6306002)(14444005)(256004)(6512007)(33656002)(68736007)(6436002)(72206003)(106356001); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2550; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: XZGQ4r3aOH5fLjGuP+Lp3ddIXl60r1cruLME8FpBMhmZa2sSVDF3sNgv801KiDfU/alIMuv1u0WoidbzBM3zEbgWOBEAHhZxYp0bOkYb3WDBcSqL36X/KDG6+seuv1jfm7ucF31kKWGHwPGsrkGGPMNkO0Al7/EbEcdxW3iEt0w1ri0WG55kmfJpeeYx8XxchYUTnIgc7QVXipopWnfFrkyy7AVaqj7tjjY907Znr6JG3CrqTrtYSpsIZp2n3+V0AVJdzjsJuxvWZHtDU+ZAItYdvDRrDEbRVLDOaWMyvn4uBA4Pq/DRjiujojQa2ryEdfU04+s/+JwXwUp73RSPh2ynT/qVmnCpN1R13tPNHoSwUu+6k0NG5sTFyrmL1+hK5EenaAgV7lIUOxaUP0zIHzkCb7nMQTUbLm9W5Q4yUYg= Content-Type: text/plain; charset="utf-8" Content-ID: <13AF2DE4613F744EBF532D857D1172A8@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 78c08c9b-8142-4240-5f60-08d6a6ec48bf X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 13:11:48.1467 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2550 Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 11:36:43 -0700 Subject: Re: [Doh] [EXTERNAL] Re: [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 13:12:02 -0000 TURNIGlzIGFsc28gYSByZWQtaGVycmluZyBnaXZlbiA+OTAlIG9mIGRldmljZXMgd29ybGQtd2lk ZSBhcmVuJ3QgbWFuYWdlZCBzbyBhbnlvbmUgdGFsa2luZyBvZiBNRE0gcmlkaW5nIHRvIHRoZSBy ZXNjdWUgb2YgRG9IIGNsaWVudCBjb25maWd1cmF0aW9uIGlzIHdhbGtpbmcgYXJvdW5kIHdpdGgg YmxpbmtlcnMgb24uIEV2ZW4gaW5zaWRlIGNvbXBhbnkgbmV0d29ya3MgdGhlcmUgYXJlIHNlcnZl cnMgbm90IHVuZGVyIE1ETTsgbG9jYWxseSBkZXZlbG9wZWQgYXBwbGljYXRpb25zIHRoYXQgbWln aHQgaW4gZnV0dXJlIHB1bGwgaW4gYSBEb0ggcmVzb2x2ZXI7IEJZT0Q7IHZpc2l0b3JzOyBtYWx3 YXJlIGFuZCBzbyBvbi4gU28gd2hhdGV2ZXIgeW91IHRoaW5rIGEgcmVhc29uYWJsZSBzb2x1dGlv biBmb3IgY2xpZW50IGNvbmZpZ3VyYXRpb24gaGFzIHRvIHN0YXJ0IHdpdGggdW5tYW5hZ2VkIGNs aWVudHMuIFRoYXQgbGFzdCBvbmUgbWFsd2FyZSBpcyB3aHkgdGhlIGNvcnBvcmF0ZSByZXNwb25z ZSBtYXkgd2VsbCBiZSAnTUlUTScgdGhlIHRyYWZmaWMgc28gd2UgY2FuIHByb3RlY3QgdGhlIGRh dGEsIHBlb3BsZSBhbmQgc3lzdGVtcyB1c2luZyBvdXIgbmV0d29yay4NCg0KV2hhdCBEb0ggZGlz Y292ZXJ5IGFuZCBwcmVzZW50YXRpb24gbG9va3MgbGlrZSBpcyBjb21wbGV4IGlzc3VlIHRoYXQg d2lsbCB0YWtlIHNvbWUgZGlzY3Vzc2lvbi4gSnVzdCBvbmUgc21hbGwgZXhhbXBsZSwgSSBtaWdo dCB3YW50IHRvIHVzZSB0aGUgbG9jYWwgbmV0d29ya3MgRE5TIGlmIGFuZCBvbmx5IGlmIGl0IHBy b3ZpZGVzIGFudGktbWFsd2FyZSBwcm90ZWN0aW9uIGFuZCBoYXMgYSByZWFzb25hYmxlIHByaXZh Y3kgcG9saWN5IGJ1dCB1c2UgYSBzdGF0aWMgb25lIGlmIG5vdC4gT3IgcGVyaGFwcyBvbiBhIGNo aWxkJ3MgZGV2aWNlIGl0J3Mgb2theSBpZiB0aGVyZSBpcyBmaWx0ZXJpbmcgaW4gcGxhY2Ugc3Vp dGFibGUgZm9yIGNoaWxkcmVuLg0KDQpBbGlzdGVyDQoNCu+7v09uIDEyLzAzLzIwMTksIDA1OjQz LCAiZG5zLXByaXZhY3kgb24gYmVoYWxmIG9mIEtvbmRhLCBUaXJ1bWFsZXN3YXIgUmVkZHkiIDxk bnMtcHJpdmFjeS1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBUaXJ1bWFsZXN3YXJSZWRk eV9Lb25kYUBNY0FmZWUuY29tPiB3cm90ZToNCg0KICAgID4gLS0tLS1PcmlnaW5hbCBNZXNzYWdl LS0tLS0NCiAgICA+IEZyb206IEVsaW90IExlYXIgPGxlYXJAY2lzY28uY29tPg0KICAgID4gU2Vu dDogTW9uZGF5LCBNYXJjaCAxMSwgMjAxOSAxMTo0OSBQTQ0KICAgID4gVG86IFBhdWwgVml4aWUg PHBhdWxAcmVkYmFybi5vcmc+DQogICAgPiBDYzogbmFsaW5pIGVsa2lucyA8bmFsaW5pLmVsa2lu c0BlLWRjby5jb20+OyBLb25kYSwgVGlydW1hbGVzd2FyIFJlZGR5DQogICAgPiA8VGlydW1hbGVz d2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbT47IGRvaEBpZXRmLm9yZzsgZG5zb3BAaWV0Zi5vcmc7 DQogICAgPiBBY2tlcm1hbm4sIE1pY2hhZWwgPG1hY2tlcm1hbm5AYmNic20uY29tPjsgQ2hyaXN0 aWFuIEh1aXRlbWENCiAgICA+IDxodWl0ZW1hQGh1aXRlbWEubmV0PjsgZG5zLXByaXZhY3lAaWV0 Zi5vcmc7IFZpdHRvcmlvIEJlcnRvbGENCiAgICA+IDx2aXR0b3Jpby5iZXJ0b2xhPTQwb3Blbi14 Y2hhbmdlLmNvbUBkbWFyYy5pZXRmLm9yZz47IFN0ZXBoZW4gRmFycmVsbA0KICAgID4gPHN0ZXBo ZW4uZmFycmVsbEBjcy50Y2QuaWU+DQogICAgPiBTdWJqZWN0OiBSZTogW0RvaF0gW2Rucy1wcml2 YWN5XSBbRE5TT1BdIE5ldzogZHJhZnQtYmVydG9sYS1iY3AtZG9oLWNsaWVudHMNCiAgICA+DQog ICAgPiBIaSBQYXVsLA0KICAgID4NCiAgICA+ID4gT24gMTEgTWFyIDIwMTksIGF0IDE5OjEyLCBQ YXVsIFZpeGllIDxwYXVsQHJlZGJhcm4ub3JnPiB3cm90ZToNCiAgICA+ID4NCiAgICA+ID4NCiAg ICA+ID4NCiAgICA+ID4gbmFsaW5pIGVsa2lucyB3cm90ZSBvbiAyMDE5LTAzLTExIDEwOjI2Og0K ICAgID4gPj4gVGlydSwNCiAgICA+ID4+IFRoYW5rcyBmb3IgeW91ciBjb21tZW50cy4NCiAgICA+ ID4+ID4gRW50ZXJwcmlzZSBuZXR3b3JrcyBhcmUgYWxyZWFkeSBhYmxlIHRvIGJsb2NrIERvSCBz ZXJ2aWNlcywNCiAgICA+ID4gaSB3b25kZXIgaWYgZXZlcnlvbmUgaGVyZSBrbm93cyB0aGF0IFRM UyAxLjMgYW5kIGVuY3J5cHRlZCBoZWFkZXJzIGlzDQogICAgPiBnb2luZyB0byBwdXNoIGEgU09D S1MgYWdlbmRhIG9udG8gZW50ZXJwcmlzZXMgdGhhdCBoYWQgbm90IHByZXZpb3VzbHkNCiAgICA+ IG5lZWRlZCBvbmUsIGFuZCB0aGF0IHNpbXBseSBibG9ja2luZyBldmVyeSBleHRlcm5hbCBlbmRw b2ludCBrbm93biBvcg0KICAgID4gdGVzdGVkIHRvIHN1cHBvcnQgRG9IIHdpbGwgYmUgdGhlIGNo ZWFwZXIgYWx0ZXJuYXRpdmUsIGV2ZW4gaWYgdGhhdCBtYWtlcw0KICAgID4gbWlsbGlvbnMgb2Yg b3RoZXIgZW5kcG9pbnRzIGF0IGdvb2dsZSwgY2xvdWRmbGFyZSwgY2lzY28sIGFuZCBpYm0gdW5y ZWFjaGFibGUNCiAgICA+IGFzIGEgc2lkZSBlZmZlY3Q/DQogICAgPg0KICAgID4gVGhhdCBvciBp dCB3aWxsIHJlcXVpcmUgYSBiaXQgbW9yZSBtYW5hZ2VtZW50IGF0IHRoZSBNRE0gbGV2ZWwuICBJ 4oCZbSBob3BpbmcNCiAgICA+IHRoZSBsYXR0ZXIuICBBbmQgSSBob3BlIHRoYXQgb25lIG91dHB1 dCBvZiBhbGwgb2YgdGhlc2UgZG9jdW1lbnRzIHdpbGwgYmUgYQ0KICAgID4gcmVjb21tZW5kYXRp b24gcmVnYXJkaW5nIE1ETSBpbnRlcmZhY2VzLg0KDQogICAgSSBkb24ndCB0aGluayBNRE0gaXMg cmVxdWlyZWQgdG8gdXNlIHRoZSBEb1QvRG9IIHNlcnZlcnMgcHJvdmlkZWQgYnkgdGhlIGxvY2Fs IG5ldHdvcmsuDQoNCiAgICAtVGlydQ0KDQogICAgPg0KICAgID4gRWxpb3QNCiAgICBfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KICAgIGRucy1wcml2YWN5 IG1haWxpbmcgbGlzdA0KICAgIGRucy1wcml2YWN5QGlldGYub3JnDQogICAgaHR0cHM6Ly9lbWVh MDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3 dy5pZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmRucy1wcml2YWN5JmFtcDtkYXRhPTAy JTdDMDElN0NhbGlzdGVyLndpbmZpZWxkJTQwc2t5LnVrJTdDYWI1ZmFhOTMzZjM3NGFlN2I3MmMw OGQ2YTZhZGEzNDglN0M2OGI4NjVkNWNmMTg0YjJiODJhNGE0ZWRkYjljNTIzNyU3QzAlN0MwJTdD NjM2ODc5NjYyMDU5MzM3MTg0JmFtcDtzZGF0YT1iYmEzYmFwSU8zZmZpbHlsaG9JajB4M3pWa0hZ bE5DNEdpZDk2WWJ4OVhvJTNEJmFtcDtyZXNlcnZlZD0wDQogICAgLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0NCiAgICBU aGlzIGVtYWlsIGlzIGZyb20gYW4gZXh0ZXJuYWwgc291cmNlLiBQbGVhc2UgZG8gbm90IG9wZW4g YXR0YWNobWVudHMgb3IgY2xpY2sgbGlua3MgZnJvbSBhbiB1bmtub3duIG9yIHN1c3BpY2lvdXMg b3JpZ2luLiBQaGlzaGluZyBhdHRlbXB0cyBjYW4gYmUgcmVwb3J0ZWQgYnkgc2VuZGluZyB0aGVt IHRvIHBoaXNoaW5nQHNreS51ayBhcyBhdHRhY2htZW50cy4gVGhhbmsgeW91DQogICAgLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0NCg0KDQoNCkluZm9ybWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRh Y2htZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBl eGNsdXNpdmVseSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90 IGJlIG9mZmljaWFsIHBvbGljeSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2lu YXRvci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhl IHNlbmRlciBieSByZXR1cm4gZS1tYWlsIGFuZCBkZWxldGUgaXQgZnJvbSB5b3VyIHN5c3RlbS4g WW91IHNob3VsZCBub3QgcmVwcm9kdWNlLCBkaXN0cmlidXRlLCBzdG9yZSwgcmV0cmFuc21pdCwg dXNlIG9yIGRpc2Nsb3NlIGl0cyBjb250ZW50cyB0byBhbnlvbmUuIFBsZWFzZSBub3RlIHdlIHJl c2VydmUgdGhlIHJpZ2h0IHRvIG1vbml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9uIHRocm91 Z2ggb3VyIGludGVybmFsIGFuZCBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1h cmtzIGFyZSB0cmFkZW1hcmtzIG9mIFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBB RyBhbmQgYXJlIHVzZWQgdW5kZXIgbGljZW5jZS4NCg0KU2t5IFVLIExpbWl0ZWQgKFJlZ2lzdHJh dGlvbiBOby4gMjkwNjk5MSksIFNreS1Jbi1Ib21lIFNlcnZpY2UgTGltaXRlZCAoUmVnaXN0cmF0 aW9uIE5vLiAyMDY3MDc1KSwgU2t5IFN1YnNjcmliZXJzIFNlcnZpY2VzIExpbWl0ZWQgKFJlZ2lz dHJhdGlvbiBOby4gMjM0MDE1MCkgYW5kIFNreSBDUCBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8u IDk1MTMyNTkpIGFyZSBkaXJlY3Qgb3IgaW5kaXJlY3Qgc3Vic2lkaWFyaWVzIG9mIFNreSBMaW1p dGVkIChSZWdpc3RyYXRpb24gTm8uIDIyNDc3MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50 aW9uZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJlIGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBX YWxlcyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJ c2xld29ydGgsIE1pZGRsZXNleCBUVzcgNVFEDQo= From nobody Tue Mar 12 11:37:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48E70130DCB; Tue, 12 Mar 2019 09:01:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s7d6DDJmWWrx; Tue, 12 Mar 2019 09:01:43 -0700 (PDT) Received: from mx4.nic.fr (mx4.nic.fr [IPv6:2001:67c:2218:2::4:12]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 167F9124B91; Tue, 12 Mar 2019 09:01:43 -0700 (PDT) Received: from mx4.nic.fr (localhost [127.0.0.1]) by mx4.nic.fr (Postfix) with SMTP id 8760F280285; Tue, 12 Mar 2019 17:01:41 +0100 (CET) Received: by mx4.nic.fr (Postfix, from userid 500) id 7E50A28038C; Tue, 12 Mar 2019 17:01:41 +0100 (CET) Received: from relay01.prive.nic.fr (relay01.prive.nic.fr [IPv6:2001:67c:2218:15::11]) by mx4.nic.fr (Postfix) with ESMTP id 7643E280285; Tue, 12 Mar 2019 17:01:41 +0100 (CET) Received: from b12.nic.fr (b12.tech.ipv6.nic.fr [IPv6:2001:67c:1348:7::86:133]) by relay01.prive.nic.fr (Postfix) with ESMTP id 6F1E2663E720; Tue, 12 Mar 2019 17:01:41 +0100 (CET) Received: by b12.nic.fr (Postfix, from userid 1000) id 6760B40235; Tue, 12 Mar 2019 17:01:41 +0100 (CET) Date: Tue, 12 Mar 2019 17:01:41 +0100 From: Stephane Bortzmeyer To: Neil Cook Cc: Stephane Bortzmeyer , nalini elkins , Stephen Farrell , doh@ietf.org, dnsop@ietf.org, Christian Huitema , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" Message-ID: <20190312160141.ibnjtdt5myntwiwk@nic.fr> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> X-Operating-System: Debian GNU/Linux 9.8 X-Kernel: Linux 4.9.0-8-amd64 x86_64 X-Charlie: Je suis Charlie Organization: NIC France X-URL: http://www.nic.fr/ User-Agent: NeoMutt/20170113 (1.7.2) X-Bogosity: No, tests=bogofilter, spamicity=0.000170, version=1.2.2 X-PMX-Version: 6.0.0.2142326, Antispam-Engine: 2.7.2.2107409, Antispam-Data: 2019.3.12.155116 Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 11:36:43 -0700 Subject: Re: [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:01:50 -0000 On Tue, Mar 12, 2019 at 04:55:11PM +0100, Neil Cook wrote a message of 22 lines which said: > Actually many enterprises (particularly banks etc.) do not allow DNS resolution directly from employee endpoints. They block UDP/53, which is not the same thing. Malware or non-cooperating applications can do name resolution by other means. I still do not understand why people have a problem with DoH whch did not already exist before with my-own-name-resolution-protocol-over-HTTPS. From nobody Tue Mar 12 11:37:07 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44B89130F4F; Tue, 12 Mar 2019 09:10:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.4 X-Spam-Level: X-Spam-Status: No, score=-0.4 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_SORBS_WEB=1.5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9AxD-S5pwlG5; Tue, 12 Mar 2019 09:10:46 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 39554130FC7; Tue, 12 Mar 2019 09:10:46 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 98D3D5F40512; Tue, 12 Mar 2019 17:10:44 +0100 (CET) Received: from [172.19.248.24] (unknown [104.153.224.168]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 81CC55F402C2; Tue, 12 Mar 2019 17:10:22 +0100 (CET) From: "Ralf Weber" To: "Stephane Bortzmeyer" Cc: "Neil Cook" , doh@ietf.org, dnsop@ietf.org, "Ackermann, Michael" , "Christian Huitema" , "nalini elkins" , dns-privacy@ietf.org, "Vittorio Bertola" , "Stephen Farrell" Date: Tue, 12 Mar 2019 17:10:14 +0100 X-Mailer: MailMate (1.12.4r5594) Message-ID: <4DFF5687-7C5C-4B36-85CE-B58325F0B8D7@fl1ger.de> In-Reply-To: <20190312160141.ibnjtdt5myntwiwk@nic.fr> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> <20190312160141.ibnjtdt5myntwiwk@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 11:36:43 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:10:49 -0000 Moin! On 12 Mar 2019, at 17:01, Stephane Bortzmeyer wrote: > On Tue, Mar 12, 2019 at 04:55:11PM +0100, > Neil Cook wrote > a message of 22 lines which said: > >> Actually many enterprises (particularly banks etc.) do not allow DNS >> resolution directly from employee endpoints. > > They block UDP/53, which is not the same thing. Well the DNS protocol has been defined on UDP and TCP port 53, so if you block this, you block DNS. If you add TCP/853 into the mix you block DNS over TLS, all of which is relative easy for an enterprise to do. > Malware or > non-cooperating applications can do name resolution by other means. I > still do not understand why people have a problem with DoH whch did > not already exist before with > my-own-name-resolution-protocol-over-HTTPS. A malware doing something specific to it is different than an IETF standard and application providers taking this standard (DoH) to switch a basic internet function (name lookups) without the users consent which are due to using HTTPs/443 harder to block for enterprises. It is a pretty clear difference. So long -Ralf —-- Ralf Weber From nobody Tue Mar 12 11:37:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 742F7130E66; Tue, 12 Mar 2019 11:17:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mazzjEqzYSgs; Tue, 12 Mar 2019 11:17:42 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E35341277DE; Tue, 12 Mar 2019 11:17:42 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id B4052892C6; Tue, 12 Mar 2019 18:17:42 +0000 (UTC) From: Paul Vixie To: Eliot Lear Cc: nalini elkins , "Konda, Tirumaleswar Reddy" , "doh@ietf.org" , "dnsop@ietf.org" , "Ackermann, Michael" , Christian Huitema , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Date: Tue, 12 Mar 2019 18:17:41 +0000 Message-ID: <1821023.QPalJCvhiW@linux-9daj> Organization: Vixie Freehold In-Reply-To: <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <36C6BE4B-5919-4658-9AF1-AB1572E5999C@cisco.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 11:36:43 -0700 Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 18:17:44 -0000 On Monday, 11 March 2019 18:18:38 UTC Eliot Lear wrote: =2E.. > > i wonder if everyone here knows that TLS 1.3 and encrypted headers is > > going to push a SOCKS agenda onto enterprises that had not previously > > needed one, and that simply blocking every external endpoint known or > > tested to support DoH will be the cheaper alternative, even if that mak= es > > millions of other endpoints at google, cloudflare, cisco, and ibm > > unreachable as a side effect? >=20 > That or it will require a bit more management at the MDM level. I=E2=80= =99m hoping > the latter. And I hope that one output of all of these documents will be= a > recommendation regarding MDM interfaces. MDM is a cooperation protocol. that is, both the operator and the app or us= er=20 have to want data management to be be mastered (DM to be M, so, MDM). this is off-topic for DoH, which seeks to prevent on-path interference with= =20 DNS operations. that is, someone or something using DoH cannot be expected = to=20 seek cooperation with the network operator. teenagers and malware being two easy examples. BYOD being another. pre-DoH, it was possible to ensure that noncompliance with MDM would yield= =20 failures. that is, disallowing outbound 53 and 853 except from the operator= 's=20 own name servers. post-DoH, such enforcement is (deliberately) impossible. can we therefore please stop talking about MDM here. vixie From nobody Tue Mar 12 11:37:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFEAD1311A8; Tue, 12 Mar 2019 11:35:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j4zHqE8DhMOm; Tue, 12 Mar 2019 11:35:23 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C1CF1311B8; Tue, 12 Mar 2019 11:35:23 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 97E59892C6; Tue, 12 Mar 2019 18:35:22 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Eric Rescorla , Stephen Farrell , "Konda, Tirumaleswar Reddy" , "doh@ietf.org" , Christian Huitema , nalini elkins , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" Date: Tue, 12 Mar 2019 18:35:21 +0000 Message-ID: <4935758.NkxX2Kjbm0@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 11:36:43 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 18:35:25 -0000 On Monday, 11 March 2019 21:44:06 UTC Eric Rescorla wrote: > On Mon, Mar 11, 2019 at 11:13 AM Paul Vixie wrote: > > > > Enterprise networks are already able to block DoH services, > > > > i wonder if everyone here knows that TLS 1.3 and encrypted headers is > > going to push a SOCKS agenda onto enterprises that had not previously > > needed one, > > I'm pretty familiar with TLS 1.3, but I don't know what this means. TLS 1.3 > doesn't generally encrypt headers any more than TLS 1.2 did, except for > the content type byte, which isn't that useful for inspection anyway. > Are you perchance referring to encrypted SNI? Something else? yes, i mean encrypted SNI, and i apologize for saying "encrypted headers". > encrypted SNI, an extension to the TLS 1.3 protocol that improves privacy of > Internet users by preventing on-path observers, including ISPs, coffee shop > owners and firewalls, from intercepting the TLS Server Name Indication > (SNI) extension and using it to determine which websites users are > visiting. (https://blog.cloudflare.com/encrypted-sni/) what this means is, if someone is concerned that some of the web sites reachable through some CDN are dangerous, they can no longer operate a mostly- transparent edge gateway, to permit or forbid transactions on a case by case basis. rather, they will have to use SOCKS or similar, and blackhole the CDN from being reached other than from the SOCKS/similar proxy. this significantly increases policy enforcement costs, probably placing them outside the budget of most small/medium companies, and all home networks. and that's the intent. so: > Enterprise networks are already able to block DoH services, that's old-think. vixie From nobody Tue Mar 12 11:53:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1BA521312DD; Tue, 12 Mar 2019 11:52:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n7tocuH6rwL6; Tue, 12 Mar 2019 11:52:44 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CB271312D8; Tue, 12 Mar 2019 11:52:44 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 70691892C6; Tue, 12 Mar 2019 18:52:44 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Stephane Bortzmeyer , Vittorio Bertola , dns-privacy@ietf.org, doh@ietf.org, hrpc@irtf.org Date: Tue, 12 Mar 2019 18:52:43 +0000 Message-ID: <2044747.4WdMZHU4Qz@linux-9daj> Organization: Vixie Freehold In-Reply-To: <20190312090142.s32hdimbozsrbovt@nic.fr> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 18:52:46 -0000 On Tuesday, 12 March 2019 09:01:42 UTC Stephane Bortzmeyer wrote: > On Mon, Mar 11, 2019 at 06:57:03PM +0100, > Vittorio Bertola wrote > > a message of 18 lines which said: > > Moreover, centralization is not the only Do*-related problem > > category that has been raised (my draft alone lists eight others). > > IMHO, this is precisely the biggest problem with these three drafts: > they accumulate a lot of unrelated rants, and it is important to split > between issues that are really DoH-specific from more general issues. when you refer to something as a rant, you diminish and disrespect it. any concern about the inability of a network operator to maintain possession of their RDNS control plane is on-topic for DoH, simply because RFC 8484's stated goal is to prevent on-path interference with DNS operations. please do not relegate discussions about the loss of operator control over the RDNS control plane to some mailing list where DoH is not front-and-center. their intentions were clear. therefore they should participate in the results. > > Warren Kumari did a good job of sorting that out in > . I > quote him: > > 1: the protocol, > 2: the deployment concerns, > 3: "resolverless DNS", > 4: the loss of visibility from encrypting the DNS that is a useless distinction. > > IMHO, this makes several side meetings. People are welcome to organize > more. in usenet, we used to say "please take this to some mailing list" by which we meant "...that i won't be joining, so that i no longer have to listen to you." so far, most responses to RDNS control plane ownership issues have received a similar response. "please find someone who cares, and talk to them about it." that's going to make the coming fight harder. we should be looking to make it easier. vixie From nobody Tue Mar 12 12:15:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 543731278CF; Tue, 12 Mar 2019 12:15:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 64UCa9sB_vzd; Tue, 12 Mar 2019 12:15:43 -0700 (PDT) Received: from mail-it1-x12f.google.com (mail-it1-x12f.google.com [IPv6:2607:f8b0:4864:20::12f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A1491277E7; Tue, 12 Mar 2019 12:15:43 -0700 (PDT) Received: by mail-it1-x12f.google.com with SMTP id l139so6346102ita.5; Tue, 12 Mar 2019 12:15:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=X8izjUOM1gchIZFMDQDXwkO7AYVfeoBVKxbDflkDpYM=; b=tlGADYt5x5h+0wDRWUxcisBCddaLmLvTe9a+i8CZe+P73q3sPYdj9SE0XbOK/gkQsx f0+1776SzJq8UAz0sSK1CRaWpBnHIUWrt9xdEO2eAd4I6QgRzGhAEi3Ks79NMBSZ4uRG Da21T4Wo0bsl5SYW8WN2ANX/B6jwsZGrhrdvk83niLsoCA7tfuSCurTmI28Wrx8g5qv4 Jxvqj6hBOos0a666FJsYcNmHy5UcPFcFL+pmPaz+w7mhls6+hN3rhf3oEq1OffBR3+bS LQmyw2Ie8+KgwHp0FSNZeUpUq7edZ/sWtIwK3xlBwzmuMFF0xyHpBjq6nNxlHWJZmQuf gDRQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=X8izjUOM1gchIZFMDQDXwkO7AYVfeoBVKxbDflkDpYM=; b=c7OQaK+DH65hmILluD+j3ZE7275tHW3fZSoUmVKr0KTVmse/n1SVx642hyTNSucxgG UBaYDASF4H9XR/u7hI0rPWmWfeMsBjmtkI0mGFVk2ppyFerK+892QZx/NhjGrMNRcnmL zmAa26/LnGgRgxvPNXbszL8xLOMlYLrSTvJAlf3b0ob2JbdkORlw61E7oM+eRuUbTrSX 5kzxITUQKZbEx5v7rUvIKYkP7NQXbDXUoiojkZpZ4QeyETdLm0Q/IvNY76iBJmWtChLB C+UuGZwh9bIMsrMKOLVf4IcByjuji/caCy5n6m7ykW2zmRnQ7nnCNEdOTkEgX7gYE07D FTRg== X-Gm-Message-State: APjAAAUFAhSLQxX+M55keAoy7UT59smVb56y3ZfOcyg2DQvcBrxXE+Fx uQ3vSiSYVROrDs8xBcT7H+DrB7C55/eCrKml45M= X-Google-Smtp-Source: APXvYqxC6F2z8o0Lm133z9ToZ7I61goec8Aq6pxi4UE6ekDjcCq6JiE9g+VeZfkRHzhHIANk2hGXOCJ8Mg8l7efZevE= X-Received: by 2002:a24:4741:: with SMTP id t62mr2928175itb.110.1552418142613; Tue, 12 Mar 2019 12:15:42 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <5456b9d9-844f-f410-3935-2b2d3ae22745@redbarn.org> <3457266.o2ixm6i3xM@linux-9daj> In-Reply-To: <3457266.o2ixm6i3xM@linux-9daj> From: Ted Hardie Date: Tue, 12 Mar 2019 12:15:16 -0700 Message-ID: To: Paul Vixie Cc: Warren Kumari , Jim Reid , DoH WG , dnsop Content-Type: multipart/alternative; boundary="000000000000eef9ae0583ea833a" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 19:15:45 -0000 --000000000000eef9ae0583ea833a Content-Type: text/plain; charset="UTF-8" Hi Paul, Comments in-line. On Tue, Mar 12, 2019 at 11:27 AM Paul Vixie wrote: > On Monday, 11 March 2019 18:30:51 UTC Ted Hardie wrote: > > On Mon, Mar 11, 2019 at 11:06 AM Paul Vixie wrote: > > > DoH will moot that approach. > > > > Any system that actually checks the credentials presented by the > responding > > server will also moot that approach. > > yes! but it will fail "closed". thus, no unauthorized exfiltration risk > will > exist. > > > Given how easy it is to pin > > credential characteristics in applications distributed as binaries, this > > seems to mean that your method will either continue to permit > applications > > other than browsers to use their own resolution systems or it will hard > > fail all such applications it can identify. No pass through will work, > as > > far as I can tell, in that scenario. > > that's precisely the goal, because very few network operators can > preordain > the users and apps that will connect through their networks. I do not believe this goal is met by what you describe, since an application can use a proprietary resolution service in its flows. Imagine for a moment an application on a smart TV that wants to provide content from the closest server which contains that content. It can use a redirect from the original server when a new, closer server comes online (or when a different server has that content), and it can provide the mapping between that server and one or more addresses for that server with the redirect, in whatever format its individual cache can store. All of this can take place within its confidential channel, using whatever proprietary format they find convenient. In that case, the local network will see new flows to the new servers without having observed the resolution event. Blocking destinations for which you have seen no resolution events will work for a subset of these cases, but it won't work when the resolution points to a common CDN destination. That approach will, of course, also have a wide variety of failure modes when the resolution event data is incomplete for timing or other reasons; it will also block all of the flows which MUD would handle. to the extent > that monitoring ('dnstap') and controlling (DNS RPZ) dns lookups by > connected > users and apps is considered a vital local security policy, attempts at > such > "pass through" must be made to fail. > Those are security mechanisms, rather than policy, and it may be worth teasing apart what the actual desired security policy is. You may find that it is more easily implemented at the routing layer than the resolution system in the light of proprietary resolution systems and DoH. regards, Ted Hardie > > > > > Perhaps, though, I am missing something about your intent. > > > > i think you've restated some key points of my position with perfect > accuracy. > > DoH wants to empower users and apps to make decisions about their RDNS > which > cannot be interfered with by on-path actors such as their own network > operators. by doing this, DoH makes a false equivalence between a > dissident > (who may be considered a criminal in some places) and a criminal (who is > always considered a criminal in most places) and private users in a hotel > room > or coffee shop or on their home broadband connection, and malware which > gets > inside a network and wants to avoid detection/mitigation while performing > lookups or exfiltration. > > those are four very different things. demanding identical treatment for > all of > them is, in the best possible interpretation, naive. > > vixie > > > --000000000000eef9ae0583ea833a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Paul,

Comments in-li= ne.

On Tue, Mar 12, 2019 at 11:27 AM Paul Vixie <paul@redbarn.org> wrote:
On Monday, 11 March 2019 18:30:51 UTC Ted = Hardie wrote:
> On Mon, Mar 11, 2019 at 11:06 AM Paul Vixie <paul@redbarn.org> wrote:
> > DoH will moot that approach.
>
> Any system that actually checks the credentials presented by the respo= nding
> server will also moot that approach.

yes! but it will fail "closed". thus, no unauthorized exfiltratio= n risk will
exist.

> Given how easy it is to pin
> credential characteristics in applications distributed as binaries, th= is
> seems to mean that your method will either continue to permit applicat= ions
> other than browsers to use their own resolution systems or it will har= d
> fail all such applications it can identify.=C2=A0 No pass through will= work, as
> far as I can tell, in that scenario.

that's precisely the goal, because very few network operators can preor= dain
the users and apps that will connect through their networks.

I do not believe this goal is met by what you describe, s= ince an application can use a proprietary resolution service in its flows.= =C2=A0 Imagine for a moment an application on a smart TV that wants to prov= ide content from the closest server which contains that content.=C2=A0 It c= an use a redirect from the original server when a new, closer server comes = online (or when a different server has that content), and it can provide th= e mapping between that server and one or more addresses for that server wit= h the redirect, in whatever format its individual cache can store.=C2=A0 Al= l of this can take place within its confidential channel, using whatever pr= oprietary format they find convenient.=C2=A0 In that case, the local networ= k will see new flows to the new servers without having observed the resolut= ion event.=C2=A0 Blocking destinations for which you have seen no resolutio= n events will work for a subset of these cases, but it won't work when = the resolution points to a common CDN destination.=C2=A0 That approach will= , of course, also have a wide variety of failure modes when the resolution = event data is incomplete for timing or other reasons; it will also block al= l of the flows which MUD would handle.

to the extent
that monitoring ('dnstap') and controlling (DNS RPZ) dns lookups by= connected
users and apps is considered a vital local security policy, attempts at suc= h
"pass through" must be made to fail.

Those are securit= y mechanisms, rather than policy, and it may be worth teasing apart what th= e actual desired security policy is.=C2=A0 You may find that it is more eas= ily implemented at the routing layer than the resolution system in the ligh= t of proprietary resolution systems and DoH.

regards,

Ted Hardie
=C2=A0

>
> Perhaps, though, I am missing something about your intent.
>

i think you've restated some key points of my position with perfect acc= uracy.

DoH wants to empower users and apps to make decisions about their RDNS whic= h
cannot be interfered with by on-path actors such as their own network
operators. by doing this, DoH makes a false equivalence between a dissident=
(who may be considered a criminal in some places) and a criminal (who is always considered a criminal in most places) and private users in a hotel r= oom
or coffee shop or on their home broadband connection, and malware which get= s
inside a network and wants to avoid detection/mitigation while performing <= br> lookups or exfiltration.

those are four very different things. demanding identical treatment for all= of
them is, in the best possible interpretation, naive.

vixie


--000000000000eef9ae0583ea833a-- From nobody Tue Mar 12 12:28:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA9D81312F6 for ; Tue, 12 Mar 2019 11:56:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t1j9a87KQq6v for ; Tue, 12 Mar 2019 11:56:13 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 818301312F0 for ; Tue, 12 Mar 2019 11:56:10 -0700 (PDT) Received: from xsmtp05.mail2web.com ([168.144.250.245]) by mx148.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3mZM-000xe2-Ix for doh@ietf.org; Tue, 12 Mar 2019 19:56:09 +0100 Received: from [10.5.2.17] (helo=xmail07.myhosting.com) by xsmtp05.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3mZK-00052N-Rh for doh@ietf.org; Tue, 12 Mar 2019 14:56:07 -0400 Received: (qmail 19283 invoked from network); 12 Mar 2019 18:56:06 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail07.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 12 Mar 2019 18:56:05 -0000 To: Paul Vixie , dnsop@ietf.org Cc: Eric Rescorla , "doh@ietf.org" , "Ackermann, Michael" , "Konda, Tirumaleswar Reddy" , nalini elkins , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Tue, 12 Mar 2019 11:56:05 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <4935758.NkxX2Kjbm0@linux-9daj> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US X-Originating-IP: 168.144.250.245 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.15) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5qGIEnBHWZeGDA0ACsQV3dB602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxMe6Snv1NB4F6YQlvWWAe3Eh5 mNm/WjPqhYqCeBiCKwwnRtk/d5gNfEtjtud5V8jpaWmuI1j60B6jdQGl4a3Z3x/TBCf6oYXAWGet lavcAjD9ytQxIHf9lN5jjLJaPK8l4YBmPrqPoeRXD34azf1rYZv5uZUEePrXZkexHL9EC3AAJAfA 9MMVcQ9WVjD1q+Rbd9IPG/DQ2p+GU04sTuYFs91jhnM/Mbva2XLV/LIEzaKyLm0zESXAkIAT8ZKA DvsGI5uh86ZVnyOrYkLMWyEaRt9fxN2oReTDHAyOynaY0CmHJLVH4DfVNbPXJmiLfub/IRFsicyJ MEhQFtD8PLoiniWmsFByBoXAuCZEyg59LM/9rUJrEbVA84BZVscMTXpbpuxXJTL417vaJWq5kk+j cuidX4Ts4xdG+C13IyWeZaIRGoD2KPSWEKpVAxkLUfednCaCEKGdKQmLPXZE3/X31oH42qtzkAg6 Z54J+ZrWvdqAImxrekFydH4DojSCKJXVXfdz0+Q1eHsqtFQKXUaZ+h596SWGosiQ15/fAFUBngWU swziTuoonQBgr0dS5AZLiwQzKw+6v3CaIMG6s7LqJB5zW4lvOt7yZYITzR9pjE5SyaRgIwuFZktu hI3SFVknyJcyw0GFnMXEGYqGvmjkAHWj+84pUrfapBgDRj+KYVDtOuTWXXIj0TpQpfUxR/zGwdBB Bfh3x3VaPNtdo70DPj5Gegm2Di+XkC+U0gjMGGKacOVTXotsdlkDAl5HBq84rNLMkKiSx4DbX99P +gh4iWPT5m4OdqWMdE0b4Joz08+J+cv73CChOPjKA0/DVd830vHLIFSGGMV7x6CHvZpJG/9P/4OG qJ5dkO1xTEy0joEwyGTHIAoNFX+jcW7DGmdEezpuI9IICsCKA/p66v7fhw== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 12:28:30 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 18:56:15 -0000 On 3/12/2019 11:35 AM, Paul Vixie wrote: > if someone is concerned that some of the web sites=20 > reachable through some CDN are dangerous... Paul, who is this someone? How do they decide? What does dangerous mean? These questions are very much behind the tension we see today. And the answers are not as black and white as "this is my network, I get to decid= e". For example, users routinely delegate the filtering decision to some kind of security software running on their device, often with support from some cloud based service. They are making an explicit decision, and often use menu options to decide what type of site is OK or not -- adults would probably not subscribe to parental control services. There is a market for these products, they compete based on reputation, ease of use, etc. You are saying that whoever happens to control part of the network path is entitled to override the user choices and impose their own. Really? As Stephane wrote, that may be legit in some circumstances, but much more questionable in others, such as a hotel Wi-Fi attempting to decide what sites I could or could not access. It really is a tussle. -- Christian Huitema From nobody Tue Mar 12 12:34:06 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5D5B131228; Tue, 12 Mar 2019 12:33:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M2T_bxVrQH-x; Tue, 12 Mar 2019 12:33:48 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DFA511311B1; Tue, 12 Mar 2019 12:33:48 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id B389F892C6; Tue, 12 Mar 2019 19:33:48 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Stephane Bortzmeyer , nalini elkins , Stephen Farrell , doh@ietf.org, Christian Huitema , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" Date: Tue, 12 Mar 2019 19:33:47 +0000 Message-ID: <3519715.nWsYgrufbW@linux-9daj> Organization: Vixie Freehold In-Reply-To: <20190312153636.qdsdne24vmi4xdoe@nic.fr> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 19:33:51 -0000 On Tuesday, 12 March 2019 15:36:36 UTC Stephane Bortzmeyer wrote: > On Mon, Mar 11, 2019 at 08:55:18AM +0530, > nalini elkins wrote > > a message of 202 lines which said: > > The questions that the Fortune 50 company architect asked were something > > like this: > > > > 1. You mean that DNS could be resolved outside my enterprise? > > I suggest to explain to this person that it was possible before, as > any malware author discovered. no, it was not possible before. or rather, it could be cheaply prevented before. > If people responsible for networks of Fortune 50 company don't know > that it is difficult to stop unwanted communication (except when you > control all the endpoints, or when you airgap your network), then it > is indeed a problem :-) in my own travels, i've met some fortune-level CISO's who had not yet been told that RDNS monitor/control bypass was now an internet standard, and that behavioural modeling based on TCP/443 endpoints was no longer practical. so, i urge greater efforts on getting the word out. vixie From nobody Tue Mar 12 13:22:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D7ED81312EC; Tue, 12 Mar 2019 13:22:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id erGmWWzDBO3r; Tue, 12 Mar 2019 13:22:02 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 781391312E3; Tue, 12 Mar 2019 13:22:02 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id ED81C892C6; Tue, 12 Mar 2019 20:22:00 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Ted Hardie , DoH WG Date: Tue, 12 Mar 2019 20:22:00 +0000 Message-ID: <1914607.BasjITR8KA@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 20:22:04 -0000 On Tuesday, 12 March 2019 19:15:16 UTC Ted Hardie wrote: > ... > > that's precisely the goal, because very few network operators can > > preordain the users and apps that will connect through their networks. > > I do not believe this goal is met by what you describe, since an > application can use a proprietary resolution service in its flows. rogue flows have their own accounting. my problem isn't with one-off's, because traditional security is anomaly-based. DoH, by folding control plane data into previously non-anomalous flows, presents a new problem. if CF and G and IBM and Cisco decide to offer DoH on the same IP address that they offer API's and services i actually do need or want to permit, i'm going to have to increase my investment. this equation, where something is created which is a danger to me, which blends in with the crowd of things that are not dangerous to me, is the method by which DoH achieves its stated aim, "prevent on-path interference in DNS operations." all war is economics. they are increasing my costs, deliberately. i am on-path and i intend to interfere. at whatever cost that may be. i also reserve the right to re-externalize some or all of those new imposed costs. > Imagine for a moment an application on a smart TV that wants to provide > content from the closest server which contains that content. ... Blocking > destinations for which you have seen no resolution events will work for a > subset of these cases, but it won't work when the resolution points to a > common CDN destination. That approach will, of course, also have a wide > variety of failure modes when the resolution event data is incomplete for > timing or other reasons; it will also block all of the flows which MUD > would handle. generally speaking, security policies break down into two categories. allow all except some, or deny all except some. which one an operator chooses will depend on their goals, budgets, and in particular, the cost of anomaly detection. it's the change in cost of anomaly detection, deliberately intended by the authors of RFC 8484, which is at the root of some very expensive policy choices that the rest of us must now make. your smart-tv example is not involved in that causalality path. noting also, i have a TV which offers the kind of feature you describe, but only if i accept its software license. (something to do with GDPR, i suspect.) so i did not accept that license, and as a result, i have a disconnected device whose flaws, both now known and not yet known, will pose no threats here. my TV, my rules. > > to the extent that monitoring ('dnstap') and controlling (DNS RPZ) dns > > lookups by connected users and apps is considered a vital local security > > policy, attempts at such "pass through" must be made to fail. > Those are security mechanisms, rather than policy, and it may be worth > teasing apart what the actual desired security policy is. You may find > that it is more easily implemented at the routing layer than the resolution > system in the light of proprietary resolution systems and DoH. to be clear, the policy is, "allow all, except some". i implement as much of this policy as possible at the routing layer, and i do my research on proprietary resolution systems to decide whether i can tolerate the risks of devices which use such things. (so, no nest thermostats here, the TV's are not smart, and the apple home pods are in their not-logged-in state.) it is the standards nature of DoH that amplifies its imposed costs. i could simply outlaw by IP or port# a proprietary or otherwise bespoke protocol. (working out with my kids what online games require what permissions, has been burdensome on both me and them.) DoH, by _intending to bypass_ network operator policy DNS, and my seamlessly hiding in the crowd of TCP/443 transactions now made indiscernible by TLS 1.3 and ESNI, is an act of economic warfare against all RDNS control plane owners. (deliberately.) vixie From nobody Tue Mar 12 13:29:54 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 46638128B14; Tue, 12 Mar 2019 13:29:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sr2v886Qd2zo; Tue, 12 Mar 2019 13:29:40 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D61A1127817; Tue, 12 Mar 2019 13:29:39 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [206.125.172.202]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x2CKTW28061687 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 12 Mar 2019 16:29:34 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from nofx.lbl.gov (nofx.lbl.gov [IPv6:2620:83:8000:107::f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id 2502465A00; Tue, 12 Mar 2019 13:29:34 -0700 (PDT) To: Jim Reid , Stephane Bortzmeyer Cc: dnsop WG , DoH WG , dns-privacy@ietf.org References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> <20190312160141.ibnjtdt5myntwiwk@nic.fr> From: Michael Sinatra Message-ID: <096d59ee-0524-833f-f421-dbb05ce9b2b8@brokendns.net> Date: Tue, 12 Mar 2019 13:29:30 -0700 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:60.0) Gecko/20100101 Thunderbird/60.5.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [162.217.113.18]); Tue, 12 Mar 2019 16:29:37 -0400 (EDT) Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 20:29:41 -0000 On 3/12/19 9:14 AM, Jim Reid wrote: > > >> On 12 Mar 2019, at 16:01, Stephane Bortzmeyer wrote: >> >> I still do not understand why people have a problem with DoH whch did >> not already exist before with my-own-name-resolution-protocol-over-HTTPS. > > It’s a question of scale/ubiquity. These “alterate” resolution tricks have up until now been mostly confined to a small number of clueful people. That is going to change dramatically once the world’s web browsers and other web-based apps start using DoH. More so if those platforms have DoH enabled by default. There's also a fundamental tension that arises when we define as legitimate those practices that are indistinguishable (or hard to distinguish) from what bad guys do. Think of all of the HR departments out there that send *legitimate* emails asking their employees to click on a link to update/verify information. DoH does this too and it arguably goes a step further by effectively obfuscating DNS resolution activity, so that legitimate users occupy the same "hideout" as the bad guys. This is one of the main themes of section 9 of draft-reid-doh-operator and one of the main motivations in the recommendations of section 4 of draft-bertola-bcp-doh-clients, but it bears restating because for those of us trying to do risk mitigation, or even policy compliance, DoH gives us additional headaches. michael From nobody Tue Mar 12 13:30:18 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 827CC13123C; Tue, 12 Mar 2019 13:30:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=VaoYDzYK; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=e12kTm4L Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SDeA27Uht6O7; Tue, 12 Mar 2019 13:30:09 -0700 (PDT) Received: from alln-iport-5.cisco.com (alln-iport-5.cisco.com [173.37.142.92]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2D725131096; Tue, 12 Mar 2019 13:30:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=2350; q=dns/txt; s=iport; t=1552422609; x=1553632209; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=HLl/BC2MJhUtqzCU3NGJri4qvQ8otjoYFyGk80T81yE=; b=VaoYDzYKO/BE08l3GIG2UrexzRp4mQ36nMYQbL2SdfG3m3gu3dAYr5f4 AKg/MTrs+o6PYnEPv/GFG/oLhMUCO9aGj+2HBOtbCmjWheGB52rqpCgR0 rTbPpQjBiwPgKu9iXRNBd0y6dhGg9nPMN1G0wD6gj2FDRITTg3o5BCcFT o=; IronPort-PHdr: =?us-ascii?q?9a23=3AhkVcaR2mjYNRnm0xsmDT+zVfbzU7u7jyIg8e44?= =?us-ascii?q?YmjLQLaKm44pD+JxKHt+51ggrPWoPWo7JfhuzavrqoeFRI4I3J8RVgOIdJSw?= =?us-ascii?q?dDjMwXmwI6B8vQGEzgLPfrZQQxHd9JUxlu+HToeUU=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BdAADOFYhc/40NJK1kGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZYE9UANodAQLJwqEAINHA48/gleZTwNUCwEBGA0HhEACF4Q?= =?us-ascii?q?iIjgSAQEDAQEJAQMCbRwMhUsBAQMBAQEhEQwBASwLAQ8CAQgaAiYCAgIlCxU?= =?us-ascii?q?QAgQOBYMiAYFdAw0IAQIMpU8CihRxgS+CeAEBBYExAYNaGIIMAwWBCySLLRe?= =?us-ascii?q?BQD+BOB+CTIMeAQGBYReCczGCJoxShCeTOAkCh1OLQBmTPJBkihGCWAIEAgQ?= =?us-ascii?q?FAg4BAQWBXiGBVnAVOyoBgg0BAQExggoMF4NLhRSFP3KBKI5/AYEeAQE?= X-IronPort-AV: E=Sophos;i="5.58,471,1544486400"; d="scan'208";a="243956898" Received: from alln-core-8.cisco.com ([173.36.13.141]) by alln-iport-5.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 12 Mar 2019 20:30:07 +0000 Received: from XCH-RCD-004.cisco.com (xch-rcd-004.cisco.com [173.37.102.14]) by alln-core-8.cisco.com (8.15.2/8.15.2) with ESMTPS id x2CKU7d6027805 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Tue, 12 Mar 2019 20:30:07 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-RCD-004.cisco.com (173.37.102.14) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 12 Mar 2019 15:30:07 -0500 Received: from xhs-rtp-003.cisco.com (64.101.210.230) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Tue, 12 Mar 2019 16:30:06 -0400 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Tue, 12 Mar 2019 16:30:06 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector1-cisco-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HLl/BC2MJhUtqzCU3NGJri4qvQ8otjoYFyGk80T81yE=; b=e12kTm4LkZjSDSGfZEMNGDG0QW62Qm2sQlcY2BJYW303g34Tko+pvtlxAumDhMvpentgQzeUFXY44/cR6Y/TTkal6pMkfsMel+s+liMUwr+swQP41fPF9MqaiqrqjGOFuUjGUV+n/xnoQwYkPBqaz4W4NX7KACHnIMMggawwNnU= Received: from BN8PR11MB3682.namprd11.prod.outlook.com (20.178.220.33) by BN8PR11MB3587.namprd11.prod.outlook.com (20.178.218.221) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.13; Tue, 12 Mar 2019 20:30:04 +0000 Received: from BN8PR11MB3682.namprd11.prod.outlook.com ([fe80::19c:1732:d955:fc45]) by BN8PR11MB3682.namprd11.prod.outlook.com ([fe80::19c:1732:d955:fc45%5]) with mapi id 15.20.1709.011; Tue, 12 Mar 2019 20:30:04 +0000 From: "Yishai Beeri (yishaib)" To: Stephane Bortzmeyer CC: "doh@ietf.org" , "dnsop@ietf.org" , "dns-privacy@ietf.org" Thread-Topic: [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2QKoZpCouOIK2EWvJIZOa3/An6YIlD4A Date: Tue, 12 Mar 2019 20:30:03 +0000 Message-ID: <0B8BC769-EB92-473B-9C56-82CD489EFE8E@cisco.com> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> <50BAF399-B95D-438B-B3FC-05A0159439E2@noware.co.uk> <20190312160141.ibnjtdt5myntwiwk@nic.fr> In-Reply-To: <20190312160141.ibnjtdt5myntwiwk@nic.fr> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=yishaib@cisco.com; x-originating-ip: [192.118.78.21] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c517baf7-a5f7-4528-6853-08d6a7298242 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BN8PR11MB3587; x-ms-traffictypediagnostic: BN8PR11MB3587: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-forefront-prvs: 09749A275C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(376002)(396003)(136003)(39860400002)(199004)(189003)(81166006)(97736004)(8676002)(81156014)(105586002)(25786009)(106356001)(36756003)(6116002)(3846002)(68736007)(478600001)(6506007)(76176011)(102836004)(14444005)(256004)(5660300002)(2906002)(83716004)(26005)(71200400001)(71190400001)(186003)(66574012)(82746002)(446003)(966005)(6486002)(66066001)(2616005)(11346002)(33656002)(476003)(229853002)(486006)(7736002)(6436002)(6512007)(305945005)(8936002)(99286004)(6306002)(93886005)(14454004)(6916009)(54906003)(4326008)(316002)(86362001)(6246003)(53936002); DIR:OUT; SFP:1101; SCL:1; SRVR:BN8PR11MB3587; H:BN8PR11MB3682.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 9wJaIyXPoPHrDcH2cnB25+VeED2Ypk75uStMV+D/YJJVCDR9rWh6DbZhczlOeh12dFcIiZ6aYGwkx2DB1oFFW6o11dvZWjmFzkejQ/O1VtRqGiRJBKbHPVKjEa5eNvjmyWDweSPtaCUvFjZX+25/Y8lJ9cuPsUXkmSHYSMlLzwtPRmnewqf8XGzamMVBsHtJ6c2M+VYbFtt1MYCi9XviH0R8blErZy65CvlE+tndtp7I6UrynI6ByvZI15IVWwwVlGUFOTzzfYuNKU/xusIvYYBdZNDcmsP/29z55u1/8Wwpfissd5JuUdgQH051abcf8e7N9FPuxlqx81WopBcWJZad2azvaowHcD/ou4df2LGwx1VrJgvB9+Q+NCLyEt2n6C14ptpv+/GMvRhFN8TQMRAYNJa5pz8Y6ydcNVsy2Ks= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: c517baf7-a5f7-4528-6853-08d6a7298242 X-MS-Exchange-CrossTenant-originalarrivaltime: 12 Mar 2019 20:30:03.8590 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN8PR11MB3587 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.14, xch-rcd-004.cisco.com X-Outbound-Node: alln-core-8.cisco.com Archived-At: Subject: Re: [Doh] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 20:30:17 -0000 DQoNCu+7v09uIDEyLzAzLzIwMTksIDIwOjM3LCAiRG9oIG9uIGJlaGFsZiBvZiBTdGVwaGFuZSBC b3J0em1leWVyIiA8ZG9oLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGJvcnR6bWV5ZXJA bmljLmZyPiB3cm90ZToNCg0KICAgIE9uIFR1ZSwgTWFyIDEyLCAyMDE5IGF0IDA0OjU1OjExUE0g KzAxMDAsDQogICAgIE5laWwgQ29vayA8bmVpbC5jb29rQG5vd2FyZS5jby51az4gd3JvdGUgDQog ICAgIGEgbWVzc2FnZSBvZiAyMiBsaW5lcyB3aGljaCBzYWlkOg0KICAgIA0KICAgID4gQWN0dWFs bHkgbWFueSBlbnRlcnByaXNlcyAocGFydGljdWxhcmx5IGJhbmtzIGV0Yy4pIGRvIG5vdCBhbGxv dyBETlMgcmVzb2x1dGlvbiBkaXJlY3RseSBmcm9tIGVtcGxveWVlIGVuZHBvaW50cy4NCiAgICAN CiAgICBUaGV5IGJsb2NrIFVEUC81Mywgd2hpY2ggaXMgbm90IHRoZSBzYW1lIHRoaW5nLiBNYWx3 YXJlIG9yDQogICAgbm9uLWNvb3BlcmF0aW5nIGFwcGxpY2F0aW9ucyBjYW4gZG8gbmFtZSByZXNv bHV0aW9uIGJ5IG90aGVyIG1lYW5zLiBJDQogICAgc3RpbGwgZG8gbm90IHVuZGVyc3RhbmQgd2h5 IHBlb3BsZSBoYXZlIGEgcHJvYmxlbSB3aXRoIERvSCB3aGNoIGRpZA0KICAgIG5vdCBhbHJlYWR5 IGV4aXN0IGJlZm9yZSB3aXRoDQogICAgbXktb3duLW5hbWUtcmVzb2x1dGlvbi1wcm90b2NvbC1v dmVyLUhUVFBTLg0KICAgIA0KSXQgaXMgY29tbW9uIHByYWN0aWNlIGZvciBNYWx3YXJlIG9wZXJh dG9ycyB0byB1c2UgYm9uYSBmaWRlIEROUyBpbmZyYXN0cnVjdHVyZSAoaW5jbHVkaW5nIHJlc29s dmVycykgdG8gY29tbXVuaWNhdGUgd2l0aCB0aGUgbWFsd2FyZSBhcHBsaWNhdGlvbi4gT25lIHVz ZWZ1bCBleGFtcGxlIGFyZSBER0FzIFsxXS4gVGhpcyBwcmFjdGljZSBpcyBjaGVhcGVyIGFuZCBt b3JlIHJvYnVzdCBmb3IgTWFsd2FyZSBvcGVyYXRvcnMgdGhhbiBzZXR0aW5nIHVwIHRoZWlyIG93 biBETlMgcmVzb2x2ZXIgc2VydmljZSwgbm90IHRvIG1lbnRpb24gaW1wbGVtZW50aW5nIGEgcHJv cHJpZXRhcnkgcHJvdG9jb2wuIEl0IGFsc28gaGVscHMgaXNvbGF0ZSB0aGUgbWFsd2FyZSBvcGVy YXRvciBmcm9tIHRoZSBtYWx3YXJlIGFzIHRoZXNlIGNvbW11bmljYXRpb25zIGFsbCBoYXBwZW4g dGhyb3VnaCBsZWdpdCBzZXJ2aWNlcyAoYWxsIHRoZSBtYWx3YXJlIG9wZXJhdG9yIGhhcyB0byBk byB0byB0cmlnZ2VyIHRoZSByZXNpZGVudCBtYWx3YXJlIGlzIHRvIHJlZ2lzdGVyIGEgZG9tYWlu KS4NCg0KRG9ILCBhbmQgc3BlY2lmaWNhbGx5IHRoZSAoaW50ZW5kZWQpIGluYWJpbGl0eSB0byBk aXN0aW5ndWlzaCBEb0ggZnJvbSBvdGhlciB0cmFmZmljLCBtYWtlcyB0aGlzIHByYWN0aWNlIG11 Y2ggaGFyZGVyIHRvIGRldGVjdCBhbmQgdG8gYmxvY2sgLSB3aGljaCBpcyB3aHkgdGhpcyBhIHBy b2JsZW0gdGhhdCBkaWQgbm90IGFscmVhZHkgZXhpc3QgYmVmb3JlLg0KDQpbMV0gaHR0cHM6Ly91 bWJyZWxsYS5jaXNjby5jb20vYmxvZy8yMDE2LzEwLzEwL2RvbWFpbi1nZW5lcmF0aW9uLWFsZ29y aXRobXMtZWZmZWN0aXZlLw0KDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCiAgICBEb2ggbWFpbGluZyBsaXN0DQogICAgRG9oQGlldGYub3JnDQog ICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kb2gNCiAgICANCllpc2hh aQ0KDQo= From nobody Tue Mar 12 13:32:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3FF44131047 for ; Tue, 12 Mar 2019 13:32:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n0dPEHwAJpLi for ; Tue, 12 Mar 2019 13:32:01 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DF05129619 for ; Tue, 12 Mar 2019 13:32:01 -0700 (PDT) Received: from xsmtp06.mail2web.com ([168.144.250.232]) by mx128.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3o47-000oVj-67 for doh@ietf.org; Tue, 12 Mar 2019 21:32:00 +0100 Received: from [10.5.2.35] (helo=xmail10.myhosting.com) by xsmtp06.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3o45-0003QN-2R for doh@ietf.org; Tue, 12 Mar 2019 16:31:57 -0400 Received: (qmail 25482 invoked from network); 12 Mar 2019 20:31:54 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail10.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 12 Mar 2019 20:31:53 -0000 To: Paul Vixie Cc: dnsop@ietf.org, "doh@ietf.org" , "dns-privacy@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <4935758.NkxX2Kjbm0@linux-9daj> <1709670.IeiIJmgblr@linux-9daj> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Tue, 12 Mar 2019 13:31:54 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <1709670.IeiIJmgblr@linux-9daj> Content-Type: multipart/alternative; boundary="------------2E530AC6F7B2239774F10CE5" Content-Language: en-US X-Originating-IP: 168.144.250.232 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.22) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5tmN+rWG84UkZYKthaIf4V1602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxEpy77RTKAc/FDgI7BhIZIUh5 mNm/WjPqhYqCeBiCKwwnRtk/d5gNfEtjtud5V8jpiaCVHNB1k1ihcHciE5ixJx/TBCf6oYXAWGet lavcAjD9ytQxIHf9lN5jjLJaPK8l4YBmPrqPoeRXD34azf1rYZv5uZUEePrXZkexHL9EC3AAJAfA 9MMVcQ9WVjD1q+Rbd9IPG/DQ2p+GU04sTuYFs91jhnM/Mbva2XLV/LIEzaKyLm0zESXAkIAT8ZKA DvsGI5uh86ZVnyOrYkLMWyEaRt9fxN2oReTDHAyOynaY0CmHJLVH4DfVNbPXJmiLfub/IRFsicyJ MEhQFtD8PLoiniWmsFByBoXAuCZEyg59LM/9rUJrEbVA84BZVscMTXpbpuxXJTL417vaJWq5kk+j cuidX4Ts4xdG+C13IyWeZaJu1FKs5TGF0HQNGKdqWSmvPwUimsNGvJJilSn4u6QSZCnkOqZzaZmC p6YTl3HFM6cs95DGoDQyh90npG6wuAU16Y3oZJdQ0WXQEIKhyt8GANo5bn0tFTz4SVUdCy2MVE6+ P+NMWgh0hdHFCOgNkMJ392PNDpgLsd6Ddd/s7VM53uY0TTxj2gGBZlqXYSmNS2/AMgFPp7+h3kLe NmBV53UGkXtpH08U7NneeNkAVgFL31MRg4v/FSmzX+j1xbZuCJFRXxKF5tPxTxfD0dMN+t5ZP6zO upSxHMPsAHfGhZAC/ELfT40IeeXtXsko+FU3ueL7G3ch6MdB0XuALpEgtIRS9gE9qVUwhDs/Gbvv EKtxst40eTXlWiUAYdLmsJdAoPJHNvQfAjIDptXbNSradnS0Zqm0mOdPl1LeUTNmkYtBTuxv0/1e /nzlq13wYTxncOSJHdsd+cwIgRT6euCWiMrA+4FHNKsiy9wMVtQ6ai8zTQ== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 20:32:09 -0000 This is a multi-part message in MIME format. --------------2E530AC6F7B2239774F10CE5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 3/12/2019 12:56 PM, Paul Vixie wrote: >> As Stephane wrote, that may be legit in some circumstances, but much >> more questionable in others, such as a hotel Wi-Fi attempting to decid= e >> what sites I could or could not access. It really is a tussle. > i don't like the chinese government's rules for the great firewall. so,= i keep=20 > my visits to that otherwise-great country short. this hurts me, and may= be=20 > hurts them also. but, it's their country, and i will obey their laws wh= en i am=20 > using their network. and then i'll vote with my feet, to get to a bette= r=20 > network with better rules. i once traveled to HK for a weekend between = two=20 > week-long conferences behind the GFW, just so i could get work done. There is a lot of difference between what can be imposed in a police state and what looks legitimate in a user agreement in a free country. And I sure hope that we maintain that difference. A good result of that discussion would be to clarify these differences. For example, there are legal differences between what can be done in a private home, and what can be done in a place like a hotel that provides public accommodation. Just like hotels cannot discriminate against some categories of customers, I don't think that places providing public connectivity should be able to discriminate against content accessed by their guests. -- Christian Huitema --------------2E530AC6F7B2239774F10CE5 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit


On 3/12/2019 12:56 PM, Paul Vixie wrote:
As Stephane wrote, that may be legit in some circumstances, but much
more questionable in others, such as a hotel Wi-Fi attempting to decide
what sites I could or could not access. It really is a tussle.

i don't like the chinese government's rules for the great firewall. so, i keep 
my visits to that otherwise-great country short. this hurts me, and maybe 
hurts them also. but, it's their country, and i will obey their laws when i am 
using their network. and then i'll vote with my feet, to get to a better 
network with better rules. i once traveled to HK for a weekend between two 
week-long conferences behind the GFW, just so i could get work done.


There is a lot of difference between what can be imposed in a police state and what looks legitimate in a user agreement in a free country. And I sure hope that we maintain that difference. A good result of that discussion would be to clarify these differences. For example, there are legal differences between what can be done in a private home, and what can be done in a place like a hotel that provides public accommodation. Just like hotels cannot discriminate against some categories of customers, I don't think that places providing public connectivity should be able to discriminate against content accessed by their guests.

-- Christian Huitema

--------------2E530AC6F7B2239774F10CE5-- From nobody Tue Mar 12 13:51:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA5851311CB; Tue, 12 Mar 2019 13:51:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oZmBe1o_0Sca; Tue, 12 Mar 2019 13:51:14 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2749B1312B6; Tue, 12 Mar 2019 13:51:14 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id EC039892C6; Tue, 12 Mar 2019 20:51:13 +0000 (UTC) From: Paul Vixie To: Christian Huitema Cc: dnsop@ietf.org, "doh@ietf.org" , "dns-privacy@ietf.org" Date: Tue, 12 Mar 2019 20:51:12 +0000 Message-ID: <5342244.Q90AZAhhXk@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <1709670.IeiIJmgblr@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 20:51:16 -0000 On Tuesday, 12 March 2019 20:31:54 UTC Christian Huitema wrote: > On 3/12/2019 12:56 PM, Paul Vixie wrote: ... > > i don't like the chinese government's rules for the great firewall. so, i > > keep my visits to that otherwise-great country short. this hurts me, and > > maybe hurts them also. but, it's their country, and i will obey their > > laws when i am using their network. and then i'll vote with my feet, to > > get to a better network with better rules. i once traveled to HK for a > > weekend between two week-long conferences behind the GFW, just so i could > > get work done. > There is a lot of difference between what can be imposed in a police > state and what looks legitimate in a user agreement in a free country. > And I sure hope that we maintain that difference. i expect you to be disappointed in that hope, if you work on this long enough. > A good result of that > discussion would be to clarify these differences. For example, there are > legal differences between what can be done in a private home, and what > can be done in a place like a hotel that provides public accommodation. there are also legal differences from nation to nation, from state to state, from county to county, and from city to city. the internet is below all of that. > Just like hotels cannot discriminate against some categories of > customers, I don't think that places providing public connectivity > should be able to discriminate against content accessed by their guests. just as i've cautioned the RFC 8484 authors against imposing their anti- censorship views on my parental controls or corporate network policies, let me here caution you against imposing your (clearly) western liberal-democratic views on the development of protocols whose ideal state is "interoperability" and never more or less. vixie From nobody Tue Mar 12 13:51:38 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7915131109; Tue, 12 Mar 2019 12:56:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nrT6Ev9FdKmp; Tue, 12 Mar 2019 12:56:31 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4CF2130E67; Tue, 12 Mar 2019 12:56:31 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 6EA15892C6; Tue, 12 Mar 2019 19:56:31 +0000 (UTC) From: Paul Vixie To: Christian Huitema Cc: dnsop@ietf.org, Eric Rescorla , "doh@ietf.org" , "Ackermann, Michael" , "Konda, Tirumaleswar Reddy" , nalini elkins , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Date: Tue, 12 Mar 2019 19:56:30 +0000 Message-ID: <1709670.IeiIJmgblr@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <4935758.NkxX2Kjbm0@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: X-Mailman-Approved-At: Tue, 12 Mar 2019 13:51:26 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 19:56:33 -0000 On Tuesday, 12 March 2019 18:56:05 UTC Christian Huitema wrote: > On 3/12/2019 11:35 AM, Paul Vixie wrote: > > if someone is concerned that some of the web sites > > reachable through some CDN are dangerous... > > Paul, who is this someone? a network operator. > How do they decide? What does dangerous mean? that's a local policy matter, not subject to standardization, thus off-topic here. > These questions are very much behind the tension we see today. And the > answers are not as black and white as "this is my network, I get to decide". if it is my network, i get to decide. that's what i told spammers when i started the first anti-spam company (MAPS) and co-invented the first distributed reputation protocol (RBL), 23 years ago. it remains true today. my network, my rules. don't like my rules? use a different network. > > For example, users routinely delegate the filtering decision to some > kind of security software running on their device, often with support > from some cloud based service. They are making an explicit decision, and > often use menu options to decide what type of site is OK or not -- > adults would probably not subscribe to parental control services. There > is a market for these products, they compete based on reputation, ease > of use, etc. > > You are saying that whoever happens to control part of the network path > is entitled to override the user choices and impose their own. Really? no. not really. not at all. because, as before, you are claiming to restate my position, but doing so erroneously. > As Stephane wrote, that may be legit in some circumstances, but much > more questionable in others, such as a hotel Wi-Fi attempting to decide > what sites I could or could not access. It really is a tussle. i don't like the chinese government's rules for the great firewall. so, i keep my visits to that otherwise-great country short. this hurts me, and maybe hurts them also. but, it's their country, and i will obey their laws when i am using their network. and then i'll vote with my feet, to get to a better network with better rules. i once traveled to HK for a weekend between two week-long conferences behind the GFW, just so i could get work done. if you visit my home or office, you will either use my offered RDNS, or you will use an authorized VPN. so, beware. those are the rules. if you want different rules, use a different network. vixie From nobody Tue Mar 12 13:53:03 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 11998131192; Tue, 12 Mar 2019 13:52:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0qiFDUoodKTX; Tue, 12 Mar 2019 13:52:55 -0700 (PDT) Received: from mail-io1-xd2b.google.com (mail-io1-xd2b.google.com [IPv6:2607:f8b0:4864:20::d2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 250BE13119D; Tue, 12 Mar 2019 13:52:55 -0700 (PDT) Received: by mail-io1-xd2b.google.com with SMTP id f6so3384156iop.3; Tue, 12 Mar 2019 13:52:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8uH74dwKq3luot1c08dsoo/wGRBhptHqxMOb9b3SuKE=; b=OmAbfMAa9zbJNy3DeFuHzcxkuNhJy6I5qPGoarOrfYaJ+7nA5Ierb5wSW5Q8+zdJSM zJ8AWSjZ//tvOOjbXDiAOERatxdKz1fhDqoNWmfsGS94RZrvSqheogyyz3T1VLGqQfXY hcpXDEPFUGdm/vxH8mRQOfm7OW9V2ksyb2A6kiFHw3iOrHO+b0EWaS9QoNAn/8wjzwu4 u7FtUueSbouvuaveEXBOXGhXMb9XAf5B4Sjx+LPzzNuqdQosBr45Mo9aXmSLM98TmogX 63DsV5WHYqyLiZX6oH0SaPHSSo2UlHaVpdH5WwFTZEssj0WMG0+wh9KnphMcn7KdNnZc ZM6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8uH74dwKq3luot1c08dsoo/wGRBhptHqxMOb9b3SuKE=; b=bFSdZtuxTdUTXUH2eWkvyUA502pr/eLhrDSHtgkkIehKwpno6Y5gHnN7A59t5tPgpF Vgp0H2vkaCUfqBrWHZdXEitoplQyS/vOxm/EqZ2X7tqHhhQEIncAxgZ06AG9WC6487WH C6F4XlWBjruuzOse/HjPS5thIeOaqZwMNA3bIz7Jzd93fLJy0CaEDuxDLrIci5qVLUUD n96jH7hsEEItgU1IQzljeU80Mf9icKNC3P3KC8qYKHnLUsavtf4/iob416MebitDDpsY njDkp4ZBpFPmpPCwgsC6v3QscjRp1a4zvebJ2DktrvDMlyLzqQL7rVwNBi0ld1ArL1Hf zGfw== X-Gm-Message-State: APjAAAW1CBpsSggOiOeq5ohQIZ82c5dzYiSWaOCkFo0h1xAQFWDdwQwZ kDA75PdrcKpDjCNs9reBlJJTwhvTfqKhlVATO3hrHMhxcOk= X-Google-Smtp-Source: APXvYqxiEN5URCVuSS+o06pI5ACDA2kRcNCONQiH84ArfOGikirQt2ULduEkKhwm3ozuvK6Z2yKI6aitkewJ0BD3l3I= X-Received: by 2002:a6b:abc2:: with SMTP id u185mr22429856ioe.145.1552423974167; Tue, 12 Mar 2019 13:52:54 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> In-Reply-To: <1914607.BasjITR8KA@linux-9daj> From: Ted Hardie Date: Tue, 12 Mar 2019 13:52:27 -0700 Message-ID: To: Paul Vixie Cc: dnsop , DoH WG Content-Type: multipart/alternative; boundary="0000000000008568b90583ebdfdb" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 20:53:03 -0000 --0000000000008568b90583ebdfdb Content-Type: text/plain; charset="UTF-8" Paul, Since it is apparent our disagreement is at a more fundamental level, I will make only two further comments. The first is that you recently chided someone for using the word "rant", saying that it would "diminish and disrespect" someone's words. In the note below you use terms like "warfare" to characterize the work of the authors; that is both inflammatory and disrespectful. The authors worked on a chartered working group item throughout the IETF process. You disagree with the security trade-offs made in the chartering and execution of that work, and discussion of that disagreement will hopefully be fruitful. But if you want their respect of your opinion, according them the respect due theirs will go a long way; they did not make these choices arbitrarily. My second comment is to point out that the IETF has been heading this way for about five years now. The IAB formalized its early support of this approach in November of 2014 with this text: The IAB urges protocol designers to design for confidential operation by default. We strongly encourage developers to include encryption in their implementations, and to make them encrypted by default. We similarly encourage network and service operators to deploy encryption where it is not yet deployed, and we urge firewall policy administrators to permit encrypted traffic. We believe that each of these changes will help restore the trust users must have in the Internet. We acknowledge that this will take time and trouble, though we believe recent successes in content delivery networks, messaging, and Internet application deployments demonstrate the feasibility of this migration. We also acknowledge that many network operations activities today, from traffic management and intrusion detection to spam prevention and policy enforcement, assume access to cleartext payload. For many of these activities there are no solutions yet, but the IAB will work with those affected to foster development of new approaches for these activities which allow us to move to an Internet where traffic is confidential by default. By that point, the IETF working groups were already in formation. Moving the DNS toward encryption has been going on since DPRIVE and has been accompanied by the rise of transports like QUIC which are encrypted by default. You have been working around that, rather than developing new practices. I invite you instead to consider how you can accomplish what you need to in an Internet where all traffic is confidential. Enterprises are currently doing that via managed software and environments, and that approach seems to be well in-line with your practices below. Using resolution systems for this will not accomplish what you need now, nor will it do so going forward; it is time for a different approach, rather than seeking to return to cleartext. The situation that moved this community to that stance was well-laid out in IETF 88. We must acknowledge that not all devices which are on-path are controlled by entities known to the user or network operator and not all of them are acting in the interests of those parties. Protecting against that threat requires us to change our ways. Please help, rather than working around the effort. regards, Ted Hardie (wearing no hats) On Tue, Mar 12, 2019 at 1:22 PM Paul Vixie wrote: > On Tuesday, 12 March 2019 19:15:16 UTC Ted Hardie wrote: > > ... > > > that's precisely the goal, because very few network operators can > > > preordain the users and apps that will connect through their networks. > > > > I do not believe this goal is met by what you describe, since an > > application can use a proprietary resolution service in its flows. > > rogue flows have their own accounting. my problem isn't with one-off's, > because traditional security is anomaly-based. DoH, by folding control > plane > data into previously non-anomalous flows, presents a new problem. if CF > and G > and IBM and Cisco decide to offer DoH on the same IP address that they > offer > API's and services i actually do need or want to permit, i'm going to have > to > increase my investment. > > this equation, where something is created which is a danger to me, which > blends in with the crowd of things that are not dangerous to me, is the > method > by which DoH achieves its stated aim, "prevent on-path interference in DNS > operations." all war is economics. they are increasing my costs, > deliberately. > > i am on-path and i intend to interfere. at whatever cost that may be. i > also > reserve the right to re-externalize some or all of those new imposed costs. > > > Imagine for a moment an application on a smart TV that wants to provide > > content from the closest server which contains that content. ... > Blocking > > destinations for which you have seen no resolution events will work for a > > subset of these cases, but it won't work when the resolution points to a > > common CDN destination. That approach will, of course, also have a wide > > variety of failure modes when the resolution event data is incomplete for > > timing or other reasons; it will also block all of the flows which MUD > > would handle. > > generally speaking, security policies break down into two categories. > allow > all except some, or deny all except some. which one an operator chooses > will > depend on their goals, budgets, and in particular, the cost of anomaly > detection. it's the change in cost of anomaly detection, deliberately > intended > by the authors of RFC 8484, which is at the root of some very expensive > policy > choices that the rest of us must now make. > > your smart-tv example is not involved in that causalality path. noting > also, i > have a TV which offers the kind of feature you describe, but only if i > accept > its software license. (something to do with GDPR, i suspect.) so i did not > accept that license, and as a result, i have a disconnected device whose > flaws, both now known and not yet known, will pose no threats here. my TV, > my > rules. > > > > to the extent that monitoring ('dnstap') and controlling (DNS RPZ) dns > > > lookups by connected users and apps is considered a vital local > security > > > policy, attempts at such "pass through" must be made to fail. > > > Those are security mechanisms, rather than policy, and it may be worth > > teasing apart what the actual desired security policy is. You may find > > that it is more easily implemented at the routing layer than the > resolution > > system in the light of proprietary resolution systems and DoH. > > to be clear, the policy is, "allow all, except some". i implement as much > of > this policy as possible at the routing layer, and i do my research on > proprietary resolution systems to decide whether i can tolerate the risks > of > devices which use such things. (so, no nest thermostats here, the TV's are > not > smart, and the apple home pods are in their not-logged-in state.) > > it is the standards nature of DoH that amplifies its imposed costs. i > could > simply outlaw by IP or port# a proprietary or otherwise bespoke protocol. > (working out with my kids what online games require what permissions, has > been > burdensome on both me and them.) DoH, by _intending to bypass_ network > operator policy DNS, and my seamlessly hiding in the crowd of TCP/443 > transactions now made indiscernible by TLS 1.3 and ESNI, is an act of > economic warfare against all RDNS control plane owners. (deliberately.) > > vixie > > > --0000000000008568b90583ebdfdb Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Paul,

Since it is apparent o= ur disagreement is at a more fundamental level, I will make only two furthe= r comments.

The first is that you recently chided = someone for using the word "rant", saying that it would "dim= inish and disrespect" someone's words.=C2=A0 In the note below you= use terms like "warfare" to characterize the work of the authors= ; that is both inflammatory and disrespectful.=C2=A0 The authors worked on = a chartered working group item throughout the IETF process.=C2=A0 You disag= ree with the security trade-offs made in the chartering and execution of th= at work, and discussion of that disagreement will hopefully be fruitful.=C2= =A0 But=C2=A0 if you want their respect of your opinion, according them the= respect due theirs will go a long way; they did not make these choices arb= itrarily.

My second comment is to point out that t= he IETF has been heading this way for about five years now.=C2=A0 The IAB f= ormalized its early support of this approach in November of 2014 with this = text:

The IAB urges = protocol designers to design for confidential operation by default.=C2=A0 We strongly encourage developers to include encryption i= n=20 their implementations, and to make them encrypted by default.=C2=A0 We=20 similarly encourage network and service operators to deploy encryption=20 where it is not yet deployed, and we urge firewall policy administrators to permit encrypted traffic.

We believe that each of these changes w= ill help restore the trust=20 users must have in the Internet.=C2=A0 We acknowledge that this will take= =20 time and trouble, though we believe recent successes in content delivery networks, messaging, and Internet application deployments demonstrate=20 the feasibility of this migration.=C2=A0 We also acknowledge that many=20 network operations activities today, from traffic management and=20 intrusion detection to spam prevention and policy enforcement, assume=20 access to cleartext payload.=C2=A0 For many of these activities there are n= o=20 solutions yet, but the IAB will work with those affected to foster=20 development of new approaches for these activities which allow us to=20 move to an Internet where traffic is confidential by default.

By that point, the IETF working groups were already in formation= .=C2=A0 Moving the DNS toward encryption has been going on since DPRIVE and= has been accompanied by the rise of transports like QUIC which are encrypt= ed by default.=C2=A0 You have been working around that, rather than develop= ing new practices.=C2=A0 I invite you instead to consider how you can accom= plish what you need to in an Internet where all traffic is confidential.=C2= =A0 Enterprises are currently doing that via managed software and environme= nts, and that approach seems to be well in-line with your practices below.= =C2=A0 Using resolution systems for this will not accomplish what you need = now, nor will it do so going forward; it is time for a different approach, = rather than seeking to return to cleartext.

The si= tuation that moved this community to that stance was well-laid out in IETF = 88.=C2=A0 We must acknowledge that not all devices which are on-path are co= ntrolled by entities known to the user or network operator and not all of t= hem are acting in the interests of those parties.=C2=A0 Protecting against = that threat requires us to change our ways.=C2=A0 Please help, rather than = working around the effort.

regards,

=
Ted Hardie
(wearing no hats)


On Tue, Mar 12, 2019 at 1:22= PM Paul Vixie <paul@redbarn.org= > wrote:
On Tuesday, 12 March 2019 19:15:16 UTC Ted Hardie wr= ote:
> ...
> > that's precisely the goal, because very few network operators= can
> > preordain the users and apps that will connect through their netw= orks.
>
> I do not believe this goal is met by what you describe, since an
> application can use a proprietary resolution service in its flows.

rogue flows have their own accounting. my problem isn't with one-off= 9;s,
because traditional security is anomaly-based. DoH, by folding control plan= e
data into previously non-anomalous flows, presents a new problem. if CF and= G
and IBM and Cisco decide to offer DoH on the same IP address that they offe= r
API's and services i actually do need or want to permit, i'm going = to have to
increase my investment.

this equation, where something is created which is a danger to me, which blends in with the crowd of things that are not dangerous to me, is the met= hod
by which DoH achieves its stated aim, "prevent on-path interference in= DNS
operations." all war is economics. they are increasing my costs, delib= erately.

i am on-path and i intend to interfere. at whatever cost that may be. i als= o
reserve the right to re-externalize some or all of those new imposed costs.=

> Imagine for a moment an application on a smart TV that wants to provid= e
> content from the closest server which contains that content.=C2=A0 ...= Blocking
> destinations for which you have seen no resolution events will work fo= r a
> subset of these cases, but it won't work when the resolution point= s to a
> common CDN destination.=C2=A0 That approach will, of course, also have= a wide
> variety of failure modes when the resolution event data is incomplete = for
> timing or other reasons; it will also block all of the flows which MUD=
> would handle.

generally speaking, security policies break down into two categories. allow=
all except some, or deny all except some. which one an operator chooses wil= l
depend on their goals, budgets, and in particular, the cost of anomaly
detection. it's the change in cost of anomaly detection, deliberately i= ntended
by the authors of RFC 8484, which is at the root of some very expensive pol= icy
choices that the rest of us must now make.

your smart-tv example is not involved in that causalality path. noting also= , i
have a TV which offers the kind of feature you describe, but only if i acce= pt
its software license. (something to do with GDPR, i suspect.) so i did not =
accept that license, and as a result, i have a disconnected device whose flaws, both now known and not yet known, will pose no threats here. my TV, = my
rules.

> > to the extent that monitoring ('dnstap') and controlling = (DNS RPZ) dns
> > lookups by connected users and apps is considered a vital local s= ecurity
> > policy, attempts at such "pass through" must be made to= fail.

> Those are security mechanisms, rather than policy, and it may be worth=
> teasing apart what the actual desired security policy is.=C2=A0 You ma= y find
> that it is more easily implemented at the routing layer than the resol= ution
> system in the light of proprietary resolution systems and DoH.

to be clear, the policy is, "allow all, except some". i implement= as much of
this policy as possible at the routing layer, and i do my research on
proprietary resolution systems to decide whether i can tolerate the risks o= f
devices which use such things. (so, no nest thermostats here, the TV's = are not
smart, and the apple home pods are in their not-logged-in state.)

it is the standards nature of DoH that amplifies its imposed costs. i could=
simply outlaw by IP or port# a proprietary or otherwise bespoke protocol. <= br> (working out with my kids what online games require what permissions, has b= een
burdensome on both me and them.) DoH, by _intending to bypass_ network
operator policy DNS, and my seamlessly hiding in the crowd of TCP/443
transactions now made indiscernible=C2=A0 by TLS 1.3 and ESNI, is an act of=
economic warfare against all RDNS control plane owners. (deliberately.)

vixie


--0000000000008568b90583ebdfdb-- From nobody Tue Mar 12 14:05:45 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA40A12F1A5; Tue, 12 Mar 2019 14:05:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1FOzsfHe7etp; Tue, 12 Mar 2019 14:05:41 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 501E5127817; Tue, 12 Mar 2019 14:05:41 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 14E19BE5C; Tue, 12 Mar 2019 21:05:39 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id poFbXQSAWKRG; Tue, 12 Mar 2019 21:05:37 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 80E17BE50; Tue, 12 Mar 2019 21:05:37 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552424737; bh=YajT/gy9uHNtXy+Z/0vyseCKUXl8dNY6pmaLo5WvK1A=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=qlVZOScXpN7S5mJwlLwD4+E6VWdXkwhbMtJt4H4RJ0ILSCRSV2f6kS83zD/HSz193 PpKLiS8xhWc/8WIFa1E60VP8xSXqf//tH15Moyq6hhFg6gJOkuNFOFPxVsUgWnb4lA pMXRElbbTpcsFARP0vEp04U1qJ77AvLKnHQlOkWM= To: Paul Vixie , Christian Huitema Cc: dnsop@ietf.org, "doh@ietf.org" , "dns-privacy@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <1709670.IeiIJmgblr@linux-9daj> <5342244.Q90AZAhhXk@linux-9daj> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Tue, 12 Mar 2019 21:05:36 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <5342244.Q90AZAhhXk@linux-9daj> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="7utLVy0XllXFfJHpSsBplOM1jGjwo8trJ" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 21:05:44 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --7utLVy0XllXFfJHpSsBplOM1jGjwo8trJ Content-Type: multipart/mixed; boundary="d1ek5Mu4FWoCI7guLLnJLXpmETbGaR4eV"; protected-headers="v1" From: Stephen Farrell To: Paul Vixie , Christian Huitema Cc: dnsop@ietf.org, "doh@ietf.org" , "dns-privacy@ietf.org" Message-ID: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <1709670.IeiIJmgblr@linux-9daj> <5342244.Q90AZAhhXk@linux-9daj> In-Reply-To: <5342244.Q90AZAhhXk@linux-9daj> --d1ek5Mu4FWoCI7guLLnJLXpmETbGaR4eV Content-Type: multipart/mixed; boundary="------------2BBAF0219ABB43FE962A4DD0" Content-Language: en-GB This is a multi-part message in MIME format. --------------2BBAF0219ABB43FE962A4DD0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Paul, On 12/03/2019 20:51, Paul Vixie wrote: > just as i've cautioned the RFC 8484 authors against imposing their anti= - > censorship views on my parental controls or corporate network policies,= let me=20 > here caution you against imposing your (clearly) western liberal-democr= atic=20 > views on the development of protocols whose ideal state is "interoperab= ility"=20 > and never more or less. I'm sorry but I don't understand this argument. DoH interoperates pretty well. You and Christian have expressed different concerns not related to interop. I don't see why, based on your argument, your concerns trump his. Can you explain? Thanks, S. --------------2BBAF0219ABB43FE962A4DD0 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------2BBAF0219ABB43FE962A4DD0-- --d1ek5Mu4FWoCI7guLLnJLXpmETbGaR4eV-- --7utLVy0XllXFfJHpSsBplOM1jGjwo8trJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyIHyAACgkQWrL68XsX K+oNOw//XVu8Wk+vrfA+r/DNi1jTSxRZuO7lzQoHhY9upZ24IEKpwGgs3PqNjq8M VaGuLmkhGARU3yP+llZgZH5UgI4425xjErV0iVrHGh5D/98AKi9sR0G209tb56m6 ykXVW3CExdumBZcWClGvAWfJTmrVmuXujdwO+nJyu+Uz/lntXfhmwMU7t+qge47C zOCE+lO7QFO1RlNtxw/lSYAtKg1Uqy1qCoBxnSWVGbng/k1ehP12nyE7QYSTBo9+ x16P/cULx0JmFGYS37JeYIn4qFHjHbDqQAfk4zXXHBzbf7+DKtNN75U6vumSRyek NtxH/W5Vp9Rv+r+xHLyf+i0Nm3gffrVO5R/N5IrgGQ9BAIKf35gVVHGpy0URIDSS JVLeHJohBMEfp3/74dZGT2v6XJur5AORfiGdLV2iR23mNuZ7Qpl8bgnywnXxU6nN JjW4niXB2szfiWD3nKbzUCHvY7J1HKZl7k/F2NTCCi2tbbJy4YIMxXnsdAx+ky6F 1+5D8cxX8vmqDhq6HQKwGwnwwI0zZT6pII/ED/XTawiMnCF0rrCLYPy/CGafTwD/ ff0noGSp1VG1E+Rt8C/1eptDc70XJX1jR1/yx9lUK0e1tumHFsy31YGnzfQs1yt6 yjHMzlhPf4Pqvtdq+aERsfAu2dvxjrDuLNvVI/uiO/VzZoALUDU= =Qr5L -----END PGP SIGNATURE----- --7utLVy0XllXFfJHpSsBplOM1jGjwo8trJ-- From nobody Tue Mar 12 14:11:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D98C412796B; Tue, 12 Mar 2019 14:11:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id by88CRs0yveJ; Tue, 12 Mar 2019 14:11:06 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E459B1240D3; Tue, 12 Mar 2019 14:11:06 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id A8F88892C6; Tue, 12 Mar 2019 21:11:06 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Stephen Farrell , Christian Huitema , "doh@ietf.org" , "dns-privacy@ietf.org" Date: Tue, 12 Mar 2019 21:11:05 +0000 Message-ID: <2356055.DoC3vY7yXE@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <5342244.Q90AZAhhXk@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 21:11:08 -0000 On Tuesday, 12 March 2019 21:05:36 UTC Stephen Farrell wrote: > Paul, > > On 12/03/2019 20:51, Paul Vixie wrote: > > just as i've cautioned the RFC 8484 authors against imposing their anti- > > censorship views on my parental controls or corporate network policies, > > let me here caution you against imposing your (clearly) western > > liberal-democratic views on the development of protocols whose ideal > > state is "interoperability" and never more or less. > > I'm sorry but I don't understand this argument. > > DoH interoperates pretty well. but does it intend more, or less? > ... Two primary use cases were considered during this protocol's > development. These use cases are preventing on-path devices from > interfering with DNS operations, ... (from Introduction, RFC 8484.) > > You and Christian have expressed different concerns not > related to interop. did you read what i wrote? > > I don't see why, based on your argument, your concerns > trump his. > > Can you explain? he's trying to achieve a political aim using technology. that is not the purpose for which the internet engineering task force, or the internet itself, was convened. it is not why our employers pay our travel costs. and it is not why the rest of the world trusts our outputs. From nobody Tue Mar 12 14:39:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91EB5127873; Tue, 12 Mar 2019 14:38:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eJ49Io234uIp; Tue, 12 Mar 2019 14:38:50 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4C5B4126CFF; Tue, 12 Mar 2019 14:38:49 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 48F82BE8A; Tue, 12 Mar 2019 21:38:47 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TLBHNPVA8sik; Tue, 12 Mar 2019 21:38:46 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id C2C9BBE83; Tue, 12 Mar 2019 21:38:45 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552426726; bh=gBYicn1mSb98fIgWhBNt8n2JMmI7F75yQPWmVbcyEiY=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=pslT4y3lLUvalpAuF/OaAymIvNqZneg54eenaWhhn5PRl1sPdVJEiKjSaSeJu+QgZ FAmSLFIPMrZgzGFQhkIFyFocCi5vcFJ7HYBQ3uJkWfGLrQVU+SKyZ7vnU2kPSTFrr7 qmeC7YNBTa0BY/1ehKxAoTaFWzrAam9fc35pxYcU= To: Paul Vixie , dnsop@ietf.org Cc: "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <5342244.Q90AZAhhXk@linux-9daj> <2356055.DoC3vY7yXE@linux-9daj> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> Date: Tue, 12 Mar 2019 21:38:44 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <2356055.DoC3vY7yXE@linux-9daj> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="lxbjInOfEI5aXryXjGoA8LC7gyjBWPBnw" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 21:38:53 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --lxbjInOfEI5aXryXjGoA8LC7gyjBWPBnw Content-Type: multipart/mixed; boundary="XykkxikAeS3ZCH2g33HZhYnRHg6eXx9z0"; protected-headers="v1" From: Stephen Farrell To: Paul Vixie , dnsop@ietf.org Cc: "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema Message-ID: <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <5342244.Q90AZAhhXk@linux-9daj> <2356055.DoC3vY7yXE@linux-9daj> In-Reply-To: <2356055.DoC3vY7yXE@linux-9daj> --XykkxikAeS3ZCH2g33HZhYnRHg6eXx9z0 Content-Type: multipart/mixed; boundary="------------82318D0F1243432E30FBC1D5" Content-Language: en-GB This is a multi-part message in MIME format. --------------82318D0F1243432E30FBC1D5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 12/03/2019 21:11, Paul Vixie wrote: > he's trying to achieve a political aim using technology. Ok, now I think I understand and am pretty sure I disagree with you there. There are reasons to want confidentiality for DNS queries and answers, and access patterns, for which the IETF has achieved consensus. (See RFC7626) (*) DoT is one way to tackle those problems. DoH is another. I think an argument that DoH is "just politics" and is not aiming to try provided a security/privacy mechanism to tackle a problem on which the IETF has consensus falls on that basis myself. I fully agree that there are potential DoH deployments that could have side-effects (more that DoT) that warrant more discussion, but I figure your arguments along the above lines are misdirected. Cheers, S. (*) Ironically, one of the arguments against DoH raised in this discussion is that it would expose that kind of information from split-horizon deployments, so it seems that even those concerned about DoH accept the problem statement, which is helpful. --------------82318D0F1243432E30FBC1D5 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------82318D0F1243432E30FBC1D5-- --XykkxikAeS3ZCH2g33HZhYnRHg6eXx9z0-- --lxbjInOfEI5aXryXjGoA8LC7gyjBWPBnw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyIJuQACgkQWrL68XsX K+pTBA/+JnBYPhZtORbG3bQbppF0MK39moHKnJon545mFU89OlNl39zyOXcrhmd2 KSkNZKir70SBSptf4J2jFujX506QWF86wl0X42vVeLQR7siKi9/9RxK7HoWOd8Ce 3f1E/Uubh7TyB1s7A2LrthS9Wcjv8/o604G9iyzVdZW0qU87OgmBPd6TVjpv0ENm q2hOcNALbhy1u0HiRGoBuCudBt3Ncl9M8tIOck9YrGbDi8hiTTkmyprlTaUq5zio oR/HWKW38k8uCQ9cp0HBi2XT+7RR8CL1vwyi3n6djgVeZLnKGcDetuepuHpNtIUc m7T/f9A99QvGTpeCPXEp/Ch5IQ/Ir8Yr6C7MheRblshvjp0DFTQm87rqryg2BVv2 Hnc8rP+AxqCGjPuM9Jo+d2CcBYwhTpCSNK8oFMDWbYk/BAEicQbUXdyVl+wUXcaN x/z1l3qtxaMAEA55UcZ+JTFDFVqaNq9pRHi9I2yFz4VOuFFNlbN8VS3dXEzV4sLO bJmUQew9bQsAv4d1XAPTRmdLaxJQebuUtqMre1GmX9PqDEQRBA/tJNAdg8YU+Db3 yMTiRtfX7RolR7xuPcTpsVt0Dfgr7DSWu8F+Vii+rPesTo8MyS3rOmBqGKp3Npxq xc2x2QqFMrmFs+7bfXq5b8RXs/UWXe/rVofLIAKZmxRfHNS6VoM= =v2IF -----END PGP SIGNATURE----- --lxbjInOfEI5aXryXjGoA8LC7gyjBWPBnw-- From nobody Tue Mar 12 14:53:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EEA0D1310F1; Tue, 12 Mar 2019 14:53:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5jcoQ1128C0t; Tue, 12 Mar 2019 14:52:58 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 371D81279A2; Tue, 12 Mar 2019 14:52:57 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [206.125.172.202]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x2CLqq2D061927 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 12 Mar 2019 17:52:53 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from nofx.lbl.gov (nofx.lbl.gov [IPv6:2620:83:8000:107::f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id D22D865A15; Tue, 12 Mar 2019 14:52:53 -0700 (PDT) To: Ted Hardie , Paul Vixie Cc: dnsop , DoH WG References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> From: Michael Sinatra Message-ID: Date: Tue, 12 Mar 2019 14:52:50 -0700 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:60.0) Gecko/20100101 Thunderbird/60.5.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [162.217.113.18]); Tue, 12 Mar 2019 17:52:55 -0400 (EDT) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 21:53:01 -0000 I realize you're responding to Paul, but your message below did pique (in a good way) my thinking and the distinction in my mind, as an operator, between DoH and DoT (and other forms of encrypted communication). I am top-posting intentionally because I am responding to your entire message. I support TLS 1.3 as written. I support DoT. I support DNSSEC, HTTPS-everywhere, HSTS, etc. I am a big fan of confidentiality and privacy. DoT gives us that. DoH does too, but it also gives us protocol obfuscation, and that makes me uneasy as an operator. I understand that in certain environments, this is seen as a good thing, but I can also imagine a number of environments where this approach will create considerable collateral damage and greatly hamper efforts at risk mitigation. Put differently, if we try to work around what our CISO is legitimately trying to do, they will come out with bigger and more expensive ban-hammers[1], and that will potentially lead to an arms race of more workarounds and even bigger ban-hammers. I think DoT makes a good compromise between confidentiality and protocol transparency. DoH does not because it intentionally works against protocol transparency. Again, that's what makes me uneasy and why I support the efforts behind the various internet-drafts that we're discussing here. michael [1] As an example, I am personally and practically opposed to inline TLS decryption in most enterprises. DoH gives further ammo for security folks to insist on inline TLS decryption, IMO. DoT, not as much, since the protocol can be easily identified on the wire and any necessary actions taken. Manipulating DoT transactions is a far cry from manipulating/decrypting all TLS... On 3/12/19 1:52 PM, Ted Hardie wrote: > Paul, > > Since it is apparent our disagreement is at a more fundamental level, I > will make only two further comments. > > The first is that you recently chided someone for using the word "rant", > saying that it would "diminish and disrespect" someone's words.  In the > note below you use terms like "warfare" to characterize the work of the > authors; that is both inflammatory and disrespectful.  The authors > worked on a chartered working group item throughout the IETF process.  > You disagree with the security trade-offs made in the chartering and > execution of that work, and discussion of that disagreement will > hopefully be fruitful.  But  if you want their respect of your opinion, > according them the respect due theirs will go a long way; they did not > make these choices arbitrarily. > > My second comment is to point out that the IETF has been heading this > way for about five years now.  The IAB formalized its early support of > this approach in November of 2014 with this text: > > The IAB urges protocol designers to design for confidential operation by > default.  We strongly encourage developers to include encryption in > their implementations, and to make them encrypted by default.  We > similarly encourage network and service operators to deploy encryption > where it is not yet deployed, and we urge firewall policy administrators > to permit encrypted traffic. > > We believe that each of these changes will help restore the trust users > must have in the Internet.  We acknowledge that this will take time and > trouble, though we believe recent successes in content delivery > networks, messaging, and Internet application deployments demonstrate > the feasibility of this migration.  We also acknowledge that many > network operations activities today, from traffic management and > intrusion detection to spam prevention and policy enforcement, assume > access to cleartext payload.  For many of these activities there are no > solutions yet, but the IAB will work with those affected to foster > development of new approaches for these activities which allow us to > move to an Internet where traffic is confidential by default. > > By that point, the IETF working groups were already in formation..  > Moving the DNS toward encryption has been going on since DPRIVE and has > been accompanied by the rise of transports like QUIC which are encrypted > by default.  You have been working around that, rather than developing > new practices.  I invite you instead to consider how you can accomplish > what you need to in an Internet where all traffic is confidential.  > Enterprises are currently doing that via managed software and > environments, and that approach seems to be well in-line with your > practices below.  Using resolution systems for this will not accomplish > what you need now, nor will it do so going forward; it is time for a > different approach, rather than seeking to return to cleartext. > > The situation that moved this community to that stance was well-laid out > in IETF 88.  We must acknowledge that not all devices which are on-path > are controlled by entities known to the user or network operator and not > all of them are acting in the interests of those parties.  Protecting > against that threat requires us to change our ways.  Please help, rather > than working around the effort. > > regards, > > Ted Hardie > (wearing no hats) > > > On Tue, Mar 12, 2019 at 1:22 PM Paul Vixie > wrote: > > On Tuesday, 12 March 2019 19:15:16 UTC Ted Hardie wrote: > > ... > > > that's precisely the goal, because very few network operators can > > > preordain the users and apps that will connect through their > networks. > > > > I do not believe this goal is met by what you describe, since an > > application can use a proprietary resolution service in its flows. > > rogue flows have their own accounting. my problem isn't with one-off's, > because traditional security is anomaly-based. DoH, by folding > control plane > data into previously non-anomalous flows, presents a new problem. if > CF and G > and IBM and Cisco decide to offer DoH on the same IP address that > they offer > API's and services i actually do need or want to permit, i'm going > to have to > increase my investment. > > this equation, where something is created which is a danger to me, > which > blends in with the crowd of things that are not dangerous to me, is > the method > by which DoH achieves its stated aim, "prevent on-path interference > in DNS > operations." all war is economics. they are increasing my costs, > deliberately. > > i am on-path and i intend to interfere. at whatever cost that may > be. i also > reserve the right to re-externalize some or all of those new imposed > costs. > > > Imagine for a moment an application on a smart TV that wants to > provide > > content from the closest server which contains that content.  ... > Blocking > > destinations for which you have seen no resolution events will > work for a > > subset of these cases, but it won't work when the resolution > points to a > > common CDN destination.  That approach will, of course, also have > a wide > > variety of failure modes when the resolution event data is > incomplete for > > timing or other reasons; it will also block all of the flows which MUD > > would handle. > > generally speaking, security policies break down into two > categories. allow > all except some, or deny all except some. which one an operator > chooses will > depend on their goals, budgets, and in particular, the cost of anomaly > detection. it's the change in cost of anomaly detection, > deliberately intended > by the authors of RFC 8484, which is at the root of some very > expensive policy > choices that the rest of us must now make. > > your smart-tv example is not involved in that causalality path. > noting also, i > have a TV which offers the kind of feature you describe, but only if > i accept > its software license. (something to do with GDPR, i suspect.) so i > did not > accept that license, and as a result, i have a disconnected device > whose > flaws, both now known and not yet known, will pose no threats here. > my TV, my > rules. > > > > to the extent that monitoring ('dnstap') and controlling (DNS > RPZ) dns > > > lookups by connected users and apps is considered a vital local > security > > > policy, attempts at such "pass through" must be made to fail. > > > Those are security mechanisms, rather than policy, and it may be worth > > teasing apart what the actual desired security policy is.  You may > find > > that it is more easily implemented at the routing layer than the > resolution > > system in the light of proprietary resolution systems and DoH. > > to be clear, the policy is, "allow all, except some". i implement as > much of > this policy as possible at the routing layer, and i do my research on > proprietary resolution systems to decide whether i can tolerate the > risks of > devices which use such things. (so, no nest thermostats here, the > TV's are not > smart, and the apple home pods are in their not-logged-in state.) > > it is the standards nature of DoH that amplifies its imposed costs. > i could > simply outlaw by IP or port# a proprietary or otherwise bespoke > protocol. > (working out with my kids what online games require what > permissions, has been > burdensome on both me and them.) DoH, by _intending to bypass_ network > operator policy DNS, and my seamlessly hiding in the crowd of TCP/443 > transactions now made indiscernible  by TLS 1.3 and ESNI, is an act of > economic warfare against all RDNS control plane owners. (deliberately.) > > vixie > > > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop > From nobody Tue Mar 12 15:51:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B1421224E8; Tue, 12 Mar 2019 15:51:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nQNgAxMjcHDX; Tue, 12 Mar 2019 15:51:04 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7C9671200D7; Tue, 12 Mar 2019 15:51:04 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 7FA38892C6; Tue, 12 Mar 2019 22:51:03 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Stephen Farrell , "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema Date: Tue, 12 Mar 2019 22:51:01 +0000 Message-ID: <7128698.bmqQpDD1M4@linux-9daj> Organization: Vixie Freehold In-Reply-To: <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 22:51:06 -0000 On Tuesday, 12 March 2019 21:38:44 UTC Stephen Farrell wrote: > On 12/03/2019 21:11, Paul Vixie wrote: > > ... > > There are reasons to want confidentiality for DNS queries > and answers, and access patterns, for which the IETF has > achieved consensus. (See RFC7626) (*) i have no qualms about confidentiality, for traffic allowed by a network operator. it's the inability to interefere (as called for in RFC 8484) and not the inability to observe (as called for in RFC 7626) that's at issue here. > DoT is one way to tackle those problems. DoH is another. DoT does not intend to place itself beyond interference by on-path entities, and as such, my choice as a network operator is either to allow it through even though i can't see the contents, or disallow it. and that's all fine. DoH intends "to prevent on-path interference with DNS operations", and that's well beyond the remit of RFC 7626, and is therefore not spoken to one way or another by IETF consensus. i do not believe that a non-interference objective would reach broader IETF consensus. perhaps we can test that one day. vixie From nobody Tue Mar 12 16:12:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB2A11278CF; Tue, 12 Mar 2019 16:12:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PprSAzy_ANYR; Tue, 12 Mar 2019 16:12:50 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2F021200D7; Tue, 12 Mar 2019 16:12:49 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id d2so4598442qti.11; Tue, 12 Mar 2019 16:12:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HlUYRI5YfVapiEBfupAP40hlQS+ndhH6MwgK/NyL3p0=; b=VBplFPLaVvBXHY6RTeps+eZAcpgGZzBoEB6QJPjRCZUeN36iYa3XcPiU/5d6CKKnhY Jxzgk7REHz/V+8NMoIcgc5kN0a6bEU+AjUpIvFBD1QfiLRvCoPX4d6iqXLiLsb+CvVGm L0rXZQy2EulFSWVreu2WDu6A5cQ1apah1d5IlfLRxCyNoTGL5uDrjS6kpQxxLLiAg0FG mUgGC3yswSaNslwXQkmrJUJkng9freVAkQSJfMSIZMB3Xm9w8ztzdbyRtbn5UkYdMfl+ pII3gxM9dRHlWa5QuBteqb/2MQEaE08noRoQdoL29AQQ9wzLzxM1dqlzxDvFAfSD+odW xmsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HlUYRI5YfVapiEBfupAP40hlQS+ndhH6MwgK/NyL3p0=; b=T3k+Eo/AYrPytey+qNaJ27AHaZur577sfjVzavNSxoLp8yrFqAEoTv+VNtK4cE12WS Rsz3KbOdNjOzhOwx/lzjxD9m0wWVUgXqQtVkE3gRTQDk+ZvoSFB9vdTStvOfb37Zt3MP 8lip5sYdGSxE8z4mtUNoFtGdNUQifEiU0V5LJah26pF2z+p2bfT6nrnZebGP/Twjk/ih Vn9Up87wXLYjj4VdUK6rHYYQ87nl7GAAlIerVwKbq5rOckYKZzq2tGFH63MuC74dQNpG 0calO4V5jlOfKIAox9skVooLe6Q54Cmr19oKNFilEEd+dRf4994ogC5ofXg9M4au8qNP yJLw== X-Gm-Message-State: APjAAAVZgkkmR1MeJQgdtLSNwkAULmCPwKyQUeTYQ08wCmFuTE95VIec IF+OfHGSGlu9VBy16ahMe8mAQ+OsfSMSqcHip9y0QA== X-Google-Smtp-Source: APXvYqzPRjCFLPHR7xWfCPw7WRdvt/DlxywsQGXy6xUc74rt8dAik2C6wlmYFWP7wF+aBlQpGEfClO5+vUTQaLQUuGQ= X-Received: by 2002:ac8:3896:: with SMTP id f22mr31490715qtc.324.1552432368642; Tue, 12 Mar 2019 16:12:48 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> In-Reply-To: <7128698.bmqQpDD1M4@linux-9daj> From: Brian Dickson Date: Tue, 12 Mar 2019 16:12:37 -0700 Message-ID: To: Paul Vixie Cc: "dnsop@ietf.org WG" , "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000def3660583edd324" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 23:12:52 -0000 --000000000000def3660583edd324 Content-Type: text/plain; charset="UTF-8" On Tue, Mar 12, 2019 at 3:51 PM Paul Vixie wrote: > On Tuesday, 12 March 2019 21:38:44 UTC Stephen Farrell wrote: > > On 12/03/2019 21:11, Paul Vixie wrote: > > > ... > > > > There are reasons to want confidentiality for DNS queries > > and answers, and access patterns, for which the IETF has > > achieved consensus. (See RFC7626) (*) > > i have no qualms about confidentiality, for traffic allowed by a network > operator. it's the inability to interefere (as called for in RFC 8484) and > not > the inability to observe (as called for in RFC 7626) that's at issue here. > > > DoT is one way to tackle those problems. DoH is another. > > DoT does not intend to place itself beyond interference by on-path > entities, > and as such, my choice as a network operator is either to allow it through > even though i can't see the contents, or disallow it. and that's all fine. > > I think there is a way to use technical design(s) to split hairs, i.e. I think the side meeting has the possibility of bearing fruit which is palatable enough for all parties. The crux of the problem is how to determine if the network operator is truly hostile (GFC), or merely restrictive (Paul's network, Paul's rules.) Suppose the client signaled a desire to use a particular DoH operator. The network could respond with, "No", or "Yes", or "Yes, but I want to inspect your DNS traffic", or "No, but I'll place you logically outside my network, and enable the isolated bubble you are in to do what you want." The client could treat "No" as hostile, and do something appropriate for being behind the GFC. The client could treat the "Yes, but" as a reason to then ask for the "bubble" treatment. If the client is offered and accepts, or requests and is permitted, the "bubble" treatment, there is no need to go hostile. In "bubble", the client would not be able to interact with any local resources, in effect being in a non-split-mode VPN to the outside world. There is really nothing that would stop a non-compliant client (or malware) from choosing the "hostile" mode. However, if "bubble" is available, I don't see why that would not be acceptable for any client that isn't malicious. Does "bubble" (and the signaling required) seem like a promising compromise? (Presuming the operator can still refuse "bubble" requests, of course, perhaps with a polite message denying the request with an explanation.) (Also, I would expect the MDM thing can be reduced to whether client(s) are allowed to go hostile or do "bubble" mode.) Brian Brian > DoH intends "to prevent on-path interference with DNS operations", and > that's > well beyond the remit of RFC 7626, and is therefore not spoken to one way > or > another by IETF consensus. i do not believe that a non-interference > objective > would reach broader IETF consensus. perhaps we can test that one day. > > vixie > > > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy > --000000000000def3660583edd324 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 12, 2019 at 3:51 PM Paul = Vixie <paul@redbarn.org> wrot= e:
On Tuesday, 1= 2 March 2019 21:38:44 UTC Stephen Farrell wrote:
> On 12/03/2019 21:11, Paul Vixie wrote:
> > ...
>
> There are reasons to want confidentiality for DNS queries
> and answers, and access patterns, for which the IETF has
> achieved consensus. (See RFC7626) (*)

i have no qualms about confidentiality, for traffic allowed by a network operator. it's the inability to interefere (as called for in RFC 8484) = and not
the inability to observe (as called for in RFC 7626) that's at issue he= re.

> DoT is one way to tackle those problems. DoH is another.

DoT does not intend to place itself beyond interference by on-path entities= ,
and as such, my choice as a network operator is either to allow it through =
even though i can't see the contents, or disallow it. and that's al= l fine.


I think there is a way to use technica= l design(s) to split hairs, i.e. I think the side meeting
has the= possibility of bearing fruit which is palatable enough for all parties.

The crux of the problem is how to determine if the n= etwork operator is truly hostile (GFC),
or merely restrictive (Pa= ul's network, Paul's rules.)

Suppose the c= lient signaled a desire to use a particular DoH operator.
The net= work could respond with, "No", or "Yes", or "Yes, = but I want to inspect your DNS traffic",
or "No, but I&= #39;ll place you logically outside my network, and enable the isolated bubb= le you are in to do what you want."
The client could treat &= quot;No" as hostile, and do something appropriate for being behind the= GFC.
The client could treat the "Yes, but" as a reason= to then ask for the "bubble" treatment.
If the client = is offered and accepts, or requests and is permitted, the "bubble"= ; treatment, there is no need to go hostile.
In "bubble"= ;, the client would not be able to interact with any local resources, in ef= fect being in a non-split-mode VPN to the outside world.

There is really nothing that would stop a non-compliant client (or m= alware) from choosing the "hostile" mode.
However, if &= quot;bubble" is available, I don't see why that would not be accep= table for any client that isn't malicious.

Doe= s "bubble" (and the signaling required) seem like a promising com= promise?
(Presuming the operator can still refuse "bubble&qu= ot; requests, of course, perhaps with a polite message denying the request = with an explanation.)

(Also, I would expect the MD= M thing can be reduced to whether client(s) are allowed to go hostile or do= "bubble" mode.)

Brian

Brian
=C2=A0
DoH intends "to prevent on-path interference with DNS operations"= , and that's
well beyond the remit of RFC 7626, and is therefore not spoken to one way o= r
another by IETF consensus. i do not believe that a non-interference objecti= ve
would reach broader IETF consensus. perhaps we can test that one day.

vixie


_______________________________________________
dns-privacy mailing list
dns-privacy@ietf.= org
https://www.ietf.org/mailman/listinfo/dns-privacy
--000000000000def3660583edd324-- From nobody Tue Mar 12 17:36:55 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8145D1295EC; Tue, 12 Mar 2019 17:36:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4S4PmX2GoaYk; Tue, 12 Mar 2019 17:36:38 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 47014129524; Tue, 12 Mar 2019 17:36:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7D888BE3E; Wed, 13 Mar 2019 00:36:35 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j49yRGfpnKYV; Wed, 13 Mar 2019 00:36:33 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 775FABE2E; Wed, 13 Mar 2019 00:36:33 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552437393; bh=qtfcXmkj6vY3XXgc/3ng0t0bxNia9NJ7EZDg+jdLE+M=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=ba8wCKjbKNGqoTRUhk+KPBWx3LQJ+Kg5J6QKrdyw/sXDaOCI9zhfUAAVRL2q6kPbV 333Av5UT+yAFZ7DKAXyK0fBuavK7OlxWG5Mmw6d7KnnEfEZV1m2IYmNZGN0D4OxcVM OVfqRZ5TDFLEhyBkJ1WJVAUjF0j/AWg/KClY0Jhs= To: Paul Vixie , dnsop@ietf.org Cc: "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> Date: Wed, 13 Mar 2019 00:36:32 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <7128698.bmqQpDD1M4@linux-9daj> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="p4Da6P4wbCTimfWsIUoL0ayfWLGPYZvaE" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 00:36:41 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --p4Da6P4wbCTimfWsIUoL0ayfWLGPYZvaE Content-Type: multipart/mixed; boundary="H1Yv9dVBcyTvB6nKnlOjTb0OnKlxzCyMg"; protected-headers="v1" From: Stephen Farrell To: Paul Vixie , dnsop@ietf.org Cc: "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema Message-ID: <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> In-Reply-To: <7128698.bmqQpDD1M4@linux-9daj> --H1Yv9dVBcyTvB6nKnlOjTb0OnKlxzCyMg Content-Type: multipart/mixed; boundary="------------4C3F527D628555E0EA97CB62" Content-Language: en-GB This is a multi-part message in MIME format. --------------4C3F527D628555E0EA97CB62 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 12/03/2019 22:51, Paul Vixie wrote: > On Tuesday, 12 March 2019 21:38:44 UTC Stephen Farrell wrote: >> On 12/03/2019 21:11, Paul Vixie wrote: >>> ... >> >> There are reasons to want confidentiality for DNS queries >> and answers, and access patterns, for which the IETF has >> achieved consensus. (See RFC7626) (*) >=20 > i have no qualms about confidentiality, for traffic allowed by a networ= k=20 > operator.=20 To me, the above reads as self-contradictory. If the traffic is confidential the operator doesn't know if its "allowed" except possibly in some extremely coarse-grained sense. Perhaps when you said "traffic allowed" maybe you meant "protocol allowed"? But even that is confusing, given the likes of websockets, alpn, and other webby ways in which stuff gets layered on 443 all the time. > it's the inability to interefere (as called for in RFC 8484) and not=20 > the inability to observe (as called for in RFC 7626) that's at issue he= re. Hmm. Not sure what to make of that. DNSSEC presumably makes it possible to detect interference, and yet RPZ (IIRC) calls for not changing DNSSEC-signed answers. I don't get why an inability to change is ok for the RPZ/DNSSEC context but not for DoH. Another possibility is that we're discovering that when this confidentiality stuff gets used for real, we find that we'd really prefer to not have to change what we've been doing before. I don't mean that as an accusation but it has been easy to ignore e.g. the lack of deployment of DNSSEC or more recently, DoT. >=20 >> DoT is one way to tackle those problems. DoH is another. >=20 > DoT does not intend to place itself beyond interference by on-path enti= ties,=20 > and as such, my choice as a network operator is either to allow it thro= ugh=20 > even though i can't see the contents, or disallow it. and that's all fi= ne. >=20 > DoH intends "to prevent on-path interference with DNS operations", and = that's=20 > well beyond the remit of RFC 7626, and is therefore not spoken to one w= ay or=20 > another by IETF consensus. i do not believe that a non-interference obj= ective=20 > would reach broader IETF consensus. perhaps we can test that one day. Over the years, we've had quite a few people propose schemes to provide integrity (and presumably hence prevent "interference") but no confidentiality. (There's an ongoing discussion of the very latest iteration of that on the TLS list in the last month or so.) That leads me to guess that a position that "interference is ok but confidentiality is not a problem" is not one that'd tend to garner consensus. But as you say, maybe some day we'll test that proposition. Cheers, S. >=20 > vixie >=20 >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh >=20 --------------4C3F527D628555E0EA97CB62 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------4C3F527D628555E0EA97CB62-- --H1Yv9dVBcyTvB6nKnlOjTb0OnKlxzCyMg-- --p4Da6P4wbCTimfWsIUoL0ayfWLGPYZvaE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyIUJAACgkQWrL68XsX K+p9CRAAmWdrFLS1pBnVtULGBXmDvSGkBa5QJ95HSnN6HYIuQB9vFQzrs16kAi91 f1KzCJAxS3EnJ5Nf7lQjRvPiFbJvY3+E9ugQJ0bWq8hFhOz20DXTbgyFRIRmv+40 S2/uFUGlOKz+Nvrcniw8lpF9bVwJkKJulhwg//KPn0v+1KgZw2hHCRlypHV8ByGv FLOfoWAmr2e8/y9ZsWsLEwoDgjkIY8cCplq0YK3TAb0WU8QZqeqbYFutD10fqXNr Nmv4OVMdrLmmpkgxB5CJ+f1o7ja04URZKXyZXjt9jVBa2j7W7r9yI3G+XwdYAWZJ 6jnkOGTNDWUEjw/vnUIS7C34gntOuIF3EGziyeJmgRbnXuotg9lNvtyYILS7Zw+R 3OuFDbu1AsdvQb6QW5Hg8p9vSBPlXlDjhADs6gsLvDIk0NApPHh/qHOJEUcariHV MgnamoeTFw+Ao5SMCQRQAKcVBQBICAhAPFOsNBvTTVNGJwWMa/CveRopNWgnXUeU 8H5y8lcFaPgtXFH2lTiRzZT9J+P5vUF9tyZwxbNE1+BANlqYJRaz0vqshnHbK7Wo eIDdp4oyI8pvxpiZRM6gHe4uNji6LOyh1/yJ0L7W1lxAGtHpenR5H3hVPp9Xk0Hz fXB/weUv0ksIr4FYN/0k1/TKQRorlmnou228NLLbQNzFGProy8g= =a+ts -----END PGP SIGNATURE----- --p4Da6P4wbCTimfWsIUoL0ayfWLGPYZvaE-- From nobody Tue Mar 12 18:04:42 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB6E1130ED1; Tue, 12 Mar 2019 18:04:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.9 X-Spam-Level: X-Spam-Status: No, score=-6.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a7IpLxwIDnGH; Tue, 12 Mar 2019 18:04:26 -0700 (PDT) Received: from mx.pao1.isc.org (mx.pao1.isc.org [149.20.64.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D7B312705F; Tue, 12 Mar 2019 18:04:26 -0700 (PDT) Received: from zmx1.isc.org (zmx1.isc.org [149.20.0.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id CE1933AB001; Wed, 13 Mar 2019 01:04:25 +0000 (UTC) Received: from zmx1.isc.org (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTPS id B7DF916006F; Wed, 13 Mar 2019 01:04:25 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTP id A375616006C; Wed, 13 Mar 2019 01:04:25 +0000 (UTC) Received: from zmx1.isc.org ([127.0.0.1]) by localhost (zmx1.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id WG_uVQotGv4w; Wed, 13 Mar 2019 01:04:25 +0000 (UTC) Received: from [172.30.42.69] (c27-253-115-14.carlnfd2.nsw.optusnet.com.au [27.253.115.14]) by zmx1.isc.org (Postfix) with ESMTPSA id 7B5C0160068; Wed, 13 Mar 2019 01:04:24 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Mark Andrews In-Reply-To: <2BA35B39-D6D7-43AD-A868-E59E4AD5F237@rfc1035.com> Date: Wed, 13 Mar 2019 12:04:21 +1100 Cc: Stephane Bortzmeyer , dnsop WG , DoH WG , dns-privacy@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9D703923-07DC-4A7E-9BFC-5DD9AA3B0658@isc.org> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <092c081b-50b2-0c37-7a06-a3bd16c9ccdb@huitema.net> <3e91ec1f-f2d5-a3f1-a40c-5039d24f49b9@redbarn.org> <20190312154913.4ch2bn6jyu53tfhl@nic.fr> <2BA35B39-D6D7-43AD-A868-E59E4AD5F237@rfc1035.com> To: Jim Reid X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 01:04:29 -0000 > On 13 Mar 2019, at 3:02 am, Jim Reid wrote: >=20 >=20 >=20 >> On 12 Mar 2019, at 15:49, Stephane Bortzmeyer = wrote: >>=20 >> the case of a commercial >> Internet access provider is clear in the other direction: a client is >> not an employee, and is entitled to a free, open and neutral Internet >> access. >=20 > Stephane, that=E2=80=99s simply not true. A client of an Internet = access provider is entitled to the service that they contractually = agreed to pay for. Check the small print. Or the T&Cs the next time you = use some coffeeshop=E2=80=99s wifi. Even if your ISP offers you =E2=80=9Cf= ree, open and neutral Internet access=E2=80=9D (for some definition of = that phrase), I=E2=80=99m pretty sure they=E2=80=99ll drop your service = if you were damaging their network or or doing something else that was = illegal or otherwise in breach of their T&Cs. And what part of doing a DNS lookups breaks any reasonable terms and = conditions? > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --=20 Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From nobody Tue Mar 12 18:04:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1545C1311E3; Tue, 12 Mar 2019 18:04:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P05NnP2P0Q4O; Tue, 12 Mar 2019 18:04:34 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0270D1311B5; Tue, 12 Mar 2019 18:04:34 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 44JtsW11VnzKJY; Wed, 13 Mar 2019 02:04:31 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1552439071; bh=x2k8Mmmo03gTfzOs9pF0Al5B9U1AJ6EuLhTA5OrWGic=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=Fco5j8ToJEEsyGrt8jt2TdH0deV9muFxjiP8fh318DUZlg8IEQYtsSWME9HKHFrkw yG53G4j3PBxLVfKXAd72qdcKxBfeFb0C5h75MNhZB/w7e0ur7KsuY5bMG3GNYn2ilB kaelbefFWL4tGyapop1UVCrg62WI9hOs5n0kT2GU= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id xobr81eYOZIC; Wed, 13 Mar 2019 02:04:29 +0100 (CET) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 13 Mar 2019 02:04:28 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id B567C2FCD9; Tue, 12 Mar 2019 21:04:27 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca B567C2FCD9 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id AB5D540D35BD; Tue, 12 Mar 2019 21:04:27 -0400 (EDT) Date: Tue, 12 Mar 2019 21:04:27 -0400 (EDT) From: Paul Wouters To: Stephen Farrell cc: dnsop , "dns-privacy@ietf.org" , "doh@ietf.org" In-Reply-To: <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 01:04:42 -0000 On Wed, 13 Mar 2019, Stephen Farrell wrote: > Hmm. Not sure what to make of that. DNSSEC presumably makes it > possible to detect interference, and yet RPZ (IIRC) calls for > not changing DNSSEC-signed answers. I don't get why an inability > to change is ok for the RPZ/DNSSEC context but not for DoH. no. RPZ allows filtering answers which would turn into BOGUS for DNSSEC validating clients. I am waiting for RPZ to be an RFC to start a bis document that moves the Answer to the Authoritative section, so you can indeed detect the network's desire for protecting you, and use DNSSEC to confirm you are not censored without consent. Paul ps. I owe the ISE a rpz document review, so it is partially my fault this is stuck now. I hope to get enough airplane time in the next two weeks to fix that :) From nobody Tue Mar 12 18:11:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7CF1613117B; Tue, 12 Mar 2019 18:10:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XSQb2g5zrp0R; Tue, 12 Mar 2019 18:10:43 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [193.110.157.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C2E912705F; Tue, 12 Mar 2019 18:10:43 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 44Jv0b6C0fzKJY; Wed, 13 Mar 2019 02:10:39 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1552439439; bh=GDeSHca/f2cr7Zc/MJ/rN2hUvqVGrLw/aPP3ILWg3Ug=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=S+DyX4om9LSCe2srkYkQYhilNze6UwLNNUpRCJVa8PGGMqbPIlO5iW5HLUDdVnlAV ducIwllNiJzEN03aXFngZdLfcY5fVybH3z5laeJG+S8sunfE9jClS+9RqKCuSc+uRF LmBoDP5wFRJ4vGgLEFZYHqEhaQcoZs1zO8YWUP+U= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id N8sZ8GstLP_H; Wed, 13 Mar 2019 02:10:38 +0100 (CET) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Wed, 13 Mar 2019 02:10:38 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 1BE152FCD9; Tue, 12 Mar 2019 21:10:37 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 1BE152FCD9 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 0ED5140D35BD; Tue, 12 Mar 2019 21:10:37 -0400 (EDT) Date: Tue, 12 Mar 2019 21:10:37 -0400 (EDT) From: Paul Wouters To: Paul Vixie cc: "doh@ietf.org" , dnsop , "dns-privacy@ietf.org" In-Reply-To: <1709670.IeiIJmgblr@linux-9daj> Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <4935758.NkxX2Kjbm0@linux-9daj> <1709670.IeiIJmgblr@linux-9daj> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 01:10:45 -0000 On Tue, 12 Mar 2019, Paul Vixie wrote: > i don't like the chinese government's rules for the great firewall. so, i keep > my visits to that otherwise-great country short. this hurts me, and maybe > hurts them also. but, it's their country, and i will obey their laws when i am > using their network. and then i'll vote with my feet, to get to a better > network with better rules. This is spoken from priviledge and really pretty unfair to claim. If tomorrow Trump installed mandated ISP DNS firewalls with RPZ that every MUST use and is a crime to not use, and fbi.gov is filtered like tiananmen square you would not follow your governments rules because it is their/your country, nor denaturalize yourself and move country. I remember all the people who would leave California if Arnold would become governor. Or when Bush would be elected. Twice. And those who would leave when Trump would be elected. I know of exactly 0 individuals who kept their promise. Paul From nobody Tue Mar 12 18:16:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4A37412705F; Tue, 12 Mar 2019 18:16:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0hNdFdU99sBQ; Tue, 12 Mar 2019 18:16:18 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 02529126CAD; Tue, 12 Mar 2019 18:16:18 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id DE1E7BE5C; Wed, 13 Mar 2019 01:16:15 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AN-RS9JOqfNT; Wed, 13 Mar 2019 01:16:14 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 723E9BE3E; Wed, 13 Mar 2019 01:16:14 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552439774; bh=vm9ee1BavHehJfC2KdoSQwcrQNbxQxO4FTtloNxRmKI=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=MmHsvBSK5aXmY2l9rnno0QbDkjIX0ZV9d0/efdFOry3XEIwv4tmhAAqVamIzs/ZKO ulMoYEaZD8jwnF3sxY98w65sKin47cJIjVjbLa3tz6pA27Syq4X0s1ySXdm6n3MbMM 79apQa3dWx1QF105heS2PWXJK+V1CYvraVAcHXwU= To: Paul Wouters Cc: dnsop , "doh@ietf.org" , "dns-privacy@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <038d1397-621f-340e-56cc-28dcd4b81816@cs.tcd.ie> Date: Wed, 13 Mar 2019 01:16:13 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="7Oq37s0Jpga7WwGQdNXwluso6PNbEUPpp" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 01:16:20 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --7Oq37s0Jpga7WwGQdNXwluso6PNbEUPpp Content-Type: multipart/mixed; boundary="1M6TSgPEP8BxIw5geFkNOiqBnekBgx54n"; protected-headers="v1" From: Stephen Farrell To: Paul Wouters Cc: dnsop , "doh@ietf.org" , "dns-privacy@ietf.org" Message-ID: <038d1397-621f-340e-56cc-28dcd4b81816@cs.tcd.ie> Subject: Re: [dns-privacy] [Doh] [DNSOP] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> In-Reply-To: --1M6TSgPEP8BxIw5geFkNOiqBnekBgx54n Content-Type: multipart/mixed; boundary="------------96C33917AE29581E4A928EB3" Content-Language: en-GB This is a multi-part message in MIME format. --------------96C33917AE29581E4A928EB3 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 13/03/2019 01:04, Paul Wouters wrote: > RPZ allows filtering answers which would turn into BOGUS for > DNSSEC validating clients. Could well be my terminology was imprecise. What I recalled from some discussion a year or more ago was that RPZ MUST NOT change a DNSSEC-signed answer that verifies. If that's wrong or no longer the case then my point there is off base. (I'll go back and find another tomorrow:-) If I'm correct, then I remain puzzled as to why Paul V. finds it acceptable to be unable to "interfere" with DNS answers in one case (RPZ-with-good-DNSSEC) but not the other (DoH). Cheers, S. --------------96C33917AE29581E4A928EB3 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------96C33917AE29581E4A928EB3-- --1M6TSgPEP8BxIw5geFkNOiqBnekBgx54n-- --7Oq37s0Jpga7WwGQdNXwluso6PNbEUPpp Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyIWd0ACgkQWrL68XsX K+q6tw//Sbg1vj5eVX76MKfp4Rv0qyNhuVeG0MyMwEoSAnqzZbgFTbkscTARHUWf UeirWPtJuArbsNdbClOvyr5kghHCsI/aORpeWr2A8YwHUDqaHRomN52eDKJ2HKdY EiczGdXQIk1ZZt2tmhXEYiFhP1KumuhI00hvA2YH8dn33QbQpQ0bPnBFUv5AOFXk jXHGBHSoTxZzleRrJF/YVWpHSRZFEhv5K3UEAc+rEHRSoXd3iumsCjqmf3LC6NlD 9CCOwf0gv1jgVUC9k57KfosaA3rJM/3DtFDZsYFH52e2huyTL6ktxCfrkXhuSbhQ em0iPt3cWCibbf6wV3rTvO3xJatYrsbpwnXY5Qa6v91sC6qzkX2DlfIKG//TKNQV WB1lc88isyoa15NQNL6YA0wyXn+sCcqvq/L6XHGiK150t7pMWBgm7ef1OeG6JJMh mr1xHOHwfvRTqEzj0GdtLClc4KI2N4b0HYi4K0KuYpdfSUjxpWVipwfP9BReOjXr IJN6Jpvb91+NYmPr0uyVtqw5y4dldWLiwtiHCSn8bCfd5lsFssRzWTfpDthKNjoz SVZct9DnRUVZXZiifN6iHg8YYCjN3t8LRDdFmjwEHd8a0A02tc+li9QCobdyB00w EEzgtHbTbvU+62fpElHhsEK4wN/owsUS1yDlefrWCz4qmTsiS+k= =KTKW -----END PGP SIGNATURE----- --7Oq37s0Jpga7WwGQdNXwluso6PNbEUPpp-- From nobody Tue Mar 12 19:21:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1CABB1277DB; Tue, 12 Mar 2019 19:20:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q0cJWkHxD0S5; Tue, 12 Mar 2019 19:20:54 -0700 (PDT) Received: from mail1.oneunified.net (mail1.oneunified.net [63.85.42.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4269112716C; Tue, 12 Mar 2019 19:20:53 -0700 (PDT) X-One-Unified-MailScanner-Watermark: 1553048446.86058@7dkIhg02GGVo+6hDntueFg X-One-Unified-MailScanner-From: ray@oneunified.net X-One-Unified-MailScanner: Not scanned: postmaster@oneunified.net X-One-Unified-MailScanner-ID: x2D2KhpI014706 X-OneUnified-MailScanner-Information: Please contact the ISP for more information Received: from [10.55.40.139] (h96-45-2-121-eidnet.org.2.45.96.in-addr.arpa [96.45.2.121] (may be forged)) (authenticated bits=0) by mail1.oneunified.net (8.14.4/8.14.4/Debian-4) with ESMTP id x2D2KhpI014706 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NOT); Wed, 13 Mar 2019 02:20:44 GMT To: Paul Vixie , dnsop@ietf.org Cc: "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema , Stephen Farrell References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> From: Raymond Burkholder Organization: One Unified Net Limited Message-ID: Date: Tue, 12 Mar 2019 20:20:42 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <7128698.bmqQpDD1M4@linux-9daj> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 02:20:56 -0000 On 2019-03-12 4:51 p.m., Paul Vixie wrote: > On Tuesday, 12 March 2019 21:38:44 UTC Stephen Farrell wrote: > DoH intends "to prevent on-path interference with DNS operations", and that's > well beyond the remit of RFC 7626, and is therefore not spoken to one way or > another by IETF consensus. i do not believe that a non-interference objective > would reach broader IETF consensus. perhaps we can test that one day. I'm not sure I understand the double-double negative happening here. It appears to me that there is considerable support for DoH, meaning there is support for non-interference. In the IPv6 spectrum with the mac/slaac randomization games which have become standardized, and which have been instituted to supply other forms of security/hiding/non-interference, it appears that DoH would similarly be 'allowed' through the standardization process. Having said that, and if this is how one performs the testing, I would have to say that DoH would be make it much harder for me as a security engineer to perform my duties. It would seem that if DoH is standardized, then it would probably become standard practice, then like 8.8.8.8 and similar quads, by default meaningful data becomes hidden for managing the interior of networks. For some networks, pi-hole is a mechanism for preventing certain traffic operations. AS I look at it this moment, it has over 112K domains blacklisted, and on one particular network, 31% of the queries have been blocked as a passive protection mechanism. I find these blocks useful. With DoH, probably DoH would become ubiquitous, and these types of blocks would be prevented. Https is common ground for much hiding. DNS is probably our last bastion of having any semblance of identification of what is happneing to the interior of our networks. Carriers might not be so concerned. But for those who operation enterprise, business, home, some forms of social protection, security management becomes more difficult. As has happened in the IPv6 space, the same happens here in the DNS space: there are groups who wish the privacy/non-interference/hiding ability vs the groups who need the information in the data streams to properly secure and manage the interior and perimeter. How would the requirements of each group be recognized? The simplest would be to not proceed with DoH. From nobody Tue Mar 12 19:30:40 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B899D1277DB; Tue, 12 Mar 2019 19:30:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CnX6eX_OX6PF; Tue, 12 Mar 2019 19:30:17 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00BAF12705F; Tue, 12 Mar 2019 19:30:16 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id D66606A26A; Wed, 13 Mar 2019 03:30:14 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552444214; bh=BxEC4LcXntdtLjgzl2RIWu7z4L3F0oLK/enfxlRYLWA=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=oBhLH3buG2JOLgjJzFi8aC6T0ar+aqRFwnPUJFdbn3a73ST+D+WS/+MUbDB2FQ4D+ z6XQfBStCN573g7Pc25RVvk/gJwBG8t/QA00UyPx3mU8wFxmnnHVRxRGE2momcBxb9 lJmQBgJspGFN71a9kxz5mql+wB2+KM4VsGdtVEcuTDvh8x4CHN/uWKl4xnF1+aVwM7 +Qe+5pkI100CZ+9qZBmLZOSA2bjTrBDSYbDDHl358Hw14TQ7cPn90o1h0Ibgo7Qon9 01TZOiOlqfDtt84qkJugFPxujpdx+teNvCep7fStNB9mpcpSSMe6kWJzepO9ZPM/di V5ePLi9H/AmHg== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id C8C7A3C0078; Wed, 13 Mar 2019 03:30:14 +0100 (CET) Date: Wed, 13 Mar 2019 03:30:14 +0100 (CET) From: Vittorio Bertola To: Raymond Burkholder Cc: dns-privacy@ietf.org, dnsop@ietf.org, doh@ietf.org Message-ID: <190682238.19914.1552444214771@appsuite.open-xchange.com> In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <92a3c1c1-0e0b-50c4-252f-94755addf971@cs.tcd.ie> <7128698.bmqQpDD1M4@linux-9daj> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 02:30:19 -0000 > Il 13 marzo 2019 alle 3.20 Raymond Burkholder ha scritto: > > It appears to me that there is considerable support for DoH, meaning > there is support for non-interference. I think there is support within the IETF, but "non-interference" on DNS has lots of implications at the legal, business, policy and political levels, which implies that there are many more stakeholders than the technical community, and these stakeholders have never been asked what they think of this. This is part of the discussion that needs to happen to get to broad consensus on DoH deployment models, as opposed to a technical arms race to enable/stop DoH between the Web people on one side and the security, ISP and government people on the other. > How would the requirements of each group be recognized? The simplest > would be to not proceed with DoH. My draft attempts exactly to promote a discussion to find the conditions (if any exist) under which DoH could be deployed broadly without making any stakeholder group [too] unhappy. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Mar 12 19:32:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 10BAE1277DB for ; Tue, 12 Mar 2019 19:32:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 44ezHGNI2_S3 for ; Tue, 12 Mar 2019 19:32:33 -0700 (PDT) Received: from mail-io1-xd2f.google.com (mail-io1-xd2f.google.com [IPv6:2607:f8b0:4864:20::d2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73DC112865E for ; Tue, 12 Mar 2019 19:32:29 -0700 (PDT) Received: by mail-io1-xd2f.google.com with SMTP id k21so310600ior.13 for ; Tue, 12 Mar 2019 19:32:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xeYsj2L5rzy74kfnFhdF6P+Uq3YGoyNCGioBJnjPRJ4=; b=CsBHI+JOA5huaXkWe9J+iQHK+q+2kv2p5c4QIsE5IC84VlbOLsaA/zBXrX8Ei81Uci WCHQaWvvH2KUdd4+4OwhSMLZBL99LT2Ri/HGZ6hszqzKQiaaPRMiEr8LVij3nz8NjbFv kvxqnhlIz/lisNSdmENHJbxXHU/vQUMA+4C5r5YMT1LfvrxLBvsJ4iohQhvch8GC0N7E qJ56SBBKmsRCJTE8lWS2qh07tq4GMmo88fYGTESpc6+aOMaYm42Af2mV97Vf//29/V99 Vv/gBDy5dz0IYvWEItc7ouwJBH36SIsuV1hmA90teUhOtpe7m6+mP2kLOsaHl+YFk3eh /7/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xeYsj2L5rzy74kfnFhdF6P+Uq3YGoyNCGioBJnjPRJ4=; b=aKVT3Vn70L2lLBap7NlBkoXjFuM/cm51Fqzxqt/lHP/m7hwhyT5GLbxKIKKd78XiU3 Ql5/QhqkGPVWZXr0loFt3oD9cWo1zziaJ4hA42buYUGi2G0uR0hvnYvW4jlEpGh5/Qjx 2wLRkoJZ2QGwc05p2/ZKTScaPYZzKwaCq7C+SwvXTAeaKYkb0i537bYhRBU7CeM9WGZg RIrbmTC2jdWPrSLPoxhOrZMWdz9/W3BVuHWxCeVXQQ5rfklN5j6XhGmQfHJbRykAnt07 3Izzk5EWT9D5RrMQOb2OMEtF99xoAhqy3YVEbFXv+9e4sClb2j8QXYR4aUkKPztKkVyZ y00g== X-Gm-Message-State: APjAAAXyfIaUgq2x9B57SWzJ0ApujsDZQi9xqtedbVCmC2OshEDDov7g lkg+4aF2nfRezGthr/BWEVyJWbceLbvs3z3ZbhgEDA== X-Google-Smtp-Source: APXvYqxSm90rpxNMA4JjVsHPl9K4Lt7iC1Skvt/fhGJ472UBPrZrr6fLjpqMwHdSJdXhmY0MUiTFknTpb72VIwhSlWU= X-Received: by 2002:a5d:8190:: with SMTP id u16mr23422006ion.238.1552444348692; Tue, 12 Mar 2019 19:32:28 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <20190312153636.qdsdne24vmi4xdoe@nic.fr> <3519715.nWsYgrufbW@linux-9daj> In-Reply-To: <3519715.nWsYgrufbW@linux-9daj> From: nalini elkins Date: Wed, 13 Mar 2019 08:02:19 +0530 Message-ID: To: Paul Vixie Cc: dnsop@ietf.org, Stephane Bortzmeyer , Stephen Farrell , doh@ietf.org, Christian Huitema , dns-privacy@ietf.org, Vittorio Bertola , "Ackermann, Michael" Content-Type: multipart/alternative; boundary="000000000000f00d270583f09d21" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 02:32:35 -0000 --000000000000f00d270583f09d21 Content-Type: text/plain; charset="UTF-8" Paul, On Wed, Mar 13, 2019 at 1:03 AM Paul Vixie wrote: > On Tuesday, 12 March 2019 15:36:36 UTC Stephane Bortzmeyer wrote: > > On Mon, Mar 11, 2019 at 08:55:18AM +0530, > > nalini elkins wrote > > > > a message of 202 lines which said: > > > The questions that the Fortune 50 company architect asked were > something > > > like this: > > > > > > 1. You mean that DNS could be resolved outside my enterprise? > > > > I suggest to explain to this person that it was possible before, as > > any malware author discovered. > > no, it was not possible before. or rather, it could be cheaply prevented > before. > > > If people responsible for networks of Fortune 50 company don't know > > that it is difficult to stop unwanted communication (except when you > > control all the endpoints, or when you airgap your network), then it > > is indeed a problem :-) > > in my own travels, i've met some fortune-level CISO's who had not yet been > told that RDNS monitor/control bypass was now an internet standard, and > that > behavioural modeling based on TCP/443 endpoints was no longer practical. > so, i > urge greater efforts on getting the word out. > > vixie > > > Thank you. -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --000000000000f00d270583f09d21 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Paul,

On Wed, Mar 13, 2019 at 1:03 AM Paul Vixie <<= a href=3D"mailto:paul@redbarn.org">paul@redbarn.org> wrote:
On Tuesday, 12 March 201= 9 15:36:36 UTC Stephane Bortzmeyer wrote:
> On Mon, Mar 11, 2019 at 08:55:18AM +0530,
>=C2=A0 nalini elkins <nalini.elkins@e-dco.com> wrote
>
>=C2=A0 a message of 202 lines which said:
> > The questions that the Fortune 50 company architect asked were so= mething
> > like this:
> >
> > 1. You mean that DNS could be resolved outside my enterprise?
>
> I suggest to explain to this person that it was possible before, as > any malware author discovered.

no, it was not possible before. or rather, it could be cheaply prevented before.

> If people responsible for networks of Fortune 50 company don't kno= w
> that it is difficult to stop unwanted communication (except when you > control all the endpoints, or when you airgap your network), then it > is indeed a problem :-)

in my own travels, i've met some fortune-level CISO's who had not y= et been
told that RDNS monitor/control bypass was now an internet standard, and tha= t
behavioural modeling based on TCP/443 endpoints was no longer practical. so= , i
urge greater efforts on getting the word out.

vixie



Thank you.

--=
Thanks,
Nalini Elkins
President<= /div>
Enterprise Data Center Operators
=

--000000000000f00d270583f09d21-- From nobody Tue Mar 12 19:32:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DA99127994 for ; Tue, 12 Mar 2019 19:32:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GwajeHvkVYno for ; Tue, 12 Mar 2019 19:32:37 -0700 (PDT) Received: from mail-lf1-x12a.google.com (mail-lf1-x12a.google.com [IPv6:2a00:1450:4864:20::12a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A1DED128BCC for ; Tue, 12 Mar 2019 19:32:36 -0700 (PDT) Received: by mail-lf1-x12a.google.com with SMTP id u2so290370lfd.4 for ; Tue, 12 Mar 2019 19:32:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=ee99X5buP/qCX6ZOv7ytxmKIMNM6QQgOJ+AJRuHeOmM=; b=KgDkCmFsrRym09MR3cCnPqfa4HbRkj79RyCcw1ujXUrrQdaWnvDrbvaLKSu43EOEpe ccU/8gMc3DChMNP5PU0+tP+5DAHXvdhszgql8Jg+6WLmJ8Bvh3gmggbeZD9LwWyJ1+6P 7PZ9nIWsJ2YBvo8BjizzmGHWccCc5Fv24vJw5OsqtihBQr/i6fzHGOxxgCZx8y25jfnX h2vADqxIX9k3Z071hCvDJyX0Uk1szKZQaO0utT2GnA67Ag8Xk2etxlU6QOdN+XCjvRN3 49yju3feKybKnI/tmZrhGjYuMGmW8QPXhrbGhZmj131LPc+PzriZGAKchhWDrojjOhC2 Kf1w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ee99X5buP/qCX6ZOv7ytxmKIMNM6QQgOJ+AJRuHeOmM=; b=fTwTgvVwzAa589CklE+Rzz56n010VhCW7bjQF2gJHedaSj+jBZy0PkGxQ9fIUQvdgg 8L7dLsMKibuG7GWSlcQf9aOsfXctRnoq2PNyqaG5fO14htABvQlFHTwnLr7VpIbAK4PA yrMo/g1a9F30uApeNQ/AqXlGC/i2Z0y4T9e+EvXjFLKv97xq1gKQb1pMXCnIoLE5Nmnp geIFwr8vdg/GzPKcddOg7hQ/vIhCKpNfeb45d8eFmCcUm/kOHU1Wy+4oMaAWMQkvCvi3 QfukFAVqypvYxX8QTtjelsKJHX34XP6DOdbDjFxJNWApoPTxqgs5PaG/VHp44lXGYmnL e8aQ== X-Gm-Message-State: APjAAAVwVKRu92BDWpghWJG8JCdfnV3dwPKV5gF6A+OD4LrAuwn2So5D 8GNgx84D0NX8aEVwVN9v/uV3UdTIe83BuNim5VAvnqV+zdiJtw== X-Google-Smtp-Source: APXvYqyyGk9WxqKcQ88aC5W/W8ASdCm4eFqZ7omhNyxOqioe5BsSH3fVTOC79gf/YYwrTWvC7Bzh8QtjA1lVZoUDy/E= X-Received: by 2002:a19:7412:: with SMTP id v18mr6654954lfe.116.1552444354296; Tue, 12 Mar 2019 19:32:34 -0700 (PDT) MIME-Version: 1.0 From: Kenji Baheux Date: Wed, 13 Mar 2019 11:32:23 +0900 Message-ID: To: doh@ietf.org Content-Type: multipart/alternative; boundary="00000000000045e5080583f09e78" Archived-At: Subject: Re: [Doh] Concerns around deployment of DNS over HTTPS (DoH) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 02:32:43 -0000 --00000000000045e5080583f09e78 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable *(Sincere apologies about the multi-posting but the discussion seems to be happening in different places...)* Hi, I'm involved with Chrome's DoH efforts. I've noticed a few drafts listing concerns about certain types of deployment for DoH. It appears that the key concerns are based on assumptions about various browsers' plans. So, to address misunderstandings, I'd like to share some background, and the high level principles that guide our work on DoH in Chrome. Our motivations in pursuing DoH in Chrome is to offer our users a better user experience: - Stronger privacy and security. - Hopefully, some performance wins. Principles and illustrative* examples: 1. Provide our users with meaningful choice and control, e.g. allow end-users/admins to control and configure the feature, whether they want= to use a custom DoH server, or just keep on using their regular DNS. 2. Don't surprise our users, e.g. don't silently force a different provider= . 3. Continue to support admins for Education and Enterprise use cases, and parents for family use cases, e.g. prevent students/employees/kids from accessing unsafe/inappropriate websites. *: not necessarily our actual concrete plans (still WIP for the most part, subject to change due to unforeseen implementation hurdles, or informed by feedback and discussion, etc.), only shared as a comprehension aid. Tentative plans: - We are considering a first milestone where Chrome would do an automatic upgrade to DoH when a user=E2=80=99s existing resolver is capable of it. - There are some unanswered questions about how we will be doing that discovery, and would welcome input from the community. Perhaps, a good topic for IETF 104. - For Education and Enterprise use cases, we believe that a group policy to disable and/or configure the feature will be enough. - For family use cases, we believe that allowing users to keep using their existing solution or opting into a DoH compatible solution (if available= ) will be enough. - There are no plans to force any specific resolver without user consent / opt-in (see principle #2) We believe that starting with an automatic upgrade approach should address a lot of the concerns expressed in the various drafts, because it gives a chance to existing players to play an active role in providing stronger privacy and security to end-users. PS: I won't be able to join IETF 104 to discuss this face to face, but I will see if someone from our side can represent us. --=20 Kenji BAHEUX Product Manager - Chrome Google Japan --00000000000045e5080583f09e78 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

(Sincere apologies about the multi-posting but the discussion seems to= be happening in different places...)


Hi,


I'm involved= with Chrome's DoH efforts.


I've noticed a few draft= s listing concerns about certain types of deployment for DoH. It appears th= at the key concerns are based on assumptions about various browsers' pl= ans. So, to address misunderstandings, I'd like to share some backgrou= nd, and the high level principles that guide our work on DoH in Chrome.


Our motivations in pursuing DoH in Chrome is to offer our users= a better user experience:

  • Stronger privacy and security.

  • Hopefully, some performance wins.


Principle= s and illustrative* exampl= es:

  1. Provide our users with meaningful choice and control, e.g. allow en= d-users/admins to control and configure the feature, whether they want to u= se a custom DoH server, or just keep on using their regular DNS.

    =

  2. Don't surprise our users, e.g. don't sile= ntly force a different provider.

  3. Continue to support admins for Education and Enterprise use cases, and = parents for family use cases, e.g. prevent students/employees/kids from accessing un= safe/inappropriate websites.

*: not= necessarily our actual concrete plans (still WIP for the most part, subjec= t to change due to unforeseen implementation hurdles, or informed by feedba= ck and discussion, etc.), only shared as a comprehension aid.


Tentative plans:

  • We are considering a first milestone where Chrome would do= an automatic upgrade to DoH when a user=E2=80=99s existing resolver is cap= able of it.

  • There are some unanswered questions a= bout how we will be doing that discovery, and would welcome input from the = community. Perhaps, a good topic for IETF 104.

  • Fo= r Education and Enterprise use cases, we believe that a group policy to dis= able and/or configure the feature will be enough.

  • For family use cases, we believe that allowing users to keep using their e= xisting solution or opting into a DoH compatible solution (if available) wi= ll be enough.

  • There are no plans to force any sp= ecific resolver without user consent / opt-in (see principle #2)

    =

We believe that starting with an automatic upgrade approach shou= ld address a lot of the concerns expressed in the various drafts, because i= t gives a chance to existing players to play an active role in providing st= ronger privacy and security to end-users.


PS: I won't be= able to join IETF 104 to discuss this face to face, but I will see if some= one from our side can represent us.



--
Ke= nji BAHEUX
Product Manager - Chrome
Google Japan
--00000000000045e5080583f09e78-- From nobody Tue Mar 12 19:57:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1B8B91311A3; Tue, 12 Mar 2019 19:57:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I9dJZkmu-2SZ; Tue, 12 Mar 2019 19:57:01 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 07617129B88; Tue, 12 Mar 2019 19:57:01 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 352CE6A26A; Wed, 13 Mar 2019 03:56:59 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552445819; bh=oXRkTmAP4LeKsLoCdNZ2M0kws9iKZgzZ3nZ/mhr9Skw=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=kSrC5gdS5UIawnKwF0tRw6HSSL19O80ZwK0iMSkiHSD8Qfc1uvKWR/Xqq5bZQbxOa eSlTi2+PqWGnpRq691v0jbAKjHcK8iPT/8He0zGPeL1OflwfnKiPnjJlz+uty8jjxA 5ZgR958g0A1yJWqk7DDtcwCy6QX8jRaqS6Cj+avD2jMr3tOQOvS5N5zEni49f7NP1F 877MNQAg8nGYuGIvpGDyzXPFGGbuXMgh7UcM9VF3P7PYE+CFrBq9MFGqsUqI6iYMtm hyjgwr+tHx+/QdseSk/Bf0/tgxGLFjrQcxFJWr1Smv5FlcNdDznBh+v0WAyPgFZ2wx G+PugBHZ2UX8Q== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 267FE3C0078; Wed, 13 Mar 2019 03:56:59 +0100 (CET) Date: Wed, 13 Mar 2019 03:56:58 +0100 (CET) From: Vittorio Bertola To: Christian Huitema Cc: dns-privacy@ietf.org, doh@ietf.org, dnsop@ietf.org Message-ID: <807193999.19916.1552445819087@appsuite.open-xchange.com> In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 02:57:09 -0000 > Il 12 marzo 2019 alle 19.56 Christian Huitema ha scritto: > > You are saying that whoever happens to control part of the network path > is entitled to override the user choices and impose their own. Really? > As Stephane wrote, that may be legit in some circumstances, but much > more questionable in others, such as a hotel Wi-Fi attempting to decide > what sites I could or could not access. The reaction I got from some policy people when I mentioned this kind of arguments going on here is "when did the IETF get the mandate to decide for everyone that content filtering by intermediaries is always bad? This is matter for competition / telco / human rights legislation, and will vary country by country." To quote what you wrote in another message: > There is a lot of difference between what can be imposed in a > police state and what looks legitimate in a user agreement in a > free country. And I sure hope that we maintain that difference. A > good result of that discussion would be to clarify these > differences. Do you really think that this is the IETF's job? Deciding "what looks legitimate in a user agreement in a free country" (and presumably, also what tells "a police state" from "a free country") and enforcing such decision via technical measures? Ciao, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Mar 12 20:01:39 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 095D012705F for ; Tue, 12 Mar 2019 20:01:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ih20hDGuloCT for ; Tue, 12 Mar 2019 20:01:34 -0700 (PDT) Received: from mail-it1-x12d.google.com (mail-it1-x12d.google.com [IPv6:2607:f8b0:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB56812DF71 for ; Tue, 12 Mar 2019 20:01:33 -0700 (PDT) Received: by mail-it1-x12d.google.com with SMTP id m137so565242ita.0 for ; Tue, 12 Mar 2019 20:01:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=PGWHMj19m/q97PLz87G24G01FEM3IGbwUF2F4ZyBVkQ=; b=Uo0VfLVFNcBLcKltRBk4VCVlOm1G9gDe9ch4nfpeL7IPjgtNnl9LmdeAy3jWCtq8vD Go3iwo358VqiTl5C6L7cyQGGNF6svDKARCl+XaduPFWYFGhWsz/Gz1fMj1qXQrtsJCuN 4LBToj8U/HEQ4jT57I4LGz6lc/l6E0MICIqkRkzYAbWhjnC8vZCkimtGYl/5PHS6rINV rqLrZU+hLQFQ8pP5NNcatFRK4qaezKyHnz9I2pKFYmPkF3LzdVFNCuMY9KGAYp+V3BT+ Itpz74z3Mzjs2uRVjhepnU1jlk8bR+kBIVl0VTmlHgUmyhB3Y4FK77cXwPCOXMcQtdgF Oegw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=PGWHMj19m/q97PLz87G24G01FEM3IGbwUF2F4ZyBVkQ=; b=WDHGeh64Bwqcu7u8vXDwQKz3670ZbvjB8WwGONbXWfZnGDBqSWjWyeO/YDAxT1YWvR rkyL1cuPE98ILF5hCn4xEzCeMkf83NVZEkV/Q20+TCA6HVoD0vUGe9swd+9a2uRNGVgt 0smqNnRSVs7rQHZdnKcfvbXI5nRrMmj+NjF80LP2vmKjbZqmr+/ETLFJ4KnkV93QV/Kr 15XgXm62+DbIzm+ccOnY4Mva8KVA3pYvvcc088BdjpU2qQPvQz+DEAFLQEDQnKbloR6x gIQHghL2ZXXDqcUYNIPZb1OyvRuPh3tqIJMstZtG2wyhgCJOfKJBn/2H+AP8xhvMy/s5 bilA== X-Gm-Message-State: APjAAAVO6MVSyYOr2t9HBRssmtwx5TLFUq35T4Wou6qaISGYKyE2hyzF LcuyflQnadjDedRcRjHp9VVMQvNbrwDuLGJP4FtBAw== X-Google-Smtp-Source: APXvYqxDptKRt/MtA/U356feNzvR5+6x2DJVIBE6H+W2+X5f5MwYi9aIzNjqmHGU0Yl1UXHjudNa/S8vz4m+Hy9vMnU= X-Received: by 2002:a24:4755:: with SMTP id t82mr566947itb.96.1552446093028; Tue, 12 Mar 2019 20:01:33 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: nalini elkins Date: Wed, 13 Mar 2019 08:31:24 +0530 Message-ID: To: Kenji Baheux Cc: doh@ietf.org, "Ackermann, Michael" Content-Type: multipart/alternative; boundary="000000000000e885d60583f10589" Archived-At: Subject: Re: [Doh] Concerns around deployment of DNS over HTTPS (DoH) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 03:01:37 -0000 --000000000000e885d60583f10589 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable *Kenji,* Thank you for your note. I am happy to see the following: *>*Don't surprise our users, e.g. don't silently force a different provider= . >Continue to support admins for Education and Enterprise use cases, and parents for family use cases, e.g. prevent students/employees/kids from accessing > unsafe/inappropriate websites But, I am not sure I understand: >We believe that starting with an automatic upgrade approach should address a lot of the concerns expressed in the various drafts, because it gives a chance to existing players to play > an active role in providing stronger privacy and security to end-users. What would be the nature of the "automatic upgrade"? That is, if there is no "group policy" defined by an enterprise, what might be the default? Would we get an alert / notification? You may not have completely defined this, which I can understand. Thank you again for sharing your plans. Thanks, Nalini On Wed, Mar 13, 2019 at 8:03 AM Kenji Baheux wrote: > *(Sincere apologies about the multi-posting but the discussion seems to b= e > happening in different places...)* > > > Hi, > > I'm involved with Chrome's DoH efforts. > > I've noticed a few drafts listing concerns about certain types of > deployment for DoH. It appears that the key concerns are based on > assumptions about various browsers' plans. So, to address > misunderstandings, I'd like to share some background, and the high level > principles that guide our work on DoH in Chrome. > > Our motivations in pursuing DoH in Chrome is to offer our users a better > user experience: > > - > > Stronger privacy and security. > - > > Hopefully, some performance wins. > > > Principles and illustrative* examples: > > 1. > > Provide our users with meaningful choice and control, e.g. allow > end-users/admins to control and configure the feature, whether they wa= nt to > use a custom DoH server, or just keep on using their regular DNS. > 2. > > Don't surprise our users, e.g. don't silently force a different > provider. > 3. > > Continue to support admins for Education and Enterprise use cases, and > parents for family use cases, e.g. prevent students/employees/kids > from accessing unsafe/inappropriate websites. > > *: not necessarily our actual concrete plans (still WIP for the most part= , > subject to change due to unforeseen implementation hurdles, or informed b= y > feedback and discussion, etc.), only shared as a comprehension aid. > > > Tentative plans: > > - > > We are considering a first milestone where Chrome would do an > automatic upgrade to DoH when a user=E2=80=99s existing resolver is ca= pable of it. > - > > There are some unanswered questions about how we will be doing that > discovery, and would welcome input from the community. Perhaps, a good > topic for IETF 104. > - > > For Education and Enterprise use cases, we believe that a group policy > to disable and/or configure the feature will be enough. > - > > For family use cases, we believe that allowing users to keep using > their existing solution or opting into a DoH compatible solution (if > available) will be enough. > - > > There are no plans to force any specific resolver without user consent > / opt-in (see principle #2) > > We believe that starting with an automatic upgrade approach should addres= s > a lot of the concerns expressed in the various drafts, because it gives a > chance to existing players to play an active role in providing stronger > privacy and security to end-users. > > PS: I won't be able to join IETF 104 to discuss this face to face, but I > will see if someone from our side can represent us. > > > -- > Kenji BAHEUX > Product Manager - Chrome > Google Japan > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --=20 Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --000000000000e885d60583f10589 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Kenji,

Th= ank you for your note.=C2=A0 I am happy to see the following:
>Don't surprise our= users, e.g. don't silently force a different provider.=
>Continue to support admins for Ed= ucation and Enterprise use cases, and parents for family use cases= , e.g. prevent students/employees/kids from accessing
&g= t; unsafe/inappropriate websites

<= span style=3D"font-family:Arial;font-size:9pt;white-space:pre-wrap;font-var= iant-numeric:normal;font-variant-east-asian:normal;vertical-align:baseline"= >But, I am not sure I understand:
>We believe that starting with an automatic upgr= ade approach should address a lot of the concerns expressed in the various = drafts, because it gives a chance to existing players to play > an activ= e role in providing stronger privacy and security to end-users.

What would be the nature of the "autom= atic upgrade"? That is, if there is no "group policy" defin= ed by an enterprise, what might be the default? Would we get an alert / n= otification?

= You may not have comple= tely defined this, which I can understand. Thank you again for sharing you= r plans.

Thanks,
Nalini

On Wed, Mar 13, 2019 at 8:03 AM Kenji Baheux <kenjibaheux= =3D40google.com@dmarc.ietf.o= rg> wrote:

(Sincere apologies about the multi-posti= ng but the discussion seems to be happening in different places...)


<= /span>

Hi,


I'm involved with Chrome's DoH efforts.

= o address misunderstandings, I'= ;d like to share some background, and the high level principles that guide = our work on DoH in Chrome.


Our motivations in pursuing DoH i= n Chrome is to offer our users a better user experience:

  • Stronger privacy an= d security.

  • Hopefully, some performance win= s.


Principles and illustrative* examples:

  1. Provide our user= s with meaningful choice and control, e.g. allow end-users/admins to control and con= figure the feature, whether they want to use a custom DoH server, or just k= eep on using their regular DNS.

  2. Don't surprise our users, e.g. don't silently force a different provi= der.

  3. Continue to support= admins for Education and Enterprise use cases, and parents for family use = cases, e.= g. prevent students/employees/kids from accessing unsafe/inappropriate webs= ites.

*: not necessarily our actual= concrete plans (still WIP for the most part, subject to change due to unfo= reseen implementation hurdles, or informed by feedback and discussion, etc.= ), only shared as a comprehension aid.



Tentative plans:<= /span>

  • W= e are considering a first milestone where Chrome would do an automatic upgr= ade to DoH when a user=E2=80=99s existing resolver is capable of it.=

  • There are some unanswered questions about how we w= ill be doing that discovery, and would welcome input from the community. Pe= rhaps, a good topic for IETF 104.

  • For Educat= ion and Enterprise use cases, we believe that a group policy to disable and= /or configure the feature will be enough.

  • Fo= r family use cases, we believe that allowing users to keep using their exis= ting solution or opting into a DoH compatible solution (if available) will = be enough.

  • There are no plans to force any = specific resolver without user consent / opt-in (see principle #2)

We believe that starting with an automatic upgrade approach sh= ould address a lot of the concerns expressed in the various drafts, because= it gives a chance to existing players to play an active role in providing = stronger privacy and security to end-users.


PS: I won't = be able to join IETF 104 to discuss this face to face, but I will see if so= meone from our side can represent us.



--
Kenji BAHEUX
Produc= t Manager - Chrome
Google Japan
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh


--
Thanks,
Nalini = Elkins
President
Enterprise Data Center Operators

--000000000000e885d60583f10589-- From nobody Tue Mar 12 20:05:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DBAE1277DB; Tue, 12 Mar 2019 20:05:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QZpXNNcldsPs; Tue, 12 Mar 2019 20:05:17 -0700 (PDT) Received: from mail1.oneunified.net (mail1.oneunified.net [63.85.42.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7F0D312705F; Tue, 12 Mar 2019 20:05:17 -0700 (PDT) X-One-Unified-MailScanner-Watermark: 1553051114.94864@SF0/2f51EuEo2gshRMRQUQ X-One-Unified-MailScanner-From: ray@oneunified.net X-One-Unified-MailScanner: Not scanned: postmaster@oneunified.net X-One-Unified-MailScanner-ID: x2D35Ba3015270 X-OneUnified-MailScanner-Information: Please contact the ISP for more information Received: from [10.55.40.139] (h96-45-2-121-eidnet.org.2.45.96.in-addr.arpa [96.45.2.121] (may be forged)) (authenticated bits=0) by mail1.oneunified.net (8.14.4/8.14.4/Debian-4) with ESMTP id x2D35Ba3015270 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NOT); Wed, 13 Mar 2019 03:05:12 GMT To: Ted Hardie , Paul Vixie Cc: DoH WG , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <5456b9d9-844f-f410-3935-2b2d3ae22745@redbarn.org> <3457266.o2ixm6i3xM@linux-9daj> From: Raymond Burkholder Organization: One Unified Net Limited Message-ID: Date: Tue, 12 Mar 2019 21:05:10 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 03:05:19 -0000 On 2019-03-12 1:15 p.m., Ted Hardie wrote: > that's precisely the goal, because very few network operators can > preordain > the users and apps that will connect through their networks. but there are more than just network operators. There are security people at all levels of organizations who are extremely interested and who are empowered to manage/monitor what is happening inside a network. DoH removes much of this power. I'm not sure if that is a 'good thing'. > I do not believe this goal is met by what you describe, since an > application can use a proprietary resolution service in its flows. > Imagine for a moment an application on a smart TV that wants to provide > content from the closest server which contains that content.  It can use > a redirect from the original server when a new, closer server comes > online (or when a different server has that content), and it can provide > the mapping between that server and one or more addresses for that > server with the redirect, in whatever format its individual cache can > store.  All of this can take place within its confidential channel, > using whatever proprietary format they find convenient.  In that case, > the local network will see new flows to the new servers without having > observed the resolution event.  Blocking destinations for which you have > seen no resolution events will work for a subset of these cases, but it > won't work when the resolution points to a common CDN destination.  That > approach will, of course, also have a wide variety of failure modes when > the resolution event data is incomplete for timing or other reasons; it > will also block all of the flows which MUD would handle. I think that is to be expected: when a network operator (enterprise, home, organization) is dynamically adjusting ip based rule-sets based upon what meta-data can be derived from flow inspection. If a proprietary resolution service is used, then it is expected that 'by default blocks' will be performed if the traffic protection engine is not appraised of change. If DoH is implemented, then traffic, whether it be lookup, or otherwise, in a 'default drop' scenario is just going to have to be, well, 'default dropped'. Brute force I guess is the protection mechanism. So, I think, then, this begs the question, how can the needs/desires of those in charge of security be balanced with the needs/desires of those who desiring to bypass inspection? I guess the maxim 'my network, my rules' holds. But what DoH will cause is an even increasing tightening of network rules. With current passive DNS pass-through, DNSEC and such can remain unmolested, but at least follow-on flows can be identified for forensic or security or policy purposes. With DoH, this correlation can not be performed, and thus, by default, a user's ability will be more restricted in order to prevent unknown unknowns from happening. The only way around this, for a security operator's perspective, will be certificate insertion so that proxying can be performed. And we are back to what we currently have anyway. Would a compromise be that, if someone requires personal security, the standard fall back would be to use a VPN? > > to the extent > that monitoring ('dnstap') and controlling (DNS RPZ) dns lookups by > connected > users and apps is considered a vital local security policy, attempts > at such > "pass through" must be made to fail. > > > Those are security mechanisms, rather than policy, and it may be worth > teasing apart what the actual desired security policy is.  You may find > that it is more easily implemented at the routing layer than the > resolution system in the light of proprietary resolution systems and DoH. You've mentioned that 'security' is separate from 'policy' and then mention 'security policy'. And I implicitly agree with the latter, security and policy go hand in hand, and are difficult to separate. Handling at the routing layer is not possible. Handling at the interrogation/interception/transparent-evaluation intelligence layers is where it begins. This information then feeds the interior/perimeter protection layers. The policies implement the security. If the interrogation/interception/transparent-evaluation layers are unable to identify key interactions, then security is unable to be performed. Raymond From nobody Tue Mar 12 20:11:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DD5312788C; Tue, 12 Mar 2019 20:11:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fF2NNrjzZveP; Tue, 12 Mar 2019 20:11:33 -0700 (PDT) Received: from mail1.oneunified.net (mail1.oneunified.net [63.85.42.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5BD981277DB; Tue, 12 Mar 2019 20:11:33 -0700 (PDT) X-One-Unified-MailScanner-Watermark: 1553051487.829@re6lKkH95ufVYuTn2mmLUQ X-One-Unified-MailScanner-From: ray@oneunified.net X-One-Unified-MailScanner: Not scanned: postmaster@oneunified.net X-One-Unified-MailScanner-ID: x2D3BPRL015322 X-OneUnified-MailScanner-Information: Please contact the ISP for more information Received: from [10.55.40.139] (h96-45-2-121-eidnet.org.2.45.96.in-addr.arpa [96.45.2.121] (may be forged)) (authenticated bits=0) by mail1.oneunified.net (8.14.4/8.14.4/Debian-4) with ESMTP id x2D3BPRL015322 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NOT); Wed, 13 Mar 2019 03:11:27 GMT To: Paul Vixie , Christian Huitema Cc: dnsop@ietf.org, "doh@ietf.org" , "dns-privacy@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <1709670.IeiIJmgblr@linux-9daj> <5342244.Q90AZAhhXk@linux-9daj> From: Raymond Burkholder Organization: One Unified Net Limited Message-ID: <3846722d-ef8a-074c-ff08-f9e9c19e0939@oneunified.net> Date: Tue, 12 Mar 2019 21:11:25 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <5342244.Q90AZAhhXk@linux-9daj> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 03:11:35 -0000 On 2019-03-12 2:51 p.m., Paul Vixie wrote: > ... development of protocols whose ideal state is "interoperability" > and never more or less. slightly out of context, but I find the 'interoperability' context as an underlying definition worthy of support. From nobody Tue Mar 12 20:20:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC3E112788C; Tue, 12 Mar 2019 20:20:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V-PlrZu5DuAT; Tue, 12 Mar 2019 20:20:30 -0700 (PDT) Received: from mail1.oneunified.net (mail1.oneunified.net [63.85.42.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5997112705F; Tue, 12 Mar 2019 20:20:30 -0700 (PDT) X-One-Unified-MailScanner-Watermark: 1553052027.76065@ME98ZMqiOvwR1z6WPnYVqg X-One-Unified-MailScanner-From: ray@oneunified.net X-One-Unified-MailScanner: Not scanned: postmaster@oneunified.net X-One-Unified-MailScanner-ID: x2D3KMsH015420 X-OneUnified-MailScanner-Information: Please contact the ISP for more information Received: from [10.55.40.139] (h96-45-2-121-eidnet.org.2.45.96.in-addr.arpa [96.45.2.121] (may be forged)) (authenticated bits=0) by mail1.oneunified.net (8.14.4/8.14.4/Debian-4) with ESMTP id x2D3KMsH015420 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NOT); Wed, 13 Mar 2019 03:20:23 GMT To: Ted Hardie , Paul Vixie Cc: dnsop , DoH WG References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> From: Raymond Burkholder Organization: One Unified Net Limited Message-ID: <2d8170de-2649-b274-aedd-b74bc62426df@oneunified.net> Date: Tue, 12 Mar 2019 21:20:22 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 03:20:34 -0000 On 2019-03-12 2:52 p.m., Ted Hardie wrote: > the feasibility of this migration.  We also acknowledge that many > network operations activities today, from traffic management and > intrusion detection to spam prevention and policy enforcement, assume > access to cleartext payload.  For many of these activities there are no > solutions yet, but the IAB will work with those affected to foster > development of new approaches for these activities which allow us to > move to an Internet where traffic is confidential by default. So... would someone be able to identify some of the 'new approaches' which help security practitioners ply their trade? If these approaches were identified, then perhaps there would be less resistance to maintaining access to the cleartext flows we use to maintain security state. > by default.  You have been working around that, rather than developing > new practices.  I invite you instead to consider how you can accomplish > what you need to in an Internet where all traffic is confidential. Can some of these new practices be part of the protocol development process? > Enterprises are currently doing that via managed software and > environments, and that approach seems to be well in-line with your > practices below.  Using resolution systems for this will not accomplish Where can I read up on some of these practices? > what you need now, nor will it do so going forward; it is time for a > different approach, rather than seeking to return to cleartext. > > The situation that moved this community to that stance was well-laid out > in IETF 88.  We must acknowledge that not all devices which are on-path > are controlled by entities known to the user or network operator and not > all of them are acting in the interests of those parties.  Protecting > against that threat requires us to change our ways.  Please help, rather > than working around the effort. From nobody Tue Mar 12 20:39:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FF65127970 for ; Tue, 12 Mar 2019 20:39:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tq7JRMFtYy6S for ; Tue, 12 Mar 2019 20:39:48 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB92112788C for ; Tue, 12 Mar 2019 20:39:48 -0700 (PDT) Received: from xsmtp31.mail2web.com ([168.144.250.234] helo=xsmtp11.mail2web.com) by mx37.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3uk6-0007L9-N1 for doh@ietf.org; Wed, 13 Mar 2019 04:39:47 +0100 Received: from [10.5.2.16] (helo=xmail06.myhosting.com) by xsmtp11.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3uk4-0008Kn-Oc for doh@ietf.org; Tue, 12 Mar 2019 23:39:45 -0400 Received: (qmail 13328 invoked from network); 13 Mar 2019 03:39:43 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail06.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 13 Mar 2019 03:39:43 -0000 To: Vittorio Bertola Cc: dns-privacy@ietf.org, doh@ietf.org, dnsop@ietf.org References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> Date: Tue, 12 Mar 2019 20:39:42 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <807193999.19916.1552445819087@appsuite.open-xchange.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US X-Originating-IP: 168.144.250.234 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.18) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5nhhtHPDMpxc2YLAr0vhfKJ602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxHFAv2RJrlzr7n27y9mKHtUh5 mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2sYjO05mTPID+/6Aj9ZzRI/vRa7MR4hgRIg8N 1QlY4G7x1YBTEs55LirRLgpsvCFt8i77Wu2Jb/TI0CxS53moc/SlgXpNwUDmiieE9G+9VqfZ1kay mqFCHRp6u+mIhIXg5jssJAnfERZ2C5vj1sOdsnQOD0r6/AaHZiEtdTMtMljoSvSqrGwueTSCQFid cy15jQ4HwbF4aWaRl0axA525ouWBOXp8nHKe0R+FkIqN7hkgzj0zEmu34GPXR572RNl5VgW9/bkt U41htiJ8fk7NkHmplbyYh4+w03es32OzjfSo5Jhwk+hMTKYppuA2BaWeipTPWMHGUquOFNpW9R6n Md9TLrF9l3ItGfA/WrnALV5BhFjwanMsx4Rx/4gso194hPg+bPVScl7pKoYc6HuoJiTtEj+bvnho NdnsZyyO4yE69TdE5SQ4dxJir0Y8rHr0CnFV4ppbCSIV+5MQOIhZD0YsNwSrwzPbXZMD1WP1LXFD lJBVkCSQ2iLcAY5Y0XJtqwPiG77RlB1oqlzsN7KI5Od/gB/NihMPulp0+atPY7ir2Sqw9KBaAUuM ZylbRx9Eiw3ZdHQ3+5Ez2N2wnzZ1IVZJ2M+zEpkFF0ivqIXa3VYUjH7OdA4AxqY9XSPDZhXTawLW W3GG8MACLK1/XOkZcwxWFSzsWt2uE/YFyU00jIgFmOuE2myvw52ju4vOqkVF7R9lLUJTOMC9AqYW 1lRNjkWXJryJ9+EiOvBe6vFbUGRrwytzyq4nhu0+m3/YUu4UI2GoiS4jWHSkvyyyS8KErWmYf+RR A94if7oLzRs73BRh3+MrOOK4NgfP/RZivWtTzbcnsscMdnMYECIJ64duuA== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 03:39:50 -0000 On 3/12/2019 7:56 PM, Vittorio Bertola wrote: > The reaction I got from some policy people when I mentioned this kind of arguments going on here is "when did the IETF get the mandate to decide for everyone that content filtering by intermediaries is always bad? This is matter for competition / telco / human rights legislation, and will vary country by country." The mirror image of that statement is, "when did intermediaries get a mandate to filter content?" The internet architecture assumes full connectivity. At some point, people deployed middle-boxes and filtered content because they could. They did not exactly try to get a mandate, or obtain consensus that this was proper. Technologies like DoH force the discussion in the open. Why do you think you can filter content? Who made you king? -- Christian Huitema From nobody Tue Mar 12 21:25:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCD8B12D827; Tue, 12 Mar 2019 21:25:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dAZk44rW0dlG; Tue, 12 Mar 2019 21:25:27 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0462C12D826; Tue, 12 Mar 2019 21:25:26 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id B44736A25A; Wed, 13 Mar 2019 05:25:24 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552451124; bh=abPHCHKcxGL3eqZ0eyWVc6b8xF78lGyYoyNsdMJapHc=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=Hbu0MsGQbaQ2E+gMB5rGhYt85f9zjrJ0hBHYc/EYpB6hN3FOlSP9nnU448XtjQgBL w5fIt56qsw2m9JXIYWEVvjRxJAT3UMvm+63j8IlF0VfYz1IyLCiAocgsO0k+Vh1C0L eHYjAi9l5wSKq8gHPfpldbxeHlsFvn+iSjtwjUaYm5fZeK+50/H/khK/JsXLkBmwqm HbT8otSkxKck/sRPVmxDCli6309DyncABd+7xM6fGH6y2rzODZNGsoOSk/siq4Azpw YWSqamNSdSfYa0mxlgqSNJ4Meesqw0oeYfDcp+sn7+mNB+P6mGfe+thXYArNv8ewvu 6InD1tm+sTnkw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id A7C113C0078; Wed, 13 Mar 2019 05:25:24 +0100 (CET) Date: Wed, 13 Mar 2019 05:25:24 +0100 (CET) From: Vittorio Bertola To: Christian Huitema Cc: dns-privacy@ietf.org, doh@ietf.org, dnsop@ietf.org Message-ID: <1999852265.19964.1552451124634@appsuite.open-xchange.com> In-Reply-To: <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 04:25:29 -0000 > Il 13 marzo 2019 alle 4.39 Christian Huitema ha scritto: > > On 3/12/2019 7:56 PM, Vittorio Bertola wrote: > > The reaction I got from some policy people when I mentioned this kind of arguments going on here is "when did the IETF get the mandate to decide for everyone that content filtering by intermediaries is always bad? This is matter for competition / telco / human rights legislation, and will vary country by country." > > The mirror image of that statement is, "when did intermediaries get a > mandate to filter content?" When a regularly elected government, having sovereignty over them and their users, told them that they can / should / must do it. Note that I don't particularly like this practice (I'm currently busy in the battle against Article 13 in the EU), I'm just trying to sort out everyone's role in this discussion. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Tue Mar 12 21:27:24 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 177C312D826 for ; Tue, 12 Mar 2019 21:27:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DsdgSydcOkpV for ; Tue, 12 Mar 2019 21:27:20 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94816129441 for ; Tue, 12 Mar 2019 21:27:20 -0700 (PDT) Received: from xsmtp02.mail2web.com ([168.144.250.215]) by mx65.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3u6q-0005dd-0Z for doh@ietf.org; Wed, 13 Mar 2019 03:59:23 +0100 Received: from [10.5.2.12] (helo=xmail02.myhosting.com) by xsmtp02.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3u6m-0002lu-Ta for doh@ietf.org; Tue, 12 Mar 2019 22:59:09 -0400 Received: (qmail 25282 invoked from network); 13 Mar 2019 02:59:07 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail02.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 13 Mar 2019 02:59:07 -0000 To: Paul Vixie , dnsop@ietf.org Cc: "dns-privacy@ietf.org" , "doh@ietf.org" , Stephen Farrell References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <5342244.Q90AZAhhXk@linux-9daj> <2356055.DoC3vY7yXE@linux-9daj> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <891d320e-f05e-f926-f74a-7c09c6ed553a@huitema.net> Date: Tue, 12 Mar 2019 19:59:07 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <2356055.DoC3vY7yXE@linux-9daj> Content-Type: multipart/alternative; boundary="------------D2C8F41144BBE5C5A8945A43" Content-Language: en-US X-Originating-IP: 168.144.250.215 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.11) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5uRqdFX5XL9mitCR6UW/F9h602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6Bx0SHlMLRget0LJWq5s2PCckh5 mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2cFBJ33PyTEulbj2AjstEIPvRa7MR4hgRIg8N 1QlY4G7x1YBTEs55LirRLgpsvCFt8i77Wu2Jb/TI0CxS53moc/SlgXpNwUDmiieE9G+9VqfZ1kay mqFCHRp6u+mIhIXg5jssJAnfERZ2C5vj1sOdsnQOD0r6/AaHZiEtdTMtMljoSvSqrGwueTSCQFid cy15jQ4HwbF4aWaRl0axA525ouWBOXp8nHKe0R+FkIqN7hkgzj0zEmu34GPXR572RNl5VgW9/bkt U41htiJ8fk7NkHmplbyYh4+w03es32OzjfSo5Jhwk+hMTKYppuA2BaWeipTPWMHGUquOFNpW9R6n Md9TLrF9l3ItGfA/WrnALV71dGJ7HPnOCWRaxVuHANylPwUimsNGvJJilSn4u6QSZEkDitK+KIxa w1mXy0kC8P0s95DGoDQyh90npG6wuAU16Y3oZJdQ0WXQEIKhyt8GANo5bn0tFTz4SVUdCy2MVE6+ P+NMWgh0hdHFCOgNkMJ392PNDpgLsd6Ddd/s7VM53mcGFxy0M5Q2RXlX/+X6wmXAMgFPp7+h3kLe NmBV53UGhAjOLDU6naDKefjpd4sNuaU6hEqPEeY0Xb+wIhhLsX9RXxKF5tPxTxfD0dMN+t5ZP6zO upSxHMPsAHfGhZAC/HMCgMVStxCO22NkyuIHHH77G3ch6MdB0XuALpEgtIRS6Y2WR4MiVFjj8UQT P/XooN40eTXlWiUAYdLmsJdAoPJHNvQfAjIDptXbNSradnS0Zqm0mOdPl1LeUTNmkYtBTuxv0/1e /nzlq13wYTxncOSJHdsd+cwIgRT6euCWiMrA+4FHNKsiy9wMVtQ6ai8zTQ== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 04:27:22 -0000 This is a multi-part message in MIME format. --------------D2C8F41144BBE5C5A8945A43 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit On 3/12/2019 2:11 PM, Paul Vixie wrote: >> I don't see why, based on your argument, your concerns >> trump his. >> >> Can you explain? > he's trying to achieve a political aim using technology. that is not the > purpose for which the internet engineering task force, or the internet itself, > was convened. it is not why our employers pay our travel costs. and it is not > why the rest of the world trusts our outputs. Sorry, but no. I am vying for network transparency, and I believe that if filtering is to be enforced, it should be controlled by the user. You are claiming that safety mandates giving the network operator full control over name resolution. Both of these positions come from specific visions about how the network should work. Neither is more a political goal than the other. -- Christian Huitema --------------D2C8F41144BBE5C5A8945A43 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit


On 3/12/2019 2:11 PM, Paul Vixie wrote:
I don't see why, based on your argument, your concerns
trump his.

Can you explain?

he's trying to achieve a political aim using technology. that is not the 
purpose for which the internet engineering task force, or the internet itself, 
was convened. it is not why our employers pay our travel costs. and it is not 
why the rest of the world trusts our outputs.

Sorry, but no. I am vying for network transparency, and I believe that if filtering is to be enforced, it should be controlled by the user. You are claiming that safety mandates giving the network operator full control over name resolution. Both of these positions come from specific visions about how the network should work. Neither is more a political goal than the other.

-- Christian Huitema

--------------D2C8F41144BBE5C5A8945A43-- From nobody Tue Mar 12 21:46:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19B6012D826 for ; Tue, 12 Mar 2019 21:46:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iwlctf4f0uk2 for ; Tue, 12 Mar 2019 21:46:13 -0700 (PDT) Received: from mail-lf1-x142.google.com (mail-lf1-x142.google.com [IPv6:2a00:1450:4864:20::142]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EE677127916 for ; Tue, 12 Mar 2019 21:46:12 -0700 (PDT) Received: by mail-lf1-x142.google.com with SMTP id g12so390219lfb.13 for ; Tue, 12 Mar 2019 21:46:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pT/sHcG1P2fC0iPPuRYGn3NrvIyEHEbyVsBCI+JORvU=; b=FcvzVozIg8u2MVmWgm/kSgBmKcXpvbxjEJusJTnLegl91xE7njPvD/rBEk+UAMMVOr NTDNLZ+R76G680Jt+h5RXVrAmrNXO4u/rSX0yuhyJbKBgnkJLhgf42CC8nJJZmeiPk3o hs+/csHmG37UgDV56967WbI0WlQH4OgMDhahvckxGVT4QmmC/6BZFgA0674182lZzJdc FzmoK20NLWULVMsbKA9HyO2xY508kEfYGAZSP7XcK7Vin4+hM5pxbQEQ/4cnMOrNwMFn suKiopitT0YKUPQkxx8EPKMTQgf5Qch/eNbLvcbRuuInrszJjEYIVL47F00FeUlpatxB 6Deg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pT/sHcG1P2fC0iPPuRYGn3NrvIyEHEbyVsBCI+JORvU=; b=dswNIEdVdhlttz474P4SI1zsYQO5w6HxY+C80mFkRrOy8h3saFwEcjIrCkcbBWMglo jt4lp26H3Tuy1/9xOiOkS+ithhYtciYC6JD2Is1bJqUqKjzXXo5/OOZeJssGWCKbtIlL 6J+tGe0SpXCGJIlzSBim6QJljSQE7pbHDcz27IOKn35GV8Aa0G9nIFyUqAxZrKEYNFlD 3ZhsWddB0eeiXDZ0TlSjruZQ13h3Agdr8QaSXGQuUrED+l6LYsa1Qm/X7hNO4sT7dngL PB6rRr4TpLJHkigmfKriSMssszUYHVUG6rua9QCmHTRAi6Z83w8N6h2+XtmELZ/ku+lm j1vw== X-Gm-Message-State: APjAAAVHUmTztYYapK+XuneJUzZb4/r3b/5joTtlsxx72ubomtjkSqTU B/OXCs8evZdE79p445KzlQ8t/mmmKWB8vjGn4ACb7g== X-Google-Smtp-Source: APXvYqxYqSO/jvpSfriYweF9GxU6Di8P7WsCGZHQi04biOTNTDItDR/irotN52usMn5IAQ+7PHgyXdpE7WfEc2VGjXc= X-Received: by 2002:a19:4b14:: with SMTP id y20mr8541728lfa.36.1552452370613; Tue, 12 Mar 2019 21:46:10 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Kenji Baheux Date: Wed, 13 Mar 2019 13:45:58 +0900 Message-ID: To: nalini elkins Cc: doh@ietf.org, "Ackermann, Michael" Content-Type: multipart/alternative; boundary="0000000000001535f50583f27c64" Archived-At: Subject: Re: [Doh] Concerns around deployment of DNS over HTTPS (DoH) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 04:46:23 -0000 --0000000000001535f50583f27c64 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, Mar 13, 2019, 12:01 nalini elkins wrote: > *Kenji,* > > Thank you for your note. I am happy to see the following: > > *>*Don't surprise our users, e.g. don't silently force a different > provider. > >Continue to support admins for Education and Enterprise use cases, and > parents for family use cases, e.g. prevent students/employees/kids from > accessing > > unsafe/inappropriate websites > > But, I am not sure I understand: > >We believe that starting with an automatic upgrade approach should > address a lot of the concerns expressed in the various drafts, because it > gives a chance to existing players to play > an active role in providing > stronger privacy and security to end-users. > > What would be the nature of the "automatic upgrade"? > With the usual "tentative" caveats: To clarify, it would be something like "is this user's existing DNS known to be capable of doing DoH? If yes then use this DNS provider's DoH endpoint otherwise keep doing regular DNS queries ". In other words, the DNS provider is kept as-is, we just try to upgrade to the DoH flavor if it exists. Again, the discovery aspect needs to be explored. That is, if there is no "group policy" defined by an enterprise, what might > be the default? > The default would be the "autoupgrade" explained above. I assume that enterprises with specific needs are using their own DNS or DNS provider by other companies. So, there shouldn't be any surprise. Would we get an alert / notification? > As part of any Chrome releases, we communicate about any changes that might impact Enterprises/Educations. So, no in-product notifications but sufficient comms on our part. > You may not have completely defined this, which I can understand. Thank > you again for sharing your plans. > > Thanks, > Nalini > > On Wed, Mar 13, 2019 at 8:03 AM Kenji Baheux 40google.com@dmarc.ietf.org> wrote: > >> *(Sincere apologies about the multi-posting but the discussion seems to >> be happening in different places...)* >> >> >> Hi, >> >> I'm involved with Chrome's DoH efforts. >> >> I've noticed a few drafts listing concerns about certain types of >> deployment for DoH. It appears that the key concerns are based on >> assumptions about various browsers' plans. So, to address >> misunderstandings, I'd like to share some background, and the high level >> principles that guide our work on DoH in Chrome. >> >> Our motivations in pursuing DoH in Chrome is to offer our users a better >> user experience: >> >> - >> >> Stronger privacy and security. >> - >> >> Hopefully, some performance wins. >> >> >> Principles and illustrative* examples: >> >> 1. >> >> Provide our users with meaningful choice and control, e.g. allow >> end-users/admins to control and configure the feature, whether they w= ant to >> use a custom DoH server, or just keep on using their regular DNS. >> 2. >> >> Don't surprise our users, e.g. don't silently force a different >> provider. >> 3. >> >> Continue to support admins for Education and Enterprise use cases, >> and parents for family use cases, e.g. prevent >> students/employees/kids from accessing unsafe/inappropriate websites. >> >> *: not necessarily our actual concrete plans (still WIP for the most >> part, subject to change due to unforeseen implementation hurdles, or >> informed by feedback and discussion, etc.), only shared as a comprehensi= on >> aid. >> >> >> Tentative plans: >> >> - >> >> We are considering a first milestone where Chrome would do an >> automatic upgrade to DoH when a user=E2=80=99s existing resolver is c= apable of it. >> - >> >> There are some unanswered questions about how we will be doing that >> discovery, and would welcome input from the community. Perhaps, a goo= d >> topic for IETF 104. >> - >> >> For Education and Enterprise use cases, we believe that a group >> policy to disable and/or configure the feature will be enough. >> - >> >> For family use cases, we believe that allowing users to keep using >> their existing solution or opting into a DoH compatible solution (if >> available) will be enough. >> - >> >> There are no plans to force any specific resolver without user >> consent / opt-in (see principle #2) >> >> We believe that starting with an automatic upgrade approach should >> address a lot of the concerns expressed in the various drafts, because i= t >> gives a chance to existing players to play an active role in providing >> stronger privacy and security to end-users. >> >> PS: I won't be able to join IETF 104 to discuss this face to face, but I >> will see if someone from our side can represent us. >> >> >> -- >> Kenji BAHEUX >> Product Manager - Chrome >> Google Japan >> _______________________________________________ >> Doh mailing list >> Doh@ietf.org >> https://www.ietf.org/mailman/listinfo/doh >> > > > -- > Thanks, > Nalini Elkins > President > Enterprise Data Center Operators > www.e-dco.com > > --0000000000001535f50583f27c64 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, Mar 13, 2019, 12:01 nalini elkins <nalini.elkins@e-dco.com> wrote:<= br>
Kenji,

Thank you for your note.=C2=A0 I am h= appy to see the following:

>= Don't surprise our users, e.g. don't sil= ently force a different provider.
>Continue to support admins for Education and Enterprise use cases, a= nd parents for family use cases, e.g. prevent students/employees/k= ids from accessing
> unsafe/inappropriate websites

But, I am not sure I understand:
>We believe that starting with an automatic upgr= ade approach should address a lot of the concerns expressed in the various = drafts, because it gives a chance to existing players to play > an activ= e role in providing stronger privacy and security to end-users.

What would be the nature of the "autom= atic upgrade"?

With the usual "tentative" cave= ats:

To clarify, it woul= d be something like "is this user's existing DNS known to be capab= le of doing DoH? If yes then use this DNS provider's DoH endpoint other= wise keep doing regular DNS queries ".=C2=A0
In other words, the DNS provider is kept as-is, w= e just try to upgrade to the DoH flavor if it exists. Again, the discovery = aspect needs to be explored.



That = is, if there is no "group policy" defined by an enterprise, what = might be the default?

The default would be the "autoup= grade" explained above. I assume that enterprises with specific needs = are using their own DNS or DNS provider by other companies. So, there shoul= dn't be any surprise.=C2=A0

Would we get an alert / notification?
<= /blockquote>

As pa= rt of any Chrome releases, we communicate about any changes that might impa= ct Enterprises/Educations. So, no in-product notifications but sufficient c= omms on our part.



You may not have completel= y defined this, which I can understand. Thank you again for sharing your p= lans.
<= br>

Thanks,
Nalini

On Wed, Mar 13, 2019 at 8:03 AM Kenji Baheux <kenjibaheux= =3D40google.com@dmarc.ietf.org> wrote:

(Sincere apologies about the multi-posting but the discus= sion seems to be happening in different places...)


Hi,


I&#= 39;m involved with Chrome's DoH efforts.


I've notice= d a few drafts listing concerns about certain types of deployment for DoH. = It appears that the key concerns are based on assumptions about various bro= wsers' plans. So, to address misunderstandings, I'd like to share = some background, and the high level principles that guide our work on DoH i= n Chrome.


Our motivations in pursuing DoH in Chrome is to of= fer our users a better user experience:

  • Stronger privacy and security.

  • Hopefully, some performance wins.


Principles and illustrat= ive* examples:

  1. Provide our users with meaningful= choice and control, e.g. allow end-users/admins to control and configure the featur= e, whether they want to use a custom DoH server, or just keep on using thei= r regular DNS.

  2. Don't = surprise our users, e.g. don't silently force a different provider.

  3. Continue to support admins for Educa= tion and Enterprise use cases, and parents for family use cases, e.g. prevent studen= ts/employees/kids from accessing unsafe/inappropriate websites.

    =

*: not necessarily our actual concrete plans (= still WIP for the most part, subject to change due to unforeseen implementa= tion hurdles, or informed by feedback and discussion, etc.), only shared as= a comprehension aid.



Tentative plans:

  • We are considering= a first milestone where Chrome would do an automatic upgrade to DoH when a= user=E2=80=99s existing resolver is capable of it.

  • There are some unanswered questions about how we will be doing tha= t discovery, and would welcome input from the community. Perhaps, a good to= pic for IETF 104.

  • For Education and Enterpri= se use cases, we believe that a group policy to disable and/or configure th= e feature will be enough.

  • <= p dir=3D"ltr" style=3D"line-height:1.8;margin-top:0pt;margin-bottom:0pt">For family use cas= es, we believe that allowing users to keep using their existing solution or= opting into a DoH compatible solution (if available) will be enough.

  • There are no plans to force any specific resolve= r without user consent / opt-in (see principle #2)

We = believe that starting with an automatic upgrade approach should address a l= ot of the concerns expressed in the various drafts, because it gives a chan= ce to existing players to play an active role in providing stronger privacy= and security to end-users.


PS: I won't be able to join = IETF 104 to discuss this face to face, but I will see if someone from our s= ide can represent us.



-= -
Kenji BAHEUX
Product Manager - Chrome
Google Japan
_______________________________________________
Doh mailing list
Doh@ie= tf.org
https://www.ietf.org/mailman/listinfo/doh


--
Thanks,
Nalini Elkins
President<= /div>
Enterprise Data Center Operators
=

--0000000000001535f50583f27c64-- From nobody Tue Mar 12 21:56:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 08B3212D827 for ; Tue, 12 Mar 2019 21:56:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3dYc7z5Y7CKH for ; Tue, 12 Mar 2019 21:56:06 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5F8412AF7D for ; Tue, 12 Mar 2019 21:56:06 -0700 (PDT) Received: from xsmtp01.mail2web.com ([168.144.250.230]) by mx63.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h3vek-0008Ja-Ms for doh@ietf.org; Wed, 13 Mar 2019 05:38:19 +0100 Received: from [10.5.2.14] (helo=xmail04.myhosting.com) by xsmtp01.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h3ved-0006px-B7 for doh@ietf.org; Wed, 13 Mar 2019 00:38:14 -0400 Received: (qmail 22970 invoked from network); 13 Mar 2019 04:38:07 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail04.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 13 Mar 2019 04:38:06 -0000 To: Vittorio Bertola Cc: dns-privacy@ietf.org, doh@ietf.org, dnsop@ietf.org References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> <1999852265.19964.1552451124634@appsuite.open-xchange.com> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <6e86ba02-c548-a391-c468-ac96a90d5c2d@huitema.net> Date: Tue, 12 Mar 2019 21:38:06 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <1999852265.19964.1552451124634@appsuite.open-xchange.com> Content-Type: multipart/alternative; boundary="------------F13791C1BECF2EF919897773" Content-Language: en-US X-Originating-IP: 168.144.250.230 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.27) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5tRcseoT0EQpIN8mBNOod9h602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxPEpY4Hlgka6PKh/CshvUFUh5 mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2yeUS6ilZ72myviihm1aaOPvRa7MR4hgRIg8N 1QlY4G7x1YBTEs55LirRLgpsvCFt8i77Wu2Jb/TI0CxS53moc/SlgXpNwUDmiieE9G+9VqfZ1kay mqFCHRp6u+mIhIXg5jssJAnfERZ2C5vj1sOdsnQOD0r6/AaHZiEtdTMtMljoSvSqrGwueTSCQFid cy15jQ4HwbF4aWaRl0axA525ouWBOXp8nHKe0R+FkIqN7hkgzj0zEmu34GPXR572RNl5VgW9/bkt U41htiJ8fk7NkHmplbyYh4+w03es32OzjfSo5Jhwk+hMTKYppuA2BaWeipTPWMHGUquOFNpW9R6n Md9TLrF9l3ItGfA/WrnALV6Um6URtV0G+vIgHIS/B0/Kjs6fUmxRcqAfCeADTbVL+K78vlX/OiDX hnXLKGl5POY69TdE5SQ4dxJir0Y8rHr0CnFV4ppbCSIV+5MQOIhZD0YsNwSrwzPbXZMD1WP1LXFD lJBVkCSQ2iLcAY5Y0XJtqwPiG77RlB1oqlzsN7KI5Biyp9ZnkUf43DmQkwMxjMGr2Sqw9KBaAUuM ZylbRx9Er1fy92LlUvGUTf72MrAetvnYb+pM14aYkGA2mgaZ33IUjH7OdA4AxqY9XSPDZhXT6M47 7mTTjrCp/RIS63OqgwxWFSzsWt2uE/YFyU00jIjWwjb685UoihdX5h7TT7vp7R9lLUJTOMC9AqYW 1lRNjkWXJryJ9+EiOvBe6vFbUGRrwytzyq4nhu0+m3/YUu4UI2GoiS4jWHSkvyyyS8KErWmYf+RR A94if7oLzRs73BRh3+MrOOK4NgfP/RZivWtTzbcnsscMdnMYECIJ64duuA== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 04:56:08 -0000 This is a multi-part message in MIME format. --------------F13791C1BECF2EF919897773 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit On 3/12/2019 9:25 PM, Vittorio Bertola wrote: >> Il 13 marzo 2019 alle 4.39 Christian Huitema ha scritto: >> >> On 3/12/2019 7:56 PM, Vittorio Bertola wrote: >>> The reaction I got from some policy people when I mentioned this kind of arguments going on here is "when did the IETF get the mandate to decide for everyone that content filtering by intermediaries is always bad? This is matter for competition / telco / human rights legislation, and will vary country by country." >> The mirror image of that statement is, "when did intermediaries get a >> mandate to filter content?" > When a regularly elected government, having sovereignty over them and their users, told them that they can / should / must do it. > > Note that I don't particularly like this practice (I'm currently busy in the battle against Article 13 in the EU), I'm just trying to sort out everyone's role in this discussion. The legal mandate is really a best effort mandate, as in "if you provide name resolution, you should not resolve name X, Y and Z". It is a constraint on the way a service provider provides a specific service. It is not a grant of monopoly, that only the connectivity provider should provide name resolution. It could perhaps be interpreted to say that DoH providers, subject to the same laws as ISP, should perform the same filtering. But that's a different question. -- Christian Huitema --------------F13791C1BECF2EF919897773 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit


On 3/12/2019 9:25 PM, Vittorio Bertola wrote:
Il 13 marzo 2019 alle 4.39 Christian Huitema <huitema@huitema.net> ha scritto:

On 3/12/2019 7:56 PM, Vittorio Bertola wrote:

The reaction I got from some policy people when I mentioned this kind of arguments going on here is "when did the IETF get the mandate to decide for everyone that content filtering by intermediaries is always bad? This is matter for competition / telco / human rights legislation, and will vary country by country."

The mirror image of that statement is, "when did intermediaries get a
mandate to filter content?"

When a regularly elected government, having sovereignty over them and their users, told them that they can / should / must do it.

Note that I don't particularly like this practice (I'm currently busy in the battle against Article 13 in the EU), I'm just trying to sort out everyone's role in this discussion.

The legal mandate is really a best effort mandate, as in "if you provide name resolution, you should not resolve name X, Y and Z". It is a constraint on the way a service provider provides a specific service. It is not a grant of monopoly, that only the connectivity provider should provide name resolution. It could perhaps be interpreted to say that DoH providers, subject to the same laws as ISP, should perform the same filtering. But that's a different question.

-- Christian Huitema

--------------F13791C1BECF2EF919897773-- From nobody Tue Mar 12 22:04:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 051DB130DE3; Tue, 12 Mar 2019 22:04:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uZddekRXptaw; Tue, 12 Mar 2019 22:04:23 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E1EE130DC9; Tue, 12 Mar 2019 22:04:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6642; q=dns/txt; s=iport; t=1552453462; x=1553663062; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=Y21T41ED/1s9TGHrDFbm0pRGqn1V4ytDkgmG28XAZSs=; b=HuGBLgipm6O0Zi5ZqOj7nzO3WNuu/CvhLuxZFgkQHtUSA9nnOSAXxUmw YN5fUSgXoAVzjC85fOo+nOE5ktzyDwPIp3fOF1iUy59olrNxYeRGEc7Kg qpYZ8o6crXX3WEiS5QQTsHQzpd4II1afAMotuzA0iT/ow3tSd2rQ8CEcC k=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AHAAAQj4hc/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUwIBAQEBAQsBgndxEieECoh5jGaSNoV1gXsIAwEBGAE?= =?us-ascii?q?KhEkChFs2Bw0BAQMBAQkBAwJtHAyFSgEBAQMBAQEhSwYFBQsLGCoCAicwBhO?= =?us-ascii?q?DIgGBbQgPr06BLx+FJoRjCgWBLwGBSIl7gX+BOB+CTIMeAQGEazGCJgOMJoR?= =?us-ascii?q?RTJJuCYRbjjoZkz6aYoJuAgQGBQIVgU4CL4FWMxoIGxU7KgGCQT6BU4h7hUA?= =?us-ascii?q?+AzCRQwEB?= X-IronPort-AV: E=Sophos;i="5.58,473,1544486400"; d="asc'?scan'208,217";a="10707558" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 13 Mar 2019 05:04:19 +0000 Received: from ams3-vpn-dhcp7163.cisco.com (ams3-vpn-dhcp7163.cisco.com [10.61.91.250]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2D54I3b027990 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Wed, 13 Mar 2019 05:04:19 GMT From: Eliot Lear Message-Id: <0675B05A-54DE-4C07-A014-F8D4C272575E@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_838E1E39-B8CF-4C4F-B893-6B856C6106FB"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Wed, 13 Mar 2019 06:04:17 +0100 In-Reply-To: <891d320e-f05e-f926-f74a-7c09c6ed553a@huitema.net> Cc: Paul Vixie , dnsop , "dns-privacy@ietf.org" , "doh@ietf.org" , Stephen Farrell To: Christian Huitema References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <5342244.Q90AZAhhXk@linux-9daj> <2356055.DoC3vY7yXE@linux-9daj> <891d320e-f05e-f926-f74a-7c09c6ed553a@huitema.net> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.91.250, ams3-vpn-dhcp7163.cisco.com X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 05:04:25 -0000 --Apple-Mail=_838E1E39-B8CF-4C4F-B893-6B856C6106FB Content-Type: multipart/alternative; boundary="Apple-Mail=_AFB77940-92CB-4BA6-9DC7-271F1DAE1A34" --Apple-Mail=_AFB77940-92CB-4BA6-9DC7-271F1DAE1A34 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Gentlemen, This conversation has gone to the zoo. What is or is not political = doesn=E2=80=99t matter at this stage in the game, and neither is arguing = over rights over bits. If people want to do that I suggest doing so in = the HRPC WG and with a draft in hand. Flaming back and forth without an = objective of actually modifying text or developing a work proposal is = quite pointless. What is important is to document the technical ramifications of the = changes brought about by DoH. To move things forward, can we simply go = through the drafts in the side meeting, and indicate what administrators = might do about any perceived negative effects? Whether those effects = seem negative to you only matters if there is a proposal for the IETF to = take on new work to =E2=80=9Ccorrect=E2=80=9D them. Eliot > On 13 Mar 2019, at 03:59, Christian Huitema = wrote: >=20 >=20 >=20 > On 3/12/2019 2:11 PM, Paul Vixie wrote: >>> I don't see why, based on your argument, your concerns >>> trump his. >>>=20 >>> Can you explain? >> he's trying to achieve a political aim using technology. that is not = the >> purpose for which the internet engineering task force, or the = internet itself, >> was convened. it is not why our employers pay our travel costs. and = it is not >> why the rest of the world trusts our outputs. >=20 > Sorry, but no. I am vying for network transparency, and I believe that = if filtering is to be enforced, it should be controlled by the user. You = are claiming that safety mandates giving the network operator full = control over name resolution. Both of these positions come from specific = visions about how the network should work. Neither is more a political = goal than the other. >=20 > -- Christian Huitema >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh --Apple-Mail=_AFB77940-92CB-4BA6-9DC7-271F1DAE1A34 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Gentlemen,

This conversation has gone to the zoo.  What is or is = not political doesn=E2=80=99t matter at this stage in the game, and = neither is arguing over rights over bits.  If people want to do = that I suggest doing so in the HRPC WG and with a draft in hand. =  Flaming back and forth without an objective of actually modifying = text or developing a work proposal is quite pointless.

What is important is to = document the technical ramifications of the changes brought about by = DoH.  To move things forward, can we simply go through the drafts = in the side meeting, and indicate what administrators might do about any = perceived negative effects?  Whether those effects seem negative to = you only matters if there is a proposal for the = IETF to take on new work to =E2=80=9Ccorrect=E2=80=9D them.

Eliot

On 13 Mar 2019, at 03:59, Christian Huitema <huitema@huitema.net>= wrote:

=20


On 3/12/2019 2:11 PM, Paul Vixie = wrote:
I don't see why, based on =
your argument, your concerns
trump his.

Can you explain?

he's trying to achieve a =
political aim using technology. that is not the=20
purpose for which the internet engineering task force, or the internet =
itself,=20
was convened. it is not why our employers pay our travel costs. and it =
is not=20
why the rest of the world trusts our outputs.

Sorry, but no. I am vying for network = transparency, and I believe that if filtering is to be enforced, it should be controlled by the user. You are claiming that safety mandates giving the network operator full control over name resolution. Both of these positions come from specific visions about how the network should work. Neither is more a political goal than the other.

-- Christian Huitema

_______________________________________________
Doh = mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh

= --Apple-Mail=_AFB77940-92CB-4BA6-9DC7-271F1DAE1A34-- --Apple-Mail=_838E1E39-B8CF-4C4F-B893-6B856C6106FB Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyIj1EACgkQh7ZrRtnS ejONLQgAqmoRjwoyGohHqMufPISZ3DQhFnNjbd+OEa5B3f60fxv7jjYPYKkuD2KY T4GdPDFHsqyN9y3FdJCy0qeGPmBZQNiY+PXULVlm0aamaZZhh+ozZ8x3S1QogZjt qJD99dNud0ntT3y7MhuPEVfjr8FREGyU6UWu/xB7haSunaql3+KGMI4ik7cSv6fY XSIXwNMgz7e7VS2IFxjPk3SEhfyPc0Es+ugrM21VDSRbIYGiz/Sye+00eSh6a686 tjlLsZ+4HFeBUx0ExXcqz8Hs3uR4wT/qQEAXN3QMKQcW9tyMFd5pzR99juZL2qBP JHNSH2OXZV7iDx4oNcGC+NyThBGiUw== =oW1D -----END PGP SIGNATURE----- --Apple-Mail=_838E1E39-B8CF-4C4F-B893-6B856C6106FB-- From nobody Tue Mar 12 22:37:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D74412D4E7; Tue, 12 Mar 2019 22:37:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=mcafee.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bDZpczh40quy; Tue, 12 Mar 2019 22:37:44 -0700 (PDT) Received: from DNVWSMAILOUT1.mcafee.com (dnvwsmailout1.mcafee.com [161.69.31.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 01E93130E7C; Tue, 12 Mar 2019 22:37:42 -0700 (PDT) X-NAI-Header: Modified by McAfee Email Gateway (5500) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mcafee.com; s=s_mcafee; t=1552455263; h=From: To:CC:Subject:Thread-Topic:Thread-Index:Date: Message-ID:References:In-Reply-To:Accept-Language: Content-Language:X-MS-Has-Attach:X-MS-TNEF-Correlator: dlp-product:dlp-version:dlp-reaction:authentication-results: x-originating-ip:x-ms-publictraffictype:x-ms-office365-filtering-correlation-id: x-microsoft-antispam:x-ms-traffictypediagnostic: x-ms-exchange-purlcount:x-microsoft-exchange-diagnostics: x-microsoft-antispam-prvs:x-forefront-prvs: x-forefront-antispam-report:received-spf:x-ms-exchange-senderadcheck: x-microsoft-antispam-message-info:Content-Type: MIME-Version:X-MS-Exchange-CrossTenant-Network-Message-Id: X-MS-Exchange-CrossTenant-originalarrivaltime: X-MS-Exchange-CrossTenant-fromentityheader: X-MS-Exchange-CrossTenant-id:X-MS-Exchange-CrossTenant-mailboxtype: X-MS-Exchange-Transport-CrossTenantHeadersStamped: X-OriginatorOrg:X-NAI-Spam-Flag:X-NAI-Spam-Threshold: X-NAI-Spam-Score:X-NAI-Spam-Version; bh=a Cdr9/xGFf1HbLolaID07Jlvfm9xBSWVk3NbLfzHQy A=; b=CskhOvRQfkX+M9/ORozFYS7/hmD/kIBzCz7hZVZMTiJo DdzwZIFhekCLG6g+/2sgDCXsXXZLz32xO5pVbTbIJICWyr9Bpt ug+yLNUgFUjuzGlk9sGpA70LYHOPrJDbl7eABpsXBiJPI+f3P3 0dsjiNCDmqVxqSIpWtaMLq2nMVU= Received: from DNVEXAPP1N06.corpzone.internalzone.com (unknown [10.44.48.90]) by DNVWSMAILOUT1.mcafee.com with smtp (TLS: TLSv1/SSLv3,256bits,ECDHE-RSA-AES256-SHA384) id 4780_2a5a_96df891e_c6d9_470c_9a06_377adf5f94a9; Tue, 12 Mar 2019 23:34:22 -0600 Received: from DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) by DNVEXAPP1N06.corpzone.internalzone.com (10.44.48.90) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 23:37:28 -0600 Received: from DNVO365EDGE1.corpzone.internalzone.com (10.44.176.66) by DNVEXAPP1N04.corpzone.internalzone.com (10.44.48.88) with Microsoft SMTP Server (TLS) id 15.0.1395.4 via Frontend Transport; Tue, 12 Mar 2019 23:37:28 -0600 Received: from NAM01-SN1-obe.outbound.protection.outlook.com (10.44.176.242) by edge.mcafee.com (10.44.176.66) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Tue, 12 Mar 2019 23:37:27 -0600 Received: from BYAPR16MB2790.namprd16.prod.outlook.com (20.178.233.91) by BYAPR16MB2520.namprd16.prod.outlook.com (20.177.224.213) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.19; Wed, 13 Mar 2019 05:37:26 +0000 Received: from BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39]) by BYAPR16MB2790.namprd16.prod.outlook.com ([fe80::9c48:452b:e39c:ef39%2]) with mapi id 15.20.1709.011; Wed, 13 Mar 2019 05:37:26 +0000 From: "Konda, Tirumaleswar Reddy" To: Eric Rescorla CC: "doh@ietf.org" , "dnsop@ietf.org" , "dns-privacy@ietf.org" , Vittorio Bertola , Stephen Farrell Thread-Topic: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2C+f7jidn2WHF0WeuF/A93J/OKYGu6uAgAA7DwCAASpAQIAAB3AAgADZPyA= Date: Wed, 13 Mar 2019 05:37:26 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7667c4d7-2e78-0a27-84af-cf1c00fd4897@cs.tcd.ie> <1991054337.12802.1552259263075@appsuite.open-xchange.com> <69f989ba-0939-b917-b586-9e3af3fb8b74@redbarn.org> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action authentication-results: spf=none (sender IP is ) smtp.mailfrom=TirumaleswarReddy_Konda@McAfee.com; x-originating-ip: [103.245.47.20] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: fa4f9b87-794a-4083-6107-08d6a775f9c6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:BYAPR16MB2520; x-ms-traffictypediagnostic: BYAPR16MB2520: x-ms-exchange-purlcount: 3 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtCWUFQUjE2TUIyNTIwOzIzOjdaMk1YVEJCdUtLMkl1a2ZUc0FndXgvakJM?= =?utf-8?B?NkdZS014U205c0xYaVlyOUUwSFN6NDRqb3FweGdvc2k3VTMvWHA3bEIvT3o2?= =?utf-8?B?c2d2MHB6UW1oRlg1b0w4Q3Bja3gzMGYrVWpaWjUrSE1qeEVySWlkSFA1aGRW?= =?utf-8?B?anlzWWRiR1pacXNJSk5pNEpzbTJXWEFSS0k2N0lWbC9xT0V6MUJGWVpnZTdC?= =?utf-8?B?Vmg3MXBBQVdTZzlpbDhLK0dOUnZ2elg0ZnA4Z21wSzRZTnN5T25GdUx2THpP?= =?utf-8?B?ZE5SUzJrb0F3c05ZSkZkZlRiT2FYQTV6ditSaUlOTkZMYmR3aEd2ODF0K1lt?= =?utf-8?B?TzRUTm1tdXBZV1VOQTNlTlhkcFlCMDB5T0c5MlJGbU1TeXAzZ3pDSE16NHU5?= =?utf-8?B?a2J1QXhZanYrRHFaSFlNUTl0elZoS3RqMFl5UmhQdmtPM21ab1FRa1FaaVlT?= =?utf-8?B?NnZpWmh1NURmMXVsNGdkYnlodms3dWFuQlF5cjJVc3R0UUpVTFgrT2c5NWRn?= =?utf-8?B?RnR6Z1g0UlA2eVNPOHJrMHNMN3hITHRmUG5QL3F0RFFTa29HaDVjV3Y1ZEJv?= =?utf-8?B?UG1hOFBLd1hwei80REVyZnh2SHA5b0x0eXVjMnJkZ3FJMGNKQUZuYzI5Y0NF?= =?utf-8?B?ZWpFcVQ4WkhBU21GMlFjMHRwWXdxbkJTdTZHYVZnMlRQdXRjVFpzQ0VGaytS?= =?utf-8?B?RVVlUDV5c3lNejRwNUNNSjJ4bmJ2bEQwZGxIeEtWRTRTMmRDVlp3akxqMmNB?= =?utf-8?B?VjF4UVRJeUM0N0dIaWFWcWRLUEVlbFRSN0pHOGpKQUtIQXNqWHFoem1ac2Nn?= =?utf-8?B?aFYrdGZUQmF6dFIrL3l3bzhlQ3Z3SVVuVGNON01pSU1LbjlaWHZMWE5QM1Fj?= =?utf-8?B?RWt1cG05YUYrbkZUYlA1b3RmMEdONEVwNmlFZ3pwZE4vTmdTNFc0Z2FJeUJz?= =?utf-8?B?azk4K0cvZkdpUVZvWWdDVjVlZEhPRkFzTFZFQVk4RzJhWkRzR0FsQUdHSDZs?= =?utf-8?B?RGdGM0pwQld5NHExUnBudlBOSXYrZm5UdjVCTFdrUHNtcnpsT0xQUVAvelBB?= =?utf-8?B?a0xGZFVXYldTMWpYS0hPcjRDOGRhS1hOOGREVmtaVnI5Mlpxd0w5Ylo4bGNP?= =?utf-8?B?d0dqUjViTTFRbGxwbzE5d1NQOGpwK003VGgrRWpHYWRzckVqNlRqVG91OVlw?= =?utf-8?B?YXh6SWlick5VVmI3ME42cDBzRWNhekNWU3l0c3ljQ29rUk5GQkxNckV0ZWE4?= =?utf-8?B?ajlpdEFhaGV2WkdpUVZMT0NSdWd0clhMV3ZoTkVWTVB5SElNVUFyUHVaN1Zn?= =?utf-8?B?SUNWejF3bHBWbGloRHhaN05NeHU4OEZKd1RhQ0NPcGJYaXpPb1FHYS8wNWp0?= =?utf-8?B?Z2JRRW4vc3g0RmF2bjdnYjYzQkFNbTBSVjY3bjNaK2w1OWhnbGpkaWhTNGdy?= =?utf-8?B?ckNEejdiTDNqU0twOXh5ek0zT09jYktzc1l2dksvZHNYNU5Dd1B3S083akNJ?= =?utf-8?B?ZTZtRTVWcUNjVVhsNFU0SnpLWWYzWUZweDRzMkQvNnBkRWFybGRJMGJoVDcw?= =?utf-8?B?dUJWUWNCTzRaM1ZLcm9zTytSdU1veXNaMWZlRC9jdkpRcWtucVhyVFZQZnpr?= =?utf-8?B?SHBZbXYzUEVybGk2a1MvTGRreWJqRjdFNW5sWVhneFN0SXR1Tys4NEY2Y2Fa?= =?utf-8?B?WkxkYUw1bFlvSU43elVXc1NhU3BBV010ckU0VHVRMjh3aElrRFBWNHN3a2Ra?= =?utf-8?B?T1JCM3luTVJhaVduMHlMeFhjQUowY1I4UjhiMmJBRU5FZUE5WWwwQU1TK3l4?= =?utf-8?B?QVdXU2lOQ05RSmFqbHIwdHA2anJZTWQ0aHpocmttL1J5VjNwc0ErOC9WYVll?= =?utf-8?B?V0d6VEZaY2NIOTY1QlVnUzFKejM4OWFSWEFkcG5ZOU0yMzJQUmZ1bWJBbU1G?= =?utf-8?B?QjN5U1pHWHg0VUpnZGxuMFliQU0yK0lhaEpVMXpTeVo5aUlLd2ZMR0IwWC9D?= =?utf-8?B?d0VVcVFMMDdFQkdFY25tNThiMnhjZFdvNlhNamsrbVRGUmtET2E4WUt3NGdr?= =?utf-8?B?MTBFSFUzTUZwMDN0c2x3enRjRGtCOUJXdWNmQ1h6WkdaSHVOWlExUU04Rk5Q?= =?utf-8?Q?bN3Xk1Esj5uSGdxe4k4EnMxXfA2/NHuVmED4Lw1Nb0Oj?= x-microsoft-antispam-prvs: x-forefront-prvs: 09752BC779 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(6019001)(376002)(39860400002)(396003)(366004)(346002)(136003)(269900001)(189003)(54094003)(199004)(32952001)(71200400001)(71190400001)(53936002)(53546011)(26005)(8936002)(486006)(7696005)(86362001)(54906003)(66066001)(186003)(55016002)(99286004)(476003)(6246003)(6506007)(256004)(5024004)(8676002)(446003)(11346002)(2906002)(14444005)(81166006)(6436002)(68736007)(81156014)(102836004)(76176011)(4326008)(72206003)(966005)(80792005)(606006)(93886005)(25786009)(6916009)(97736004)(52536013)(229853002)(33656002)(5660300002)(14454004)(236005)(9686003)(105586002)(54896002)(7736002)(316002)(6306002)(74316002)(790700001)(3846002)(6116002)(106356001)(478600001)(85282002)(256605007)(16193025007); DIR:OUT; SFP:1101; SCL:1; SRVR:BYAPR16MB2520; H:BYAPR16MB2790.namprd16.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: McAfee.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: Az+i2+47Ilq+wdmxmg7ag9n3TfgZw2cVre4cJ1/utGAoEOO+PFWIfn9qNPf+2DL0nK9KZddXkj4UUXyOq9CQc+b8w0zZqXvEk+tbU++FdewvSm+cJKcuwtdzY8UGRHMAGjYzAfxe/Pe2vwLgiDc1frGBiLarm8HrTcmm3VuXRb0Sz3pXVaSngpeDpDcxrTFNrHWSsLY3aLPpqNpK/MKZibZTbvbnarfi4oo0JmTDpJlM1elmK6bJEqZBPJD/HQniJqIq0vi6xXh0xhf1K1DNtaHFiNyBhMDgtlyti+mNNmNr01ytPdNO+UlLTi3QcWnb3XFkk2wWTHz+8rUT9FbZm5BPfmUWbZ6u2wJ3LX1/FBVh03w5tnPf9xcgIkCpDagALpI49Xmqt5piDusZ0lzK/wAIHY06QGDxmyEPHLVa0S0= Content-Type: multipart/alternative; boundary="_000_BYAPR16MB2790DDBE743A504D0983C7A3EA4A0BYAPR16MB2790namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: fa4f9b87-794a-4083-6107-08d6a775f9c6 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 Mar 2019 05:37:26.1762 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 4943e38c-6dd4-428c-886d-24932bc2d5de X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR16MB2520 X-OriginatorOrg: mcafee.com X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 15 X-NAI-Spam-Score: 0 X-NAI-Spam-Version: 2.3.0.9418 : core <6501> : inlines <7032> : streams <1815557> : uri <2811792> Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 05:37:47 -0000 --_000_BYAPR16MB2790DDBE743A504D0983C7A3EA4A0BYAPR16MB2790namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 UGxlYXNlIHNlZSBpbmxpbmUNCg0KRnJvbTogRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPg0K U2VudDogVHVlc2RheSwgTWFyY2ggMTIsIDIwMTkgOToyOCBQTQ0KVG86IEtvbmRhLCBUaXJ1bWFs ZXN3YXIgUmVkZHkgPFRpcnVtYWxlc3dhclJlZGR5X0tvbmRhQE1jQWZlZS5jb20+DQpDYzogZG9o QGlldGYub3JnOyBkbnNvcEBpZXRmLm9yZzsgZG5zLXByaXZhY3lAaWV0Zi5vcmc7IFZpdHRvcmlv IEJlcnRvbGEgPHZpdHRvcmlvLmJlcnRvbGE9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYu b3JnPjsgU3RlcGhlbiBGYXJyZWxsIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPg0KU3ViamVj dDogUmU6IFtEb2hdIFtkbnMtcHJpdmFjeV0gW0ROU09QXSBOZXc6IGRyYWZ0LWJlcnRvbGEtYmNw LWRvaC1jbGllbnRzDQoNCg0KQ0FVVElPTjogRXh0ZXJuYWwgZW1haWwuIERvIG5vdCBjbGljayBs aW5rcyBvciBvcGVuIGF0dGFjaG1lbnRzIHVubGVzcyB5b3UgcmVjb2duaXplIHRoZSBzZW5kZXIg YW5kIGtub3cgdGhlIGNvbnRlbnQgaXMgc2FmZS4NCg0KDQpfX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXw0KDQoNCk9uIFR1ZSwgTWFyIDEyLCAyMDE5IGF0IDg6NTEgQU0gS29uZGEsIFRp cnVtYWxlc3dhciBSZWRkeSA8VGlydW1hbGVzd2FyUmVkZHlfS29uZGFAbWNhZmVlLmNvbTxtYWls dG86VGlydW1hbGVzd2FyUmVkZHlfS29uZGFAbWNhZmVlLmNvbT4+IHdyb3RlOg0KSGkgRXJpYywN Cg0KSW4gVExTIDEuMiwgaXQgaXMgcG9zc2libGUgZm9yIGZpcmV3YWxscyB0byBpbnNwZWN0IHRo ZSBUTFMgaGFuZHNoYWtlLCBhbmQgd2hpdGUtbGlzdCwgYmxhY2stbGlzdCBhbmQgZ3JleS1saXN0 IFRMUyBzZXNzaW9uIGJhc2VkIG9uIHRoZSBzZXJ2ZXIgaWRlbnRpdHkuIEluIG90aGVyIHdvcmRz LCBtaWRkbGVib3hlcyBhcmUgY29uZGl0aW9uYWxseSBhY3RpbmcgYXMgVExTIHByb3hpZXMgdG8g c3BlY2lmaWMgc2VydmVycyAoY2F0ZWdvcml6ZWQgaW4gdGhlIGdyZXktbGlzdCkuDQpXaXRoIFRM UyAxLjMgYW5kIGVuY3J5cHRlZCBTTkksIHRoZSBtaWRkbGUgYm94IG5vdyBoYXMgdG8gYWN0IGFz IGEgVExTIHByb3h5IGZvciBhbGwgdGhlIGZsb3dzLg0KDQpJdCB3b3VsZCBiZSBtb3N0IHVzZWZ1 bCBub3QgdG8gY29uZmxhdGUgVExTIDEuMyBhbmQgRVNOSS4NCg0KSW4gb3JkaW5hcnkgVExTIDEu MywgdGhlIFNOSSBpcyBpbiB0aGUgY2xlYXIgYnV0IHRoZSBzZXJ2ZXIgY2VydCBpcyBub3QuIEhv d2V2ZXIsIGltcG9ydGFudGx5LCBldmVuIGluIFRMUyAxLjIsIHRoZSBzZXJ2ZXIgY2VydGlmaWNh dGUgaXMgbm90IHZlcmlmaWFibGUsIGFuZCB0aGVyZWZvcmUgaXMgbm90IHNpZ25pZmljYW50bHkg bW9yZSB0cnVzdHdvcnRoeSB0aGFuIFNOSS4NCg0KW1RSXSBNaWRkbGUgYm94ZXMgaGF2ZSBhIHRy dXN0IHN0b3JlIChlLmcuIGRvd25sb2FkZWQgZnJvbSBNb3ppbGxhIENBIHN0b3JlKSB0byB2YWxp ZGF0ZSB0aGUgc2VydmVyIGNlcnRpZmljYXRlLiAgTWFsd2FyZXMgbGllIGFib3V0IFNOSSAodHlw aWNhbGx5IHVzZSBhIEZRRE4gd2hvc2UgcmVwdXRhdGlvbiBzY29yZSBpcyBnb29kKSwgdmFsaWRh dGluZyB0aGUgc2VydmVyIGNlcnRpZmljYXRlIChlLmcuIGNlcnRhaW4gdHlwZXMgb2YgbWFsd2Fy ZXMgIHVzZSBzZWxmLXNpZ25lZCBjZXJ0aWZpY2F0ZXMpIGFuZCBTTkkgbWlzbWF0Y2ggaGVscHMg ZGV0ZWN0IHRoZSBjbGllbnQgaXMgbHlpbmcuDQoNCldpdGggRVNOSSwgdGhlIFNOSSBpcyBlbmNy eXB0ZWQgKGhlbmNlIHRoZSBuYW1lKS4gSG93ZXZlciwgdGhlIHhwZWN0YXRpb24gaXMgdGhhdCBl bnRlcnByaXNlcyB3aGljaCB3YW50IHRvIGRvIGNvbmRpdGlvbmFsIGluc3BlY3Rpb24gd2lsbCBk aXNhYmxlIEVTTkkgb24gdGhlIGNsaWVudC4gVGhpcyBzaG91bGQgbm90IGJlIHByb2JsZW1hdGlj IGFzIHRoZXkgYWxyZWFkeSBuZWVkIGFjY2VzcyB0byB0aGUgY2xpZW50IHRvIGluc3RhbGwgdGhl aXIgb3duIHRydXN0IGFuY2hvci4NCg0KW1RSXSBJIHNlZSBGaXJlZm94IGhhcyBnaXZlbiBhbiBv cHRpb24gdG8gZGlzYWJsZSBFU05JLCBob3BlZnVsbHkgb3RoZXJzIHdpbGwgcHJvdmlkZSBhIGNv bmZpZ3VyYWJsZSBvcHRpb24uDQoNCkNoZWVycywNCi1UaXJ1DQoNCi1Fa3INCg0KDQoNCi1UaXJ1 DQoNCkZyb206IEVyaWMgUmVzY29ybGEgPGVrckBydGZtLmNvbTxtYWlsdG86ZWtyQHJ0Zm0uY29t Pj4NClNlbnQ6IFR1ZXNkYXksIE1hcmNoIDEyLCAyMDE5IDM6MTQgQU0NClRvOiBQYXVsIFZpeGll IDxwYXVsQHJlZGJhcm4ub3JnPG1haWx0bzpwYXVsQHJlZGJhcm4ub3JnPj4NCkNjOiBuYWxpbmkg ZWxraW5zIDxuYWxpbmkuZWxraW5zQGUtZGNvLmNvbTxtYWlsdG86bmFsaW5pLmVsa2luc0BlLWRj by5jb20+PjsgS29uZGEsIFRpcnVtYWxlc3dhciBSZWRkeSA8VGlydW1hbGVzd2FyUmVkZHlfS29u ZGFATWNBZmVlLmNvbTxtYWlsdG86VGlydW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbT4+ OyBkb2hAaWV0Zi5vcmc8bWFpbHRvOmRvaEBpZXRmLm9yZz47IGRuc29wQGlldGYub3JnPG1haWx0 bzpkbnNvcEBpZXRmLm9yZz47IEFja2VybWFubiwgTWljaGFlbCA8bWFja2VybWFubkBiY2JzbS5j b208bWFpbHRvOm1hY2tlcm1hbm5AYmNic20uY29tPj47IENocmlzdGlhbiBIdWl0ZW1hIDxodWl0 ZW1hQGh1aXRlbWEubmV0PG1haWx0bzpodWl0ZW1hQGh1aXRlbWEubmV0Pj47IGRucy1wcml2YWN5 QGlldGYub3JnPG1haWx0bzpkbnMtcHJpdmFjeUBpZXRmLm9yZz47IFZpdHRvcmlvIEJlcnRvbGEg PHZpdHRvcmlvLmJlcnRvbGE9NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnPG1haWx0 bzo0MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmc+PjsgU3RlcGhlbiBGYXJyZWxsIDxz dGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPG1haWx0bzpzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmll Pj4NClN1YmplY3Q6IFJlOiBbRG9oXSBbZG5zLXByaXZhY3ldIFtETlNPUF0gTmV3OiBkcmFmdC1i ZXJ0b2xhLWJjcC1kb2gtY2xpZW50cw0KDQoNCkNBVVRJT046IEV4dGVybmFsIGVtYWlsLiBEbyBu b3QgY2xpY2sgbGlua3Mgb3Igb3BlbiBhdHRhY2htZW50cyB1bmxlc3MgeW91IHJlY29nbml6ZSB0 aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuDQoNCg0KX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX18NCg0KDQpPbiBNb24sIE1hciAxMSwgMjAxOSBhdCAxMToxMyBB TSBQYXVsIFZpeGllIDxwYXVsQHJlZGJhcm4ub3JnPG1haWx0bzpwYXVsQHJlZGJhcm4ub3JnPj4g d3JvdGU6DQoNCg0KbmFsaW5pIGVsa2lucyB3cm90ZSBvbiAyMDE5LTAzLTExIDEwOjI2Og0KPiBU aXJ1LA0KPg0KPiBUaGFua3MgZm9yIHlvdXIgY29tbWVudHMuDQo+DQo+ICA+IEVudGVycHJpc2Ug bmV0d29ya3MgYXJlIGFscmVhZHkgYWJsZSB0byBibG9jayBEb0ggc2VydmljZXMsDQppIHdvbmRl ciBpZiBldmVyeW9uZSBoZXJlIGtub3dzIHRoYXQgVExTIDEuMyBhbmQgZW5jcnlwdGVkIGhlYWRl cnMgaXMNCmdvaW5nIHRvIHB1c2ggYSBTT0NLUyBhZ2VuZGEgb250byBlbnRlcnByaXNlcyB0aGF0 IGhhZCBub3QgcHJldmlvdXNseQ0KbmVlZGVkIG9uZSwNCg0KSSdtIHByZXR0eSBmYW1pbGlhciB3 aXRoIFRMUyAxLjMsIGJ1dCBJIGRvbid0IGtub3cgd2hhdCB0aGlzIG1lYW5zLiBUTFMgMS4zDQpk b2Vzbid0IGdlbmVyYWxseSBlbmNyeXB0IGhlYWRlcnMgYW55IG1vcmUgdGhhbiBUTFMgMS4yIGRp ZCwgZXhjZXB0IGZvcg0KdGhlIGNvbnRlbnQgdHlwZSBieXRlLCB3aGljaCBpc24ndCB0aGF0IHVz ZWZ1bCBmb3IgaW5zcGVjdGlvbiBhbnl3YXkuDQpBcmUgeW91IHBlcmNoYW5jZSByZWZlcnJpbmcg dG8gZW5jcnlwdGVkIFNOST8gU29tZXRoaW5nIGVsc2U/DQoNCi1Fa3INCg0KYW5kIHRoYXQgc2lt cGx5IGJsb2NraW5nIGV2ZXJ5IGV4dGVybmFsIGVuZHBvaW50IGtub3duIG9yDQp0ZXN0ZWQgdG8g c3VwcG9ydCBEb0ggd2lsbCBiZSB0aGUgY2hlYXBlciBhbHRlcm5hdGl2ZSwgZXZlbiBpZiB0aGF0 DQptYWtlcyBtaWxsaW9ucyBvZiBvdGhlciBlbmRwb2ludHMgYXQgZ29vZ2xlLCBjbG91ZGZsYXJl LCBjaXNjbywgYW5kIGlibQ0KdW5yZWFjaGFibGUgYXMgYSBzaWRlIGVmZmVjdD8NCg0KQ0YgaGFz IHNvIGZhciBvbmx5IHN1cHBvcnRlZCBEb0ggb24gMS4xLjEuMC8yNDxodHRwOi8vMS4xLjEuMC8y ND4gYW5kIDEuMC4xLjAvMjQ8aHR0cDovLzEuMC4xLjAvMjQ+LCB3aGljaCBpDQpibG9ja2VkIGFs cmVhZHkgKGJlZm9yZSBEb0gpIHNvIHRoYXQncyBub3QgYSBwcm9ibGVtLiBidXQgaWYgZ29vZ2xl DQpkZWNpZGVzIHRvIHN1cHBvcnQgRG9IIG9uIHRoZSBzYW1lIElQIGFkZHJlc3NlcyBhbmQgcG9y dCBudW1iZXJzIHRoYXQNCmFyZSB1c2VkIGZvciBzb21lIEFQSSBvciB3ZWIgc2VydmljZSBpIGRl cGVuZCBvbiwgdGhhdCB3ZWIgc2VydmljZSBpcw0KZ29pbmcgdG8gYmUgZWl0aGVyIGJsb2NrZWQs IG9yIGZvcmNlZCB0byBnbyB0aHJvdWdoIFNPQ0tTLiB0aGlzIHdpbGwgYWRkDQpjb25zaWRlcmFi bGUgY29zdCB0byBteSBuZXR3b3JrIHBvbGljeS4gKGJ5IGRlc2lnbi4pDQoNCi0tDQpQIFZpeGll DQoNCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpEb2gg bWFpbGluZyBsaXN0DQpEb2hAaWV0Zi5vcmc8bWFpbHRvOkRvaEBpZXRmLm9yZz4NCmh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZG9oDQo= --_000_BYAPR16MB2790DDBE743A504D0983C7A3EA4A0BYAPR16MB2790namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPCEtLVtp ZiAhbXNvXT48c3R5bGU+dlw6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kb1w6KiB7 YmVoYXZpb3I6dXJsKCNkZWZhdWx0I1ZNTCk7fQ0Kd1w6KiB7YmVoYXZpb3I6dXJsKCNkZWZhdWx0 I1ZNTCk7fQ0KLnNoYXBlIHtiZWhhdmlvcjp1cmwoI2RlZmF1bHQjVk1MKTt9DQo8L3N0eWxlPjwh W2VuZGlmXS0tPjxzdHlsZT48IS0tDQovKiBGb250IERlZmluaXRpb25zICovDQpAZm9udC1mYWNl DQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0xOjIgNCA1IDMgNSA0IDYg MyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpEZW5nWGlhbjsNCglwYW5vc2UtMToy IDEgNiAwIDMgMSAxIDEgMSAxO30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsN CglwYW5vc2UtMToyIDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFt aWx5OiJcQERlbmdYaWFuIjsNCglwYW5vc2UtMToyIDEgNiAwIDMgMSAxIDEgMSAxO30NCi8qIFN0 eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9y bWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZTox MS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFu Lk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0 ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtG b2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQt ZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYu bXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3At YWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUyMQ0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCglj b2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9y dC1vbmx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRT ZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4g MS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0 eWxlPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRp dCIgc3BpZG1heD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5 XT48eG1sPg0KPG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVk aXQiIGRhdGE9IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hl YWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2 IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+UGxlYXNlIHNlZSBp bmxpbmU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdiBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgYmx1ZSAx LjVwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDQuMHB0Ij4NCjxkaXY+DQo8ZGl2IHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNFMUUxRTEgMS4wcHQ7cGFkZGluZzozLjBwdCAwaW4g MGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gRXJpYyBSZXNjb3Js YSAmbHQ7ZWtyQHJ0Zm0uY29tJmd0OyA8YnI+DQo8Yj5TZW50OjwvYj4gVHVlc2RheSwgTWFyY2gg MTIsIDIwMTkgOToyOCBQTTxicj4NCjxiPlRvOjwvYj4gS29uZGEsIFRpcnVtYWxlc3dhciBSZWRk eSAmbHQ7VGlydW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbSZndDs8YnI+DQo8Yj5DYzo8 L2I+IGRvaEBpZXRmLm9yZzsgZG5zb3BAaWV0Zi5vcmc7IGRucy1wcml2YWN5QGlldGYub3JnOyBW aXR0b3JpbyBCZXJ0b2xhICZsdDt2aXR0b3Jpby5iZXJ0b2xhPTQwb3Blbi14Y2hhbmdlLmNvbUBk bWFyYy5pZXRmLm9yZyZndDs7IFN0ZXBoZW4gRmFycmVsbCAmbHQ7c3RlcGhlbi5mYXJyZWxsQGNz LnRjZC5pZSZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IFtEb2hdIFtkbnMtcHJpdmFjeV0g W0ROU09QXSBOZXc6IGRyYWZ0LWJlcnRvbGEtYmNwLWRvaC1jbGllbnRzPG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8ZGl2Pg0KPHRhYmxlIGNsYXNzPSJNc29Ob3JtYWxUYWJsZSIgYm9yZGVyPSIxIiBjZWxs c3BhY2luZz0iMyIgY2VsbHBhZGRpbmc9IjAiIHN0eWxlPSJiYWNrZ3JvdW5kOiNGM0ZGMzM7Ym9y ZGVyOnNvbGlkICM5QjlBODcgMS41cHQiPg0KPHRib2R5Pg0KPHRyPg0KPHRkIHN0eWxlPSJib3Jk ZXI6bm9uZTtwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij4NCjxwPjxzdHJvbmc+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzlCOEIzRSI+Q0FVVElPTjwvc3Bhbj48L3N0cm9uZz48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 JnF1b3Q7QXJpYWwmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojOUI4QjNFIj46PC9zcGFuPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOmJs YWNrIj4gRXh0ZXJuYWwgZW1haWwuIERvIG5vdCBjbGljayBsaW5rcyBvciBvcGVuDQogYXR0YWNo bWVudHMgdW5sZXNzIHlvdSByZWNvZ25pemUgdGhlIHNlbmRlciBhbmQga25vdyB0aGUgY29udGVu dCBpcyBzYWZlLjwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7QXJpYWwmcXVv dDssc2Fucy1zZXJpZiI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Ri b2R5Pg0KPC90YWJsZT4NCjxkaXYgY2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNlbnRlciIgc3R5 bGU9InRleHQtYWxpZ246Y2VudGVyIj4NCjxociBzaXplPSIzIiB3aWR0aD0iMTAwJSIgYWxpZ249 ImNlbnRlciI+DQo8L2Rpdj4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi Pk9uIFR1ZSwgTWFyIDEyLCAyMDE5IGF0IDg6NTEgQU0gS29uZGEsIFRpcnVtYWxlc3dhciBSZWRk eSAmbHQ7PGEgaHJlZj0ibWFpbHRvOlRpcnVtYWxlc3dhclJlZGR5X0tvbmRhQG1jYWZlZS5jb20i PlRpcnVtYWxlc3dhclJlZGR5X0tvbmRhQG1jYWZlZS5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwv bzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1s ZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4t bGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj5IaSBFcmljLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+SW4gVExTIDEu MiwgaXQgaXMgcG9zc2libGUgZm9yIGZpcmV3YWxscyB0byBpbnNwZWN0IHRoZSBUTFMgaGFuZHNo YWtlLCBhbmQgd2hpdGUtbGlzdCwgYmxhY2stbGlzdCBhbmQgZ3JleS1saXN0IFRMUyBzZXNzaW9u IGJhc2VkIG9uIHRoZSBzZXJ2ZXIgaWRlbnRpdHkuIEluIG90aGVyIHdvcmRzLCBtaWRkbGVib3hl cw0KIGFyZSBjb25kaXRpb25hbGx5IGFjdGluZyBhcyBUTFMgcHJveGllcyB0byBzcGVjaWZpYyBz ZXJ2ZXJzIChjYXRlZ29yaXplZCBpbiB0aGUgZ3JleS1saXN0KS4NCjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6 bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4g Ni4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+V2l0aCBUTFMgMS4zIGFuZCBlbmNyeXB0ZWQgU05JLCB0 aGUgbWlkZGxlIGJveCBub3cgaGFzIHRvIGFjdCBhcyBhIFRMUyBwcm94eSBmb3IgYWxsIHRoZSBm bG93cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCB3b3VsZCBiZSBtb3N0IHVzZWZ1bCBub3QgdG8g Y29uZmxhdGUgVExTIDEuMyBhbmQgRVNOSS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SW4gb3JkaW5hcnkgVExTIDEuMywgdGhlIFNOSSBpcyBp biB0aGUgY2xlYXIgYnV0IHRoZSBzZXJ2ZXIgY2VydCBpcyBub3QuIEhvd2V2ZXIsIGltcG9ydGFu dGx5LCBldmVuIGluIFRMUyAxLjIsIHRoZSBzZXJ2ZXIgY2VydGlmaWNhdGUgaXMgbm90IHZlcmlm aWFibGUsIGFuZCB0aGVyZWZvcmUgaXMgbm90IHNpZ25pZmljYW50bHkgbW9yZSB0cnVzdHdvcnRo eSB0aGFuIFNOSS48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+W1RSXSBNaWRkbGUgYm94ZXMgaGF2 ZSBhIHRydXN0IHN0b3JlIChlLmcuIGRvd25sb2FkZWQgZnJvbSBNb3ppbGxhIENBIHN0b3JlKSB0 byB2YWxpZGF0ZSB0aGUgc2VydmVyIGNlcnRpZmljYXRlLiAmbmJzcDtNYWx3YXJlcyBsaWUgYWJv dXQgU05JICh0eXBpY2FsbHkgdXNlIGEgRlFETiB3aG9zZSByZXB1dGF0aW9uIHNjb3JlIGlzIGdv b2QpLCB2YWxpZGF0aW5nIHRoZSBzZXJ2ZXIgY2VydGlmaWNhdGUgKGUuZy4gY2VydGFpbg0KIHR5 cGVzIG9mIG1hbHdhcmVzICZuYnNwO3VzZSBzZWxmLXNpZ25lZCBjZXJ0aWZpY2F0ZXMpIGFuZCBT TkkgbWlzbWF0Y2ggaGVscHMgZGV0ZWN0IHRoZSBjbGllbnQgaXMgbHlpbmcuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPldpdGggRVNOSSwgdGhl IFNOSSBpcyBlbmNyeXB0ZWQgKGhlbmNlIHRoZSBuYW1lKS4gSG93ZXZlciwgdGhlIHhwZWN0YXRp b24gaXMgdGhhdCBlbnRlcnByaXNlcyB3aGljaCB3YW50IHRvIGRvIGNvbmRpdGlvbmFsIGluc3Bl Y3Rpb24gd2lsbCBkaXNhYmxlIEVTTkkgb24gdGhlIGNsaWVudC4gVGhpcyBzaG91bGQgbm90IGJl IHByb2JsZW1hdGljIGFzIHRoZXkgYWxyZWFkeSBuZWVkIGFjY2VzcyB0byB0aGUgY2xpZW50DQog dG8gaW5zdGFsbCB0aGVpciBvd24gdHJ1c3QgYW5jaG9yLjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij5bVFJdIEkgc2VlIEZpcmVmb3ggaGFzIGdpdmVuIGFuIG9wdGlvbiB0byBkaXNhYmxlIEVTTkks IGhvcGVmdWxseSBvdGhlcnMgd2lsbCBwcm92aWRlIGEgY29uZmlndXJhYmxlIG9wdGlvbi4NCjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5DaGVlcnMsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj4tVGlydSA8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ LUVrcjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRl cjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBp biA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGluIj4NCjxkaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+LVRpcnU8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+Jm5ic3A7PG86cD48L286cD48L3A+DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXIt bGVmdDpzb2xpZCB3aW5kb3d0ZXh0IDEuNXB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNC4wcHQ7Ym9y ZGVyLWNvbG9yOmN1cnJlbnRjb2xvciBjdXJyZW50Y29sb3IgY3VycmVudGNvbG9yIGJsdWUiPg0K PGRpdj4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgd2luZG93dGV4 dCAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluO2JvcmRlci1jb2xvcjpjdXJyZW50Y29s b3IgY3VycmVudGNvbG9yIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PGI+RnJvbTo8L2I+IEVy aWMgUmVzY29ybGEgJmx0OzxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS5jb20iIHRhcmdldD0iX2Js YW5rIj5la3JAcnRmbS5jb208L2E+Jmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IFR1ZXNkYXksIE1h cmNoIDEyLCAyMDE5IDM6MTQgQU08YnI+DQo8Yj5Ubzo8L2I+IFBhdWwgVml4aWUgJmx0OzxhIGhy ZWY9Im1haWx0bzpwYXVsQHJlZGJhcm4ub3JnIiB0YXJnZXQ9Il9ibGFuayI+cGF1bEByZWRiYXJu Lm9yZzwvYT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBuYWxpbmkgZWxraW5zICZsdDs8YSBocmVmPSJt YWlsdG86bmFsaW5pLmVsa2luc0BlLWRjby5jb20iIHRhcmdldD0iX2JsYW5rIj5uYWxpbmkuZWxr aW5zQGUtZGNvLmNvbTwvYT4mZ3Q7OyBLb25kYSwgVGlydW1hbGVzd2FyIFJlZGR5ICZsdDs8YSBo cmVmPSJtYWlsdG86VGlydW1hbGVzd2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbSI+VGlydW1hbGVz d2FyUmVkZHlfS29uZGFATWNBZmVlLmNvbTwvYT4mZ3Q7Ow0KPGEgaHJlZj0ibWFpbHRvOmRvaEBp ZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRvaEBpZXRmLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0 bzpkbnNvcEBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPg0KZG5zb3BAaWV0Zi5vcmc8L2E+OyBB Y2tlcm1hbm4sIE1pY2hhZWwgJmx0OzxhIGhyZWY9Im1haWx0bzptYWNrZXJtYW5uQGJjYnNtLmNv bSIgdGFyZ2V0PSJfYmxhbmsiPm1hY2tlcm1hbm5AYmNic20uY29tPC9hPiZndDs7IENocmlzdGlh biBIdWl0ZW1hICZsdDs8YSBocmVmPSJtYWlsdG86aHVpdGVtYUBodWl0ZW1hLm5ldCIgdGFyZ2V0 PSJfYmxhbmsiPmh1aXRlbWFAaHVpdGVtYS5uZXQ8L2E+Jmd0OzsNCjxhIGhyZWY9Im1haWx0bzpk bnMtcHJpdmFjeUBpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPmRucy1wcml2YWN5QGlldGYub3Jn PC9hPjsgVml0dG9yaW8gQmVydG9sYSAmbHQ7dml0dG9yaW8uYmVydG9sYT08YSBocmVmPSJtYWls dG86NDBvcGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnIiB0YXJnZXQ9Il9ibGFuayI+NDBv cGVuLXhjaGFuZ2UuY29tQGRtYXJjLmlldGYub3JnPC9hPiZndDs7IFN0ZXBoZW4gRmFycmVsbCAm bHQ7PGEgaHJlZj0ibWFpbHRvOnN0ZXBoZW4uZmFycmVsbEBjcy50Y2QuaWUiIHRhcmdldD0iX2Js YW5rIj5zdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPC9hPiZndDs8YnI+DQo8Yj5TdWJqZWN0Ojwv Yj4gUmU6IFtEb2hdIFtkbnMtcHJpdmFjeV0gW0ROU09QXSBOZXc6IGRyYWZ0LWJlcnRvbGEtYmNw LWRvaC1jbGllbnRzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8dGFibGUgY2xhc3M9Ik1z b05vcm1hbFRhYmxlIiBib3JkZXI9IjEiIGNlbGxzcGFjaW5nPSIzIiBjZWxscGFkZGluZz0iMCIg c3R5bGU9ImJhY2tncm91bmQ6I0YzRkYzMztib3JkZXI6c29saWQgIzlCOUE4NyAxLjVwdDtiYWNr Z3JvdW5kLWF0dGFjaG1lbnQ6c2Nyb2xsO2JhY2tncm91bmQtcG9zaXRpb24teDowJTtiYWNrZ3Jv dW5kLXBvc2l0aW9uLXk6MCUiPg0KPHRib2R5Pg0KPHRyPg0KPHRkIHN0eWxlPSJib3JkZXI6bm9u ZTtwYWRkaW5nOi43NXB0IC43NXB0IC43NXB0IC43NXB0Ij4NCjxwPjxiPjxzcGFuIHN0eWxlPSJm b250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM5QjhCM0UiPkNB VVRJT048L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDtBcmlhbCZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiM5QjhCM0UiPjo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFt aWx5OiZxdW90O0FyaWFsJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6YmxhY2siPiBFeHRlcm5hbCBl bWFpbC4gRG8gbm90IGNsaWNrIGxpbmtzIG9yIG9wZW4gYXR0YWNobWVudHMNCiB1bmxlc3MgeW91 IHJlY29nbml6ZSB0aGUgc2VuZGVyIGFuZCBrbm93IHRoZSBjb250ZW50IGlzIHNhZmUuPC9zcGFu PjxvOnA+PC9vOnA+PC9wPg0KPC90ZD4NCjwvdHI+DQo8L3Rib2R5Pg0KPC90YWJsZT4NCjxkaXYg Y2xhc3M9Ik1zb05vcm1hbCIgYWxpZ249ImNlbnRlciIgc3R5bGU9InRleHQtYWxpZ246Y2VudGVy Ij4NCjxociBzaXplPSIzIiB3aWR0aD0iMTAwJSIgYWxpZ249ImNlbnRlciI+DQo8L2Rpdj4NCjwv ZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10 b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+ PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk9uIE1vbiwgTWFyIDEx LCAyMDE5IGF0IDExOjEzIEFNIFBhdWwgVml4aWUgJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsQHJl ZGJhcm4ub3JnIiB0YXJnZXQ9Il9ibGFuayI+cGF1bEByZWRiYXJuLm9yZzwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgd2luZG93dGV4dCAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYu MHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjtt YXJnaW4tYm90dG9tOjUuMHB0O2JvcmRlci1jb2xvcjpjdXJyZW50Y29sb3IgY3VycmVudGNvbG9y IGN1cnJlbnRjb2xvciByZ2IoMjA0LDIwNCwyMDQpIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0 eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+ PGJyPg0KPGJyPg0KbmFsaW5pIGVsa2lucyB3cm90ZSBvbiAyMDE5LTAzLTExIDEwOjI2Ojxicj4N CiZndDsgVGlydSw8YnI+DQomZ3Q7IDxicj4NCiZndDsgVGhhbmtzIGZvciB5b3VyIGNvbW1lbnRz Ljxicj4NCiZndDsgPGJyPg0KJmd0OyZuYnNwOyAmZ3Q7IEVudGVycHJpc2UgbmV0d29ya3MgYXJl IGFscmVhZHkgYWJsZSB0byBibG9jayBEb0ggc2VydmljZXMsPGJyPg0KaSB3b25kZXIgaWYgZXZl cnlvbmUgaGVyZSBrbm93cyB0aGF0IFRMUyAxLjMgYW5kIGVuY3J5cHRlZCBoZWFkZXJzIGlzIDxi cj4NCmdvaW5nIHRvIHB1c2ggYSBTT0NLUyBhZ2VuZGEgb250byBlbnRlcnByaXNlcyB0aGF0IGhh ZCBub3QgcHJldmlvdXNseSA8YnI+DQpuZWVkZWQgb25lLDxvOnA+PC9vOnA+PC9wPg0KPC9ibG9j a3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRv cC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdp bi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkknbSBwcmV0dHkgZmFt aWxpYXIgd2l0aCBUTFMgMS4zLCBidXQgSSBkb24ndCBrbm93IHdoYXQgdGhpcyBtZWFucy4gVExT IDEuMzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij5kb2Vzbid0IGdlbmVyYWxseSBlbmNyeXB0IGhlYWRlcnMgYW55IG1vcmUgdGhhbiBUTFMgMS4y IGRpZCwgZXhjZXB0IGZvcjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj50aGUgY29udGVudCB0eXBlIGJ5dGUsIHdoaWNoIGlzbid0IHRoYXQgdXNl ZnVsIGZvciBpbnNwZWN0aW9uIGFueXdheS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28t bWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+QXJlIHlvdSBwZXJjaGFuY2UgcmVmZXJyaW5nIHRvIGVu Y3J5cHRlZCBTTkk/IFNvbWV0aGluZyBlbHNlPzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21z by1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+LUVrcjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDph dXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkIHdp bmRvd3RleHQgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0Ljhw dDttYXJnaW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowaW47bWFyZ2luLWJvdHRvbTo1LjBwdDti b3JkZXItY29sb3I6Y3VycmVudGNvbG9yIGN1cnJlbnRjb2xvciBjdXJyZW50Y29sb3IgcmdiKDIw NCwyMDQsMjA0KSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPmFuZCB0aGF0IHNpbXBseSBibG9j a2luZyBldmVyeSBleHRlcm5hbCBlbmRwb2ludCBrbm93biBvcg0KPGJyPg0KdGVzdGVkIHRvIHN1 cHBvcnQgRG9IIHdpbGwgYmUgdGhlIGNoZWFwZXIgYWx0ZXJuYXRpdmUsIGV2ZW4gaWYgdGhhdCA8 YnI+DQptYWtlcyBtaWxsaW9ucyBvZiBvdGhlciBlbmRwb2ludHMgYXQgZ29vZ2xlLCBjbG91ZGZs YXJlLCBjaXNjbywgYW5kIGlibSA8YnI+DQp1bnJlYWNoYWJsZSBhcyBhIHNpZGUgZWZmZWN0Pzxi cj4NCjxicj4NCkNGIGhhcyBzbyBmYXIgb25seSBzdXBwb3J0ZWQgRG9IIG9uIDxhIGhyZWY9Imh0 dHA6Ly8xLjEuMS4wLzI0IiB0YXJnZXQ9Il9ibGFuayI+MS4xLjEuMC8yNDwvYT4gYW5kDQo8YSBo cmVmPSJodHRwOi8vMS4wLjEuMC8yNCIgdGFyZ2V0PSJfYmxhbmsiPjEuMC4xLjAvMjQ8L2E+LCB3 aGljaCBpIDxicj4NCmJsb2NrZWQgYWxyZWFkeSAoYmVmb3JlIERvSCkgc28gdGhhdCdzIG5vdCBh IHByb2JsZW0uIGJ1dCBpZiBnb29nbGUgPGJyPg0KZGVjaWRlcyB0byBzdXBwb3J0IERvSCBvbiB0 aGUgc2FtZSBJUCBhZGRyZXNzZXMgYW5kIHBvcnQgbnVtYmVycyB0aGF0IDxicj4NCmFyZSB1c2Vk IGZvciBzb21lIEFQSSBvciB3ZWIgc2VydmljZSBpIGRlcGVuZCBvbiwgdGhhdCB3ZWIgc2Vydmlj ZSBpcyA8YnI+DQpnb2luZyB0byBiZSBlaXRoZXIgYmxvY2tlZCwgb3IgZm9yY2VkIHRvIGdvIHRo cm91Z2ggU09DS1MuIHRoaXMgd2lsbCBhZGQgPGJyPg0KY29uc2lkZXJhYmxlIGNvc3QgdG8gbXkg bmV0d29yayBwb2xpY3kuIChieSBkZXNpZ24uKTxicj4NCjxicj4NCi0tIDxicj4NClAgVml4aWU8 YnI+DQo8YnI+DQpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f Xzxicj4NCkRvaCBtYWlsaW5nIGxpc3Q8YnI+DQo8YSBocmVmPSJtYWlsdG86RG9oQGlldGYub3Jn IiB0YXJnZXQ9Il9ibGFuayI+RG9oQGlldGYub3JnPC9hPjxicj4NCjxhIGhyZWY9Imh0dHBzOi8v d3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZG9oIiB0YXJnZXQ9Il9ibGFuayI+aHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kb2g8L2E+PG86cD48L286cD48L3A+DQo8 L2Jsb2NrcXVvdGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9i bG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0 bWw+DQo= --_000_BYAPR16MB2790DDBE743A504D0983C7A3EA4A0BYAPR16MB2790namp_-- From nobody Tue Mar 12 23:28:40 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFAB31277DB; Tue, 12 Mar 2019 23:28:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qYL7TigljdHU; Tue, 12 Mar 2019 23:28:24 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C38E512008F; Tue, 12 Mar 2019 23:28:24 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id B9506892C6; Wed, 13 Mar 2019 06:28:23 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Brian Dickson , "doh@ietf.org" , Christian Huitema , "dns-privacy@ietf.org" , Stephen Farrell Date: Wed, 13 Mar 2019 06:28:23 +0000 Message-ID: <2008045.2dFDXBJIrK@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7128698.bmqQpDD1M4@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 06:28:26 -0000 On Tuesday, 12 March 2019 23:12:37 UTC Brian Dickson wrote: >... > I think there is a way to use technical design(s) to split hairs, i.e. I > think the side meeting > has the possibility of bearing fruit which is palatable enough for all > parties. i hope so. i will only be in prague from saturday evening 'til monday morning. > > The crux of the problem is how to determine if the network operator is > truly hostile (GFC), > or merely restrictive (Paul's network, Paul's rules.) no, that's not the crux. it's only one problem, the one being had by a user or application wondering which dns server and what protocol to use. there's another problem, considered the crux by some, but still only one problem, and that's how to prevent truly hostile users or apps from bypassing the security policy implemented in the local RDNS control plane. neither one gets to call itself the crux, i think. vixie From nobody Tue Mar 12 23:46:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 454C2130EA7; Tue, 12 Mar 2019 23:45:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LNomWqfyaIvd; Tue, 12 Mar 2019 23:45:43 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1291130E92; Tue, 12 Mar 2019 23:45:43 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 963E4892C6; Wed, 13 Mar 2019 06:45:43 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Stephen Farrell , "dns-privacy@ietf.org" , "doh@ietf.org" , Christian Huitema Date: Wed, 13 Mar 2019 06:45:42 +0000 Message-ID: <3721473.Tv99E4QfP4@linux-9daj> Organization: Vixie Freehold In-Reply-To: <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <7128698.bmqQpDD1M4@linux-9daj> <2d8f178f-9ba0-2b49-5553-b41a2da72310@cs.tcd.ie> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 06:45:45 -0000 On Wednesday, 13 March 2019 00:36:32 UTC Stephen Farrell wrote: > Hiya, > > On 12/03/2019 22:51, Paul Vixie wrote: ... > > i have no qualms about confidentiality, for traffic allowed by a network > > operator. > > To me, the above reads as self-contradictory. If the traffic is > confidential the operator doesn't know if its "allowed" except > possibly in some extremely coarse-grained sense. Perhaps when > you said "traffic allowed" maybe you meant "protocol allowed"? yes. > But even that is confusing, given the likes of websockets, alpn, > and other webby ways in which stuff gets layered on 443 all > the time. relevant security mechanisms allow for short term losses, leading to long term policy shifts. that is, i didn't isolate my chromecast-ultra until it misbehaved too egregiously. at work we're on more of a hair trigger. > > it's the inability to inter[e]fere (as called for in RFC 8484) and not > > the inability to observe (as called for in RFC 7626) that's at issue here. > > Hmm. Not sure what to make of that. DNSSEC presumably makes it > possible to detect interference, and yet RPZ (IIRC) calls for > not changing DNSSEC-signed answers. I don't get why an inability > to change is ok for the RPZ/DNSSEC context but not for DoH. i think that's off-topic. my point is, as an operator, i can decide whether to allow DoT to off-net providers, based on whether it's OK with me that i cannot see what it's doing OR interfere with its results. (and i choose _not to_.) whereas, as an operator, that choice was deliberately taken out of my hands with respect to DoH... by design. i think if the DoH people had wanted operators to have a choice, they might have said, DoT will handle anti-surveillance and anti-interference if it works, and the runtime will handle the selection. and, they wouldn't have said that one of their goals was to prevent on-path interference in DNS operations. their def'n of "interfere" is probably unrelated, having a totally different scope, to the RPZ concept of interference. > Another possibility is that we're discovering that when this > confidentiality stuff gets used for real, we find that we'd > really prefer to not have to change what we've been doing before. > I don't mean that as an accusation but it has been easy to > ignore e.g. the lack of deployment of DNSSEC or more recently, > DoT. i don't take it as an accusation, but this is about security economics, not new vs. old ways of doing the same thing, or preferences. the DoH people intended to dramatically raise the costs of on-path DNS interference. as an on-path interference fan, i don't like the choices they've left me with. one of those is "let any user or app inside my network do its DNS outside of my surveillance and outside of my (RPZ) policy controls." i won't be choosing that. my motives are grounded in security economics, teenagers, and malware. vixie From nobody Wed Mar 13 00:49:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B081130EA3; Wed, 13 Mar 2019 00:48:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tkdc9cqD3Lz1; Wed, 13 Mar 2019 00:48:43 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBD9212798E; Wed, 13 Mar 2019 00:48:43 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id B41F3892C6; Wed, 13 Mar 2019 07:48:43 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org Cc: Christian Huitema , "dns-privacy@ietf.org" , "doh@ietf.org" , Stephen Farrell Date: Wed, 13 Mar 2019 07:48:42 +0000 Message-ID: <4082161.Lf4rHVndz0@linux-9daj> Organization: Vixie Freehold In-Reply-To: <891d320e-f05e-f926-f74a-7c09c6ed553a@huitema.net> References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <2356055.DoC3vY7yXE@linux-9daj> <891d320e-f05e-f926-f74a-7c09c6ed553a@huitema.net> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 07:48:46 -0000 On Wednesday, 13 March 2019 02:59:07 UTC Christian Huitema wrote: > On 3/12/2019 2:11 PM, Paul Vixie wrote: > >> I don't see why, based on your argument, your concerns > >> trump his. > >> > >> Can you explain? > > > > he's trying to achieve a political aim using technology. that is not the > > purpose for which the internet engineering task force, or the internet > > itself, was convened. it is not why our employers pay our travel costs. > > and it is not why the rest of the world trusts our outputs. > > Sorry, but no. I am vying for network transparency, ... sir, that is a political position. > and I believe that > if filtering is to be enforced, it should be controlled by the user. sir, that is a political position. > You > are claiming that safety mandates giving the network operator full > control over name resolution. ... i am speaking not of the platonic perfect form of safety, of which any particular kind of safety is a mere imperfect reflection, but rather of a *very* particular kind of safety, that of the networks i operate. it is for me, and me alone, which is to say not for you, to say what kind of safety my network needs, or should have, or will have. > Both of these positions come from specific > visions about how the network should work. Neither is more a political > goal than the other. your stated goals are entirely political, resting in no way on economics, psychology, science, metaphysics, epistemology, or even engineering. vixie From nobody Wed Mar 13 05:48:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1563E130DE6 for ; Wed, 13 Mar 2019 05:48:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=innovationslab-net.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MK5JG27EcdnV for ; Wed, 13 Mar 2019 05:48:24 -0700 (PDT) Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2056124B0C for ; Wed, 13 Mar 2019 05:48:24 -0700 (PDT) Received: by mail-qk1-x72b.google.com with SMTP id c189so958728qke.6 for ; Wed, 13 Mar 2019 05:48:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=innovationslab-net.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:openpgp:autocrypt:message-id:date :user-agent:mime-version:in-reply-to; bh=CsUzPeORPYf7oE84ITb13DxM7WOqHJTmjyILi0PhHkk=; b=yLhPp4Bf1mlidBJjpkh7NL5d1Mpz5F/YhrW+WLN1ySxtocrPbWPHeNBHPhCVzJYGC1 V44gz2rIqrRbHpZxEHf2rOodb/WSAfAa4F4zb1pa1ftYUuvFy98o4D8OTMKkToQoIQOQ CUOHLWC4oWf+b32sWEjYNlzKjaYS1dpoXUB0Xdin3zM00P5s5ZzDeRg9/l8H9Z4KSfi6 b7JRMEMvqs/zb5ReEqhJgpQPSGTHwF/p8XlWjjiZ/KX0P98zB9+WlsTDtAeCAoNSqb+/ hMTclNW65CR8ZiE1DBf6bX9Ynikv01uaZ56KU8CHPWV6pmXekQJDG7Q13JX1BQlzre6v askg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:openpgp:autocrypt :message-id:date:user-agent:mime-version:in-reply-to; bh=CsUzPeORPYf7oE84ITb13DxM7WOqHJTmjyILi0PhHkk=; b=Kuuy8Ty3wXcZU+k2McYgWFqOkCCmA/6gs0wFB2vmdcOkWPRzDm9+hDacICBz3Dk9HO M8UVvdo2tFMZa7M7gPnrN5dSSctJWOA8cNb8HHEJw5LyMnmKt4x1gf+eA0rDawEKcvPM gM5nfdVD7tUy9iPV5Ca4vic/IPAWU+CPcHIrz+XujZTGGvQzcYqFhC7fj2Q70DZ+AGYq ZWIArPQvmmFx3+U9K7KIFvry4/dWxwl/aZiwPhQRqTSvXWUCpN3VW1Q2FG0C5hZI3uAP 3M1OtQoqjSZyFnGdM7GzmcXbn6KfA3cVWWD2gEvAr7/8VwUXPr73x+GhqF+ankpOtdp9 Aejw== X-Gm-Message-State: APjAAAVWC9BH7U04lli4QkV2EgyYEzEEE95M+wb0gAy7gCsMEGFHRdmp CKXNa0xAr1ISvan4EXWHIB10rQ== X-Google-Smtp-Source: APXvYqzDz/6a78gN07LPj/2xLSQo9UkEDdOkgROEjz9jMpd3hoVsM3FZXwiJVKh55P0IY0vZAhvCEA== X-Received: by 2002:a05:620a:1456:: with SMTP id i22mr32365573qkl.337.1552481303743; Wed, 13 Mar 2019 05:48:23 -0700 (PDT) Received: from clemson.local (edge-nat-all.jhuapl.edu. [128.244.87.129]) by smtp.gmail.com with ESMTPSA id d63sm9599518qka.22.2019.03.13.05.48.22 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 13 Mar 2019 05:48:22 -0700 (PDT) To: "dns-privacy@ietf.org" Cc: dnsop , "doh@ietf.org" , "int-ads@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <5342244.Q90AZAhhXk@linux-9daj> <2356055.DoC3vY7yXE@linux-9daj> <891d320e-f05e-f926-f74a-7c09c6ed553a@huitema.net> <0675B05A-54DE-4C07-A014-F8D4C272575E@cisco.com> From: Brian Haberman Openpgp: preference=signencrypt Autocrypt: addr=brian@innovationslab.net; keydata= mQINBFm5KgYBEACs2icafejrG19L5DRNFq8Q2O+K+LRxjR4qAElZDnXFXNA2ipFWPeT0J2wa KJ+h9UdfhDm8DzULB553CYm+Q3XF1N56TglkIRMZYc7mYXZEr3x7e4fmX4kD4qMjBLG8cL26 rEe3Q0qaiMGY69/4o5coVMT0qmHjgCH1tkG+L2Y8MKr1gFxS18eO8MVoWe1yDKuyxFSElHGB 3mZn4gcqeCaemPGG3CiVNlp4KnijpNcSgvseXbkQEA4IXEsIvUL8MIwOTXg9Gh5cbtisZpuf +4B0LNMUSqWlqyKd9M3KCMj+dW4vsFytc00Z+GyQ+ArOR9GwTdAwJ5qqVODTvbjKqOR1zolJ 1JxLUtSiv7Lx5x2OrCexPYXkzlTkjG9Imtg2XNh55R/JKMC3KU1NQL3nS9tJXeoRWNgWSZrG MsrbeejbqLVb9LblXNpgLciJ96XHMvYAXX7p4LAwivzSRrVg46vErYIAV6EvDvwVENWW8JCU 0vX5iTGfkEwU4KxCa7WAmmD8yiNspHP1J0uk93Sta5K0PuTi7b+EZlCjdrqOEWLGPv6qXlIu FwLLcCaDs3XdVvwgNM+UFRxFH1aOVQQKCiCOCcNlwgYG1u4ZbD2T6hd/d2tOAKu/MNnQVF7d Cfi2BtSjzglLcY61e37zqTM04BgU+LniZ7V99yneM6DM2UzgkwARAQABtClCcmlhbiBIYWJl cm1hbiA8YnJpYW5AaW5ub3ZhdGlvbnNsYWIubmV0PokCQAQTAQoAKgIbAwUJB4YfgAULCQgH AwUVCgkICwUWAgMBAAIeAQIXgAUCWbkqSAIZAQAKCRBo1jycU9GLYQixD/9UX0uiAvbJ+4dK z3Ne3kUdDK0Lk73RGfFgE/ezsc9I6ED82h+arC8pAoDnBWgzTxugZdbexek983bgMq02XFsG pJf7hudeKnB8UmtjTc0j1UUgi129FYyBmINS2Lz1gpEOygFfbeOGLJK5qZJwD3I3O6yN8SUZ uwahXXd1aEB+d1eGhNqxkjQ+L7vdfTlN662GWog3ROMwUbrg0+QAbn/Vlp2iIYO6VERUZ9Yr GfFJX9b9LKa6AHxzAaqFIix1h2wBiIacpIBGU/4+3+wL5zkCbGSRzoIHW8srllj7ehgwwfNx QevibuZWJ4XpHpIxrtsmBO7ERFk8pN7oiQ9M3b2Cg9OBD5vgxyMCHEKIblWyKz8GLtz5357L ORU1EBWB8BoJPBHz3u7bZE+jH9+w5PpI087Ae78KCDkTNj7o2wbkRoYLmLpMo8DOwAumyy5R 2DuRu0cn5Rw5pFjlJkyfM0Wf80Ml/SINrUORWeqSbsHSX8i+Y0Oyt5JNo9NFbgN0Gn/Qo364 I8cLgbvUAyFHwhnmbHB+QXFCGAy73NOQ+g2fCRPeSbihhYa34ugfmd4oa6W2w805ixzM7iGr P+wDB1dhA7eHKVmoo9Kxvm9VzU+2homYGEROd/H6n0BMvWtp1oFh/JvEgZN6dVLg3p+XX5Zj Ggy568bIY4P5kP7pAxh017kCDQRZuSoGARAAtCWxW1cRne/iGbFuibvB8d3upcbCB7oz4LWk LSE20Db2ymn04ici9V+wBSWX57me5jQdwMi/gzVVZcupbzWTg5Yhv7Qt7CKORJLEKo6nULbb 4aEpdOXD9s7wwx+foFjzjtDOH/JYoB+OEe2oW39VmK6EsIx7ClsLf6+cih5yApZHtmV+2M3J YSxD2kCUE619ITFLAkMf203ap5vJ6DDaaKnVoNhF9qV7jlJEceGqHTBG4KkBX/zNCehMIfhr ViY/B2IWAHeuZ99lnCPx2mehGGa4XLjQauUkY9KB7dOq/ODyt+7SL0dfWrOVf3BnU3C308b4 9YdId8KI4dJ30nfXn6ifTK9STZHZE+Mt1sIVmtEguqMXEk/axZmT14x194c7ZPmU/uCQTE3U y1NFs4Yof50WF1ze0CyN2ycmqx11mHjP5+L23TqcdIWmJG+EtdHUAFpu42kbB0fML3Oc/cEU SmWK3WpF5YPljLM2gyh3RXjuiBnaGoJaKTOj5zXQ2G2l3/ijbn9FbqmFup+R352dxUyakXEP xNe3HdyjfyUcy/RJNeZz/lgUIhkxWQjOOU1RIN41RtCKcF9tJjMwgQvI51QmPvf90/6ab3I/ vwEpjlRb4AbuWfPWe89J+Z3TG97V9sntlMcQ6MGiPLbyFpiXIf2150e6FxZdJtipVwY2d/kA EQEAAYkCJQQYAQoADwUCWbkqBgIbDAUJB4YfgAAKCRBo1jycU9GLYfy0EACYrxb4nWtOnIu0 N7rXXo/0ZjaBTyUhJ6hzy2D7rt3vv/qj2ui+N21ui/yMDS928za/XRfP25qN9A1puioHqN4l SAsxwCC3mT9GJXVXVgivg3MeciqBXoOdnk1hUkP1CTKL3qZ9pSuw8bPlNE7+b1xF7Oce37YH +QRVmBXbGwTxtDTCZ9Js0/IpiUtg9QCfmryB1r/fD0TFb8b9aCBuVeKocWSuX9UXRt7zRGM8 BJwOLvdLdGvV8us1imlBKFLai4L8CPgihuc/s7ZB0r3pgW697hXScWhGHF3OUWbPFVkNyivM xtDcq+9ZlUMrxFbwUEABi8NFwvzwn+YJQqlrPiF4xxsScYpnIlfWEuP6Vpp6Z/u5x+1MNyZb oxNWWaevMVeo3tdRV9F6/YFqucw4JQ9HqlCKQ62sW9+e5SSlxGNlV4j9cchG6a4fAZqxL+pS ks+KitK3ap/R4RUG+nbjLlhCwGJIti8lxvdYAoPqjtwEUmMJv4dIl0/2h1495cwBIi7XeRKZ Rx38TV3G3LCx0J8dFhkyTG5TxUZQFgHjznkIX7bzeSQX72MxT0b/tc38yM71WpAgAY+MlHCT FQRKqIQsH/4MFir+g/oV2uPNGwmg0QEOnv9zZ79JJ/nBmuXC2RwUVTtZgtiZXhaP0afvR0eg WPEzptIZZCSmtBOOYkfsAw== Message-ID: <688b5495-e3ba-8566-97df-a44766c6cda7@innovationslab.net> Date: Wed, 13 Mar 2019 08:48:21 -0400 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <0675B05A-54DE-4C07-A014-F8D4C272575E@cisco.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="otZVYRbBnnid2uWl1nGRcDgkDI1xwQm8g" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 12:48:26 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --otZVYRbBnnid2uWl1nGRcDgkDI1xwQm8g Content-Type: multipart/mixed; boundary="ystT07umaYWtRP2zFmphZPHdqbn0YuMl4"; protected-headers="v1" From: Brian Haberman To: "dns-privacy@ietf.org" Cc: dnsop , "doh@ietf.org" , "int-ads@ietf.org" Message-ID: <688b5495-e3ba-8566-97df-a44766c6cda7@innovationslab.net> Subject: Re: [dns-privacy] [Doh] [DNSOP] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <5342244.Q90AZAhhXk@linux-9daj> <2356055.DoC3vY7yXE@linux-9daj> <891d320e-f05e-f926-f74a-7c09c6ed553a@huitema.net> <0675B05A-54DE-4C07-A014-F8D4C272575E@cisco.com> In-Reply-To: <0675B05A-54DE-4C07-A014-F8D4C272575E@cisco.com> --ystT07umaYWtRP2zFmphZPHdqbn0YuMl4 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable All, I am saying this with my dprive WG chair hat on... As Eliot points out, this conversation has deteriorated beyond repair. I will now politely ask that these non-technical discussions cease on the dprive mailing list. I would recommend that everyone document their concerns with DoH and bring them to the side meeting being proposed by Stephane. Regards, Brian On 3/13/19 1:04 AM, Eliot Lear wrote: > Gentlemen, >=20 > This conversation has gone to the zoo. What is or is not political doe= sn=E2=80=99t matter at this stage in the game, and neither is arguing ove= r rights over bits. If people want to do that I suggest doing so in the = HRPC WG and with a draft in hand. Flaming back and forth without an obje= ctive of actually modifying text or developing a work proposal is quite p= ointless. >=20 > What is important is to document the technical ramifications of the cha= nges brought about by DoH. To move things forward, can we simply go thro= ugh the drafts in the side meeting, and indicate what administrators migh= t do about any perceived negative effects? Whether those effects seem ne= gative to you only matters if there is a proposal for the IETF to take on= new work to =E2=80=9Ccorrect=E2=80=9D them. >=20 > Eliot >=20 >> On 13 Mar 2019, at 03:59, Christian Huitema wrot= e: >> >> >> >> On 3/12/2019 2:11 PM, Paul Vixie wrote: >>>> I don't see why, based on your argument, your concerns >>>> trump his. >>>> >>>> Can you explain? >>> he's trying to achieve a political aim using technology. that is not = the >>> purpose for which the internet engineering task force, or the interne= t itself, >>> was convened. it is not why our employers pay our travel costs. and i= t is not >>> why the rest of the world trusts our outputs. >> >> Sorry, but no. I am vying for network transparency, and I believe that= if filtering is to be enforced, it should be controlled by the user. You= are claiming that safety mandates giving the network operator full contr= ol over name resolution. Both of these positions come from specific visio= ns about how the network should work. Neither is more a political goal th= an the other. >> >> -- Christian Huitema >> >> _______________________________________________ >> Doh mailing list >> Doh@ietf.org >> https://www.ietf.org/mailman/listinfo/doh >=20 >=20 >=20 > _______________________________________________ > dns-privacy mailing list > dns-privacy@ietf.org > https://www.ietf.org/mailman/listinfo/dns-privacy >=20 --ystT07umaYWtRP2zFmphZPHdqbn0YuMl4-- --otZVYRbBnnid2uWl1nGRcDgkDI1xwQm8g Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEUZk246qFfyoMW2DGaNY8nFPRi2EFAlyI/BUACgkQaNY8nFPR i2Gl4xAAk1+XrLFpoNOe2sa+s5NnURieCW+ePpWyna/bpnaxLHD+sKawg7M3rD5J fA7L5LC0wioxEixsKHHbgqIA3TpqGVIctYM1CaN2B1sLbqzkKZb4z5SiDkjMeYFc tiye2IkNppVrkqKLOL5MB8k+xH+UxbIJ8/wHuM+dMKf/FTWQwMK3gEQSkEorbJdW HuPpizp+iRlogD8u2t3RgswdIXO5mZgPQJADCWppWPCo8EIVofCuGvMRu3wihUcw R8K9Yxw3MNVwkn22buFEYfuiGzNMLBhXVygc0/C9UpHgnLbLqCGpj2kKvpZogYVR Y8WumVJzZkXxIXlXq27yPcwXQwDK/u9mFy1AEwPQxJr1E6b0p2qMQr0UzrJDLWz0 45R3zC74eZznTPWXbsCIam6opWnxnysb1ylzkYZdAMetcljr21Kr08noY423Al9H GbFSY76Rg77rubE7FTAyVxd6LExcG7HMNC9WNDb/R8dUZMfXUKSEGIxctx5Nro1W 6ockJ2hHwHL86Q/YgYg5CI6590f804iEbVpy6VIc54ecgKH2X8PWxnyAvV3dWSBJ gvSofksAeG8WkNezH4202JTdEQ29eyGB2FFMc3L6O2eCiUF9WQrNbQEaVITR/VCG UiCzR7xvZ1QmVQUokaz8FQGeoTuZSRAf46GtTq31mXuOpi+MNyI= =ajUw -----END PGP SIGNATURE----- --otZVYRbBnnid2uWl1nGRcDgkDI1xwQm8g-- From nobody Wed Mar 13 08:16:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77AD112716C; Tue, 12 Mar 2019 19:38:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aHw7QjBxyBG2; Tue, 12 Mar 2019 19:38:46 -0700 (PDT) Received: from mail1.oneunified.net (mail1.oneunified.net [63.85.42.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F49F12705F; Tue, 12 Mar 2019 19:38:46 -0700 (PDT) X-One-Unified-MailScanner-Watermark: 1553049515.8886@6zlgKkcO8Jee+kC+8YVo8w X-One-Unified-MailScanner-From: ray@oneunified.net X-One-Unified-MailScanner: Not scanned: postmaster@oneunified.net X-One-Unified-MailScanner-ID: x2D2cVmO015007 X-OneUnified-MailScanner-Information: Please contact the ISP for more information Received: from [10.55.40.139] (h96-45-2-121-eidnet.org.2.45.96.in-addr.arpa [96.45.2.121] (may be forged)) (authenticated bits=0) by mail1.oneunified.net (8.14.4/8.14.4/Debian-4) with ESMTP id x2D2cVmO015007 (version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NOT); Wed, 13 Mar 2019 02:38:32 GMT To: Christian Huitema , Paul Vixie , dnsop@ietf.org Cc: Stephen Farrell , Eric Rescorla , "doh@ietf.org" , "Konda, Tirumaleswar Reddy" , nalini elkins , "dns-privacy@ietf.org" , Vittorio Bertola , "Ackermann, Michael" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> From: Raymond Burkholder Organization: One Unified Net Limited Message-ID: <11b615ed-a5df-8f58-605e-a610a60886e3@oneunified.net> Date: Tue, 12 Mar 2019 20:38:31 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Wed, 13 Mar 2019 08:16:11 -0700 Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 02:38:47 -0000 In the below commentary, there are some use cases which are not being included .... On 2019-03-12 12:56 p.m., Christian Huitema wrote: > On 3/12/2019 11:35 AM, Paul Vixie wrote: > >> if someone is concerned that some of the web sites >> reachable through some CDN are dangerous... > > > Paul, who is this someone? How do they decide? What does dangerous mean? > These questions are very much behind the tension we see today. And the > answers are not as black and white as "this is my network, I get to decide". There are enterprise networks. There are home networks. There are some socially organized networks. All seeking protection for their users, or for themselves, or both. And sometimes/many-times, there has to be 'some-one' who can define some level of protection for the collection of users. DoH is almost like a trojan. Secret queries can be made to the outside world. For the 'protector' of the infrastructure, the job then becomes more difficult to perform. Are there security personnel included in these conversations? > For example, users routinely delegate the filtering decision to some > kind of security software running on their device, often with support > from some cloud based service. They are making an explicit decision, and > often use menu options to decide what type of site is OK or not -- > adults would probably not subscribe to parental control services. There > is a market for these products, they compete based on reputation, ease > of use, etc. This could be a legitimate scenario. But what if users are inside the domain of enterprise/home/organization/social, they would need to delegate their security to those who are maintaining that 'network'. But when the users can build their own DoH 'tunnels' and hide that traffic amongst other https traffic, security can be harder to enforce/manage/supervise/maintain/forensically-identify. > > You are saying that whoever happens to control part of the network path > is entitled to override the user choices and impose their own. Really? I would say, yes. > As Stephane wrote, that may be legit in some circumstances, but much > more questionable in others, such as a hotel Wi-Fi attempting to decide > what sites I could or could not access. It really is a tussle. Yes, a tussle. There are many use cases. The 'power of the individual' vs the 'will of the people'? [does not totally properly convey the concept, but close enough] From nobody Wed Mar 13 08:17:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4E0A6130F1E for ; Wed, 13 Mar 2019 08:17:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=0 tagged_above=-999 required=5 tests=[SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bEfOF_ufT3C6 for ; Wed, 13 Mar 2019 08:17:10 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB7BB130F1C for ; Wed, 13 Mar 2019 08:17:09 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id 7600A8D92B; Wed, 13 Mar 2019 11:17:08 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23689.7924.461871.555714@gro.dd.org> Date: Wed, 13 Mar 2019 11:17:08 -0400 From: Dave Lawrence To: doh@ietf.org Archived-At: Subject: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 15:17:13 -0000 * Note Well https://www.ietf.org/about/note-well/ * draft-ietf-doh-resolver-associated-doh, Paul Hoffman, 30 minutes https://datatracker.ietf.org/doc/draft-ietf-doh-resolver-associated-doh/ * draft-livingood-doh-implementation-risks-issues, Jason Livingood, 10 minutes https://datatracker.ietf.org/doc/draft-livingood-doh-implementation-risks-issues * draft-reid-doh-operator, Jim Reid, 10 minutes https://datatracker.ietf.org/doc/draft-reid-doh-operator/ * Open discussion From nobody Wed Mar 13 09:56:51 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14EDA130F35 for ; Wed, 13 Mar 2019 09:56:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.101 X-Spam-Level: X-Spam-Status: No, score=-0.101 tagged_above=-999 required=5 tests=[DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I2nncC3_bPzp for ; Wed, 13 Mar 2019 09:56:34 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76AEF130EF5 for ; Wed, 13 Mar 2019 09:56:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552496191; x=2416409791; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=hcckXDqK2dXtoKoPlWKBwcJIx9aIZIE1Xj3taF6mMLM=; b=ZVkhdV2GWsSQLPLUOd8EnFplQV9wn4kUt3luMpKO4Ip28+MJtudJlC3IHfwvQZMM qnXtCj048/v7+CEygqjNqHE+sRMRWA+L/GAHyV2VzBRNG/oZvWxdVO7owLOLROfm GxC7XDEo9uL3/GyqYy8Co0PhrX1aO7HgXqy98+a2FzdurnQFeCO8W/fz0ffyloxw NEnCQ4r3UBt9PVbZxtJvVY8io4+up4MKLm5PxuWFTJOHQOYrJ3X9oXUpQZlWbYKv nptFux7xuIHfim/Zt1F1cPyuF/HMcv4ZewCHkSQ1QoLXsDnnkuVwQqKxcMnAhopF MbofMw11089vcBGObaHY33bOtgLzDaNtqsuB03V99VUuMQM9UqHvpqixhhzwiwyF LWLMoVxeWQHHNfRHu0dXJV2T3PdcLCMOFbSFhVsq+GnSLhIgfYcRSzl3lL2H7siK 4oFzdwSy+o0JaFeM1eVvwNv595+uGk33XOAK2xe5PQ2WTFz1CytmvHjbBjmRFXli xWB/KP6Gin6L5T0yH68XnppEMP8yp2dgNp7Vy8/q80t4SL7DvVCzh0zsOUtjDTQK 6DrtF310bsZHYM7Eohwqx2MsB0CQSiUYLCXcsXTvHd4XgqE50UDscIxudmCMfl71 TgDVFgB9e6wKqxMAlAxinPz59XwK7liuJmjmQ+4R1Hs=; X-AuditID: a2962c47-fa3ff7000001abb1-2e-5c89363f2544 Received: from COPDCEXC36.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 83.14.43953.F36398C5; Wed, 13 Mar 2019 10:56:31 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC36.cable.comcast.com (147.191.125.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Wed, 13 Mar 2019 12:56:32 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Wed, 13 Mar 2019 12:56:32 -0400 From: "Livingood, Jason" To: Christian Huitema , Vittorio Bertola CC: "dns-privacy@ietf.org" , "doh@ietf.org" , "dnsop@ietf.org" Thread-Topic: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients Thread-Index: AQHU2U5xYCVl1bA2KUe9+xSi0am9yqYJyM2A Date: Wed, 13 Mar 2019 16:56:32 +0000 Message-ID: References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> In-Reply-To: <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [96.115.73.252] Content-Type: text/plain; charset="utf-8" Content-ID: <2C5A4356C6186645BA8A760932B9AD09@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrFKsWRmVeSWpSXmKPExsWSUDRnsq69WWeMwaZlyhYbWnewWtx9c5nF 4trdi2wWkxtns1u8OrmT3YHV49aMUyweS5b8ZPKY9XgiewBzVAOjTUlGUWpiiUtqWmpecaod lwIGsElKTcsvSnVNLMqpDErNSU3ErgykMiU1J7MstUgfqzH6WM1J6GLK2HzlDXvBPraKSbs3 sDUwrmDrYuTkkBAwkbj1bCKQzcUhJLCLSaKp8ys7hNPCJHHu6C5mCOc0o8Se5g52kBY2ATOJ uwuvACU4OEQEkiWm7hcHCTMLlEpsfHSZFSQsLOAtceVTAUhYRMBHYvrDV4wQtpHE1VkvWEBK WARUJR49rAMJ8wq4SPzbfIoVYlMXs0TP2y5mkASngL3Es8mLmUBsRgExie+n1jBBrBKXuPVk PhPEAwISS/acZ4awRSVePv7HCmKLCuhLbNx0FOpJRYl/s9eD7WUW0JRYv0sfYoyVxMtLJ9kg bEWJKd0P2SHuEZQ4OfMJC0SruMThIztYJzBKzkKyeRbCpFlIJs1CMmkWkkkLGFlXMfIamhnp GZoa6JmY6JkbbmIEpqhF03TcdzB+OB97iFGAg1GJh3eTcmeMEGtiWXFl7iFGCQ5mJRHeUD2g EG9KYmVValF+fFFpTmrxIUZpDhYlcV6z7x0xQgLpiSWp2ampBalFMFkmDk6pBsb5d+RyLBd5 piSE5x9R3/Lcx35rWvfklJNnjRZf6M9j3la28cmh7+27Xub+WLRS3WBheFtiysr6jtdm88U3 K5/47TdR5VnpQbdZdZzHZJPbZ5rd28k7W2P7BMcF06tFv9Y8sjXz/jP57vcq5o8MaorXAg69 EJx+5qrc5bvWb8SWc2pt3saV4WWlxFKckWioxVxUnAgA6UoYWE0DAAA= Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 16:56:36 -0000 T24gMy8xMi8xOSwgMTE6NDAgUE0sICJEb2ggb24gYmVoYWxmIG9mIENocmlzdGlhbiBIdWl0ZW1h IiA8ZG9oLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIGh1aXRlbWFAaHVpdGVtYS5uZXQ+ IHdyb3RlOg0KDQo+IFdoeSBkbyB5b3UgdGhpbmsgeW91IGNhbiBmaWx0ZXIgY29udGVudD8gV2hv IG1hZGUgeW91IGtpbmc/DQoNCltKTF0gRW5kIHVzZXJzIG1heSBoYXZlIG9wdGVkIGludG8gLyBz dWJzY3JpYmVkIHRvIHN1Y2ggYSBwYXJlbnRhbCBjb250cm9sIHN5c3RlbS4gQW4gZW50ZXJwcmlz ZSBtYXkgc2F5IHdlJ2xsIG9ubHkgY29ubmVjdCB0byB0aGUgSW50ZXJuZXQgYW5kIGFsbG93IHRy YWZmaWMgb2YgWCBvciBZIHR5cGUgaW4vb3V0IGZvciBzZWN1cml0eSByZWFzb25zLiBBbmQgYSBw cmltYXJ5IHNjaG9vbCBtYXkgYmUgbGVnYWxseSByZXF1aXJlZCB0byBmaWx0ZXIgb3V0IGFkdWx0 IGNvbnRlbnQgaW4gZXhjaGFuZ2UgZm9yIGEgZ292ZXJubWVudCBncmFudCB0byBmdW5kIHRoZWly IG5ldHdvcmsvY29tcHV0ZXJzL2Nvbm5lY3Rpdml0eS4gVGhlcmUgYXJlIG1hbnkgbW9yZSBleGFt cGxlcyB0aGF0IGNhbiBiZSBjb25zaWRlcmVkLg0KIA0KDQo= From nobody Wed Mar 13 13:30:15 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D16731311BF; Wed, 13 Mar 2019 13:29:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2xLZbcxYxqZ7; Wed, 13 Mar 2019 13:29:52 -0700 (PDT) Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7AD11311AC; Wed, 13 Mar 2019 13:29:51 -0700 (PDT) Received: by mail-qk1-x72b.google.com with SMTP id n6so1976181qkf.1; Wed, 13 Mar 2019 13:29:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OHiuMaBnn3sxOM0p53JNZ2hsd3awsaCKexj+OAxXACo=; b=ZrW26DrdlFY4tuYJkQwUzhjD1dc1enqDZDE1r7gyMb7gHWrSN2VRQ5swhqLMBZQKwF nIvIABeJW8Aj2Z8zKBMqNDC8jzqNgf1da1Of31qRUuTbFsPcSP8ahyUmVxFistxwUikR Ds9KWPyC0n7m1Npg6ym4Kd8Qm1rl4bQmNuhJPl7o+H5uwCFc5cJg+gGRt1fU+48pXvA+ ygmV1BJp806LvymY82363RWvjedS8QO1f8Gt03wCzb4opmnEI50ekwAyhJUZEV6SKcDo i2AS+EdWU86UA1rTTAEpCZArhU1cckiD4HyGtgwTYioZ9oQgs/lPUARCy9d/+FqoEHFg /kFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OHiuMaBnn3sxOM0p53JNZ2hsd3awsaCKexj+OAxXACo=; b=bHdF/ph4CKVbb9uFNaILPUso4NRO27HMjPvdBqLtJx2QZWpVQEtxV/ccWPP1s/0pue O+oRCZOb5mRUdyVmMV2O0+63wMsqmy3rHsqw4enIc52NBp2DpOYqG2LG9HyctL4eBybx 2nBFDU2krbg2h66vAs5LVuANAsWxR4y16DcEDZUUxugF0ObXn+NbyoRaVR8f2qNEOx1N 5Sg1iE9RCsJ7VyXkLtWbkh/Jf+I4CEQVruyLcq4zqPhusGmclqyoow1+pwFrCuKg/Qgv KSkYEDc7CWuXW7WmKFaLVhcMwFmMdRQgKrb7AaVuPb6S3zdJQqVB2fBGQM2WNHAAm261 fxsA== X-Gm-Message-State: APjAAAW3DI8yoB1PU5F48DomZL2FCCkYf0HHHpqXe9VGu4EadK9fTe1B NW4rUMDvwLsuwj90hk1eJYkwrvhYq+PqTCfqmIk= X-Google-Smtp-Source: APXvYqwZYbC7j63Oov63pzYU802EDWtk5y9B5y/1iGfaw8cp6DFPgw86Vz+H07UOy8dqDjQ4s5QIlKwRAypPFkOtLKo= X-Received: by 2002:a37:d6ce:: with SMTP id p75mr15063034qkl.286.1552508990888; Wed, 13 Mar 2019 13:29:50 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> In-Reply-To: From: Brian Dickson Date: Wed, 13 Mar 2019 13:29:28 -0700 Message-ID: To: Christian Huitema Cc: "Livingood, Jason" , "dns-privacy@ietf.org" , "doh@ietf.org" , "dnsop@ietf.org" Content-Type: multipart/alternative; boundary="000000000000e99f350583ffaae8" Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 20:30:01 -0000 --000000000000e99f350583ffaae8 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 13, 2019 at 12:18 PM Christian Huitema wrote: > But then, if the user has not opted in such system, it would be nice if > the ISP refrained from interfering with name resolution for that user. How > do we achieve those two goals in practice? > > -- Christian Huitema > Even that starting point is not accurate or correct, IMHO, at least for scope, or whether/how any given DoH implementation interacts with the user(s). Jason was suggesting that there are (or at least may be) multiple levels of ISP and/or Enterprise and/or controlled (parental) stuff; those might nest with no "naked" root (unfiltered) depending on the particular ISP, or mandated legal thing, or "public" offering doing anything questionable. Notwithstanding any desire to have users use DoH to arbitrary endpoints, in some environments (enterprises) or regulatory environments (western countries which have different restrictions on legal contracts and user acceptance stuff. This means that it is NOT the case that EVERY potential deployment environment is going to be compatible with a DoH client that bypasses any controls that might be present, without violating laws, contracts, or other controlling limitations. The starting place for the conversation needs to acknowledge this, and accommodate it. It is entirely possible that a DoH client that doesn't do a minimum level of getting user acknowledgement before violating policies, laws, or contracts, might itself be illegal in some jurisdictions (jurisdictions that could include some US states, some western countries, some larger entities like EU, etc.). This is not to say it isn't going to be the case that users can't "force" some kind of DoH-like thing, only that it needs to be under some kind of affirmative control, where a user makes an informed decision with some kind of explicit understanding/acknowledgement. It probably would be advisable for DoH implementations to NOT make that explicit acknowledgement externally visible to e.g. authoritarian regimes, but that is stuff to discuss/explore, i.e. it's an open question. It would be very helpful for moving the conversation forward if the DoH proponents could start with acknowledging this set of legal/contractual issues, and that any kind of DoH client that just automatically does stuff that bypasses any mechanisms to restrict DNS, likely isn't known to be compliant with all laws in all jurisdiction (and probably would be problematic, at a minimum). Brian --000000000000e99f350583ffaae8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, Mar 13, 2019 at 12:18 PM Christia= n Huitema <huitema@huitema.net> wrote:
=20 =20 =20

=C2=A0But then, if the user has not opted in such system, it would be nice if the ISP refrained from interfering with name resolution for that user. How do we achieve those two goals in practice?

-- Christian Huitema


The starting place for the con= versation needs to acknowledge this, and accommodate it. It is entirely pos= sible that a DoH client that doesn't do a minimum level of getting user= acknowledgement before violating policies, laws, or contracts, might itsel= f be illegal in some jurisdictions (jurisdictions that could include some U= S states, some western countries, some larger entities like EU, etc.).

This is not to say it isn't going to be the case t= hat users can't "force" some kind of DoH-like thing, only tha= t it needs to be under some kind of affirmative control, where a user makes= an informed decision with some kind of explicit understanding/acknowledgem= ent.

It probably would be advisable for DoH implem= entations to NOT make that explicit acknowledgement externally visible to e= .g. authoritarian regimes, but that is stuff to discuss/explore, i.e. it= 9;s an open question.

It would be very helpful for= moving the conversation forward if the DoH proponents could start with ack= nowledging this set of legal/contractual issues, and that any kind of DoH c= lient that just automatically does stuff that bypasses any mechanisms to re= strict DNS, likely isn't known to be compliant with all laws in all jur= isdiction (and probably would be problematic, at a minimum).

=
Brian
=C2=A0
--000000000000e99f350583ffaae8-- From nobody Wed Mar 13 13:35:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD5BC131101 for ; Wed, 13 Mar 2019 13:35:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 43KGalHycStv for ; Wed, 13 Mar 2019 13:35:53 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1578813117C for ; Wed, 13 Mar 2019 13:35:52 -0700 (PDT) Received: from xsmtp05.mail2web.com ([168.144.250.245]) by mx61.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h49OW-0009Ym-EB for doh@ietf.org; Wed, 13 Mar 2019 20:18:34 +0100 Received: from [10.5.2.12] (helo=xmail02.myhosting.com) by xsmtp05.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h49ON-0005ih-V6 for doh@ietf.org; Wed, 13 Mar 2019 15:18:24 -0400 Received: (qmail 32445 invoked from network); 13 Mar 2019 19:18:17 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail02.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 13 Mar 2019 19:18:16 -0000 To: "Livingood, Jason" Cc: "dns-privacy@ietf.org" , "doh@ietf.org" , "dnsop@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: Date: Wed, 13 Mar 2019 12:18:17 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------67D03749B66F24A949D9AE15" Content-Language: en-US X-Originating-IP: 168.144.250.245 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.18) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5pTTN8PgWDqTDEcWeZII/NF602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxhlT66ct9yATF5KuxCeF+g0h5 mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2OueuKdIJKegN3+UcLNo4xPvRa7MR4hgRIg8N 1QlY4G7x1YBTEs55LirRLgpsvCFt8i77Wu2Jb/TI0CxS53moc/SlgXpNwUDmiieE9G+9VqfZ1kay mqFCHRp6u+mIhIXg5jssJAnfERZ2C5vj1sOdsnQOD0r6/AaHZiEtdTMtMljoSvSqrGwueTSCQFid cy15jQ4HwbF4aWaRl0axA525ouWBOXp8nHKe0R+FkIqN7hkgzj0zEmu34GPXR572RNl5VgW9/bkt U41htiJ8fk7NkHmplbyYh4+w03es32OzjfSo5Jhwk+hMTKYppuA2BaWeipTPWMHGUquOFNpW9R6n Md9TLrF9l3ItGfA/WrnALV4O+LqJJua78ceBEzhPyCYOnCaCEKGdKQmLPXZE3/X31tpnVytX3Jff sloDSAEjEVGAImxrekFydH4DojSCKJXVXfdz0+Q1eHsqtFQKXUaZ+h596SWGosiQ15/fAFUBngWU swziTuoonQBgr0dS5AZLiwQzKw+6v3CaIMG6s7LqJB5zW4lvOt7yZYITzR9pjE5SyaRgIwuFZktu hI3SFVkngxqIs2A0wIuMQXal9Gcq2lhtZgX36S/gvs9EAgT5AUPtOuTWXXIj0TpQpfUxR/zGwdBB Bfh3x3VaPNtdo70DPj5Gegm2Di+XkC+U0gjMGGKacOVTXotsdlkDAl5HBq84rNLMkKiSx4DbX99P +gh4iWPT5m4OdqWMdE0b4Joz08+J+cv73CChOPjKA0/DVd830vHLIFSGGMV7x6CHvZpJG/9P/4OG qJ5dkO1xTEy0joEwyGTHIAoNFX+jcW7DGmdEezpuI9IICsCKA/p66v7fhw== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] [dns-privacy] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 20:35:55 -0000 This is a multi-part message in MIME format. --------------67D03749B66F24A949D9AE15 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 3/13/2019 9:56 AM, Livingood, Jason wrote: > On 3/12/19, 11:40 PM, "Doh on behalf of Christian Huitema" wrote: > >> Why do you think you can filter content? Who made you king? > [JL] End users may have opted into / subscribed to such a parental cont= rol system. An enterprise may say we'll only connect to the Internet and = allow traffic of X or Y type in/out for security reasons. And a primary s= chool may be legally required to filter out adult content in exchange for= a government grant to fund their network/computers/connectivity. There a= re many more examples that can be considered. Take the example of end users who may have opted in a parental control system. Some may have, and some may not have. If we want a productive conversation, we need to start from scenarios like that. If an end user has opted in a specific parental control system, then applications performing their own name resolution should follow the end user preference, and it would be nice to have a management interface exposing that. But then, if the user has not opted in such system, it would be nice if the ISP refrained from interfering with name resolution for that user. How do we achieve those two goals in practice? -- Christian Huitema --------------67D03749B66F24A949D9AE15 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit


On 3/13/2019 9:56 AM, Livingood, Jason wrote:
On 3/12/19, 11:40 PM, "Doh on behalf of Christian Huitema" <doh-bounces@ietf.org on behalf of huitema@huitema.net> wrote:


Why do you think you can filter content? Who made you king?

[JL] End users may have opted into / subscribed to such a parental control system. An enterprise may say we'll only connect to the Internet and allow traffic of X or Y type in/out for security reasons. And a primary school may be legally required to filter out adult content in exchange for a government grant to fund their network/computers/connectivity. There are many more examples that can be considered.


Take the example of end users who may have opted in a parental control system. Some may have, and some may not have. If we want a productive conversation, we need to start from scenarios like that. If an end user has opted in a specific parental control system, then applications performing their own name resolution should follow the end user preference, and it would be nice to have a management interface exposing that. But then, if the user has not opted in such system, it would be nice if the ISP refrained from interfering with name resolution for that user. How do we achieve those two goals in practice?

-- Christian Huitema

--------------67D03749B66F24A949D9AE15-- From nobody Wed Mar 13 13:43:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 827D41311A5; Wed, 13 Mar 2019 13:43:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oxc1sVYbMNzI; Wed, 13 Mar 2019 13:43:29 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B792B1311D3; Wed, 13 Mar 2019 13:43:28 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D0A61BE5F; Wed, 13 Mar 2019 20:43:24 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NgY9ncDkNoZT; Wed, 13 Mar 2019 20:43:23 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 57936BE2F; Wed, 13 Mar 2019 20:43:23 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552509803; bh=7lX+ztclb6ALfj93OrWuSCihcmvUjbm+vC3BP01+IHc=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=rD7sXhYKFzzN0Cv9k/5yi8KQR1SMC1dBe0uFydjp2Iel1ps974iGEk9OM/S0HjOrf 2WKh1BlrC/gI+d+Cp+M40dC7la20RN2V+aM+z0jhnqvB3VzrzDBHU1vt52vZuFHa0C cCkYK1SXVlrsMEgCqjbfqin5vzJqk+ONxmkTJpPc= To: Brian Dickson , Christian Huitema Cc: "dnsop@ietf.org" , "Livingood, Jason" , "doh@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 13 Mar 2019 20:43:21 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="MmHJOpZSCTelDcMJPYe52hwHkjsWnR8w1" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 20:43:34 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --MmHJOpZSCTelDcMJPYe52hwHkjsWnR8w1 Content-Type: multipart/mixed; boundary="u3nb4XrvmzNMqhIdsVxTYOW4B9FPGjwWR"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson , Christian Huitema Cc: "dnsop@ietf.org" , "Livingood, Jason" , "doh@ietf.org" Message-ID: Subject: Re: [dns-privacy] [DNSOP] [Doh] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> In-Reply-To: --u3nb4XrvmzNMqhIdsVxTYOW4B9FPGjwWR Content-Type: multipart/mixed; boundary="------------A9C1AAA12C31D1D59BBED665" Content-Language: en-GB This is a multi-part message in MIME format. --------------A9C1AAA12C31D1D59BBED665 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable (dropping dprive list at WG chair request) Hiya, On 13/03/2019 20:29, Brian Dickson wrote: > The starting place for the conversation needs to acknowledge this, and > accommodate it. It is entirely possible that a DoH client that doesn't = do a > minimum level of getting user acknowledgement before violating policies= , > laws, or contracts, might itself be illegal in some jurisdictions > (jurisdictions that could include some US states, some western countrie= s, > some larger entities like EU, etc.). I almost agreed with you that people need to ack others' priorities. But the above means I can't agree with your mail as "might be illegal" is vastly overstated, there being no relevant difference between DoT and DoH clients in this respect. Such overstatement doesn't help and merely makes it more likely that some of the reasonable points you make will just get lost in the noise (IMO anyway). The same goes for talk of "wars" btw. Cheers, S. --------------A9C1AAA12C31D1D59BBED665 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------A9C1AAA12C31D1D59BBED665-- --u3nb4XrvmzNMqhIdsVxTYOW4B9FPGjwWR-- --MmHJOpZSCTelDcMJPYe52hwHkjsWnR8w1 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyJa2oACgkQWrL68XsX K+oE2RAAwLkUSR75fXAswTjqp01UfE+4iXw88aoeJc3xWA6vbIqUwwgOLJ8AoizM JfqCRoA/1B+HPQv5lmH5vXZeOnW+OI1nihbaED8r/4hj7o8OKpsUfZ3F23iQPGUo JLUCTpvX9BVQuP0NQM45WxErcmDdNkr0qMHig8CiNb9wXBOa4waw+JumvPR+DHQo o2qmOSipGHj3/+2B8LwSunAYfxDjYS6KEAtsz6DfS5ZMbb/bFc2MC4cY4fBAd4tQ AUB6imifYenMLE+QhKGn5nb4jcagtDvKfG/hhuD3ZU3ySUr9dMRScYejMPoRk8DH ZfZgQkcThje7gBz+P45IijJZR5zwrfzTFAtDqb+7K+7od7i8q89R2bQJ5+RMHWm6 yZrRWyABr8dsv9CVxI4I2omxkA9fNBpM4nXVq1dzwb799QQjNKRk+FBM5kiOzN94 3OmyNNWDAH0YpINj4lI7n0YvwMGazD26W8Yw8rq17JRk4aCenN2xicEmoZF6/3Tz +sBHtLeBw3NGvtyFW9JJbtFvuRKFU+UyFWASXABs0QflULaZxQf+42FtUFC8Q0b/ tVcQV6JwnGlcAFPEHw5NDnZddMSZjPIJM5UEEiYH8ATU23kDtllyMyeiMAdHhIm+ EBtyd+YDxeTFJABq0+ISOUNgiK3Q9mm/VFRLZpP5BFg6v4yc5u0= =5Alk -----END PGP SIGNATURE----- --MmHJOpZSCTelDcMJPYe52hwHkjsWnR8w1-- From nobody Wed Mar 13 14:06:41 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DA311311B9; Wed, 13 Mar 2019 14:06:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QH8q9PY2V2Sc; Wed, 13 Mar 2019 14:06:37 -0700 (PDT) Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 09D471311B2; Wed, 13 Mar 2019 14:06:37 -0700 (PDT) Received: by mail-qt1-x831.google.com with SMTP id z25so3644560qti.13; Wed, 13 Mar 2019 14:06:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5llX2gMV8NK694d5GX27kbyv+7hGqVUAUXLfZ2NHy9M=; b=VAJUYpRSQqY8NG9nUBQg+cdxREBhWxykHWouhpbbGF7VWXBcIXpUPUhN3enZPyGbhQ wKM9Oddw2W6SayMrgsccFI9HLfl2sZWwmqLv3P0HUkAcY7cNlYvZY3oaKTN6jLFVMEUp vAf5KoGSB7Gx0m2mh6cqR3c8QJ1veWrMznuxdtnHI15vY4p6bnx05xHyZMy50WpVtgZL 6c0UKAI4kTBxFckT2nFHOlodOfVpOEHmkY/TWXIFVcSLtBXPhI6E79oZQppTBN1SzgYB gssbq1/uvhMQmZGo6/in6Qw5l9XJC6C31d34lkt4KpTOu2Bi/uWOmniQeOXz3GinSTuH 0PnA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5llX2gMV8NK694d5GX27kbyv+7hGqVUAUXLfZ2NHy9M=; b=WyYYr1f8lvG1u5RiOHz5y4w25PLuvntQkhTGtr4g4cbJFUIkgGix+MyYFz3zgLA+FR ArPZpomHwoO9aPQ4Cm2N8i12TASonEycFo+uDQUzqS38ivQl4Omjj4WTUxnQtRrVtAwx fwN8KDG9OO3XYx5OO0vW08xBm5MK5WlRK0IHxwtUu7oHOP4Awz/u8rqqw5nVpXNo6Esx VyjVwKbMPhyFAm1b1J6l7oIrGbil/GJjmHSr4pMmLsV8e+kEikPDQQMLx6O959Diuv/a Wm1voplnaj2gSrBrwJnhTrZmCyzPLnGAN05mrfMszvohFtE2+KPPmX7RRTAdFn9LZuTl VSZw== X-Gm-Message-State: APjAAAWPbbylPTXMquUGR2qPl9Vf8R4cWV7mtWBVTRfSQxS9hTTNvsvG +dpanYqY2aRLY4H3zE2kxcekoFmEegVCYV7Tlz4= X-Google-Smtp-Source: APXvYqx3HWZd+fi///YqTPBYcIpAb/P6VpqWBe44Pf2ErEmaVX21n3M077HaPADIeg4DzNXaeF8DVQIfHuPjYOBlRkQ= X-Received: by 2002:ac8:96c:: with SMTP id z41mr35679084qth.305.1552511196048; Wed, 13 Mar 2019 14:06:36 -0700 (PDT) MIME-Version: 1.0 References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> In-Reply-To: From: Brian Dickson Date: Wed, 13 Mar 2019 14:06:13 -0700 Message-ID: To: Stephen Farrell Cc: Christian Huitema , "dnsop@ietf.org" , "Livingood, Jason" , "doh@ietf.org" Content-Type: multipart/alternative; boundary="00000000000059b41b0584002e86" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 21:06:39 -0000 --00000000000059b41b0584002e86 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 13, 2019 at 1:43 PM Stephen Farrell wrote: > > (dropping dprive list at WG chair request) > > Hiya, > > On 13/03/2019 20:29, Brian Dickson wrote: > > The starting place for the conversation needs to acknowledge this, and > > accommodate it. It is entirely possible that a DoH client that doesn't > do a > > minimum level of getting user acknowledgement before violating policies, > > laws, or contracts, might itself be illegal in some jurisdictions > > (jurisdictions that could include some US states, some western countries, > > some larger entities like EU, etc.). > > I almost agreed with you that people need to ack others' > priorities. But the above means I can't agree with your > mail as "might be illegal" is vastly overstated, there > being no relevant difference between DoT and DoH clients > in this respect. You are correct, on the difference issue. This is about the base requirements, even if they are not different between DoH and DoT. And I agree, both DoH and DoT would need to meet the same set of requirements wrt to contracts, laws, informed users, and everything. I don't believe I am overstating the issue, at least in some places. E.g. I am not aware of any place where an end user can modify an EULA, sign it, and have that legally binding. Doing DoH/DoT in any such environment where the Ts & Cs prohibit their use, would at least be a contract violation. Things like DMCA and its ilk might raise the software to the level of "illegal" rather than just a contract violation by a user. > Such overstatement doesn't help and merely > makes it more likely that some of the reasonable points > you make will just get lost in the noise (IMO anyway). > > The same goes for talk of "wars" btw. > > Yeah, that's not one term I have used, but I agree. Brian --00000000000059b41b0584002e86 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Mar 13, 2019 at 1:43 PM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:

(dropping dprive list at WG chair request)

Hiya,

On 13/03/2019 20:29, Brian Dickson wrote:
> The starting place for the conversation needs to acknowledge this, and=
> accommodate it. It is entirely possible that a DoH client that doesn&#= 39;t do a
> minimum level of getting user acknowledgement before violating policie= s,
> laws, or contracts, might itself be illegal in some jurisdictions
> (jurisdictions that could include some US states, some western countri= es,
> some larger entities like EU, etc.).

I almost agreed with you that people need to ack others'
priorities. But the above means I can't agree with your
mail as "might be illegal" is vastly overstated, there
being no relevant difference between DoT and DoH clients
in this respect.

You are correct, on the d= ifference issue.

This is about the base requiremen= ts, even if they are not different between DoH and DoT.
And I agr= ee, both DoH and DoT would need to meet the same set of requirements wrt to= contracts, laws, informed users, and everything.

= I don't believe I am overstating the issue, at least in some places.
E.g. I am not aware of any place where an end user can modify an EU= LA, sign it, and have that legally binding. Doing DoH/DoT in any such envir= onment where the Ts & Cs prohibit their use, would at least be a contra= ct violation. Things like DMCA and its ilk might raise the software to the = level of "illegal" rather than just a contract violation by a use= r.
=C2=A0
= Such overstatement doesn't help and merely
makes it more likely that some of the reasonable points
you make will just get lost in the noise (IMO anyway).

The same goes for talk of "wars" btw.

Yeah, that's not one term I have used, but I agre= e.

Brian=C2=A0
--00000000000059b41b0584002e86-- From nobody Wed Mar 13 14:17:15 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA5D0120106; Wed, 13 Mar 2019 14:17:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dryBptw_K2T5; Wed, 13 Mar 2019 14:17:11 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 958C412008A; Wed, 13 Mar 2019 14:17:10 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 3CAB3BE2F; Wed, 13 Mar 2019 21:17:08 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5SZyJpcQAwiA; Wed, 13 Mar 2019 21:17:06 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 96D06BE2E; Wed, 13 Mar 2019 21:17:06 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552511826; bh=g9q6r+NiUWRjcbEGI+uJCkaBsHkAtC/oS8jRekSAaOE=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=AkWX2BSRtFsxkIZUmbzOtXlEzbVg2dpJDTw2wsAJmH2Qy32vORHDxJbnHnVwdyFWE pJYz9W8WzgPuurR8pimj33xrieo95A21AYGxWvwIILCi5vGwXDb2YlwjQiq+NvW8uo DZOiQMHO4MY8gIK+UGfN4ed594wWRFXsiMpWj18w= To: Brian Dickson Cc: "dnsop@ietf.org" , "Livingood, Jason" , Christian Huitema , "doh@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 13 Mar 2019 21:17:05 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="lKRwWEN51NXht5ZGZ89Jh60JfHXjNWhvy" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 21:17:14 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --lKRwWEN51NXht5ZGZ89Jh60JfHXjNWhvy Content-Type: multipart/mixed; boundary="jQ7uKp6Fpv1dH2gdxwVRkS19qWagPkOaf"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: "dnsop@ietf.org" , "Livingood, Jason" , Christian Huitema , "doh@ietf.org" Message-ID: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> In-Reply-To: --jQ7uKp6Fpv1dH2gdxwVRkS19qWagPkOaf Content-Type: multipart/mixed; boundary="------------A68CBF5598075943910813B5" Content-Language: en-GB This is a multi-part message in MIME format. --------------A68CBF5598075943910813B5 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 13/03/2019 21:06, Brian Dickson wrote: > Things like DMCA and its ilk might raise the software to the > level of "illegal" rather than just a contract violation by a user. Whacking someone in the head with a fish could well be illegal... but fish are not illegal:-) [1] Similarly typing "dig .example" may be argued to cause some theoretical illegality in some locations but neither the DNS protocol nor service is illegal as a result. And IANAL. But it's ok that we disagree that this is overblown, except for the way in which it makes the conversation needlessly harder. Cheers, S. [1] https://en.wikipedia.org/wiki/The_Fish-Slapping_Dance --------------A68CBF5598075943910813B5 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------A68CBF5598075943910813B5-- --jQ7uKp6Fpv1dH2gdxwVRkS19qWagPkOaf-- --lKRwWEN51NXht5ZGZ89Jh60JfHXjNWhvy Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyJc1EACgkQWrL68XsX K+qjjxAAo6IA0hD23QFboX/WH3yITUGmkrvdanrdFD2HxThMxMkcAP4XUkL8yMrv aPnNT8LBruCdA90hcuaqPSsSSBi5YBFl2mXy6UYjmwfzaFln/KPED4uDEerr4bC6 zbbJSGIOAwjXSHq8OZCb3xqdv31bVB7431UDZNLfTpjTb2Tuq1dLme+4cayp7q06 PmfdrtbEwZ6nlf1n8L+7Kw7jFffr1exdkZLfB/YJG//m82PQrWKjmfjfN06vc0w0 t1xSZaFjNQn12X8ZoRHc8PFiQVpAh7ApllZ0yXWzOv5tbCp96ZO+iPkLF4cp44DK ipCGB78ezkpgmWqg7N3YrIgS46tQyEbQsDpy+QXcf+zSaL04ptE+Lyj+osnLMU1d jSJL5gTKRYbzJHM0pt195Qv9bFm/6F3WvUlIQ+K3d6zg3MykQkTeRvQGs0kmCDsr G/Y/G+f0K8TwB9TDTyrnWsQ6Knpqkpt4Z/xZL9KpaNLq5oEz+OXXcSxwXJHWjaik eCCx3jX1+iSZJ51N2/z2AKmF5S8gn1UwVuOVD0G3LiYGzBwz7xSmgFsoS63D7LsM 1/0NO3jeZcitX1tw2AMtEssq69+4kC73YP3yFlGGM3zd4um+cW816cxgeXUpoktS jVztm6S4e4oQV2ao+P1zP4z4g4qBdntg/AzMYKOjihQDMRv2Gjc= =Sirw -----END PGP SIGNATURE----- --lKRwWEN51NXht5ZGZ89Jh60JfHXjNWhvy-- From nobody Wed Mar 13 15:02:17 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4458130FF4 for ; Wed, 13 Mar 2019 15:02:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=IBseuugC; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=MYfTcxoN Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YifDFzyGfclc for ; Wed, 13 Mar 2019 15:02:12 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 437F513121C for ; Wed, 13 Mar 2019 15:02:12 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 216D021C4F for ; Wed, 13 Mar 2019 18:02:11 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 13 Mar 2019 18:02:11 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=message-id:in-reply-to:references:date:from:to:subject :content-type; s=fm1; bh=/J93bTUEG42l6rtymMMSgXDeI5HcnWvNR5XF1Sg T/k0=; b=IBseuugCjlKAvcawtBb1kd1kKq+e8yYPLy3QQQIYYnKhaif4uhLrSzu +XZll59gEAzdDtLOQRxJgpDAfEgQQiBO9kd5C9WaA7vmjToc2srpmhbb9CIkHHb+ eEZHXG6TL+r73JgSW3l9xdp/5y5R0KxjMJ/HCh7BHim//GvZMP3hlgSQnHw/ntYA 7B4cWr8P/MOf8ifjwvhRrLaQ2dDiO+zyNwbCJGFHzBzloUcpZKS49kQLS5tevPQK 9O7JAl6v1oVRG0rCU4DiHuUWqPs+kK5hDM3ibkidGa8YOcO/k4xi5LhohIycv9hi vhSSB/n7abPZJxYZ91nI6sHxaHOQlwg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:references:subject:to:x-me-proxy:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=/J93bTUEG42l6rtym MMSgXDeI5HcnWvNR5XF1SgT/k0=; b=MYfTcxoN3W6bh5CDo76htL+j1fGU4xRnX pbBQJzB+U9gSIyEhiaM4csX3iIwNwKg0TpzVFynnsEAax7077U8WRGDIv1awbLnh 7QTPSP+0ujg4veRGMgy1egNJb1IkP1SaSKdC+iqCLThXL0aydo9H/dPxPUaltV2L eEaxW05e77SnjQ95GRP7YuECgnZw+z0Uujzh+GCvyj6P0MrlMQB7XI56zomClA1X lBWto6ofBAuVpWgDDRkgQ7DS/XdQmTOY9ARkn2NHeS63a9r/uKpibzWpFu4KIv1T twsl1QXsX/0XyTmNxCdSn7GP7Kb7Z/r2NQEKGawPSseMYp8og7YbA== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrhedtgdduheejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrghrrg hmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhushht vghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id A55B17C1EB; Wed, 13 Mar 2019 18:02:10 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-925-g644bf8c-fmstable-20190228v5 X-Me-Personality: 92534000 Message-Id: In-Reply-To: <23689.7924.461871.555714@gro.dd.org> References: <23689.7924.461871.555714@gro.dd.org> Date: Wed, 13 Mar 2019 18:02:10 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Mar 2019 22:02:15 -0000 Given the volume of discussion on-list about the latter two talks, and the absence of any significant time for open discussion, what do you expect us to gain from this session? I fully support spending the bulk of the time here on resolver-associated, but I'm concerned that having the same presentation given twice in the balance of time. It could be three if you wanted to use the last 10 minutes on draft-bertola-bcp-doh-clients. Having a clear goal in mind might help this be a productive use of time; and - if I might suggest - a shorter period of presentation (maybe Jim can negotiate with his co-author) followed by a very narrowly scoped discussion would be useful. There are lots of different concerns in these drafts, but maybe we can find one key point to concentrate on. I don't see us being able to settle one, let alone two, but we might get further into a single topic. If I were to offer a suggestion for that topic, I'd want to talk a little about the indistinguishability characteristics of DoH as distinct from DoT. And the operational consequences of the same. That seems well within the remit of this group. On Thu, Mar 14, 2019, at 02:17, Dave Lawrence wrote: > * Note Well > https://www.ietf.org/about/note-well/ > > * draft-ietf-doh-resolver-associated-doh, Paul Hoffman, 30 minutes > https://datatracker.ietf.org/doc/draft-ietf-doh-resolver-associated-doh/ > > * draft-livingood-doh-implementation-risks-issues, Jason Livingood, 10 > minutes > > https://datatracker.ietf.org/doc/draft-livingood-doh-implementation-risks-issues > > * draft-reid-doh-operator, Jim Reid, 10 minutes > https://datatracker.ietf.org/doc/draft-reid-doh-operator/ > > * Open discussion > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > From nobody Wed Mar 13 17:07:51 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C23F124B16; Wed, 13 Mar 2019 17:07:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6DjK2HCbFvNS; Wed, 13 Mar 2019 17:07:47 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 050311277E2; Wed, 13 Mar 2019 17:07:46 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [IPv6:2607:f2f8:a544:0:0:0:0:2]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x2E07Rhw067042 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Wed, 13 Mar 2019 20:07:29 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from kimberton.burnttofu.net (127.146.25.136.in-addr.arpa [136.25.146.127]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id A645765B1E; Wed, 13 Mar 2019 17:07:28 -0700 (PDT) To: Stephen Farrell , Brian Dickson , Christian Huitema Cc: "dnsop@ietf.org" , "Livingood, Jason" , "doh@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> From: Michael Sinatra Message-ID: Date: Wed, 13 Mar 2019 17:07:24 -0700 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [IPv6:2607:fc50:1:9d00:0:0:0:9977]); Wed, 13 Mar 2019 20:07:31 -0400 (EDT) Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 00:07:50 -0000 On 3/13/19 1:43 PM, Stephen Farrell wrote: > > (dropping dprive list at WG chair request) > > Hiya, > > On 13/03/2019 20:29, Brian Dickson wrote: >> The starting place for the conversation needs to acknowledge this, and >> accommodate it. It is entirely possible that a DoH client that doesn't do a >> minimum level of getting user acknowledgement before violating policies, >> laws, or contracts, might itself be illegal in some jurisdictions >> (jurisdictions that could include some US states, some western countries, >> some larger entities like EU, etc.). > > I almost agreed with you that people need to ack others' > priorities. But the above means I can't agree with your > mail as "might be illegal" is vastly overstated, there > being no relevant difference between DoT and DoH clients > in this respect. I believe that the issue of protocol obfuscation that I mentioned earlier in the draft-reid-doh-operator thread[1] is a relevant difference. There is another technical issue, and that surrounds the question of who is the user and what capabilities does the user have to manage their devices. This has been touched upon with the discussion on opt-in vs. default and with Paul's discussion of data exfiltration. In my home, I have an "Internet-capable" washing machine. Of course my "smart" TV wants to be on the Internet. My Foobot *must* be on the Internet just so I can monitor the air quality in my own home. I don't want the washer on the Internet at all, and for some of the other devices, I want to control what they do on my home network. With embedded and "IoT" devices, there may be limitations on how I--as the user--can control them. There may be hard-coded defaults that are difficult to change (and yet have a way of easily resetting themselves to "factory default"). Leaving aside for now the issue of licensing Ts&Cs, I--as the user--may want to have more *technical* control over the devices than their vendor is willing to give me. One way I can assert that control is via the network. On my home network, I am one of the users and I am also the network admin. I want to assert control over the devices for which *I* am the user, but the people who designed them didn't give them sufficient knobs for me to do this on the device. Another word for software which does things on the network outside of the user's control is "malware," whether it is legitimate or not, and I realize it predates DoH. But DoH legitimizes protocol obfuscation at the network layer and makes it potentially harder for me to control the devices for which I am the user. So if the goal is to give users more control, I'd assert that DoH, at best, works both ways. michael [1] https://mailarchive.ietf.org/arch/msg/dnsop/Qole4yY0q_-psyrvWabaRAD8_Vc From nobody Wed Mar 13 17:49:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 081F4128B33 for ; Wed, 13 Mar 2019 17:48:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kg4wraVRtz49 for ; Wed, 13 Mar 2019 17:48:57 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E43231310F0 for ; Wed, 13 Mar 2019 17:48:56 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id v10so4208528qtp.8 for ; Wed, 13 Mar 2019 17:48:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=RQjW7PjnDDy0JmlSs51eBzDiMm6vhoFPMJvUWTCWswQ=; b=py/Pztu6iEanudNUZPO7zssHRilVXRDldD53XNzeDkZnNlDv9rNhRuG7mXDj0cDmP8 vEjh5cI9fJQqJHeQKI5GUO1RUxtktlPKMksadMB1+tI616wEBlF2szNqnjQTAYcuLAqY 68SANAi8gDcpFR8AK5A4Oe/EGCcOr1akAFGVzyl9IKJdbiSOX7NuJ6s0g8eRSbd8ViX/ 7pzTwa7PdISAZBKcuYyZsV3HeJtD1MRiNLTzCgFsoRapY6z8i1lNcxmecsWuKQth009f SWkdspjs991I6rqNKb6SGiVpUueCOBbsCtRdMIcSMREpN3zvf95t3UVZ4UTHesa1fLDH oL+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=RQjW7PjnDDy0JmlSs51eBzDiMm6vhoFPMJvUWTCWswQ=; b=ad89Xn2CSRGPNMRPQ1wXfDYwLAPglC1XM5eLfGTOH3dEGeVkoocKjS/+4bZx04p6c6 VEWCqcswdAuw9SEk+2ppxAYqzrtNRA6ZODP7s4lu9s8gdMwgW93fR4bYBXxs2X07e2Sk pzziNq44VH0B79Nw3aPxfWSmgetzbAkW3XBFraeTnEjfxW6Ne8zS0jzhatBvOM2mz5x0 HIl3sIlNVx2fQv2Uq8fIXYrzlXp/5kdEVDwZPmwVUl25nsfN0Br2n8jpSoBsdBaprgpU pm7K743oTM1Cm1qY4ycHj57sa7FX4qwDZAhYtlPORKmiKZA0PdIQLaWVEHU6JM0unLak lcEg== X-Gm-Message-State: APjAAAWJa7A2UxLCFHd5Y8Y0R5me0oGiJRNvMECZDLEUGTJIC6nkPBhj 0TM4glXqkUmJmKKubgTNtHsaNw== X-Google-Smtp-Source: APXvYqzMVXZTlidocs+BUKb37qOP3kMD3aQLYzWYs2GnVawuWKXibcfrjKtp57fR3OR0leJzaZ5+1g== X-Received: by 2002:a0c:d20d:: with SMTP id m13mr3188743qvh.165.1552524536018; Wed, 13 Mar 2019 17:48:56 -0700 (PDT) Received: from [10.0.100.12] (c-73-186-137-119.hsd1.ma.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id n1sm7927068qkd.28.2019.03.13.17.48.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 13 Mar 2019 17:48:55 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_291E4122-A17D-40E5-99D4-F436A0582FAA" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.2\)) Date: Wed, 13 Mar 2019 20:48:53 -0400 In-Reply-To: <2044747.4WdMZHU4Qz@linux-9daj> Cc: dnsop@ietf.org, Vittorio Bertola , doh@ietf.org, dns-privacy@ietf.org, hrpc@irtf.org To: Paul Vixie References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> X-Mailer: Apple Mail (2.3445.104.2) Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 00:48:59 -0000 --Apple-Mail=_291E4122-A17D-40E5-99D4-F436A0582FAA Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Mar 12, 2019, at 2:52 PM, Paul Vixie wrote: > please do not relegate discussions about the loss of operator control = over the=20 > RDNS control plane Although it=E2=80=99s certainly true that DNS is used as a control plane = by many operators, there is no standard =E2=80=9CRDNS control plane.=E2=80= =9D If you think there should be, that=E2=80=99s something that the = IETF could conceivably work on, but it=E2=80=99s not something that the = DoH working group is obligated to treat as a standard use of DNS. And = I don=E2=80=99t think it=E2=80=99s a topic on which there is consensus = in the IETF. The problem with the discussion we=E2=80=99ve been having about DoH and = how it affects your =E2=80=9CRDNS control plane=E2=80=9D is that we=E2=80=99= re talking past each other, not that the discussion should be had = elsewhere. It=E2=80=99s fine for there to be a discussion, but if = there is going to be a discussion, participants need to engage = constructively, and not just fling slogans at each other. --Apple-Mail=_291E4122-A17D-40E5-99D4-F436A0582FAA Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Mar 12, 2019, at 2:52 PM, Paul Vixie <paul@redbarn.org> = wrote:
please do not = relegate discussions about the loss of operator control over the 
RDNS control = plane

Although it=E2=80=99s certainly true that DNS is used as a = control plane by many operators, there is no standard =E2=80=9CRDNS = control plane.=E2=80=9D   If you think there should be, that=E2=80=99= s something that the IETF could conceivably work on, but it=E2=80=99s = not something that the DoH working group is obligated to treat as a = standard use of DNS.   And I don=E2=80=99t think it=E2=80=99s a = topic on which there is consensus in the IETF.

The problem with the discussion we=E2=80=99= ve been having about DoH and how it affects your =E2=80=9CRDNS control = plane=E2=80=9D is that we=E2=80=99re talking past each other, not that = the discussion should be had elsewhere.   It=E2=80=99s fine for = there to be a discussion, but if there is going to be a discussion, = participants need to engage constructively, and not just fling slogans = at each other.


= --Apple-Mail=_291E4122-A17D-40E5-99D4-F436A0582FAA-- From nobody Wed Mar 13 18:10:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2988C1279A8 for ; Wed, 13 Mar 2019 18:10:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=algebras-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XAeNldUPYGn6 for ; Wed, 13 Mar 2019 18:10:11 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A7F1130E9A for ; Wed, 13 Mar 2019 18:10:11 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id x9so3469383iog.12 for ; Wed, 13 Mar 2019 18:10:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=algebras-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=W6yfIj1GiT7uj4i4CXnRTr4cznK+qnV6Wp/Z5W+hr74=; b=EtzBKFGADhg5VkEkDkMz0XgwDGbiYWRzXwGyjXj/SsHLImLu1A9SObjBDwzX7cqwY9 KPVUYovynmg84O8kLL46yiADpjVos46aVuWrfJfkFEQZ5B/EfZtjXxnPw3VkoaU1wcJg zJtmXHFKNRfrWZpUR44/WoVZz8El9uVnuZIDUNNjdZdZn02pasPDBT8p5YAW33eanPRL GFgt5QZbfrYBIUrpyw83usH3c390cM818DxZ0ny8RosKtoXErK6mMWfhMPLwRNCjkBYQ LtUFtyZCzn8+02HKiZeGwscuS3dWAY0ZGJgVgKVpOHLFz8PY1x63pHWMQz/8/1sf9/qI tnag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=W6yfIj1GiT7uj4i4CXnRTr4cznK+qnV6Wp/Z5W+hr74=; b=osJ31zQhwOKNOFGComECpvmSX2HFenb5smbv16/YxSt4iZLHfw4BQza8N/bY30Fg8T ofdOMGrS7Hw5qAMWjeb9sf5ZaXN32Oh0DLw84MW1PaKbEYe9SagE6D+0JGN4yBvsX7AW ZcRNWl2Fm7PxriGSeXU289C7/8uTiR6SS4gEdEid57uOPaN7K9qWHk5wo0iE6gSMkGFE 6rGcRtdR/zDv5wfK4ibJMuia/uZrCavEiV59xjm5TWeWBS08xShhgYdzdw0Jfc1h4PIX KeCsRbnQUGR0kTa4oyHbuo+6BMs+nHFiWOSdR/dXn0Na+sWfrVCqzZ0DzWjf3kJJXXKD FAUw== X-Gm-Message-State: APjAAAX6bB+F5ynmSa56ZOVMcuuzVnkQ38K2/mWqhQY0j+mD8foj+Wz6 8J6h7pfHcdWN4Iv5gAzLzDU02UtPR+cYEfTxDK+2Xw== X-Google-Smtp-Source: APXvYqwna0F6F+WCbPesDmHiENnePHXHQsQ87m7S31so6rwryND+tXfar8WoJf38amCO/o7KWhoCcYh33lR//03egvI= X-Received: by 2002:a6b:d304:: with SMTP id s4mr22429771iob.228.1552525810399; Wed, 13 Mar 2019 18:10:10 -0700 (PDT) MIME-Version: 1.0 References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> In-Reply-To: From: George Michaelson Date: Thu, 14 Mar 2019 11:09:58 +1000 Message-ID: To: dns-privacy@ietf.org Cc: dnsop WG , DoH WG Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 01:10:16 -0000 we're in danger of acronym soup here. RDNS can refer to reverse-DNS (in-addr.arpa and ip6.arpa) and I think usurping it for Resolverless DNS is an interesting moment. -George On Thu, Mar 14, 2019 at 10:49 AM Ted Lemon wrote: > > On Mar 12, 2019, at 2:52 PM, Paul Vixie wrote: > > please do not relegate discussions about the loss of operator control ove= r the > RDNS control plane > > > Although it=E2=80=99s certainly true that DNS is used as a control plane = by many operators, there is no standard =E2=80=9CRDNS control plane.=E2=80= =9D If you think there should be, that=E2=80=99s something that the IETF = could conceivably work on, but it=E2=80=99s not something that the DoH work= ing group is obligated to treat as a standard use of DNS. And I don=E2=80= =99t think it=E2=80=99s a topic on which there is consensus in the IETF. > > The problem with the discussion we=E2=80=99ve been having about DoH and h= ow it affects your =E2=80=9CRDNS control plane=E2=80=9D is that we=E2=80=99= re talking past each other, not that the discussion should be had elsewhere= . It=E2=80=99s fine for there to be a discussion, but if there is going t= o be a discussion, participants need to engage constructively, and not just= fling slogans at each other. > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Wed Mar 13 18:18:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 78750124B19; Wed, 13 Mar 2019 18:18:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vb-FDKVv-Uaa; Wed, 13 Mar 2019 18:17:59 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CAE06124184; Wed, 13 Mar 2019 18:17:58 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id D71A7BEB5; Thu, 14 Mar 2019 01:17:55 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSVgF1jf-Nil; Thu, 14 Mar 2019 01:17:54 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id D4068BEAF; Thu, 14 Mar 2019 01:17:53 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552526274; bh=9B90PJeS+V3ymSM5zgfJgDDZXvTNiz1NFGhzKaVzSa0=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=cSm5XC8YXnvaM+UkMP+NNI+6M08P8e1weUC2oAzp+t5dz1Mz5+1vIKtYZiSPoZbk+ Q2e02W8EvOFhJLVKb0COOot/IWK2HiRuq2hTtGa8vG5H25BuBkau99YlLWGe/J0qi1 TrpCBAOpL3f6IaSqiENUW2um56yQp3aceBicYILs= To: Michael Sinatra , Brian Dickson , Christian Huitema Cc: "dnsop@ietf.org" , "Livingood, Jason" , "doh@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Thu, 14 Mar 2019 01:17:52 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="AQiG63CuxyXjEnWUkuI0aG8Tzp9MSVaSa" Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 01:18:02 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --AQiG63CuxyXjEnWUkuI0aG8Tzp9MSVaSa Content-Type: multipart/mixed; boundary="0vYfWKatqT2b5WO32Zma2ODdmodcfpuEV"; protected-headers="v1" From: Stephen Farrell To: Michael Sinatra , Brian Dickson , Christian Huitema Cc: "dnsop@ietf.org" , "Livingood, Jason" , "doh@ietf.org" Message-ID: Subject: Re: [dns-privacy] [DNSOP] [Doh] New: draft-bertola-bcp-doh-clients References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> In-Reply-To: --0vYfWKatqT2b5WO32Zma2ODdmodcfpuEV Content-Type: multipart/mixed; boundary="------------B9AC8C3B43A57047E289C657" Content-Language: en-GB This is a multi-part message in MIME format. --------------B9AC8C3B43A57047E289C657 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi, On 14/03/2019 00:07, Michael Sinatra wrote: > On 3/13/19 1:43 PM, Stephen Farrell wrote: >> >> (dropping dprive list at WG chair request) >> >> Hiya, >> >> On 13/03/2019 20:29, Brian Dickson wrote: >>> The starting place for the conversation needs to acknowledge this, an= d >>> accommodate it. It is entirely possible that a DoH client that doesn'= t do a >>> minimum level of getting user acknowledgement before violating polici= es, >>> laws, or contracts, might itself be illegal in some jurisdictions >>> (jurisdictions that could include some US states, some western countr= ies, >>> some larger entities like EU, etc.). >> >> I almost agreed with you that people need to ack others' >> priorities. But the above means I can't agree with your >> mail as "might be illegal" is vastly overstated, there >> being no relevant difference between DoT and DoH clients >> in this respect.=20 >=20 > I believe that the issue of protocol obfuscation that I mentioned > earlier in the draft-reid-doh-operator thread[1] is a relevant differen= ce. I do not believe that is relevant to the claim I was disputing which was essentially that somehow DoH "might be illegal." If you think your point above is relevant, please consider Tor, whose major funder is (or historically was) a government and which is not illegal as far as I know (in many places). And VPNs too (but only the good ones:-). > There is another technical issue, and that surrounds the question of wh= o > is the user and what capabilities does the user have to manage their > devices. This has been touched upon with the discussion on opt-in vs. > default and with Paul's discussion of data exfiltration. >=20 > In my home, I have an "Internet-capable" washing machine. Of course my= > "smart" TV wants to be on the Internet. My Foobot *must* be on the > Internet just so I can monitor the air quality in my own home. I don't= > want the washer on the Internet at all, and for some of the other > devices, I want to control what they do on my home network. With > embedded and "IoT" devices, there may be limitations on how I--as the > user--can control them. There may be hard-coded defaults that are > difficult to change (and yet have a way of easily resetting themselves > to "factory default"). Leaving aside for now the issue of licensing > Ts&Cs, I--as the user--may want to have more *technical* control over > the devices than their vendor is willing to give me. One way I can > assert that control is via the network. On my home network, I am one o= f > the users and I am also the network admin. I want to assert control > over the devices for which *I* am the user, but the people who designed= > them didn't give them sufficient knobs for me to do this on the device.= >=20 > Another word for software which does things on the network outside of > the user's control is "malware," whether it is legitimate or not, and I= > realize it predates DoH. But DoH legitimizes protocol obfuscation at > the network layer and makes it potentially harder for me to control the= > devices for which I am the user. So if the goal is to give users more > control, I'd assert that DoH, at best, works both ways. Those seem like unrelated (and repetitive) points, except for your attempt to try equate (I assume) a browser using DoH with malware. That's the kind of overblown statement that detracts from any other reasonable points you may make (for me at least). I do agree that knowledgeable network owners, especially home network owners, ought be able to exercise control over the networks they own. I'm perfectly fine to do that in my home network and have no fear of DoH at all - I'm well used to turning off, working around or living with what I consider crappy features of browsers (e.g. cookies, JS) and other tech artefacts. DoH at least has some upsides if it gets implemented properly. I don't personally know how to properly and fairly handle such issues for network owners who quite reasonably don't know anything about the tech. ISTM that (to date) we've all contributed to failing such network owners. DoH is nothing special in that respect, nor is RPZ and nor are many other technologies we've developed. =46rom my POV, the only thing I hear about DoH that's new(-ish) is a fear= that browsers will turn it on by default in a silly manner, with some negative but not world-shattering consequences for folks who have a quite reasonable interest in existing DNS-based technologies and services. (Well, that and I've a continuing concern that somehow DoH might end up enabling web-severs succeed at drive-by attacks on client DNS caches if someone does some really stupid implementation stuff. But everyone keeps telling me that'll be ok;-) Cheers, S. >=20 > michael >=20 > [1] https://mailarchive.ietf.org/arch/msg/dnsop/Qole4yY0q_-psyrvWabaRAD= 8_Vc >=20 --------------B9AC8C3B43A57047E289C657 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------B9AC8C3B43A57047E289C657-- --0vYfWKatqT2b5WO32Zma2ODdmodcfpuEV-- --AQiG63CuxyXjEnWUkuI0aG8Tzp9MSVaSa Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyJq8AACgkQWrL68XsX K+ruUhAAt+ZJOvrsP4JGlv4PL4pnISbiS/m6KiqMGq9as7JmOhfwG1pswyPoFZfC OXBkObb9wDjeYDrWMU3JeI8TxCeIy2BcBdDZdhUSp5VDu+vGeZKP61WwWO5IYUiP l5Q0woKqcvrmo+ZnVZwwqfL/4bgNIeI1rQbDua19WpIsVQ0TgsauqWg+ZgqrsF1f mO152djQ69/+kbhEGoeKuplnsK/cTtig8bAgWWAKCyJzcvA8J8HZuuMMMb1XieX2 KfH2Dj5KSe1MtKSZM0El+zY12Wz7i7eLQHKc+7nNRuhrrD+FLy0X+T95bnmF/c+s u+QEwF2e+D+mCoA0EDV/145OIk+L4Y7lvQTRbUejS7il7ow/xqWFOnHGi0btl+Zp 7Ap6T6/Yu2PqwezIzNxMfW0nt4oIQ3MuKb2UiW2YXrsBocCdZCgShV7wIUpozC/2 zgtXcFhVI08E/hncB/d+fm9ZKWTNTAVllRTQEdaAqQoYxiKwHqZ4ZNviKY+qAlmb mfwVXPQz4zIQpI0hmBx/k4U+zDIjJM32qCZo6FustDQdo/fyU8StiNvNMpMPzW2W cKOxNR3hRmrSx4nY7NTpzbi5daZXqAhnjH1cPYwjhnaRzlSxsjzA6HU5aTvqZYfZ bnBfkqJj2jCtSg3+BD4EtuguaIjVXvG9/OpPmSM/VAn9IyQ8hSI= =2Xb1 -----END PGP SIGNATURE----- --AQiG63CuxyXjEnWUkuI0aG8Tzp9MSVaSa-- From nobody Wed Mar 13 18:59:20 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D2BB9131263; Wed, 13 Mar 2019 18:59:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GPUueYnaiXFO; Wed, 13 Mar 2019 18:59:06 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BFAD713124D; Wed, 13 Mar 2019 18:59:05 -0700 (PDT) Received: from [IPv6:2001:559:8000:c9:d802:ec52:f79e:29c] (unknown [IPv6:2001:559:8000:c9:d802:ec52:f79e:29c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 7D8E0892C6; Thu, 14 Mar 2019 01:59:05 +0000 (UTC) To: George Michaelson Cc: dns-privacy@ietf.org, dnsop WG , DoH WG References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> From: Paul Vixie Message-ID: <8648dd92-3f37-0734-1e57-96e2a5e8cd4c@redbarn.org> Date: Wed, 13 Mar 2019 18:59:04 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.11 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 01:59:12 -0000 George Michaelson wrote on 2019-03-13 18:09: > we're in danger of acronym soup here. RDNS can refer to reverse-DNS > (in-addr.arpa and ip6.arpa) and I think usurping it for Resolverless > DNS is an interesting moment. it'll always be recursive domain name service (RDNS) to me. PTR's are mostly dead, so "reverse" no longer has meaning. -- P Vixie From nobody Wed Mar 13 19:47:51 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AA966127876; Wed, 13 Mar 2019 19:47:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ao3X8hq2ySzI; Wed, 13 Mar 2019 19:47:48 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D40C126CAD; Wed, 13 Mar 2019 19:47:48 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2E2lTaN019137 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 13 Mar 2019 21:47:30 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1552531653; bh=a1Yyrus+NyAOaOITrakUyypk1xgQqzwso525i+5cYfQ=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=g9ydPdh0cbDVVzKpcRaaOQuKOs00ZRhgSIJFBrbUu0mJaRXSoEXD4qx+dd+zITtIl K3+7JVcCjeg2a8hBpOfGJI4b3A+agwSatufKwW7iyP1CDuP4+Cpn9kEbhRg5RKWbkt X9lrPQqmsnChzNpNh5+89/rhWO7Qrc8UdLN9Paj0= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Stephen Farrell , Brian Dickson Cc: "dnsop@ietf.org" , "Livingood, Jason" , Christian Huitema , "doh@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> From: Adam Roach Message-ID: <1ae1eed1-6e25-e134-e65f-8233b36f814c@nostrum.com> Date: Wed, 13 Mar 2019 21:47:24 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 02:47:50 -0000 On 3/13/19 4:17 PM, Stephen Farrell wrote: > > On 13/03/2019 21:06, Brian Dickson wrote: >> Things like DMCA and its ilk might raise the software to the >> level of "illegal" rather than just a contract violation by a user. > Whacking someone in the head with a fish could well be > illegal... but fish are not illegal:-) [1] > > Similarly typing "dig .example" may > be argued to cause some theoretical illegality in some > locations but neither the DNS protocol nor service is > illegal as a result. Closer to home, VoIP was illegal in a double-digit number of countries when the IETF started work on SIP. /a From nobody Wed Mar 13 21:31:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFC4A12B003; Wed, 13 Mar 2019 21:31:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vMiSKABNTv7b; Wed, 13 Mar 2019 21:31:40 -0700 (PDT) Received: from smarthost1.greenhost.nl (smarthost1.greenhost.nl [195.190.28.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DE3FB1294B6; Wed, 13 Mar 2019 21:31:39 -0700 (PDT) Received: from smtp.greenhost.nl ([213.108.110.112]) by smarthost1.greenhost.nl with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1h4I1o-0006QS-Gn; Thu, 14 Mar 2019 05:31:37 +0100 To: Eliot Lear , Warren Kumari Cc: dnsop , DoH WG , Stephane Bortzmeyer , hrpc@irtf.org, dprive@ietf.org References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <001FFADB-4095-471A-9A4C-61AC8B3799AB@cisco.com> From: Amelia Andersdotter Openpgp: preference=signencrypt Autocrypt: addr=amelia@article19.org; prefer-encrypt=mutual; keydata= mQINBFjWlnsBEAC+jUN+LJE+mmxEL8lHSrvg47xSBMb9GdtH1Jr8tRSxXiO6R5E+FydsfqkL sjO0dI3x/VnNBi/kgPFFWiAzDEwGTiR/C9b/Muo+xrY+it6e49N56LTPGezrY2dy5yo6VcLl 7UwGz3fIWiNIj7dvuoPMBoO1uacF073E+dqDM5CmNh6o+OrHW8zhUlC9hKgXCq+8XpZJw90H un1zsHF0sRDiurjfYaCcbdAGK9+th9378ed1ZvLVo5uBVQXdydl3eJkNCOELq7VOS7oxSliA uX5/nj9A4LjeeYXgNbwGfKrMjlffP0FcAcgfzg9seqDd1DEk9EVaUMTr32fbWOQHjinXSC7r Lw4xaNfoBebIe1M6z16Xg7+bXXCTdmJYcL9ugmkvT6tGnR12Pfoca1oBwXPvA0VIRi86kCSU D9qvZ3Vl07MKD2hsvFkGZJOQfEaYv5QLpCWv6RCjfDNC05IyMeSW4H18Fr/BoHX8FXHV3+9H LsbJQ/Zrofd/Cm+TKEmXLAtYc7iXvzV+mw3/u0VYqjEy/CRYa62Ah0NNNVIuswfRVIfx3UZo jX4y8j2Kh0jtUV5A4GGf8H3SzQ/cB0I7wTRHU9mCPVCtH6M26nPumL4Zr4D6uGnAmPf9xnlX lokOn2Qxf/mBldsL41PDbEpYhZvvn5kJ/Z9Qh7Fks/hfTbbJowARAQABtEFBbWVsaWEgQW5k ZXJzZG90dGVyIChUZWNobmljYWwgY29uc3VsdGFudCkgPGFtZWxpYUBhcnRpY2xlMTkub3Jn PokCVAQTAQgAPhYhBD1dtsq4UrmIBVpqb/7xwpS06AtVBQJZbJ97AhsjBQkJZgGABQsJCAcC BhUICQoLAgQWAgMBAh4BAheAAAoJEP7xwpS06AtVgrcQAJYg+mhDhui+9xNb9PuRJbelOI7J WlCjSycfaMi+rTJ9FjVKYIE9aug2VV486BZaeqMoOh5wjl61oeRTDHYG6HvhK4w8O/BVPsL0 8MEfYfpFevZmBsInEJypg0r7VJ/SeO9UyaFKUffgvLyiYwk7zJIgx5dHF5Vch0kTtRNc/Wbe 9MGfhl//1Ztl8GjGqzra7MwzaO12ctTDo7LIvXGqrpYm5g7+hRv3+KYVOJvlh4T4deAzNlX1 F/jj4cOYvJJxP2OMPZxoleQZSf63h0hWnKlQWX3UiUZY/M296V6niGDCQHX1q7oz9YWxwUun mNPltaPnTdvE51N98Q+hhrw39XowN0vYhfphaFNrf/crNKTB5Iqx62aAzYwqXQKlh6EtWAri 2rVB9vXxPv+1eL9t/Kga2JyCjmJVtYJxlZWceyW3EKjK+E7qjr1LHDFjV8ZbvN7QRTdjsuzR Ggz3ECba80Ij2/tASE8IXpT/Zb68NeSx3/nDXkIG13inSvGy8yNovzEADXsGO16GSx5Rool/ ECFhTYksMyM73FkvcpvXo6J+neyGEVKDx1Oy213KgTrAOrA+p2hMI2nX9sI5tvWms8XspwQ5 wtmzDribnZNQzpdrb45Chv56LjrKVer9tmraRq8Qe3mL6jXhMPWLim1OeAx6m3qBzKr3QxuG PdADCLHsuQINBFjWlnsBEADFjusaTo9W8VeWluCK/oJqyyyF1wMvou0ldfuoOpUZrOqsY67T M7yBqsv5COPVgAV+xp+axor5oHWxibd283w0Ok4dK6tvtNGwUqyDRlHtQ92DG/u4Tg5eOwrH NUn73/rfeBD9KhKAXcNKKPoccLgR8oQTXpO7eRo+0NI52pXQ6LdZ0wddYeTcHglsNKN1TK+C yYS7xfGolsZXXoBOKcyhfj/ckPFVIHWpGpEtcYWTZWvXgLprzHvpKzkzNyBwejaXE+bqCT2d Rl3omI/e2t3Vq33hFUUSAdxrFF29vMX/YsSnYqsFOIoayna+TRsDFAfZvbvHBOMckeJzvA8y Bdadw7CM08Uw8wqH7n9BA3oq//QpZJekPfrc2E9nM9H0d51T0uStLMbYDWdwxvfPA3p9z8L9 1vobt8bM/Jbhl9h+X2Yq9oBCiTI7b2izYd9FVG4BwBIdeh3bh9R9HExgRjF3XQ6uafT3pcVO PASdv9FRUYH1Va7QWQifoha0B7UXKx1OpX1Z6XR2NQ9KN2MvlwvBKdHtm6tBzUIFzW6D8vUO xiYKBA4fppJt/LJF4jsaCEyI/CVQnkC0yL5DKFOdigxTipwEL9Uc6r7VfR5OAGFd6vzuJFy+ j+/WhzaVT1oVYp6eQXh0bBtqqH2Mq9sAMnIjvaNYIKiQKgMa1Pa3OWQbQQARAQABiQI8BBgB CAAmFiEEPV22yrhSuYgFWmpv/vHClLToC1UFAljWlnsCGwwFCQlmAYAACgkQ/vHClLToC1Xn Rw//W4lzE8FddceKXGRwO/T1u4uzH9EjPCj+3/eHCrLI+h1m7QPyH1DrFAtZBoA6UoaF0+vI AJXM9/HI1FZ09EUdJr5X/+YREErFom4DbE1FK8fpK1/Hw2zI+7Xa8bVkmYrKhMGhi1Gq6Dtk sn/H4USdJL53ZPt10SVNK7H3w93Yp1GC4+0zWjfrsKfsHYZZr2SZyb5/gZlngfgaqiQLhIcP YmiU1GQi9QWkGxWRxk0YQXBwhekewvgltATxlRSCwguAi4uck9fAct9GGdpsshSOgAb9YIAn EV3EqaGnf0PknXp3vNHAZWrfM+RyuNdm2L5TjDU0rIrvyqGP3pR33cREGOAil5Sz2uFArmws Pt8VffbEXlf7qZqRBKaYeKt0qnxKMx1+e1JilVsfb8qtnAWAFDyR0HMlVj/dvGAmq/auPSOA UWRSnDRyT6rv/vXxrbkL4uxWax46qdpDhR15mS5MTng6b5b3Uox7xlveo/Sx71AdNf4goPvB /ntv0DiMuh+fmLGk3zrxs4Xd30Sx+qQwVaXR5xc5rgnF81wvfmuAOb2eP9mpD6DoabkpxC8f Lk17AK7Q1ZTgcZ+8XLRFnavdPrwCa9RU0BF53lJMSTPzyBcMwZ4sqA6Z5IRFVt7rEbSeeD8R Eiawo+FvVt9j0fKdNEBeaJ3WY5hlhNPcUXr4q1U= Organization: ARTICLE19 Message-ID: <68924c98-fc08-29f0-cda2-de4396f181fb@article19.org> Date: Thu, 14 Mar 2019 05:31:31 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <001FFADB-4095-471A-9A4C-61AC8B3799AB@cisco.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US-large Content-Transfer-Encoding: quoted-printable X-Virus-Scanned: by clamav at smarthost1.samage.net X-Scan-Signature: 094aa93d217637c77569e156d4a0c864 Archived-At: Subject: Re: [Doh] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 04:31:43 -0000 Dear all, +1 on Eliot and thank you Stephane. My deepest appreciation for T=C3=B6ma= s suggestion that really made my evening. An in-person meeting might be conducive to fleshing out a topic for this meeting, but at least to me "services centralization" rings like it might also concern detnet, quic and perhaps other groups that I cannot immediately think of. Probably we mean "DNS service centralization"? best regards, Amelia On 2019-03-12 08:19, Eliot Lear wrote: > Warren, > > I would suggest that you wait on creating a new list. > > I think Stephane was proposing an *in person* meeting, using the > 104sidemeetings Wiki, and I=E2=80=99d like to see that happen first. =C2= =A0That > also gives time for the dust from the release of these new drafts to > settle a bit, so that the contours of what can be reasonably > accomplished becomes more clear. > > Eliot > > >> On 12 Mar 2019, at 07:45, Warren Kumari > > wrote: >> >> >> On Tue, Mar 12, 2019 at 1:58 AM Stephane Bortzmeyer >> > wrote: >> >> [Sorry for the long list of working groups but the discussion alre= ady >> started in different places.] >> >> There are been some discussion about DoH (DNS-over-HTTPS, RFC 8484= ) >> deployment and the risk of centralization of Internet services.=C2= =A0 >> >> (See >> for instance drafts [this is not an endorsement] >> draft-bertola-bcp-doh-clients, draft-reid-doh-operator and >> draft-livingood-doh-implementation-risks-issues.) >> >> It was suggested Reference necessary to hav= e a >> side meeting in Prague at IETF 104. I propose monday, 1400-1600 in >> Tyrolka. The proposal is at >> . Yo= u >> are welcome to agree/disagree/meet in a bar instead. >> >> >> [ Replying here instead of bottom of thread ] >> >> Thank you for proposing / organizing this - there has been a lot of >> discussions, but (as demonstrated by the list of WGs in the To: line) >> it is somewhat unclear where the discussions should happen -- I'm >> planning on asking the secretariat to please make us a mailing list >> to better focus the discussions -- does anyone have a strong >> objection to this?=C2=A0 >> >> (also, a good suggestion for a name would be helpful :-)) >> >> W >> >> =C2=A0 >> >> >> _______________________________________________ >> Doh mailing list >> Doh@ietf.org >> https://www.ietf.org/mailman/listinfo/doh >> >> >> >> --=20 >> I don't think the execution is relevant when it was obviously a bad >> idea in the first place. >> This is like putting rabid weasels in your pants, and later >> expressing regret at having chosen those particular rabid weasels and >> that pair of pants. >> =C2=A0 =C2=A0---maf >> _______________________________________________ >> hrpc mailing list >> hrpc@irtf.org >> https://www.irtf.org/mailman/listinfo/hrpc > > > _______________________________________________ > hrpc mailing list > hrpc@irtf.org > https://www.irtf.org/mailman/listinfo/hrpc --=20 Amelia Andersdotter Technical Consultant, Digital Programme ARTICLE19 www.article19.org PGP: 3D5D B6CA B852 B988 055A 6A6F FEF1 C294 B4E8 0B55 From nobody Wed Mar 13 21:50:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D588F127598 for ; Wed, 13 Mar 2019 21:50:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=TX7cV8X/; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=cbVKyZ4G Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LJMz_tgZCqa6 for ; Wed, 13 Mar 2019 21:50:18 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C64E12705F for ; Wed, 13 Mar 2019 21:50:18 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id E666C21CB9 for ; Thu, 14 Mar 2019 00:50:17 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Thu, 14 Mar 2019 00:50:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=nuWZZRyDmnOaH0/4Q5rJLLBZzXVMpww p/H9crjtfFSs=; b=TX7cV8X/5bS1zfYPBCUpOIAP/Ozuc7j+4gSYuAJDynkFpW+ mGDWqhzkoV8JvAh97cQ5qZGqFr1G5Ck9X95UF2QpmH1q5YlTNTMFNoAN6U8oMPbj G2nZxH3EegJalUIUuPnB93ZVmMr2ANF8ZpdwbOnJ0jVTRwE+u/fmQ/2evHvbEHsj 0PlkFkssVMM3DTKpYM+ib+Hx5ah0BcQcRE90xI+mV6e8u6fbF270PCMxJPwRKv3m EXsJXEbKAKRkZuTvys8+6bWgTMwzJpUz0T1E/YqNPBS+0dVTChoCnaQxw2qI1KVg H08XQ1+WhRBiQUA33F4jady/X3t+hp2TvPoFU8A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=nuWZZR yDmnOaH0/4Q5rJLLBZzXVMpwwp/H9crjtfFSs=; b=cbVKyZ4GpO72OYc4CA3KcO bLQbK3HQGf8kl1l+Lc3Dzc3KFMpy2mA18ZqCgnxR1tM+l7Qt/XztEPZ/756cbKrr PUYKdIQiuWGoSvFJrvTQ7/kq5SgBpRaFyKefimRC74PVHApssuesWIw1MEBcjofD 5++fl/lTtg4wIXYFwltcFYng/gRYCv1slZB/W/49fOepZpJg3mJ9q4kc7JZOlG1/ YAeRDEg7Joc2TSOV9nFHytUxoBDwtZAtSS3hvLIhGJCTEfI7fmGG7DMvkzqc4QTk yWl2f2Rd7fmfMoL5GLMlrh6MRoUdaAY4zA4ozuD4vX+mInI9uhsWm51XAEPPgBMQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrhedugdejgecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreerjeenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 7CA2F7C5FB; Thu, 14 Mar 2019 00:50:17 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <33e8d27c-e657-460e-a028-dd3f5d474d69@www.fastmail.com> In-Reply-To: <68924c98-fc08-29f0-cda2-de4396f181fb@article19.org> References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <001FFADB-4095-471A-9A4C-61AC8B3799AB@cisco.com> <68924c98-fc08-29f0-cda2-de4396f181fb@article19.org> Date: Thu, 14 Mar 2019 00:50:14 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] =?utf-8?q?=5Bhrpc=5D_Proposal_for_a_side-meeting_on_servic?= =?utf-8?q?es_centralization_at_IETF_104_Prague?= X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 04:50:20 -0000 On Thu, Mar 14, 2019, at 15:31, Amelia Andersdotter wrote: > Probably we mean "DNS service centralization"? By which you meant to imply "descent", which is entirely consistent with recent discussions. "decent" would be far less appropriate. From nobody Wed Mar 13 22:33:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EFD012705F; Wed, 13 Mar 2019 22:32:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8eq3u_5h-ckt; Wed, 13 Mar 2019 22:32:52 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 337FD127994; Wed, 13 Mar 2019 22:32:52 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 4A608892C6; Thu, 14 Mar 2019 05:32:51 +0000 (UTC) From: Paul Vixie To: Ted Lemon Cc: dnsop@ietf.org, Vittorio Bertola , doh@ietf.org, dns-privacy@ietf.org, hrpc@irtf.org Date: Thu, 14 Mar 2019 05:32:48 +0000 Message-ID: <4425132.CsHbCTgi9Z@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 05:32:54 -0000 On Thursday, 14 March 2019 00:48:53 UTC Ted Lemon wrote: > On Mar 12, 2019, at 2:52 PM, Paul Vixie wrote: > > please do not relegate discussions about the loss of operator control o= ver > > the RDNS control plane >=20 > Although it=E2=80=99s certainly true that DNS is used as a control plane = by many > operators, there is no standard =E2=80=9CRDNS control plane.=E2=80=9D .= =2E. i don't think lack of standardization is the same as not existing. devices= =20 which honour the dhcp-assigned rdns service, work as expected, and as=20 intended. devices who ignore that setting and seek their own rdns by their = own=20 internal configuration, will often not work at all. because many of us amend our locally visible dns namespace with things like= =20 =2Ecorp or .home or .local, it's even more vital that devices respect the r= dns=20 assignment i make. the dns content i want to be visible on my network, have= to=20 be visible on my network. because many of us won't allow pirate or malware or otherwise undesired DNS= =20 lookups to succeed, either because we don't like the name, or we don't like= =20 the result of the query, or we don't like some name server that would be=20 involved in resolving it. the dns content i don't want to be visible on my= =20 network, have to not be visible on my network. from the days before dhcp when we typed these numbers in by hand, until now= ,=20 it has always been the expectation that rdns was part-and-parcel of local=20 network service. no different in that regard from dhcp or arp, neither of=20 which is standardized under the heading, "control plane", yet, are. so i think i'm not going to follow you down this terminological rabbit hole= =2E=20 the reason that internet creations of yours will work better on my network = if=20 you treat the rdns as part of my control plane is, because it's my network = and=20 that's how i operate it. you're not welcome to bypass it, nor answer dhcp=20 requests when you're not my dhcp server, nor answer arp requests when you=20 aren't the device i assigned that address to. you can call that tautological if you wish. but it's the life my networks=20 lead. external DoH providers are explicitly not welcome to provide service = to=20 malware or intruders who get into my network -- because rdns is part of my= =20 control plane, and like arp and dhcp, i control it and i monitor it, for=20 $reasons. > The problem with the discussion we=E2=80=99ve been having about DoH and h= ow it > affects your =E2=80=9CRDNS control plane=E2=80=9D is that we=E2=80=99re t= alking past each other, > not that the discussion should be had elsewhere. It=E2=80=99s fine for = there to > be a discussion, but if there is going to be a discussion, participants > need to engage constructively, and not just fling slogans at each other. i think i've flung considerably more than slogans, and, it's been exhaustin= g. vixie From nobody Thu Mar 14 07:23:29 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A81B130EB5 for ; Thu, 14 Mar 2019 07:23:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IRDxCZ-cGwQk for ; Thu, 14 Mar 2019 07:23:24 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 75533130EC9 for ; Thu, 14 Mar 2019 07:23:21 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 5E54D242109D; Thu, 14 Mar 2019 14:23:19 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Thu, 14 Mar 2019 14:23:16 +0000 Cc: doh@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <23689.7924.461871.555714@gro.dd.org> To: Martin Thomson X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 14:23:27 -0000 > On 13 Mar 2019, at 22:02, Martin Thomson wrote: >=20 > Given the volume of discussion on-list about the latter two talks, and = the absence of any significant time for open discussion, what do you = expect us to gain from this session? I fully support spending the bulk = of the time here on resolver-associated, but I'm concerned that having = the same presentation given twice in the balance of time. It could be = three if you wanted to use the last 10 minutes on = draft-bertola-bcp-doh-clients.=20 >=20 > Having a clear goal in mind might help this be a productive use of = time; and - if I might suggest - a shorter period of presentation (maybe = Jim can negotiate with his co-author) followed by a very narrowly scoped = discussion would be useful. There are lots of different concerns in = these drafts, but maybe we can find one key point to concentrate on. I = don't see us being able to settle one, let alone two, but we might get = further into a single topic.=20 Martin, I=E2=80=99ll be happy to work with Jason and the WG co-chairs so = we all make the most productive use of the WG time in Prague. However it seems unlikely there would be "the same presentation given = twice=E2=80=9D even if that discussion didn=E2=80=99t take place. The = two drafts are very different, albeit with some overlap. And maybe that = overlapping material (bypass concerns mostly?) should get moved into yet = another draft which might well end up being for another WG. draft-livingood-doh-implementation-risks-issues and = draft-reid-doh-operator discuss quite distinct aspects of the impact of = DoH deployment/uptake. IMO both should be considered separately by the = WG. It would be a pity if they were somehow smashed together into a = single discussion topic for Prague. If that did happen, I fear the = discussion would lack focus and probably be inconclusive. I think the questions to resolve at the WG are: 1) Are the issues identified in = draft-livingood-doh-implementation-risks-issues valid/reasonable and = does the WG want to work on them? 2) Are the issues identified in draft-reid-doh-operator valid/reasonable = and does the WG want to work on them? And if the answers to q1 or q2 are no, the followup question would be: what, if anything, needs to be done to the draft(s) to make them = WG compatible? It would be good if further discussion on the list focused on these 2 or = 3 questions.= From nobody Thu Mar 14 07:47:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 51ECD130E58; Thu, 14 Mar 2019 07:46:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id viGMPQPaz7ju; Thu, 14 Mar 2019 07:46:45 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 3DEA8130E99; Thu, 14 Mar 2019 07:46:44 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 3CD955F421F8; Thu, 14 Mar 2019 15:46:42 +0100 (CET) Received: from [172.19.42.125] (a72-246-0-22.deploy.static.akamaitechnologies.com [72.246.0.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 78C0F5F403AE; Thu, 14 Mar 2019 15:46:39 +0100 (CET) From: "Ralf Weber" To: "Ted Lemon" Cc: "Paul Vixie" , dns-privacy@ietf.org, dnsop@ietf.org, doh@ietf.org, "Vittorio Bertola" , hrpc@irtf.org Date: Thu, 14 Mar 2019 10:41:41 -0400 X-Mailer: MailMate (1.12.4r5594) Message-ID: <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> In-Reply-To: References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 14:46:48 -0000 Moin! On 13 Mar 2019, at 20:48, Ted Lemon wrote: > On Mar 12, 2019, at 2:52 PM, Paul Vixie wrote: >> please do not relegate discussions about the loss of operator control >> over the >> RDNS control plane > > Although it’s certainly true that DNS is used as a control plane by > many operators, there is no standard “RDNS control plane.” If > you think there should be, that’s something that the IETF could > conceivably work on, but it’s not something that the DoH working > group is obligated to treat as a standard use of DNS. And I don’t > think it’s a topic on which there is consensus in the IETF. Well as you said it is something that will not get consensus at the IETF, so why work on that? However as you said these RDNS control planes exist in real life and even if there is no IETF standard for it, the IETF should consider actual deployments when doing work and not just IETF standards IMHO and that is what the drafts out there trying to do, bring the view of people operating these services into the IETF. > The problem with the discussion we’ve been having about DoH and how > it affects your “RDNS control plane” is that we’re talking past > each other, not that the discussion should be had elsewhere. It’s > fine for there to be a discussion, but if there is going to be a > discussion, participants need to engage constructively, and not just > fling slogans at each other. So you are ok with having this discussion in DoH, which is good, as the DoH protocol caused some application providers to experiment with switching resolution per default away from OS and the local network provider. A lot of the exhausting thread however was about moving the discussion away from DoH. I’ll personally have the discussion anywhere, but given that the drafts have been given time in doh and people might have planned there schedule around that it should be the place. I also think Paul and others have engaged constructive in the discussion about the topic. So long -Ralf —-- Ralf Weber From nobody Thu Mar 14 07:54:06 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5547E12008F; Thu, 14 Mar 2019 07:53:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HdaGO_X73EaN; Thu, 14 Mar 2019 07:53:31 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74FA7129BBF; Thu, 14 Mar 2019 07:53:30 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 85860BED4; Thu, 14 Mar 2019 14:53:28 +0000 (GMT) Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8gaBUfIrChjq; Thu, 14 Mar 2019 14:53:28 +0000 (GMT) Received: from [134.226.36.93] (unknown [134.226.36.93]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 1AC04BECA; Thu, 14 Mar 2019 14:53:28 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552575208; bh=Jv/8EstqUrzop4Y0SQ3xmMt1+WIAqM1emI9VWVEg1nE=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=euieHdGXSW6XuKnE2s9XVr0GquPhRkKtzSKHFWzd/PUt6pLG2BYSNEh5rtTB+5our vmBHZGNp+4A0f/She91YT+gDx5izwR9F01F4m80LBrX3CuVlJ5AQdZpFDoZs4XgL3v jH45W5poCC6smXrNHIxITASDMYnjtWdZ8FBRIpiA= To: Ralf Weber , Ted Lemon Cc: Vittorio Bertola , doh@ietf.org, dnsop@ietf.org, Paul Vixie , hrpc@irtf.org, dns-privacy@ietf.org References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6a6b463c-0e67-c0cd-ca12-ea3dd298c401@cs.tcd.ie> Date: Thu, 14 Mar 2019 14:53:26 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="tFpt4R2GW2XzxhHWPZVfEWKYums6tui0O" Archived-At: Subject: Re: [Doh] [hrpc] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 14:53:44 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --tFpt4R2GW2XzxhHWPZVfEWKYums6tui0O Content-Type: multipart/mixed; boundary="3bgAgypm3hvrljBGYH1cgDC2wXcMGnDGG"; protected-headers="v1" From: Stephen Farrell To: Ralf Weber , Ted Lemon Cc: Vittorio Bertola , doh@ietf.org, dnsop@ietf.org, Paul Vixie , hrpc@irtf.org, dns-privacy@ietf.org Message-ID: <6a6b463c-0e67-c0cd-ca12-ea3dd298c401@cs.tcd.ie> Subject: Re: [hrpc] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> In-Reply-To: <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> --3bgAgypm3hvrljBGYH1cgDC2wXcMGnDGG Content-Type: multipart/mixed; boundary="------------CA494318326978C79E7AEC8C" Content-Language: en-GB This is a multi-part message in MIME format. --------------CA494318326978C79E7AEC8C Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 14/03/2019 14:41, Ralf Weber wrote: > the DoH protocol caused some application providers to experiment with > switching resolution per default away from OS and the local network pro= vider I wasn't aware that some application provider was doing this as their default (assuming that's what "per default" means). Can you provide details? I am aware of what FF/CF have done but I don't believe that was on by default. Thanks, S. PS: Apologies if there's a reference in one of the I-Ds, but I don't recall there being one for that assertion. --------------CA494318326978C79E7AEC8C Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------CA494318326978C79E7AEC8C-- --3bgAgypm3hvrljBGYH1cgDC2wXcMGnDGG-- --tFpt4R2GW2XzxhHWPZVfEWKYums6tui0O Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyKauYACgkQWrL68XsX K+ruww/+O4uQhYGKC0cquPfPiVM4LtmQ1KPWk3qXQQqnAGXmx+8xO6zSwrKYc/Kl Fs5Cx5Emz2FxpX38LT688lgyXQCZzO08mXIUGkM8cCHQI17TKx62DjvTHbgdmlpY n7fhku0vpCqpLcBRhqXfStP9DBJ3NCHWm2QH8IwMpL+dEdtzkiTS/X6THo2FG8sf NdXjsZAxitaqK94LNhujl6x9dZodTRvxYY0lII22EenLTYso4hq/4jljBL1PGTGQ iUlyZ5XYqqZRtWGJzwJvAiW90zGBgnSnG3GIdf4LN0Xx/pxw6I5mCsOl9rwOezzZ cLEK59nu8IzwdS917JhFwagq/ZPShNUssD7IZ6m0P0/c+oR9ZWjqHff05LIwmiqE Rseq10+0pBIT+2KsI3tx/feKt1p3FZR5JtAgrWr1BdtQKYZ5l4lDVF430IvHPS1x aYd2IL+o+PZvpc0aEm12w0xCNItomauohJ44/hRpEf2K0dXkX3JNaY7pNSh0YDud NKxQ7GhTSPy7FqOOIzhcehF6GPq94Bnd9q64yglRAcvwXUE5qfmgImCLmlLwFmtO TNi/TCJdH8UQYbQnkJb8IoJ7bh+jUGFr9+FSRfh5jr/rW1LeJkA8Q4cp+2EEYNml QFuxF/56dHussJTfLc+mOkBpWR0nAsI1RSWnjeafbAIb/Y6Cx10= =Dzgx -----END PGP SIGNATURE----- --tFpt4R2GW2XzxhHWPZVfEWKYums6tui0O-- From nobody Thu Mar 14 08:17:40 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 06F10129284; Thu, 14 Mar 2019 08:17:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SwBQ6Q0Rk_JL; Thu, 14 Mar 2019 08:17:30 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 883D112F18C; Thu, 14 Mar 2019 08:17:30 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 396F95F406E3; Thu, 14 Mar 2019 16:17:28 +0100 (CET) Received: from [172.19.42.125] (a72-246-0-10.deploy.static.akamaitechnologies.com [72.246.0.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id E8D8F5F40350; Thu, 14 Mar 2019 16:17:25 +0100 (CET) From: "Ralf Weber" To: "Stephen Farrell" Cc: "Ted Lemon" , "Vittorio Bertola" , doh@ietf.org, dnsop@ietf.org, "Paul Vixie" , hrpc@irtf.org, dns-privacy@ietf.org Date: Thu, 14 Mar 2019 11:17:23 -0400 X-Mailer: MailMate (1.12.4r5594) Message-ID: <7E3A5551-DADE-4C20-A9C3-CE72CEC0023E@fl1ger.de> In-Reply-To: <6a6b463c-0e67-c0cd-ca12-ea3dd298c401@cs.tcd.ie> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> <6a6b463c-0e67-c0cd-ca12-ea3dd298c401@cs.tcd.ie> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [hrpc] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 15:17:32 -0000 Moin! On 14 Mar 2019, at 10:53, Stephen Farrell wrote: > On 14/03/2019 14:41, Ralf Weber wrote: >> the DoH protocol caused some application providers to experiment with >> switching resolution per default away from OS and the local network = >> provider > > I wasn't aware that some application provider was doing this > as their default (assuming that's what "per default" means). > Can you provide details? The experiment Mozilla did switched these 25000 users to use DoH and gave that option as the default option: https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-e= xperimental-results/ > I am aware of what FF/CF have done but I don't believe that > was on by default. It was only for nightly users and only for users that have opted in for experiments, but it still IMHO gave a bad impression, as it was viewed by many as a plan send all future DNS traffic to Cloudflare. I still think giving a singular known option as it is the case currently = if you click the Dns over HTTPs button in Firefox is a bad idea, but at = least it is off per default. So long -Ralf =E2=80=94-- Ralf Weber From nobody Thu Mar 14 08:37:30 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8BC7D130E11 for ; Thu, 14 Mar 2019 08:37:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oIlsk_P1y5Br for ; Thu, 14 Mar 2019 08:37:27 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6FD1C12788F for ; Thu, 14 Mar 2019 08:37:27 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id a132so3122472lfa.13 for ; Thu, 14 Mar 2019 08:37:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=VAmtoLfBBY1Yvl9enDDMYldKWml2WhvIdfm7s5nor4o=; b=RFuV7pcK4kFpaTlu3XxHQWv11QM3v4IWkFfNU2jooUzgqUtPS3MDzZoU845Uqe2Bj3 2IqswmsD34frxL5OePjP46x/3eYLTWGa2IFTTGbR6CEBvIANOyE84gYPrlcKIwQVUMi5 kY4tmCBEiW2jKrrwFeU3j4+IGlVaeKgHCzT2qO1qyJ8H7oofiJC6ZPoLua/XmRgMIrS8 pIhVO0w7VhyHpXfmnCh2425Vi8dUxsv8AtwfJnJ9iQovji/8NmIKtZZNRJig4VqzCe6w p5YcA1lXgEh4pfkoh6Cer6rwpOMyWpEHM6nv+1ZrtkdsMdeTtmeNAjXdRCXAJINupqre M9qA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=VAmtoLfBBY1Yvl9enDDMYldKWml2WhvIdfm7s5nor4o=; b=skHO3+QQezuvxG9N9wNvMd9TtejB51gN3D5Qes+4HtPWi2r6ymXiDsZCF8bffnxEqP Kub4+eSECLQxWGRawdSYbqLVV6m75SvzYhskcV/vP+iEnS+ElPE516bhjFkzCgUfl+Pn aK/zjKrna0U8D3jx/zbzi6JbXX953ZSO0xhPQ5sjUMffqdDdN+DcId/t0bvvsDWkxfvs E3+rbq9OwgQKHU2qjQQenWimPsv5+nzIm4JJ0lMCpn6qLSwuoWA8wh1MlPlN/9435L4x sThtJCIb+s35GUD63mqSR2iP+WzlUGWg5qg+8AX9ZMLkEtAKRKH43F1PP1TlqAUpCEcH XhCg== X-Gm-Message-State: APjAAAVW4hfKxVOSc1Tzpxdv2vtb9xc/GWBt0b31LmU7QbBNXR4avxV6 sipoRhCj/fSfZOb3lCX+dFpPHrFbRwnRRbIkl27mA538 X-Google-Smtp-Source: APXvYqwtMY6NYpKe+Irq7XldVAIADRne1xPrEcKzQk0Q7pwY2rUvfZ+F5q9aAzZ4aeBZh3m3C9KN7Y/wI0OADgzVUXw= X-Received: by 2002:ac2:4191:: with SMTP id z17mr28141068lfh.78.1552577845448; Thu, 14 Mar 2019 08:37:25 -0700 (PDT) MIME-Version: 1.0 References: <23689.7924.461871.555714@gro.dd.org> In-Reply-To: From: Eric Rescorla Date: Thu, 14 Mar 2019 08:36:48 -0700 Message-ID: To: Jim Reid Cc: Martin Thomson , DoH WG Content-Type: multipart/alternative; boundary="000000000000f6e8c905840fb2ae" Archived-At: Subject: Re: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 15:37:30 -0000 --000000000000f6e8c905840fb2ae Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Mar 14, 2019 at 7:23 AM Jim Reid wrote: > > > > On 13 Mar 2019, at 22:02, Martin Thomson wrote: > > > > Given the volume of discussion on-list about the latter two talks, and > the absence of any significant time for open discussion, what do you expe= ct > us to gain from this session? I fully support spending the bulk of the > time here on resolver-associated, but I'm concerned that having the same > presentation given twice in the balance of time. It could be three if yo= u > wanted to use the last 10 minutes on draft-bertola-bcp-doh-clients. > > > > Having a clear goal in mind might help this be a productive use of time= ; > and - if I might suggest - a shorter period of presentation (maybe Jim ca= n > negotiate with his co-author) followed by a very narrowly scoped discussi= on > would be useful. There are lots of different concerns in these drafts, bu= t > maybe we can find one key point to concentrate on. I don't see us being > able to settle one, let alone two, but we might get further into a single > topic. > > Martin, I=E2=80=99ll be happy to work with Jason and the WG co-chairs so = we all > make the most productive use of the WG time in Prague. > > However it seems unlikely there would be "the same presentation given > twice=E2=80=9D even if that discussion didn=E2=80=99t take place. The two= drafts are very > different, albeit with some overlap. And maybe that overlapping material > (bypass concerns mostly?) should get moved into yet another draft which > might well end up being for another WG. > > draft-livingood-doh-implementation-risks-issues and > draft-reid-doh-operator discuss quite distinct aspects of the impact of D= oH > deployment/uptake. IMO both should be considered separately by the WG. It > would be a pity if they were somehow smashed together into a single > discussion topic for Prague. If that did happen, I fear the discussion > would lack focus and probably be inconclusive. > > I think the questions to resolve at the WG are: > > 1) Are the issues identified in > draft-livingood-doh-implementation-risks-issues valid/reasonable and does > the WG want to work on them? > 2) Are the issues identified in draft-reid-doh-operator valid/reasonable > and does the WG want to work on them? > > And if the answers to q1 or q2 are no, the followup question would be: > what, if anything, needs to be done to the draft(s) to make them > WG compatible? > Given the extraordinary amount of discussion there has already been on-list, it's hard to imagine how we could possibly resolve these in 10 minutes each. -Ekr > It would be good if further discussion on the list focused on these 2 or = 3 > questions. > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000f6e8c905840fb2ae Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Mar 14, 2019 at 7:23 AM Jim R= eid <jim@rfc1035.com> wrote:


> On 13 Mar 2019, at 22:02, Martin Thomson <mt@lowentropy.net> wrote:
>
> Given the volume of discussion on-list about the latter two talks, and= the absence of any significant time for open discussion, what do you expec= t us to gain from this session?=C2=A0 I fully support spending the bulk of = the time here on resolver-associated, but I'm concerned that having the= same presentation given twice in the balance of time.=C2=A0 It could be th= ree if you wanted to use the last 10 minutes on draft-bertola-bcp-doh-clien= ts.
>
> Having a clear goal in mind might help this be a productive use of tim= e; and - if I might suggest - a shorter period of presentation (maybe Jim c= an negotiate with his co-author) followed by a very narrowly scoped discuss= ion would be useful. There are lots of different concerns in these drafts, = but maybe we can find one key point to concentrate on.=C2=A0 I don't se= e us being able to settle one, let alone two, but we might get further into= a single topic.

Martin, I=E2=80=99ll be happy to work with Jason and the WG co-chairs so we= all make the most productive use of the WG time in Prague.

However it seems unlikely there would be "the same presentation given = twice=E2=80=9D even if that discussion didn=E2=80=99t take place. The two d= rafts are very different, albeit with some overlap. And maybe that overlapp= ing material (bypass concerns mostly?) should get moved into yet another dr= aft which might well end up being for another WG.

draft-livingood-doh-implementation-risks-issues and draft-reid-doh-operator= discuss quite distinct aspects of the impact of DoH deployment/uptake. IMO= both should be considered separately by the WG. It would be a pity if they= were somehow smashed together into a single discussion topic for Prague. I= f that did happen, I fear the discussion would lack focus and probably be i= nconclusive.

I think the questions to resolve at the WG are:

1) Are the issues identified in draft-livingood-doh-implementation-risks-is= sues valid/reasonable and does the WG want to work on them?
2) Are the issues identified in draft-reid-doh-operator valid/reasonable an= d does the WG want to work on them?

And if the answers to q1 or q2 are no, the followup question would be:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 what, if anything, needs to be done to the draf= t(s) to make them WG compatible?

Given = the extraordinary amount of discussion there has already been on-list, it&#= 39;s hard to imagine how we could possibly resolve these in 10 minutes each= .

-Ekr


It would be good if further discussion on the list focused on these 2 or 3 = questions.



_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000f6e8c905840fb2ae-- From nobody Thu Mar 14 08:46:45 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 57548130E89 for ; Thu, 14 Mar 2019 08:46:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id v8NlY_DOsn4D for ; Thu, 14 Mar 2019 08:46:42 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BB6812788F for ; Thu, 14 Mar 2019 08:46:42 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 1316C242109D; Thu, 14 Mar 2019 15:46:40 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Thu, 14 Mar 2019 15:46:39 +0000 Cc: DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <8EB4385E-69A7-49BF-B4D1-EEA1F42BF81F@rfc1035.com> References: <23689.7924.461871.555714@gro.dd.org> To: Eric Rescorla X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 15:46:45 -0000 > On 14 Mar 2019, at 15:36, Eric Rescorla wrote: >=20 > Given the extraordinary amount of discussion there has already been = on-list, it's hard to imagine how we could possibly resolve these in 10 = minutes each. True. That=E2=80=99s why I suggested having focused discussions about = them on the list. The discussions to date have gone off at a tangent (or = two). Here=E2=80=99s what I suggested earlier today: I think the questions to resolve at the WG are: 1) Are the issues identified in = draft-livingood-doh-implementation-risks-issues valid/reasonable and = does the WG want to work on them? 2) Are the issues identified in draft-reid-doh-operator valid/reasonable = and does the WG want to work on them? And if the answers to q1 or q2 are no, the followup question would be: what, if anything, needs to be done to the draft(s) to make them = WG compatible?=20 I hope the WG can concentrate on these questions in the run-up to = Prague. From nobody Thu Mar 14 09:19:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC15D1312BB; Thu, 14 Mar 2019 09:18:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BHE95SiuHTNS; Thu, 14 Mar 2019 09:18:38 -0700 (PDT) Received: from burnttofu.net (burnttofu.net [IPv6:2607:fc50:1:9d00::9977]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4FAE1312B2; Thu, 14 Mar 2019 09:18:30 -0700 (PDT) Received: from elwha.brokendns.net (elwha.brokendns.net [IPv6:2607:f2f8:a544:0:0:0:0:2]) by burnttofu.net (8.15.2/8.15.2) with ESMTPS id x2EGIEJj070189 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Thu, 14 Mar 2019 12:18:16 -0400 (EDT) (envelope-from michael@brokendns.net) Received: from nofx.lbl.gov (nofx.lbl.gov [IPv6:2620:83:8000:107::f]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by elwha.brokendns.net (5.65c/IDA-1.4.4/5.63) with ESMTPSA id D7B4865BBA; Thu, 14 Mar 2019 09:18:15 -0700 (PDT) To: Stephen Farrell , Brian Dickson , Christian Huitema Cc: "dnsop@ietf.org" , "Livingood, Jason" , "doh@ietf.org" References: <1700920918.12557.1552229700654@appsuite.open-xchange.com> <76386691-c1aa-c48a-9b0d-67eb36a08a4f@redbarn.org> <4935758.NkxX2Kjbm0@linux-9daj> <807193999.19916.1552445819087@appsuite.open-xchange.com> <9e40ac38-fa10-bbdc-1bfc-302e0ca170df@huitema.net> From: Michael Sinatra Message-ID: <3bea2834-2fa7-958c-36e7-c74e6bed512f@brokendns.net> Date: Thu, 14 Mar 2019 09:18:12 -0700 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:60.0) Gecko/20100101 Thunderbird/60.5.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Default is to whitelist mail, not delayed by milter-greylist-4.6.2 (burnttofu.net [IPv6:2607:fc50:1:9d00:0:0:0:9977]); Thu, 14 Mar 2019 12:18:18 -0400 (EDT) Archived-At: Subject: Re: [Doh] [dns-privacy] [DNSOP] New: draft-bertola-bcp-doh-clients X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 16:18:54 -0000 On 3/13/19 6:17 PM, Stephen Farrell wrote: > Those seem like unrelated (and repetitive) points, except for your > attempt to try equate (I assume) a browser using DoH with malware.> That's the kind of overblown statement that detracts from any other > reasonable points you may make (for me at least). No, that's not quite it. My point is that lots of people who support DoH say that this cat is already out of the bag. My point is to agree with Paul and Jim and others who have noted that it's a matter of scale and legitimization as a proposed standard that *differentiates* DoH from malware. Apologies if my previous post was too wordy or repetitive, so I'll just sum it up: I question the assumption, made in these threads, that DoH affords users more control. thanks, michael From nobody Thu Mar 14 09:34:18 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EFCF12AF7B for ; Thu, 14 Mar 2019 09:34:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HOaSmWJY9FuT for ; Thu, 14 Mar 2019 09:34:00 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E49F130E16 for ; Thu, 14 Mar 2019 09:33:58 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id i5so3688755qkd.13 for ; Thu, 14 Mar 2019 09:33:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=9RhQuBRoW+L57GUaCZ5g1nT2r212F+kBW64X5b0O0Qk=; b=Wc4k2RD/2LynqJoZxy+ecSMZZ+uMuHpDFQssyv9z1/wwaXuVBNAl5qRwGPg19tpvWQ IPRNsaooceN/WCKAsL9Qz2rPXcjJZuHSbv4FX3WEBDLWWZxvB/gHVDailF68VYCfcxkM CeS2smRjxyTMZ2dPkVRNSom3PZ/VO/GIKTgv+Vd7P/BVPpxnndHpV0bu8/N2/9ArD19f GhQ4l8qcL2GAwyUCMEPoyFDIbDNXYPks90/9uXZT/8wHDMJH9IK72BfoBjrlFTokmuXY 63PEWb98MpGXuaGDJmTpSEwrOlMn6eB9JcxuaTatcSgfgs4+T8x3/xRAEKj4t609N3kV HSpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=9RhQuBRoW+L57GUaCZ5g1nT2r212F+kBW64X5b0O0Qk=; b=KwW52mwuWN2OYrTsuP6uUuEDBVmjxZU543CM55+0VRLqgoWPnpt79d8ZWs0lXl3enj vhmi+R45qhQXAeDHT1K/3n17EBbELNmvIFjBzU7K2+nk+vm17lmoZEpOwMlyeJhVGgQR WTkTZ/gUaj9vThLqP3+nlsblwUFdIMIomkXi83Z82S+SwAF+IWF1grZXI6MrDAHwjUDa We6TODxiRBXf1i1iEclZOi936oEMTuADL9/nXCHvGZevsqP6Qwyf7tJkfb5Hvs14mk5Z yAOyYi2fnXAhmY5Dq//SJvVbr/nfMpO8okSZvf9/PkwbfSoT1k/rMd9x7xKvRwShmrxi VrSg== X-Gm-Message-State: APjAAAXVaUfhZnW6GGf1IQF43FMVKreqwrxVvMkGSPlKy45y+Aux/PBy oSi0yCH2MV7koM+rZ9B3WMPMSw== X-Google-Smtp-Source: APXvYqww1CbK5SFgIv274wCL/z8IokJK0oQYorrT2k59laDmE9IUcdZaQ+VNeHbivyXEhc22iFopvg== X-Received: by 2002:a37:8dc5:: with SMTP id p188mr36870776qkd.330.1552581237092; Thu, 14 Mar 2019 09:33:57 -0700 (PDT) Received: from [10.0.100.12] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id n201sm90220qka.10.2019.03.14.09.33.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 14 Mar 2019 09:33:56 -0700 (PDT) From: Ted Lemon Message-Id: <897ECF3E-6DE9-4621-A557-835E79570DC2@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_7F672512-CDB8-49F2-BE3F-0ACAD2D4D1D1" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.2\)) Date: Thu, 14 Mar 2019 12:33:54 -0400 In-Reply-To: <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> Cc: Paul Vixie , dns-privacy@ietf.org, dnsop@ietf.org, doh@ietf.org, Vittorio Bertola , hrpc@irtf.org To: Ralf Weber References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> X-Mailer: Apple Mail (2.3445.104.2) Archived-At: Subject: Re: [Doh] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 16:34:01 -0000 --Apple-Mail=_7F672512-CDB8-49F2-BE3F-0ACAD2D4D1D1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Mar 14, 2019, at 10:41 AM, Ralf Weber wrote: > Well as you said it is something that will not get consensus at the = IETF, so why work on that? However as you said these RDNS control planes = exist in real life and even if there is no IETF standard for it, the = IETF should consider actual deployments when doing work and not just = IETF standards IMHO and that is what the drafts out there trying to do, = bring the view of people operating these services into the IETF. Sorry, I expressed myself fairly poorly. What I mean is that it=E2=80=99s important to agree on what we are = talking about before we try to talk about it, because otherwise a lot of = useless back-and-forth happens where one person is arguing from one set = of assumptions, and another person is arguing from a different set of = assumptions, and neither is able to feel heard. It can feel very political to go meta on a discussion like this, but I = think it=E2=80=99s important for people to actually agree on what the = various views are of the problem and solution spaces. That is, not = agree that this problem is the correct view of the problem, or that that = solution is the correct solution to a problem, but to enumerate all the = views of the problem that various participants have, and enumerate all = the solutions to these various problems that people are interested in. With that overview, a winnowing process is possible; without it, we just = have endless non-terminal discussion. --Apple-Mail=_7F672512-CDB8-49F2-BE3F-0ACAD2D4D1D1 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Mar 14, 2019, at 10:41 AM, Ralf Weber <dns@fl1ger.de> wrote:
Well as you said it is something that will not get consensus = at the IETF, so why work on that? However as you said these RDNS control = planes exist in real life and even if there is no IETF standard for it, = the IETF should consider actual deployments when doing work and not just = IETF standards IMHO and that is what the drafts out there trying to do, = bring the view of people operating these services into the = IETF.

Sorry, I expressed myself fairly poorly.

What I mean is that = it=E2=80=99s important to agree on what we are talking about before we = try to talk about it, because otherwise a lot of useless back-and-forth = happens where one person is arguing from one set of assumptions, and = another person is arguing from a different set of assumptions, and = neither is able to feel heard.

It can feel very political to go meta = on a discussion like this, but I think it=E2=80=99s important for people = to actually agree on what the various views are of the problem and = solution spaces.   That is, not agree that this problem is the = correct view of the problem, or that that solution is the correct = solution to a problem, but to enumerate all the views of the problem = that various participants have, and enumerate all the solutions to these = various problems that people are interested in.

With that overview, a winnowing process = is possible; without it, we just have endless non-terminal = discussion.

= --Apple-Mail=_7F672512-CDB8-49F2-BE3F-0ACAD2D4D1D1-- From nobody Thu Mar 14 09:39:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 836EE131290 for ; Thu, 14 Mar 2019 09:39:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cmeEsrM6HuTm for ; Thu, 14 Mar 2019 09:39:01 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E49351310A1 for ; Thu, 14 Mar 2019 09:38:59 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id F1D2D24211EE for ; Thu, 14 Mar 2019 16:38:57 +0000 (UTC) From: Jim Reid Content-Type: multipart/mixed; boundary="Apple-Mail=_BC5154A1-BDB6-4B66-B6D3-4AB4909AF40C" Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) Message-Id: Date: Thu, 14 Mar 2019 16:38:57 +0000 To: DoH WG X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: [Doh] suggested slides for IETF 104 on draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 16:39:06 -0000 --Apple-Mail=_BC5154A1-BDB6-4B66-B6D3-4AB4909AF40C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Here=E2=80=99s what I plan to present at the WG. Please comment on the = list if you have questions or suggestions. --Apple-Mail=_BC5154A1-BDB6-4B66-B6D3-4AB4909AF40C Content-Disposition: inline; filename=IETF104.pdf Content-Type: application/pdf; x-unix-mode=0644; name="IETF104.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVyIC9G bGF0ZURlY29kZSA+PgpzdHJlYW0KeAFlUD1PxDAU2/srPDZD23y0pLchDgaYOBSJATFUISeCGnKX Bn4/aUhBAmXwk59jW++MA86g6THKe8iLEcHgEe/o7k3Q5hQ/phnBJlEWrMpVtKJ26G4dw7VPJt1+ YZVeQFvBe9pzWaZRJGnm2G7AotE9mHmK9tPs/eyDdSYGq0tCtmVgUkJIXqWAKwXJM11ApVClkgbq iCfULyTZc9SBoOF9u0M9FeaYmLyKpMrYBGM3ebMN/nWTNf5Ufpr/ZrGsfCDVM9QdblS+HCuVxcgh 2LDeJFUW3wcq8Lfym3WX2a6qw09JzagY2pKivSP4jTl8Ae6UX/gKZW5kc3RyZWFtCmVuZG9iago1 IDAgb2JqCjI0NQplbmRvYmoKMiAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9S ZXNvdXJjZXMgNiAwIFIgL0NvbnRlbnRzIDQgMCBSIC9NZWRpYUJveCBbMCAwIDEwMjQgNzY4XQo+ PgplbmRvYmoKNiAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgL0ltYWdlQiAvSW1hZ2VD IC9JbWFnZUkgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDkgMCBSCj4+IC9Gb250IDw8IC9UVDEgMTAg MCBSID4+IC9YT2JqZWN0IDw8IC9JbTEgNyAwIFIgPj4gPj4KZW5kb2JqCjcgMCBvYmoKPDwgL0xl bmd0aCA4IDAgUiAvVHlwZSAvWE9iamVjdCAvU3VidHlwZSAvSW1hZ2UgL1dpZHRoIDIwNDggL0hl aWdodCAxNTM2IC9JbnRlcnBvbGF0ZQp0cnVlIC9Db2xvclNwYWNlIDkgMCBSIC9JbnRlbnQgL1Bl cmNlcHR1YWwgL0JpdHNQZXJDb21wb25lbnQgOCAvRmlsdGVyIC9EQ1REZWNvZGUKPj4Kc3RyZWFt Cv/Y/+EAVkV4aWYAAE1NACoAAAAIAAQBGgAFAAAAAQAAAD4BGwAFAAAAAQAAAEYBKAADAAAAAQAC AAACEwADAAAAAQABAAAAAAAAAAAAkAAAAAEAAACQAAAAAf/iDFhJQ0NfUFJPRklMRQABAQAADEhM aW5vAhAAAG1udHJSR0IgWFlaIAfOAAIACQAGADEAAGFjc3BNU0ZUAAAAAElFQyBzUkdCAAAAAAAA AAAAAAAAAAD21gABAAAAANMtSFAgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAEWNwcnQAAAFQAAAAM2Rlc2MAAAGEAAAAbHd0cHQAAAHwAAAAFGJrcHQAAAIE AAAAFHJYWVoAAAIYAAAAFGdYWVoAAAIsAAAAFGJYWVoAAAJAAAAAFGRtbmQAAAJUAAAAcGRtZGQA AALEAAAAiHZ1ZWQAAANMAAAAhnZpZXcAAAPUAAAAJGx1bWkAAAP4AAAAFG1lYXMAAAQMAAAAJHRl Y2gAAAQwAAAADHJUUkMAAAQ8AAAIDGdUUkMAAAQ8AAAIDGJUUkMAAAQ8AAAIDHRleHQAAAAAQ29w eXJpZ2h0IChjKSAxOTk4IEhld2xldHQtUGFja2FyZCBDb21wYW55AABkZXNjAAAAAAAAABJzUkdC IElFQzYxOTY2LTIuMQAAAAAAAAAAAAAAEnNSR0IgSUVDNjE5NjYtMi4xAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABYWVogAAAAAAAA81EAAQAAAAEWzFhZ WiAAAAAAAAAAAAAAAAAAAAAAWFlaIAAAAAAAAG+iAAA49QAAA5BYWVogAAAAAAAAYpkAALeFAAAY 2lhZWiAAAAAAAAAkoAAAD4QAALbPZGVzYwAAAAAAAAAWSUVDIGh0dHA6Ly93d3cuaWVjLmNoAAAA AAAAAAAAAAAWSUVDIGh0dHA6Ly93d3cuaWVjLmNoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAGRlc2MAAAAAAAAALklFQyA2MTk2Ni0yLjEgRGVmYXVsdCBSR0Ig Y29sb3VyIHNwYWNlIC0gc1JHQgAAAAAAAAAAAAAALklFQyA2MTk2Ni0yLjEgRGVmYXVsdCBSR0Ig Y29sb3VyIHNwYWNlIC0gc1JHQgAAAAAAAAAAAAAAAAAAAAAAAAAAAABkZXNjAAAAAAAAACxSZWZl cmVuY2UgVmlld2luZyBDb25kaXRpb24gaW4gSUVDNjE5NjYtMi4xAAAAAAAAAAAAAAAsUmVmZXJl bmNlIFZpZXdpbmcgQ29uZGl0aW9uIGluIElFQzYxOTY2LTIuMQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAdmlldwAAAAAAE6T+ABRfLgAQzxQAA+3MAAQTCwADXJ4AAAABWFlaIAAAAAAATAlWAFAA AABXH+dtZWFzAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAACjwAAAAJzaWcgAAAAAENSVCBjdXJ2 AAAAAAAABAAAAAAFAAoADwAUABkAHgAjACgALQAyADcAOwBAAEUASgBPAFQAWQBeAGMAaABtAHIA dwB8AIEAhgCLAJAAlQCaAJ8ApACpAK4AsgC3ALwAwQDGAMsA0ADVANsA4ADlAOsA8AD2APsBAQEH AQ0BEwEZAR8BJQErATIBOAE+AUUBTAFSAVkBYAFnAW4BdQF8AYMBiwGSAZoBoQGpAbEBuQHBAckB 0QHZAeEB6QHyAfoCAwIMAhQCHQImAi8COAJBAksCVAJdAmcCcQJ6AoQCjgKYAqICrAK2AsECywLV AuAC6wL1AwADCwMWAyEDLQM4A0MDTwNaA2YDcgN+A4oDlgOiA64DugPHA9MD4APsA/kEBgQTBCAE LQQ7BEgEVQRjBHEEfgSMBJoEqAS2BMQE0wThBPAE/gUNBRwFKwU6BUkFWAVnBXcFhgWWBaYFtQXF BdUF5QX2BgYGFgYnBjcGSAZZBmoGewaMBp0GrwbABtEG4wb1BwcHGQcrBz0HTwdhB3QHhgeZB6wH vwfSB+UH+AgLCB8IMghGCFoIbgiCCJYIqgi+CNII5wj7CRAJJQk6CU8JZAl5CY8JpAm6Cc8J5Qn7 ChEKJwo9ClQKagqBCpgKrgrFCtwK8wsLCyILOQtRC2kLgAuYC7ALyAvhC/kMEgwqDEMMXAx1DI4M pwzADNkM8w0NDSYNQA1aDXQNjg2pDcMN3g34DhMOLg5JDmQOfw6bDrYO0g7uDwkPJQ9BD14Peg+W D7MPzw/sEAkQJhBDEGEQfhCbELkQ1xD1ERMRMRFPEW0RjBGqEckR6BIHEiYSRRJkEoQSoxLDEuMT AxMjE0MTYxODE6QTxRPlFAYUJxRJFGoUixStFM4U8BUSFTQVVhV4FZsVvRXgFgMWJhZJFmwWjxay FtYW+hcdF0EXZReJF64X0hf3GBsYQBhlGIoYrxjVGPoZIBlFGWsZkRm3Gd0aBBoqGlEadxqeGsUa 7BsUGzsbYxuKG7Ib2hwCHCocUhx7HKMczBz1HR4dRx1wHZkdwx3sHhYeQB5qHpQevh7pHxMfPh9p H5Qfvx/qIBUgQSBsIJggxCDwIRwhSCF1IaEhziH7IiciVSKCIq8i3SMKIzgjZiOUI8Ij8CQfJE0k fCSrJNolCSU4JWgllyXHJfcmJyZXJocmtyboJxgnSSd6J6sn3CgNKD8ocSiiKNQpBik4KWspnSnQ KgIqNSpoKpsqzysCKzYraSudK9EsBSw5LG4soizXLQwtQS12Last4S4WLkwugi63Lu4vJC9aL5Ev xy/+MDUwbDCkMNsxEjFKMYIxujHyMioyYzKbMtQzDTNGM38zuDPxNCs0ZTSeNNg1EzVNNYc1wjX9 Njc2cjauNuk3JDdgN5w31zgUOFA4jDjIOQU5Qjl/Obw5+To2OnQ6sjrvOy07azuqO+g8JzxlPKQ8 4z0iPWE9oT3gPiA+YD6gPuA/IT9hP6I/4kAjQGRApkDnQSlBakGsQe5CMEJyQrVC90M6Q31DwEQD REdEikTORRJFVUWaRd5GIkZnRqtG8Ec1R3tHwEgFSEtIkUjXSR1JY0mpSfBKN0p9SsRLDEtTS5pL 4kwqTHJMuk0CTUpNk03cTiVObk63TwBPSU+TT91QJ1BxULtRBlFQUZtR5lIxUnxSx1MTU19TqlP2 VEJUj1TbVShVdVXCVg9WXFapVvdXRFeSV+BYL1h9WMtZGllpWbhaB1pWWqZa9VtFW5Vb5Vw1XIZc 1l0nXXhdyV4aXmxevV8PX2Ffs2AFYFdgqmD8YU9homH1YklinGLwY0Njl2PrZEBklGTpZT1lkmXn Zj1mkmboZz1nk2fpaD9olmjsaUNpmmnxakhqn2r3a09rp2v/bFdsr20IbWBtuW4SbmtuxG8eb3hv 0XArcIZw4HE6cZVx8HJLcqZzAXNdc7h0FHRwdMx1KHWFdeF2Pnabdvh3VnezeBF4bnjMeSp5iXnn ekZ6pXsEe2N7wnwhfIF84X1BfaF+AX5ifsJ/I3+Ef+WAR4CogQqBa4HNgjCCkoL0g1eDuoQdhICE 44VHhauGDoZyhteHO4efiASIaYjOiTOJmYn+imSKyoswi5aL/IxjjMqNMY2Yjf+OZo7OjzaPnpAG kG6Q1pE/kaiSEZJ6kuOTTZO2lCCUipT0lV+VyZY0lp+XCpd1l+CYTJi4mSSZkJn8mmia1ZtCm6+c HJyJnPedZJ3SnkCerp8dn4uf+qBpoNihR6G2oiailqMGo3aj5qRWpMelOKWpphqmi6b9p26n4KhS qMSpN6mpqhyqj6sCq3Wr6axcrNCtRK24ri2uoa8Wr4uwALB1sOqxYLHWskuywrM4s660JbSctRO1 irYBtnm28Ldot+C4WbjRuUq5wro7urW7LrunvCG8m70VvY++Cr6Evv+/er/1wHDA7MFnwePCX8Lb w1jD1MRRxM7FS8XIxkbGw8dBx7/IPci8yTrJuco4yrfLNsu2zDXMtc01zbXONs62zzfPuNA50LrR PNG+0j/SwdNE08bUSdTL1U7V0dZV1tjXXNfg2GTY6Nls2fHadtr724DcBdyK3RDdlt4c3qLfKd+v 4DbgveFE4cziU+Lb42Pj6+Rz5PzlhOYN5pbnH+ep6DLovOlG6dDqW+rl63Dr++yG7RHtnO4o7rTv QO/M8Fjw5fFy8f/yjPMZ86f0NPTC9VD13vZt9vv3ivgZ+Kj5OPnH+lf65/t3/Af8mP0p/br+S/7c /23////uAA5BZG9iZQBkQAAAAAH/2wCEAAICAgMCAwQCAgQFBAMEBQYFBQUFBggHBwcHBwgLCQkJ CQkJCwsLCwsLCwsMDAwMDAwMDAwMDAwMDAwMDAwMDAwBAwMDBwQHDQcHDQ8NDQ0PDw4ODg4PDwwM DAwMDw8MDAwMDAwPDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDP/AABEIBgAIAAMBEQACEQED EQH/3QAEAQD/xAGiAAAABwEBAQEBAAAAAAAAAAAEBQMCBgEABwgJCgsBAAICAwEBAQEBAAAAAAAA AAEAAgMEBQYHCAkKCxAAAgEDAwIEAgYHAwQCBgJzAQIDEQQABSESMUFRBhNhInGBFDKRoQcVsUIj wVLR4TMWYvAkcoLxJUM0U5KismNzwjVEJ5OjszYXVGR0w9LiCCaDCQoYGYSURUaktFbTVSga8uPz xNTk9GV1hZWltcXV5fVmdoaWprbG1ub2N0dXZ3eHl6e3x9fn9zhIWGh4iJiouMjY6PgpOUlZaXmJ mam5ydnp+So6SlpqeoqaqrrK2ur6EQACAgECAwUFBAUGBAgDA20BAAIRAwQhEjFBBVETYSIGcYGR MqGx8BTB0eEjQhVSYnLxMyQ0Q4IWklMlomOywgdz0jXiRIMXVJMICQoYGSY2RRonZHRVN/Kjs8Mo KdPj84SUpLTE1OT0ZXWFlaW1xdXl9UZWZnaGlqa2xtbm9kdXZ3eHl6e3x9fn9zhIWGh4iJiouMjY 6Pg5SVlpeYmZqbnJ2en5KjpKWmp6ipqqusra6vr/2gAMAwEAAhEDEQA/APqDxzOcRTX4cVXYqiFy tm2vLCwVOOKrl4Yq2mTVVZeeVs28VcvDjljBVZcrZtfa+P8AYyKub+fFV6ZNkvVVyDF3LJKvVeWR VfyxVrFW+OKuXFXccVX8MVdirueKub7WKuVVxV32MVXccVXYqvbJK3kVW8eOKtK2LNvliwczYq0v 2MWa/Fg7FVT9nFVjYqv+LFXPirsVVMVU2XFV/wC1ireKtfDirTYqrYqp4qu44q7jyxVeuKrcWba/ D+xirWKrv+NMWC/j9vhirvT+LFVrKuRZL8VXLxyTFr4sWa/7X2PsYqpriq9VXjkUNL8GSYr2XFXf HiruOKr2+PFVn2/jxVf8WKqfHFmqYGbXH+TCwcy/sft4q5mxV32/gxVUxYKfBMVbXIpXPiqnzTJM nYqqYqqYq3iwU154q7FVyrizbxVtmyKG8VUlXnihU48MW1rjirvtZJpa44q39rFV3H+fFmu+xkWb lxVdiq37GKu+xhVzLirsLBvliq9cDNTXAq3FVTFXYqtZsVcy4quxVbxxa3L/ACYtjuOKr+OKuX4M Ku44FWccVX8sVWNirmxV3HFXNiruOFXfY+3iruXLFXM3LFVjLgVe2Ku5Yqs+1irm/wAjFV/LFV2K uxV2Krfi/YxVS/b55JguxYLeP8+LNv7OLBdkW52FVvLAq7Cq1l+HA1tf6+KFi/yZJk58VcrYq74c VX8ueKrPsrireLBz4q74OGKuxV3DFXK2KqeKu+1iqxsilUXFXLirmxVri+KuXjirfHJIWccVc2Kt LizX4sFv+W+Kqbf5eLN3HFgu44G53Fm6YqpsuFpU+OLNeq4q5l4tiqz4sVaxVpWxYNf6+LNt/wDL xYLsVdiq1sVa+xizWccWCpx44q5sVW4qs/yMWbWLBe3wYq1xxVbirv8AXxVY3v8AbxVzYqptizcy 4q7/AFMVb5LwxYLsVWfYxZubFWsmhTyDFyYqu44qt/18VbVf5Mkq7Is1jLiwU8VVOeKrFXFWsVW8 cVd8PL4MVab7eKt8sVU2xVb/AKmTZO4ZBis44q2uSVZliVvLliqxV5YtbmX4uGQVZk1diqmy5BWs VdiqzjgZrWVsLBa+TVa2Ku+0vxviqH/y8gqpy+HJqptkFf/Q+nrZnOIvVcVVVVf28rZr1ZUxVy/F hYKnBMmq/hiqvxTFW8WxcuKt8ueVoczclxVpeORVrFVZsVVWyStccirlVcVXtiqxm/YxV32/sYqu xVU+3irsVc+KuTFV7LiqriqjyxVfklWrirl/y8iqtxxVZy+LFXcvhxVvFm1x/kxYLsVVOGKuTFVi r/Jiq/FXMuKuxVUxVr9nFVnPFVTFWlXFWuOKt/Fiq7i+KtYqt44qr8fixVy4q7/LxVc38mLNT+1i qKyKFP8A18VX/tcP58VaX4vjyTFr9rFmsTFV7Liq/AzWf5H7GFgqL/JiwX8cVWL9jFV/7WKuVf2M VdyXjirWKt/FyxVpfgbFmsXFXccVX8lb7H28Vd+zirWKt4sG0+xkUubFV3DJMncVxV3DFXf8QxVU xVTVcixVOOKV2Fsa44q5lxVzLirv9fFWsLBr7HwYqv5YqtxVd/kPiruSYquZcihzYti7FXYq7Cra rgV3+RhV37OBrWN/PirmwtjuOKtcnwK1iqry4Yq7j9vCqz9jFXNgVbiqpirsVbZfixV3+Xi1u/yM VWcuWLY7jiq7FVzYVajXm2BVif5eKr/tYVWL8Px4quxVtlxVyx/DirljbFWsCuxVbx4/bwquxVRb AqpxxV3+Xiqz7f28VX8cVdx+LFrUm4vkktf6mKrsVXYGa5VxVTwsG2wM3fZxVpsCrWX9jCq1WwsH c8Vd8WKuTFXYq5uGKqnH4cWCxl4/bxVrIpdy4fYxVZkkNtirWKtsuKu/y8VcuKr0xVZxxVfwxVZx 4Yq74VxVrFVrN/Jiq/jiqx/8vFXLiq3jgbnLirSquFpa/wCJYqptkWTf+XkkufFXfFiqnirfLFWl +3irsVXMvNsWCxcVdx44q5vhbFXccVU+WKu4/DzxVv8Ay8VbxVTZsVVMVU/2sVcyt9jFVjfzpiq9 8Vd9jFVkmKqa4s1RVxYO5Yq1k2S34MgxdxxVzLk2S3IMVq4q5sVWvirueKr25csVWYq7FVnJ8krf LFWvhbIq7lzxVa/+RklWZFV3+viqjx5Yq7l/Pirv2sVWZJVJuWFg0n28mq7ly+DFsWMvL48WtZir WQVYvwYq5eOKu5ccDNYyrhYOVeWKqXDJti1sWtT48vgxVUXFVOTiuKrOOKv/0fqB9v48znEX8MWx U45WhV/yMLBpV+Hhiq9MVVF/kfJq5W4f7PFVRVxbG2XK0L/2sVXfs5FXf5eKt8ebZJVVW/YyKu/y 8VcuKr/ixVzYq1irf+Riq/FVPFVXJK19n4MiqpirX2cVbxVd+3iqxf58VX8UxVr4kxZr8WDfH4cV WccVXriruP7eKu+39jFV+KufFXceOKu5NirkxVUxVr/LxVvFWmbFXKuKr+PHFVLjizV8WCzjizbb Fg3izX/8RxYKaf5eKruWLNfx5Yq2rc8ihf8A8RxVYvLlkmK/b+TFVvHFmv8A8jAzbxV2KrcLBVxY OxVarfz4qvXFWsVcy/z4s3NyxV3LFWsVXKuLB3HFXLiq/hiqn+1kUu+ziq9MVdzxV3PJMncf28Vd x5/BirkxVUxVtsDN32sVd8OBW8KuxV2KrF5NhYNccVbb48Vdx7fsYq3/AMRwM1RVwKsZcVaXFVbF VvHCq7FW1XArv9TFWsVW8cVX8eeKu/18KtYFc3xN8GKt8cVWKv7eKr+WKtYq2uKu/ZxVYvw4quxV vli1ub4MVcv+RhbHcf2HwK2uFVNsCrsVb+HCrmb+fArlxV32/t4qsVcVXx4VbTCwU2XjkWa7FXYq 3xxVZkmDvjwM3MuKuXFXNiruOKu48cCrcVVf2sWtZHirXxJiq39rFVrLkkuZcVbxVrg+Kr8DNTxV e0eBVJ8kwczNirnxV3H48Vdiq/7WKrP8vFXSLirX7HwYqu54sFLIpXNkkNYqqceWKqeKt/6+KtKv D7eLNy4q1iqr9vFgsVvixVTVcWblxVtv9fFg7jirmXFVmLNr4vt4q23x/YxYOT7eKtNxxZtYGakr YWC/hiqz4cVb/axYLOWKruOLNrFV3w4sGsVWtyxVpfhxZtq2LBdiqniq1sVdxxVamKu54q7hiqn9 rFVTFXPiqk/2MWbX2l+PFg5sVaZcWa7FW+CYsFvL4eeKuXFXccVW8eeSV2RVr9nFVnHliruGKuZs Vcy4q5fixVY2Ku/2HwYq1iq3/UxVrJK1x5fAmKrWyKrXybJyYqsbFVP/AC8mh32MWtdi2IfFrdir sVdiqxcgq3FVrNz+DAzUmXLEu+3iqj+xi1ubFXP/AJeKtcWT7eQV/9L6gfZXM5xETlbNpcLBdirb Mz4qv4/Biqrk1XL8K4q0n+XkFVv9TAzcvwYquyKqi/HklW8siqpxbniruXHFV/HFW+WSVd9jIq7F XYq7FW1+LJKub4Miq5sWaxcWDfJMVd/l4q3iq5VxVdiq37f28VXrxxVTZcWapxxYObFV/wCziqxc VcuKqq4q7lirfH4sVbxVr4sVbxVdxT7eKubkuKrPsN8GKu/axVfyf7eKrsVWcsWa/liqzjiq/wDb /wAvFgvxZu4Yq7FVRvf7GLBrjirafbxV2LNtVwM3NiqzlhYL+OBm0q4Wle3LFV2KtquKrPsYqv5Y q03x/bxZtYq77OKt8cVX5Fi7FVvLFV3H4uGKrVxVfwySHJirXPFm77GKu/4hirmX9jFXM2KqvHhk WbfJMKrP2sLBfgZrcLB2KrsizXcsVdxxVzYquxVbxxVdhVS5YqvXFV2KrlxVy4q03wYqsXAq/wCL FXfFhVvCwa45Fm1irf7fx4q79rFrcq4q5lxbFjNiq/i+FWsCtti1uVcVawtjbYFc3JmxVzNxwq5W 5YFcv8mKuVcVaxV2Kt/6+KtYq77OKruWFWlwK1irlVv2MVb5Yq1irvs4q2zYqsVsVXs2KrOWFV2K qX7OKr1VcVXYqt44q7lgVbiq77eKu44VW4qqYqpKuKt4q02KrOOFg5fhwM3MuKrcLBys2KufFXYq qYqpt9nFW2+D7GLB3+virXFcilyYqtXJIab/AF8ilUySHPiqmuLNemKuxVauLBzMuKubFVP48Wbb LiwXYq7FVvH+fFXceWKrF/kxV3FfsYqpsvDFm7FXPireLBT+HFm22LBrjizd8OKuVcVdyxVtuOLB TX7eKu5Ys1+LBSVsVcq4q3iqm38mKqmKqaYq7FXYq7j8eKqeKtsuKrGxV3LFWlXFm3JiwXriqxl5 Yq7l8WKubFXccmycuKqOQYr3+3iqz7GKu4/yYq7FVnHhiq/FVPFW+OKrZPiXJKs4/wAmKtfawsmu OQYrXybJ3w4qs+1gYqbZYlzf8Piqn/xLFrXYqp88Vdx5YqpZBVrKuKuZcVWf6+Bmt4/sZYwU8VXc cVXc8VU8Vf/T+oatmc0Kv7OVod+3hYL144qvxVvJqvXFsVcVWryxVXXnlKF6/wAmKrOGKruWKqjY q5Vb9jFV3F8VVeP8+SVYq/z4quyKuZueKt/YyStZFVTFWuXPFXfF+x9jFV/L+TFXcV4Yq7jirv8A XxVfyxV3xYq1irfwp8eKt/8AEcVaXl+3iq//AFMVa54s2+GLB3Hliq7jiq7FVPl/JirnxVf8WKqa 8MWatz/bxVb/AK+LByriqrxxZtYqt+Dliq/Fgs/bxZqyYq74kbFXPiruTft4quTIoXM3w5Ji7Fmv bFgpccWar+xiwcy/F/kYqs+P9vFV7Lirvt4qvVsVWv8AYxZqnJf28VW/Fiwc2Kr+GKuxVrIpd/kY q74/sZJk7FXZFi58kyWMvw4qv+LFW/8AXxYOxVfizWYsFTjgblLhhYL2XFVy4GbeKqbYWDfL+fFV V/8ALwM2l+L48Ct/YxVbiq7/AFMVXYq7Cq3CwXYGanirv8j9jCwVMizb4/sYq1irTZJg3kWbsVb/ ANfFrdyxbFn+pi1rsVXPkktfs5Fm7/Uxa3KvxYq2uFsWv9jAq3JMF2RZrskwa4/t4GbmVcCt5Jg1 yyKF+KrG5YWxrArbYta9f58VWfFxxV3LFV6riqzk3HFXK2FsWYWC74vgyLNtcVd8OKtYq22KtYVd gVtuOFWuT4FbZsVaxVvj8XwYqs4/yYq5V/4DFXM38+Ku44q5cVcuKubFVPjiq7Cq3Cwb49v2Mizb xV2FWl4pirl/y8DW74cVUv2sklytirueKuxVzf5GKrvtNgZreGBqbTJIa/y8ilzLiq1uOSQ1iruW LNzLirbYsF6Yqsbjx+PFVPimLNtlxYO/YxV37eKubFVnwJirTYq3wfFVNl4/YxZt+mv7eLBrFm5M VbZVxYNYs1nHniq37GLBdx/nxZreK/t4sHfHirlbFWlxZrVbFg3irXLniqriqlx+HFXL/kYqs4Yq vZcVWYq7FXJiqn9nFW1xVfiqxlxV3Ht+3irvixVYv2MVdy44q6RWxVT44q5cVcuKreGKt/6mSVrI q7FXf5eKrOPPFXMuKuZsVWMvw4qo8V/YxVdk2C7IM1HjklXyKuKqfLLErf8AU+3laFsi/FliVv2c WtTxVz4q1wyCrPixVzfDgZrFwsFJ8m2KrLlaFJ8sYLVxVrj8WKv/1PqOuZTjrVwsF/8Ar4quxVV4 ZNXKzLiqt/qYq7l/Pi2LsVVePJeGUoXp9vFV6riq/wDyMVcv8mKuVeOKtYq38K4qvxV3w/sYq58V dx/YxV3H9jFVfFmp/bTFg02KqjK2KtL9vFVuLNf8LfbxYLsVb5fyYq5V+H48Vd8WKr1/nxV3w4qp Ys1X9nFg5uXLFV3HFV2KtNy/YxVyqz4q1xxV3HFV/HFm74fsPiruT4sG+WKr15Yq18XLFmtbk2LB vFm20eKu48MVX88VdzxVUxVytxxYLeOLNUwM1jNwwsFTliwcy/D/AJGKuVsVUlxZohvgxYO/ZxVy 4q0y4s3Lira8uORYrsVbySHf8QxVyrirueKtcfi54s3Yq2y4sHYq0y8MWbnxVdxxVc2RQp5JKouR ZuyTBU4/z4GbuKYFWM2Kt4qubFXNiq7FXYqt+3i1rcWxd/qYq5Vwq7jiq9l+HArWKruOFWuLfYwK 1irfLFXceeKrfTyTBvAzdgVbkmC9myLNv+T+fJMFn7OKr/8AXxVcyr+xkWbuPH9vFrcv2sVW/tZJ K7IoUmX+TJJX4quTAzWphYOxVy/Diq3IoVOPLFXPhbFr4WC7l+3kULFxVfwxVavPJJW/ZyKFThiq jkkqjc8VczYq5l/nwM12KqbfsYFdirarirWKtcckwXfDkWblXFVn2MVX8f5MVa+1iq1l/kxVZ9rF Vb7LfBiqzj/PirlXFWuL4q3xxVzYqs44VbxVbhYOxV2Krsizdiq3JMGm/wAjFXfaxVY3w4q0zcMV bZeGKt4sHYq7hirsVd/r4qsZcVaVsWbWKuxVvFgt+3iq9sVU/sYs2+PLFg5uWKu5Yq7lirlXj9jF VmLNT4/yYq5MVcy/z4q3wxYNcuOLNaq4sHfDirSrizcrcMVd8OKuxYLfsfBiq3FW+WLNrFg7FVzN /wAHiqxf8jFXfaxVYmKqmKuxV2KqfPFXfFirmXFVnHFWv2/8vFW+Pf8AYxVpcWbatiwWccVXr/Pi qxsVWM2KrVxZu5Yq1iwbZckrS/ayKuZV/nxVauSVbkVbXFXLiqz4MVd+xiqi3PFWz+3klUmZfsZY ltsVa+zlKFrNlyVv2crQt48Pt5YwWcVxV2KrGb9jIK5cVcuKrcVawM1nHLGCznirv2sVf//V+pDM uZTjt/s/BhYL1xVfk1XquKujxV3xYtiI/ZytDm44qv48/t4qq8ciq/liq1Y8kq5VyKu9PFWsVVOG KuxV2Ku/18VX/wCpirlXFXKuKruPxYs21VmxYOVf2MVdyxVe2KreOBua4phaV8fHFXfDiruOKtfD izbX/LxYL8Vd/qYqu5Yq7jirlxVdirsVWtirlxVU4/8AAYq7/iOKrsVb5fz4q5sVaXlizcrfz4q7 jzxVfwxV2Ku4/wDAYqv4/wA+Ku+HFXckxVtWXliwVcVUVXFmqNiwaXFmqKuLB3H4cVXt/qYqoccW a9ff7GKqn+piwdirsVd9jFV+LNTbi328VdirmbFW2bFg7hiruGKufFV65Fk5sVcuLYtfFV64Vaws HccizVP8jFVuKtNhVerYGt3/ABHFXZJK34MVXL8OBmuxVb+3iq7FW144FcvwYqsb4cVX/wCRiqxf sYqv44qs4/Diq7FW/iwq2v8APhYO4Yqub7PPIoW5JLnxVri+Bm6T7GFg2v8APirnxVz4quwM1nL4 vjwNa/8Ay8LY5ueKrXwsGlZvsZFm3/r5Jgu+HIs1rLkmC7/IwM21/kTCwWKuKu/ZxVz4q7nirv8A X+3iqr+zkUKTfz5JLv2cVd9jFVXj9h8ihS48sklzfaxVcmBmp/ZwNbbfBirWKt8cWxrFXYVb5YFW q38mSYN5Fm3y7/t4q5cVd/qYVbXFVNWxVay8cLBc2RQ5sVczfFiqz7WKubC2OVcVdxxVbwfCwaXF VZsDNYy4q3gVr/LT7eKqX/EMkwX8sWC3FXMuKub7WKruP7D4s28VWPiwd+zirmVsVU8Vd/qYs3Ly xV2LBUxVTxVtsVaxVaq4q3xwNzXHC0qXHFm2y4q5cWDlxV3Z8Wazj8P+TirbL/J9jFg5f58VaxZu VsVW/tYsFPjizVFXFgsjxVpV/kxZubFW2xYLsVUlbFXf6+Kt4q7FWv8AUxVpm/nxVbirm/kxV3H+ fFXMuKrOOKr8VWNiq3Fm3iwWs3HFWlxZttiwU2xVU48fgxVbirXHniqz/XxV3PFXM2KrOX7GKu+L FXccVaX7eKrWVcVc3w4qs4r9vFXLklW/6mKqXF8sS2y/t4qpt8TYqs44tbm/18VbxVTZcVWccgrX 2/t4qs4/z4q5l+Lniq/lgZobjz+xhYNr9rJq/wD/1vqQrZlOOqccLBdwxVvJqvXFVXFVq4tiqq/Y 55Wheys2KrlX+fFV6f5GRVfxxV3FmbFXLirlxVfiruGKuxVd/wASxVv9j48VbxVpm5YquXlizVFx YNYqt/yMVXs3PFXL/JirWKrv+JYquTFXK32MVdiruK4q58Vcq/yYq7FV/FMVaXFXcsVcuKt8u/7G KquKrfh44quxVZ8X2MVX8eGLN3HFW1XFg0zfDizX/wCQiYq5f58VdybFVyYGar/xHC0qa4q3iza+ 1iqouLB321xVzLireLNrjiwXYq7FW+OKtL7/AGMWbWKqvDFgqYqpr/JirWLNy8MVdirmbFXYq2q4 sFzYq0mRZLcUL+OSQ5ftfHizbxVTb+fFVXjgZr/8vAq7FVvHFV2FVvHFXccVXYqtZcVXYq2uBWsV b/ZxV3HFWsVW8cVX/s4Vd/kYFa+zirbM2KtYquVckwd/kYq74cVab+fAzb54WDXHh9vFW/8ALxVd ybAzW/6+Fg7FV6tiqzFV3w4Ga39nhhYOZcVXr8eKtcsVW/6+Ku+xirsVd8OKuVcVXLx/bwM1rcuO Fg5lxVyYq5lxVc2KrXxV2KuZsVXcm+xgZrUwsHPirm+D7GKrmbIs1nw4tbWLY0y5Jgu+LIs3f5GK ublirmXCruOBWlZf28Vb+x9vCrv2cCr/ALGFVi4FWf8AEcVX/tPhVZ6eBXLyxVy/z4quxVbxXhiq zjwxVVxVbxxVbhVUxVRwsFq4qv5YGazFVyrhaXcciyd/kYqt45JLfHniqznirsVbX4sWDnxVT4Ji rm/kTFm7/I/bxVrFVzYsF/PFVn+XirmxVrFVFl5fYxZqnLFguxVR44q1/kYs3Liq/Fg0v2eeKrOP /B4qv4/Fiqz9rFXceWKtcMWbv8jFVnHFXM3w4qt+LliwbT7GLNvFgt/yMVWfs/6uKquKreWKqbYq 2zYq7/ITFWuWKt83xVzNiqz/AFMVWMvDFXMuKubFV6/Diqmy4s2sVXf6mLBT5Piq/FVvwYqsf7eK u/a+DFVnDFXcMVdzxVz4qsySqnPFWsiqiqquKub+fFVNsVW8eHwZNk3gYqXJ8sSuZeTcMrQtVcsS o7fyYqv5Yta37OKqbfDirT5BVPFW+Xw4qs5fFirmX4sDNZywsFjfH9vFX//X+pC5luIvjxVUyauV cVVMVXcfhxbHL/JiqI4sv2MrQ2uRVUXFVv28mwXfb+DIM17YqvxV2Ku54q7FV/Ln8GKu/wAjFXNk lXcP28izcvw4q2q4sF/7PwYqtbA3LVXCwX/axYNs2KrcWa5cWC/FXfBwxVUxVTfFXJiq/j/PiqxW xVfx/kxVen+RiqxWxVcq4s1+LB2KrVxVev2vgxVpfs8MWbuXw8MVcvt9vFXLHiq9WxVdgZqTfyYW Coq4sG/sf6+LNvj/AD4q5lxVdiwXLirbYG52Fg1x5YsF2Ktrirl/kxVbizb5fD/l4q5PsYsFRVxV y/ZxVrjyxZuXhirmVcVaZeeKquKrFXhiwX8v58VdizdxyKG+OFsWKq8sCu45Jg2rfFiq5W54Ga/j yxVdgVa2KrsVdhVrlhYNKvLAzd6eBV6rxwq3xxVppMCrFbFVTlhVbga1Tlz+DFVn+vi2NYq2zYq1 9rFW+WLW5V44ti9ZP28Kuj+3gVdkmCnwxV3PIsXfbyTJ3PFXfFirnxVdxxVzNgZruLcsDWs5cFxV vk2Ku/axVa3w5JK9lbjiqz4sVXLiq3FVTlkUKf8AxDJJcv8APiruXw88Vcy4qu4ZFC3JJXZFC3FC piqnkmS/7OKtL8WBmtwsHfE/28VdyXFWmVXwM2+OKu54WDvs/YxV3JcVdirsVcmKuxVz4qp4qv5L +3kWbvhxVrFXYq2q4q5fg+xhVzYFdy/nxVrFVvHFXf5GKubFXfBiruOKubFV2KqDLkmC/Aza5Yq5 sVa/18Ct8cKrGwsF37OLB3HhireKodcWa/7GKuxVU4piwWcMVdirsVUsWbsVVcWCniqxl45FLXF8 kyXNiwdyxVyriqxeLtiq1cWa/wCzgZreXb9vCwb+ziwWf5GKu/yHxV3Ff28VWcuX+TiruK/z4q5c VW4s2+PBsVaxVtWxVbxxYNP/AJGLNtcWCnyxVdiqpiqnirX+piqzFVTFVq4qt/1MVdiqxsVX8eWK qeKrVbFXL8WKr2bFVnLFVzfbxVS/axVa2LNtsWC3hirl/wAvFXM3PFXPiqxVxV3Hhiqxo/58VU2X +fFW2Xnirv2sVW5JXJiqHZcsS5vixVZy4Ytbf2cVd9rFVLIKt5Yq7jiq3FXYqsbAzdxxV//Q+pbZ lOO3xwsFf7WTVrjiq/48Vd8eLYqquVoX4q2uRVWT7GKrf8jFV6/yYqvxVyYq7FXYqvVePwYq5l+L FW+XJskq79jIqvb48VWf5eKr2X4cVaxVtWxVr7OKqmKuVsVWNirS+328WapwxYKmKqfDFXYq77Xw YquXFV2KuxVrj/Piq748WaxsWCov8mKr+OKrOOKtt9vFm2rYq3Gv7GLBd8WLN37OKuxVTxVU+H9v FV7YsHMuLNyx88VVOWLBy/z4q5V/bxVpVxZr+XDFVqt8OLBW/wCJ4qp4q7lizaxVtv58VVOP8+LB 2Ku+LFW2b9vFmuxV2KqfL+TFXfBzxVUX4MWDf2ciyc3LFsbwq7FVithYNNirfHniqrx45FmuxV2K uxV2FVrfDiq9VXFWsDWu5YWxbgVtm/kxV32Vwq7jgVYzYqvXliq6Pkn+pi1qbL8WSS7jiq7jkWba r+2ckwa45FDl/wAvC2LWwsFX7Xx4GazjgVvJMHJiq7jirmb4fjyKHLxRueKrWXJJd8WKu+HFVyYG bm5ft4Gtvj8Xx5JLlXFVnH+fFXL8f2MVX/axVvFWmbFXcuX2MVbxVrimKtcsVW8f28VXs2KrMVdi rnxV3L48Vdiq9mxVZ9psVXMvFsih32uGFsWxthYL+X8+KrOGKrmXumRQuxQptwyTJr4cizb55Jgu VcizW8eDZJg58Vcq4qp/axVeyrgZrP2MCrsVbXFVnHFV6tiruOLW03+XirbLhbG+OKqfHjiq7Aqi 2KqitirlXFV2KqTLiqxvs4VVMVaZsVWccLBWVfhwM1JmwsHNiwczYs1j4q7FXcMVb54sHYq7k2Ku /axVTVea88Wamv28VVWbFg1irfxYqtyKVv8AkZJkqLiwczYq1iq1eOKqfB8Wa/AzU+WFg39j48VW t/PiwaXnizW8cWDSq32MWbf+RiwW/H/s8Wbvs4q3yxVYzLiq7FWuWLBr9nnizc328WDWKtM2KruT 4qt+zirv9fFW8Vdiqn8TYq7FXcMVdiqnirbYq5eSYq7j+3irvsc3xVZ9jFW8WakuLBU48cVWJ9vF VnPFXPirueKu4/BiqxsVWcsVc2KrcVU25fsYq3wySuxVz4qpcfiyxKxlxa22bFsU1xa1j4q7hiqn /kcMgrfHFWmwM2sLBayrir//0fqWq5luIqZNXKuKqifbxVd9vFVVftfHlbN3L9vFVyr+2ciqtx5Y qqcckrS5FXKuKr8VdwxVyYqvX+TFW8Vab/IxVevwtirXLFmp8sVV8WC1V/4PFV64q5mxVzYq79v4 8VX/ABYqs+P9vFXNirlxVV44q3/r4qsxVcuKrsVWtiqouKuVW5Yqs+39vFVy/bxV3wYs12Kttirf HFg7/UxVrj8WLNe32cVcq4q7niruP7GKtqvxcMWC/g+Ku5fsZFLmxSv/AMjJMWlbFmvxYLVXh9vF XcW+w+Ktcf5MWa/4cVaxV2KruOLBfirsVdx5Yq0q4s1T7WLB2LNTyLFUVf28UrsVdirS/wCpirf2 PsZJKnxxVey5FC5l+HFW/wDUxbF2KuxVaq4q748Ku44q7i+Fg5sDNvjhYLvjTIs2sVbXFVnD9jFV /LFWsKtrgVfx5rhVbhYOaPFXYq58VcvPFVV/t5FCzjywti1viwsFT4uWRQsjXniq5VXJJdzfFW1y KGuKZJLX+Xiq7FXYqtb4cihfxX7GKrfi+3kkt4qtbFV7fYyKFL4cklEcuS5FCl9nJJa44q238+Ku VfhxV3JX+3irvhxVzfBirv2+eKtq3xZFDsklTxVdxxVWb4sihSVcklvFXfDyyKFPj/weSSv49/28 VWMvw4q7FXJirlXFWvhwM28LB3PFVzYqs5c8izX8uOFVqYWDTL9jhkWbbL8Xx5JgsVfixVvIs2+P w4q1irfHFXccVbbCq3ArTfHkmDX2MDN32MVXYFWri1u44ti7FVrfDirv9TFXcV/2OFXYWCnirsVW 8cVb/wAt8Vb45FDmxVa2SS1/l4sGkxZqmKqaYq5VbFW2+ziwWf5GKu/1MVXMv7aYs1Jm+HhiwXt8 eKu7viqzjirXHFm7/LxVfiwW8cVWYs225YGbXH+TC0ubliqmy4s1PFVRWxVbyxYOb+fFXfD9jFVv NMWbvs4q2vt9vFXMvxf5eKrWxYNLizX4sFPFXYqt5Yq2q4q3irX2sVa44qtblxxV2KrP9fFV7f5G KuxVTxVtsVWM37eKr+TPiruTcsVWP/l4qs/yMVbxV2KuxVTZWxV2KrOOKqfF8VX8XxV2KqeKqbcM Vb4/8HkldH8eKrJFxVrjliVjNiqzFraZcVU/2ub5BVqrxyarcgrsVW8f5MVVOWKv/9L6lZluIq5N XMuKqy/E2LY5cVVVb9vK0ObFVWNsiq9cVXYq3x4Yqv54q7FXYqv+HFWmxVc/28krSrkVX8cVXZNk t48fjyDFerfsYq5uWKu5Yq5v8jFV/PFXK2Ku/wAhMVdiruPLFXceC4qubFVqriq7jirlXj/qYq2v 8/7GKr+P2MVczYqv48MVczcPgxVYuKuZuOKrv8h8WbXBMVbbjirm/wAjFWvtYqrJgZuxVbhYNqvw 4sF/JuWKtq3w8MiyXtirSrkmLuWKu5YqvXFXLiruWKtccWbvixV3HFXccVVMWDueKu4Yq1zxZt/6 mLBvlizXL8bfBiwaXFV2KrWxVy/YxZub4MVXrirsihUxVbyxVTVfhxbHcsVVsKuxVbxxVeq81/yM VaxVtl+HArfHCrXLAruOKrGkxVeq4q5eWKrMkwX/AN1gZr+S/YTFXfs4qtVcLBcuKub/AIfIody/ 4PFsW5Jg5lxV3LAzXcebYqvjwNbWSSu44qsb4MVbb/LyLFtV4/YxStXJMXfFkUu45JCr8L5FkpMu SS1yxVtuOKt4q74uWRQ32TFV+SStVcVWN8eRYu/yMVVf28Uqa/a4Yq5W4NwxV2SSt/yMVRGRQtyS XYqoriq9WyKHcf5MVd9n9jFXZJitVm+xkUrm/kTFKriq308VUmX4sklYy4q7hirvsYq5MVdy+DFX Yq5WVsVW5FmuVf8Ag8kwWcu/7eKrm/nwM2+PLCwaVcDNZx/nwKu+zirsVb44q1hVtsDWsZcWxdhV T5YWCpgZrV5Liq1cLBc2Bm5cCuZviwqt5YWCmq/sYq7jirfx/t4q5sWCpx/4PFVrfBkWTXxfYyTF bxxZreeKrmxVay4q2zfCiYsFTFVPFVnw4q1x+LFmqJiwU8VbbFVv+XgblqrhYO/18VWNiwb4/C+K reOLNtl5fbxVv4sWCpizUmXFVitirsVbZf58WCnyX9vFmvb+fFVnH9h8VaxVtcVWLxxVtsWDS4s1 +LBa2KrcVW8sVXYq19nFWuOKreGKuZl44q5lxVz4q7hiqz/IxV3+Rirm+PFWsVdiqx/8vFm23/D4 sFjLiqxf8vFV/wAPLhirTYqt+3iruGKuxVY2KrOWKrsVU8VUvt7P9vLkrcrQ3Jiqz48VW8csS5uW KrOWLWs48sVayCreOKrsVUePL7eKubk2Kv8A/9P6lr/JmW4ipk1X8sVXtx+xi2O44qqZWhU+HFV+ RVVZcVaxVUTFXN/l4q7FV7fYxVvFWuS8sVaX/IxZqj/5GLB3FuGKrsVb44q7liruOKu/1MVXry/b xVZ/l4qvfFXfC2Ku+xirkxV3PFV3HFXLirfL4cVX8sVU1xVWxVa32MVXYq7FW+XPFWuOLNvIoXJk krFbFVytzxVvFXf5eKt8MWDl+ziq9fsYq6PFV8fw4q7jirXHFm3y/kxYKn/EsVa44qu+PhizWfFi rsWComKu4Yq7FXYq7FV32cWa3FguVcWbuOLBpcWapgZqbYWCsuBmpquFpXR4s13HIocrfFi2O+wu KrcVdy45JguxVvliqxfhbFVbjgZtftYq5sCu/axVy/ycMWtrFXL/AJeKrsklpsizbyTB32MVd8P7 GKqeKq2RQt55JLsVdiq/1MVWYq7niqr9tMihb8OSSq8f58ihSVcklpcVdyxVWVuH+yyKFnFvsYtj mXFrdx/bxVpfi/18Va+1kkquKubIoW8cULOOKuZcVdy4Yqv+xkmSxPt4quZcihze/wBjFV7YqtxV TXj+3kkt/EuKu+HFVzNkULOOSS5fs4Ga/j9tMDW74vjxVarZJLlbFVVVyKEO+SSvZeeKruLP8eRQ tVsklrjiqt8f7P2MihZy/nxVazM+SS5v8vFXN/P+3iqxV/YxVz4qtyLNd9jJMFuRZu+1irXLnkmC 5lwM2sVXNiq3FV3PCwa5ZFDWLY7FW2VsKtYqt+xiq1P8jCwXft4GblxV3wYq1xfArfL+fFrUpMkl 37OKt4q3xwM28VW4WC1cVa4YsF/Hn8GKrFXFXcvgxV3L4MVdirsVdwxV3DFVPFWsWbf7WKt8cWCx vhxVrlizd/qYqvxYOxVS/wBTFVvLFmq8cWCxW5NirX7WLNrhkUO4/Biq1eX+wySXYqp4qqMuKtyf bxYLPsfBirS4s1LjzxYL2XFXfHiqz9rFW8VVMVU8VU8VVMVaZcVWL8OKu4Yq7hiruK/YxVZx54qv fFVnw4q5sVWNyxVyryxVvFm19tsWC3FWlb4sVabFVrN/wGKuxVT+zirfLFXccVU+L4qt4pirXHFV vDFVPj+xlyVzZWhSX/hMsYLGXFW8VU8Va4ZBVjLirWKruOKv/9T6npmc4juGKr+P7GKr1xVEL/kZ Wzcv+RiruK8sVV8iratiq9eGKuxV2KqmKrWxVU5cvt4qsVeWKq3Hhiq3FmuVsWDm44q1iqo+KqeK qmKuXl+3irTfz4s1n2sWCorft4q7FV3LFW/2sVa44qrYqt5YquxVaq4qvjxVTXFmvxYLeOKqirkW TlxVbxySXfs4qvb/ACMVcq4q7izNwxVzLiqriwab+fFV6rirlxVf+1iqm2LNUwM1nHC0r+OKtYq5 mxZu44qqYsHPirmbFXYq0rYs3YqubFW2xYNs2KtLirXHFmqYGa74MVUeOFgqcsVa4PkUKnxZJLeB mp4qu+PFV2KruOKtKuBrc2KtYWxbhYL2+PIs3K2FXM2KuVf58Cr/ALX2MKrfiwsHfDirnxV3DFXK v8mKuxV3HAzdzwsHYq5lxVcmRQtySV/HnirlyLFV+PFLuXLFVL7WSSqr8X2MihTySXLy45FDbf5f 7GLYs/y8kwVPsYq3xZPsZFCzJJa5fDireKrVxVU4/wA+KrF5Yq2qtkUOySVb7WRQprkkrlbIoU2b lirTceWSS5v58VbbIoa/ZySV+RQ0rYqt+LJJXKzNkUL/APLxVTySVq4q39nFVz/byKF/2PjxVD5J KsvFcVU+WKu5YqvVcihavLJJbxVrkmKtrkUKjL8PPFVJm4ZJKzFWuPDIs3cueKtrhVz4WDsVcmKt MuRZtsq5Jg7jgZrcVW8sCrsVdhVa/wDkYq7j8OKqi4qpqzYqv4/DiqzliqmrfyYFVP2MWtbhbFjL hYL8DNT+LjhYL/gTAzawsHcf2MWDeKrFxZtK3JcWC9lxVZirnxVzcMVdirvt4qpYs2/2sVbXFg7j zxVT44s3Lirf+Riwc2KuZVxVZx/kxVvFWvsfYxVvFVi4s1y+32MWDuWRZIfJJVGbFVPFW/2cVX4q pccWDlxVdx/kxZrW44sFjNiruPDFWuOKqnLFXMuKrOXD48VbxVTxVzfDirnxV2KuZcVdwxVTxVts VWL9jFW8WbSr8WLB328VU2xVpcWa/FgpsvDFXYq7FVPFXYq2zYqpYq1y5/Hiqxvg+PFVrNwXJK7/ ACMVc38n7eKqH2ssYOxVpcVWYq1xbIK7FVPFX//V+p+ZziKmKrvjxbG2ylCuv/EskrX28iqsq8cV d+1zxVW/yMVXLirWSVcvt9jIq5lxVpcVbVfixVUxZtK2LB3H+TFV/wCxzxVrFXYq3yxVzL/Jiq/i 2KuTFWvg+xirfFcVVMVU+Xx4q7FVbjiq3FW+WLN3x4q2uLBdirsVWcsWbf8Ar4sFT1MiyaxVezZJ i7j+xiruPx4q0vDFmv4/t4qtXniwXcsVb4/yYq7/AFMVVcVWs2KtK2LN3HFV+LBtcVaXFm7Fg2q/ z4qvZcVabnizdzxVytiq7jirXDFgv4/F8eKtccVa44s2kxYL+SYqtbFmu+39vFgu/wBfFm5cVXfF x55Fm7/LwquxVv7Hx4qt5L8GFg1xwM1/xYFaxV32sVbVsVWcuOLW7jw+N8LYvZsDW7/LxVvhkkrv 2cizW/FkmDsVczYq7FXYqv8A2/jwM2m+1wxVaq4WDv2cVVsihcy/t/t4qpL8f28kld8LfYyKHKuK uX2+xiq34/8AYZJLlbh8GKu+HFXK2Krl/nyKFq/z5JKqq81yKHcf58WxZ6eLW1/r4qqN/JiruOKq eSSrZFC1lxVri+KuZlxVtV+LFXfbxVy8cVW/8RySVytkUOZf5MVWrkkrWyKG2/nxVZ/l5JK/08ih ev8Ar4qp5JLuPw/HkUKmSSuyKEOuSSubIodih2KuyTJauKuVf2MVX/FkUL+WKrF/kfFVnHJJRGRQ oKvH7eSS5mxVZirvixVyrirnxVdkULeGKHJkmTsVdirTe/28izdxxVrFXYq3/qYqsb+TFXft4q7j hVUXFVn+XhYLePHFg2y4G5y4Fdxxa12KqbMuSS7jiqxvh+BMVdxxYK+BuQ7YWC5lxYO/yMVczYq0 2KrsVU/9fFV6r+wn2MVWPirnxV2KuTFWnxZrWxYLOP8AJirlXliruOKuXFV2KqWLN32sWDsWbf2c DNrCwcytiwU1bhizb4YsFLFmrc8DNRwsFzKvLFgpqy8sWbm+HFV/HFXYsFvHFXNiq3FWv8vFWmxV diq3jiq3jyxVyYq7hirsVd/l4qsXFVn7GKr/ANnFVnLFV2KqDYs1zLiwW8cWa5lxYOZsVWvklaZf 2MirkxVTX7eKttiqxsVcqriqxuWKrGXFVjLirbLzb48kqky/FliVnHFrd9v7GKrHxV32fsYq1kFU 8Vf/1vqfmc4i/j8XBMVVPh44qvVfiylmvxVb8P2P5MmwRCs2QZr/AE8VcuKr8Vdiq9eX+zxVvFW2 xZttiwaVsWblZcVb44sF/wDl4q5eWKr2+ziqmn2MVdirbYqv4Yq7FXJirsVX/axV32cVabFVXFm7 FVrYq2uLBdiq1sVa4pizXsvDFW8ih2KtfayTF0fLlizX8f28Vb4/yYsF37OLNv8AaxYN8fiwNzSq 2Fpd+ziqrirWLNdgZrfi+3ireFpbbFV/HjirsVcq4q7hirX/ABPFm7/iGKu4YqqYqsX+RMWC9V/y 8VbxV2KreOKr2/kxZrf8jIoVOOKqbYqrYqt44Wx3Ff2MVdxxVdiq3CwXYGbsCttirX2cVdirbf5e KuZWwq5sCtpkmDsVdzxV3DFV32MDNbwwsHL/AD4qu5Yq2qt+3irvs4q3irf2sihe2KqLZJLfHniq vkUKLN8WKqnH4sVUmb4v8jJJcvx4q1/l4qqccixWK2Kqqq3HFLuOKqn/ABHFsW/axa1rLiruP8mK u/bxVb8GSSuZcihyrirv9TFV3L4sVbXFsWN9n+XFrcq4qtxVdxxV3HFXMuKuXFXfDxxVaq5JK5ci hf8AtYq1iq3j/Piq7FW1XFVnLFV7N8WLYs+xi1qbL8OKtfFkkr+KYqptiq5VbIoa+zkkr1b+TFVq t8WRQtXJJXMrZFDSrkkrF4Yqv9PFVnHjiq7jiq3niq5m/YGBmt+xhYO4YquTAzWsuFgtb/IyKG1b hhbGsCt8sVaxV2Kuwq7mmBW/2uCYq1iq3JMF2Bmp4FXf6+LW5cVc2Ku/18VcuKrOX8mFsawsHNxx YO48PjxVr7fwYs1XFVP9rFg1xxVZ/kYs1ReKf6mLBZirsVWcv5MVdyxVrFW+OKtYq22KrGxVdirb ScsVaxVb8eKrJMVWrizXcUf7eLBr7WLNv/LxYLW/n/YwNzl/4TFVvw/sYWDm+18GKrFb+fFVnL+T FXfbxVfy/YfFVq/F9vFguxV2KuxVb9j7eKubFXM2KqfHFVuKuVcVdwxV2KrOPDFXNirWKrV5fbxV Yq/Firl+DFVTFmp/ZxYO+HFWlxVbxb7eKtvkla+3kVWNyxVzYqs/4jiq/j8Xx4qosuKtcsVc3H9j FVJv50xV2SVTbLErG/y8Wt3LFsWYtbnxVp8gr//X+qf2sznEXKrYtjmxVV5fFlaFX4ciruz4q6P/ ACPjxVEquKuxV3DFV/p/z4q0uKr8krbZFVJsWaouKr/hxVtcWDuPw4q1iqoy8VxVYvLFXNirmxVf zxVUxVr/AC8VabFW1+Fq4qq4qp4qqYqt/Z4YquxVri+LNvFg7lizcuKt5FCo+KrVZvt5JLlb4sVc vDFW/wDXxYKn7WBubxVrC0rv9fFXL/w+Kt4s1rLiq/Fg7FVv7GKtKv8AkYs1/L+fFVT7eLB3DFWs WbvhxVfx4YqsZm+xirfDFg77GKr42+LFVvHFmrfbwM1P7CYWlUX4siya+Lj8GKr8WxauFXL9n/Jx Vdiq1cVW4qqYqtXFVq4WCr+ymBm5VwK3xwq7jirXH9vArl/y8Kt/s4WDsVdwxVzKuKuxVzNirnxV y/5eKr1/1MVd9nFWlxV3HFXccVX/AG/sZFC9V44qpL7fYySW2ZcihpfgySVXFXcviyKHR4quxV2K uxVb+3irlxVdirsVWsuKubFV3H+TFVvHFV2KuxVav7fp4ti7FrbX4MWxZ8eLW7jiruWKr1xVZ9v4 8Vcy8ft4qt5ZJK5lyKHN9rhiruf7GKrsVdirsVW8cVdkkuX4cihdirsVdirsWx2LWt44qotkkr+P 7GRQtb48klvj8XPIodkktMvPFVVcihY3HFVLJJVGXjkULlySVuKtq3BcihS5Nkkrl4ZFDmZcVbf7 eSSs/wAvFXc8Vd8OKu4/t4q1/kYGbXBMCt8cVd9r7fw4q77X+VirWKuxV2KqbcU+PJMFy/DgZrsC rG+3irfHi2KrsWtS5dv28Va/y8VaXJMV+BuVMVU8VXft4qpcf2MLBdiwU+K9PtYq1/kYs3K2Ku+3 ireLBzL+2MVUsWbmb4eGKt8sVaxVvFgsb7eKrsWbuXw4GbTfyYWl3Hliql/kYs1TAzaZsVa+LC0r JF54qtbIsm0ySXc8Vcy4qt/y8WDWKt8m/YxVbizabFg7liqxm5Yqq4qp4q0rYq1yxVb/AJGKuZcV diruGKqmKqfxcfjxVTxV32sVb+LFXK2KtLizUm5YsHcskreRVTxV2KuxVZyxVfiqjxxVdireSVSy KrWxVR+1irbLw/bxVT/18uS6TkuLWsZcVd+ziqzjxxV2Kv8A/9D6pKv7GZziL/i4Yti/7WKqq/5G VoayKqi/6mSVc3/BZFV/+piq9l+HFW+OLNd+1iwaXFVRVxVy/FirXHFm74MVVOWLB3HFV6tiqziv LFXNiq98Vdirv9fFXYqqYqt/4jirfH9vFV7Yq79rhiqxmxVvFVy4qv44q1irm+DFmt4/yYsG0/y8 iyVEySVPFVdWxVYrYqvXl+3iqtiwU1wNzeKtr9jC0rsVW8vixVr9jFmqfaXFg5cVWLiq77OKrGb4 sWa74/2MVVcWDsVb5Ys1uKuxVdxxVrFgqYqs5Ys12Kt8cDNf/r4Gt3HlirvUxVbyySVy4GbsLBdg Ztr8GKtYqt/bwK7jiq7Cq1cCu5ccVXt8GFXMuKuZeGBV68MKuwNa2RVySXN9rFXJiq7jiq1V+3ir sVdiqrx/kyKFq8ckl3xYqqr/ACZFCk38mSS1xxVteKYq7imKruP28ihvjihZxxVXxSsZVxVv/UxV zNyxVey4q1i2Oxa1BPt5JKr6nxZFC/4sWxzNi1tcv5MVdiruPxYqtVWxVdirfLFsWf5eLWvVf2MW xYv8+LWvVv8AgMVd/l4tjWKuxa3N9vFsdi1rft4qvVcVd/r4qs5Yq1yfFV+KrfjxbF2LWtblirvj xV32MVXcf58Vb5Yqp8skxVGXIslNf8j7eKttirpOP2MVUvU55JLeKrVxVW5ccihRbJJX/s5FCzjk krmb9jIoVP8AXxVZx7fsYqpfbySXJirmXFXPiruGKu+xiruGKu48sVXMuBmp4Fb44q2y/wA+FVnL CwXLkWaxf58VczfyYq5lXjkmC3lxbFVuKqirgZu5cP8AXwKuxa1PFW/jyTFZizdiq3lirmxVfiwW suLNvi328WCzhirStizVMVaXFgt/yMVU+OLNY2Krvs4q77WKrl+DFg7/AF8VU3/y8Wblb+TFXfsY q2q4sFn+Xiq3jizXt/PgZtL/ACYWlpsVa44s1vDFV3+XgZtYWlT+38GLNtsWDvT5NwxVbzTFmu9P +fFgs44q5/8AIxV3Hjiqz7WKu2/nxV3w4q5vgxVZirsVXsuKrMVW/wDEcVablirvt/Hirm+PFVj/ AORiruPJsVa4pizc2KtfayTBbxyKu5Yq3x4Yqs54q7i2KrOOKrGxVfxxVQbFXccVW4q74sVWcsVW 8W5ZNgp5NWuWKub/AC8VWcV/YxV//9H6pftZnOIrq37eLY39j7eVobj+xkVX8cVVGXjiq9VxVemK uxVeq4q5VxVfxxVyr/PirmxV3w/sYqv44qv4/BiruPBcVdiqniqpx+PFXYq7j+3irv2cVdiq5sVX Yq7FVq4qrYqpL/kYqv44quxV3+Rizd+1iq1fixYLuOLNfxXFXYqt5f5eLBVX4MWbeKtcl+xiq5eO Bm7C0rv8jFWm+xizdyxVtsWDmX+TFXccVX8eeKu/4jizW4qq/wDE8WDlXFWkxZuTFXfYxV3PFVTi mLBvFVjYs3csVXYqtbFV/HAzbwKqYqt48sKt8cLBy/yYqu45FDT/AGMVbbFVjYq7ji2O44q5Vwqu xVarYFX/ALWKtqq5JguZueRZrW+P4MkwXcv58ihamSS03FMVbTFXNzxVy88VX8f2MVcy8cVd+18e Kr+PP7fwYqtXl9jIodyxV3+XircmKrOOSSuZfiyKF3HJJXNkUOVsVdz/AG8VXYq2vv8AYxVZ+1/k 4qvXFXcuGLY5sWt3LFVjfyYq7/IxVezYq74sVaxVvliqx/8AIxVdi2Lf9TFrd/r4q5sVd9vFXLiq 7FVq4quxVtcVdyxVrFW1+DFVjNiq/jiruOKuZeWKrP8ALfFV/HFsaxVauLWv488WxYzYta7FW2xV rFVvLlirv9fFV6/Hi2LGXFrcseKu5Yq7lirmxVZwfFVn+vkkrm/Y4ZFCnkkruWKtquKrMVc+KruL fsZFmtyTBzfFirvhxVpuLYGbmb4sVW8viwsF3w5FDmXFXcefx4Wxr9jhgVtcVcq4q0n2MVW/HhVt VwsHccVWMvHFVy8+ORZuZsWtYy4qq4WxS+LFVv2cLBVXAzU8LB2KreWKrcixbX4ckhy/B9jFWuXw Ys1i+/2MVVOXLFg7iv7eKrOOKtf6mLNrFVrYqqL8GLBrFVmBudywsF+LBbxxVb9nA3N4qsbC0rMW buGKqrNkUKX7WSS3x+PFg1wxZrOOKt/t88ihbkkuxVpcWC7FXYqtVsVXYqpMuKt4qpvirsVXNiq3 FXJirkxVYuKu/wBfFVq/8Fkla4r/AKmRV3JuGKu/yMVWbfz4q7/IxVvFVPFXYq5MVd6fw4qp/axV byX9vFW/28kqh9r7eRV37PDFVrfyZJWmX+TLEqbLirl+L48WtYuKt4q//9L6pMv7eZziKsbfDlbN WxVrIqrf8RxVzYqrc8VVMVa4/DirsWa9cWC77OKreWKu+2uKrlxZu+1iwb/yMVaX4MWap/kYsHMu KufFXK2KqmKqarirkxVUxV2KqmKreP8AJirS8sWapy4YsHfDirXL9jFm5VxVzYq7FgvVcWazjiq+ v+Xiq7hkULsklv7WBm5cVd/l4qqYWlvliqmvHFmu+DAzbwtLf+piqxcVXYq5WxZu44qqc8WC/wCz /qYqp/FizXf6mKreTdftYq7FVXFg3yxZrvsNgZrVwsFuKrsDNUwK7FVvLFVq5Jgv4/sYq3x/byKG 2bFsczYq1irsVbXFXK2KtYVb4/t4q5V54FX/ALfx4qtyTB328Vdx/kxVzfz4q7/XxV3x88Vdiq9m bFXMvHFXM3LIsXckyTJr/UxVW+L/AFsihRbJJb488VVV/wCEyKFL4sklvFVRcihdirsVW/HiruKr irvt4quxbHYtba4tizkmLW77f2MVXYqtVWxVTySVf/LyLNzfG2KuZcVaxa3N/kYq38OLY1irsWtt VxbGsVdi1uxVzcsVdi2N8sVWNi1r/wDIxbF7Liqzjiq/FVnH9jFXf5GKu4t9jFrUuP8AweSSuXIo c2KrsVdirf7WLYsXFrXtiqz4MVXYqt44qvVsWxY2LWuxVbx5Yq5mZsVc/wDl4q748Vcy8sVUvg/Y ySVmKruWKtr/AD4qs4r+3irX7HwYqvyLNamSYL25YqsfFXc8Vdxb7GKtMuRZrOOKrsKt/wCRgVrF VT7GFVHjgVW54VWfDga3MuKuaNcVW8eeSS18T5Fm1x5fA+LWt+38GLYq4VU8VW4WDfLAzdxxVvFW +OFpWNkWTTfBihY+SZLv+I4q1iwdiqzl/J9jIsl6ZJip8l44s3Niq1fhxYLuT4q5lxZrOLfyYqqM 3w4sFHl9tMVXqzYqs7JirTYquxVbxxVZx5Ys1VmyKFLjw+PJJb4YsFnH4cVaVsWa7jkULeWSS7jz xVtlxYLFXFV2KuxVTxVr7TYq02KrcVXNiq3FXJiqxeOKubFV/PFVi4qs45Nk5lyDFzfD9jFXMuKr V/nfJK1/l5FXf5CYqsxV2KuxVYuKuX4MVWft4qpcfi55Ng22QZtN8WSVYy4qpfY+PLEtyLwxa1P/ AF8Vdy/nxV//0/qlx7/t5nOIqKuUs1dlySrFVsLBFZBm3xxVfirmbFVTFWlXFV/7eKr+L/yYqsT/ ACMVXfaxV2KuxVUxV3FsVcmKuxVUxV2KrFxZr8WDsVXcvhxVT/4jira/AuKr/jxV3HFV2KtYs3Yq 7FW1XFVTj/JiwbwNy3Cwb/1/t4sF/H+fFV2BuW4WC/7DYsF2Kt4G5T4phYKn+viwWKuKt4s2+X7e Ku4/Fiqp8HDFg7FXcVfFWmbFm7FXcMVdx+PFW8WC/wCzirsWbsVVsDNQVcLBVb+TIs12KrWxVyr/ AMHhVbx+FMLBfx+L/XxVr/IyLNdirsVbXFXcsVWcsVXs2KtfaxVdxwq7Cwdy5Yq7FXc8Vdy/nxVU yLFarYpW5JLvt4qiOWRQ5VxVRbJJRGRQp8sklbiruX7GRYqn7GKXL/PiqlxTJJaXFVbjkUL+OKu+ Lji2LGxa164qpMq5JK5sihey4tizli1uZsVdxxV3+Xiq9f8ALxbHL8H28Vcvt9vFXNiq/FVjYq1i ra/5GKrPi/2OLWvZsWxyrxxVrFrdwTFsdirmX9j9jFWuOSYOVcVbyLNv9rFXce37eKtYq38OKtYq 7FXYq3x/kxV37WKu44taxv5MVdxxVe2KqTcOWKFT7OKXYq3xxVyrirWKrVXFsWq3HJMFVcihrFVq 4qvZf58VQ3+XkkrmX4cihU/18VU8klUxVR44q7/IxVa3JMVcmKuxV3DFV7MuKtKv8+Ku5Yq5Mihb x5ZJLX+XkWa/lzbCqxV/nxVzNgVt8kwW5Fm38OKublirXwti1reOKqnHC2KfHlgV3LFXLiruOLW5 v9fFVsjfFkkrf2sWDStizX4Gaxl5fBhYN8HxYK2RZIbJMWuGLN2Kt4sFP08ila2SQu/ZxZt8f5MW DuOKtYq1xyLJay/sZJK5cDNrj/JhaXccVU/2sWbuOLBczYG53+viql9vCwb4YsGvt4s12BmtwsHM 37eKqfwf7DFV3Lv+3iwaZmxZrVXFguxVY328VaxVbyxVv/LxV32sVWMvw4qvZcVWMvw4q58Vdx/Y xVYy/sYq77fx4q7liruK/bxVYzYq7/UxVZizd/l4sHK2KrMVdirlXFXPiqiq4q7j8WKqfHFVvJcV b4/D8eSVz4qpZFVn7GXJW4tbX+Rir//U+qvx5nNCp/kJlKFRMkrlwsFfIM3YqrcsVXYqtbFW8Wa3 jiqIVcWDmxVzfyYqvxVTxVUVafAn2MVXcsVcuKtq2KrMVVMVaVWxVvFWvtYq3iq1cVaZf+DxZq+L Bv4sVW8vi4JizW8v58VXq2KtK3w88VXfFiwXYs3fs4q2q93xYLvg+3izX4GanxwsFX/LxYO/yMVc 3H7GKt4s3en8WBm3haW/2sVa+HjwxZu+HFW2xYOZf5MVX/6mKu/yMVa4Ys3Yq74sVdx5YqqK2LB3 2cVXYG5bhYLsDNd/l4q7/LwK7jyxVyrhVv8AyE+3hYLm5f8AAZFm1hVvj/JgVf8As8MVWL8eKuVW xVrFXYq3y54Vd/r4Fb5cskwcmKr3+3irStgZrf8AiGFg58VdirlXFVTFWuPDFW8Vcq/z5FDfL9vF XfZxVYuSS3Hirf2/9fIoXt9vFW6fF/l4q5vtf5WKubFXMuKuXFVqtkkrmbIocy/yYquxVvliqxVx Veq4q1irfLFsa+1iqpwxVYv+Xirm5csWtfwxbHMuKrGXliq9MVdiqniqorYqsbFV+Kqf2cWtuP8A y8WxrFVT7TYq5WxVTxVtW5Yq5l/kxVzLirWKu4virbLiruOKr+eLWsbFscuLW1irfHFsd+1i1u44 q1irfH4cWx3HFXccWtrFW+WKrOOKr+WKqfF8VX4qt+3iruX8+KukX9jFXNirv8tMVUmbJJVVbIoc q4qo8cklay4qu/y8Vd9r4MDNay4WDnxV37OKu5fsYq7hirv8jFV7L8OKtN9rIoWccWx3H4cVaxVv l/JirWKtrirS/wAmLW7FsW/Ywq79jFXfsYFd/kYq5cWtbirv8vJJW4qtXFVRVX7eKtYsFPFV3LFV PjzXFm3x+HhireLBrIpdwxVvJIU+OLN3NMWDuL4q2uRS5v58khrFVnLFm23++0xYNN9vFW/t4qt+ LA3NYWC3j8PPFV+LBZgbncMVWvhYLOP7GKu44q2uLBbwTFmuZlTFgs+x8GKrsVUWxVU48sVU2xVd iq3liq1f58VXccVW4q7hiqmzfsYs22+DFg5uX7GKuXi2KuZfhxVzfyYqs44qsb+TFW8Vdiqm+Kuf FXYqs+LFVnHFXft4qpNk2C5/t5BmtySqfHhkVdklW5Yla38mLW//1fqyuZzQqcMrQ1wyKqyq2Kr1 XFV6rirkxVf9rFXLxxVercsVd/l4qvWNsVdxxVy4qv8AsYq7hirsVVMVU8VX/wCpireKrlXFVPli qpx5Yq18GLN32MVb5YsHNiruWKrsVbbFWsVcy4s3ccVcvHFVXAzaVeGBrXLkmLX/ABvizXcvsYsH L9rnkWS79jFDa/D8GSQ79jFV2Kt/Diq1/sYs2+WKu/y8Vdiwb/y8VX8f2MVa9N8WbuPLFW8WDuGK uTFV/HIsl2FsWfawsF6rirS/5eBm5WwK3iq7liq7Cqz4MLS0q8mxZqj/AGMizbZsVaxVbxxVf/l4 q5WxVy4q7jzxa3Mq4tjaZJg7FV/+R+3iqz7X7eKu5fz4q77eKrv9TFVv+RiqIVcihSZcklrliq7I sWuOSQrYqp4qs5Ys1bjkULsVdiq34v8AZYtjuOLWuxV2KuxVTX4sULv9hi2tMy4ta/FVvHFXfbxV WZv28Wx3Lg2KuxVTxVtsVa+1i1t/Di2L8VU8Vdiqpx5Yq77eKuxVTxVtfjxVzN+3iq/niruGLW5m 7JiqxfjxbF/2MVdiruTYqsVf58Va+1iqpiqxsWte+LYs5Yq5sVX4qsZcVdyxVrFrdirfHFXf5GLY 7ji1u44qsVsVXfZxVtsVaxVZyfFVRuOLY1i1ttiqzj8WKrsVcy8VxbFrcft4tbmxV3H4cVUn+3kk qjLiwb/y8iyUmbJJWMuKrsihb8OSS7hirnxVeuRYtfDxyTJbiruX/B4q0y8vjfIs23yTBbkWba4q 5cVd9pcVd8OFVmFg36fDFWsVWq2KqmRZrf8AXxVdirsVU2yTBbiq7j/OmKrFXFXN/PirXLFWnxYO xVrhizc+Ktq37BxYO+xirvhxVZxxVrjz+x9nFXYq2zf8BiruOKrFXFW2Zf28DcuXC0tYqo8ueLNy /Biqz4sVVPg/bxYNNiqk2KrvsYs12Bm0rfF8eFpWMuKqfxft4s1/LFVv2PsYsHcsVXYqpMvw/Bir vhxV3L+fFW8VdiqnirnxVUxVTZsVd/qYq7hiqz/LxVri+Krv2fjySqa/DkVab4vsYs2/9fFgtxVa 2KrWXFXYqp8XxVdxySqf+p+3kVW4q0zYq5v58VWt9rJK74f2MVWenwxVDtljB//W+rX2VzKcdfzx VVZf5Miq7FW2/nxVrFURirXFMVbxVcuKr1/nxVy/5eKr/wBnFVLFmqqv7GLBUxV2KuxVT/1MVVMV diq1cVc2Kt/5GKqmLNay4q3xxYL+XDFWsVXNkWTm+18GKu4tyxVvhkkuVuGKrsDN3PFXcMDWq/Bk mK37fwYG5cqr/wAFhaXfbxVeuKrGbFV2KuxV2Ku+HFm7/LxVa3LFguxV32cVVMVa4Ys3f8TxVVxY NYs3MuLBvFVv2sWbXLFV7fBkWbeKqmKrft4q5Vwq2vwYWC3/AFMWC5sWa5pP2MizaxV2Kt/5eKuX /IxVrFV32fgyTBdxxVb8WKtr9nmmRQ1kkuTFXK2Kub+fFXKuKr19/t4q23w/HkUObFVrZJKouKqf HFV/H4sihZxySVZW+LIocuKu5Yqp5JK9fs/5WRQvxVvl3/bxbGsWtazYquxVvjirWKrWxVdi2Oxa 2+OLYvxVY2Ku/axVzNiq/nirsVU8VbVsWteq4tjuGKu/ZxV3PFXfZbFVnHFV74q7FXYqp4qqYq5u XLFXYq7FVjccVdx/kxV37WKr2XFViriq/FXYqs5YqvxVZy4Yq7lirm44qv4Yqp4q2ytyxV3HFXcc VaxV2Kt8eeKrOOLW5cVXYti2Rv58WtdirsVU1ySV3L4eeRQt/wCI4oXLxxS5VxV2SSpcvhxVzZFi q/6mKVHhirfH4ckltl/YyKFLjw+3kktviqozfDkUKTcvsZJLb4qv4/FiqznirkyLFfxxVT+zhbXL gVT4viqo2Ku/18Vc0eKtYqtXFXf6mFXepiq7FVv2MVdywNa7FVv+Xiqn+zkmLsWbS/yYq5cWC7FV LFm7hiqo3x/bxYNLiq3FVjYq5f8ALxVyrx+x9jFWsVW/8RxVtuORZNfEmSYrm/y8WbfL9hMWCxvh xVZ8OKr+XFcVUmxZr8WDX7WKqbfDizXYGa1f8jCwdiq3j8WLBpft4qs5Ys12Kt4sFvH+fFXLiq3F V3HFXccVW4qp8uWKu/axVezcsVUFxZqjNiwWfFirl/y8VdxxVv8A18kqn/kZFWuOLNb+ziwWPirv 2eeKufFVi4qv/wAjFVit+xiqzjiq3FXYqs4ZJVJvjyxK7/UytC1v8vLEv//X+rKt8WZDjr4/50xV dk2CouQZqy8MVdiq/wDyMVbxVcq4quxV3NMVVExVy88Vdx5/bxV2KruOKrFb4sWariwW8cVcuKt/ DireKqmKrVxVzLxxVy4q7liq/kz4q5uWKr/2PgyLJa2KreOSSvfFXJiqniqorfsHFVRW/YxYLeWL NcrYsG8VbwNzuOFg3/r4sF7Yq5mbFXLirX2HxZu/1MVb48MWC/FXYq7FXYq5MVVciyW/FkmK1sWa IwM1JcVbxV2BWmbFVXFVq4Va/Z+PC0tftviq5VwNy7FV3xYWDXxYGbv9fAqz7GKrsVXcMkwdy+L7 GKu5ccVdiq5uPLIoWpkkqrfD8CZFCkmSS5V/4DFV6/H8GKuVcVXLxfIoX/6mKqK5JK9Pt5FC9f5M Vcvw4q77XxviruOKrsVWqvxYqv5fyYtixcWty/YxVdiq3liruOKuZcVXr7/YxVZxxVfx+LFscvwY tblxbGsVVMVd9jFVi8fsYqv54qsbFV6riruLYq7FVn2PgxV3Hniq/wC3iruX7GKu/axV3DFXMuKu fFVPl+xi1qmLY5vtYq74cVdzxV3L4MVU8VVOGKuTFXJiqzl/P9jFWsWtUxbFir/w+Kr/APX/AGMV dy/kxV3PFVi4qv8AhxVY3wfHirWKuxVUfFVPFW2bFXLi1tYtjbe32MWt3LFsaxa1qr+w/wBjFsX/ ALOLW5fjxVy4qpNkkt8nyKFTjiqxlxVZ9rFV7NiqjxySW/ixV3xYqqv/AJGRQpcf58klc0eRQ1kk tNkWLm+PFVnPFV2KVv8Al5JLueKtKuRZu5YtbuPL7GLY5fs/HhV3HhirmbAq1ckwXLkWbmbCrWKt 8ueKrP8ALxVzNirmXAq/j8XDFrUW/nxVVwtjsVW8sVU8LBvFg7FVLFm5v5MVWqvw4sF+Kqf7OLN3 HnirbYsHccVaxVY2RSvySFnHFmvxYLVbFXf5eKrOP7eKtftYs13L+fAza+LC0rFXFWm+HFm7FVrY sF2LNZ+38GKtYqu/ZxYOZcVU+L4qs4/t4s1bFgp4qt44q7jirf7OKtccVW4qs44qv4/yYqs/ZxVy 4q5fgbFVn7eKu/y8Va44s1rNz+3iwbxVTb4cVdwxV2KrGb/g8VWcf58Vd/l4q5vixVT44q0rM2SV QVcirX7eXJf/0Pq4v2cyHHcv2cVVvt4quxVtcVX8MVVMVWLizVU/y8WDv9fFV/8AqYqrKuKrMVcy 8G4Yqv8A9fFWlxVarLyxVdxxVtWxVpcVVP2MVaZsWba4sFuKruPw4q5ft/Hiq5VxZrGxVeuKqsa8 MihYvFMklvFXf5GKuxV3PFXYqvXFg77OLNUXjiwdx5Yq3izcrYGbeFpb5Yqv4/yYqpt/OmLNv9rF gvxV3PFXcMVdzxVvjizdxxVf+zkULeP7eSS02KqzYGajywsFTAza2/kxVeuBXfBiruOFXNirvsNi q7FW+P7GBXcf2MVaxVuTFXKvL7GKtthV3HFXfC/wYWDsVU8VVMVVMVW8sVd/kYq2q4q5lxVV/wAj IoWfsfHiqzlkktrxxVpcVVOOKrlXIoXYq22LY1i1rePHFXcvixVev+Xi2NYtaxlXFW+KYti9cVd/ qYtaxfsYqvZcWxfirsVWf5eKubFV+KrOOKub7PPFXKuKr8VcmKr/AIsVWftYq5MVcq4q5VxV3xLi rsVcmKuxVz4q7l8GKuxVT+1iqo+KuVsVdirsVWf5eKr8Vc3w4q7l/wAHiqzj/Pirv2sVXvirnxVT xVUfFVPFVTFVjKuKr2/nxVZx/nxVemKrFxVfwxVZxxVzYq1iq34uPPFrXr8GLY743xVr7f28Wtts Vc2LY74sWtZ8eKuZf28Vd/kYq5vixVdiqHbJJVvt/YyKFnFl64qsbJJc2Ktq2KttkUNMuSS19r4M izWvkmDvj54q58Vd/l4qsbFVRl55FDf+Ri2LeOFVv2sCttiqzimKr2kxVrFXYVdiqmvLCwXMuBm5 sVd+3iqnywKqcX+xirvhfFVNcVdxxVtsKreOFpb/AGPgxVQ/y8Wa/FV/LFgt54q0zYs1P7OKqv8A l/sYsFjYq5vjxVzYqpsuRSvySFjfz4s1+LBa3FP9TFXL8LYqpr/Pizd+ziq3hiwaVfhxZrsDNy/Z xVbwwsHYqsZvhxV3+piq1sWC5mxZtsv7b4sFj/5GKuZsVXYqp4q18f7GKt4q19nFVj4q5l/YxVZ/ qYqv+xiqnirf7OKuZf28VWNH+xirlZcVWceGKuX4/t4q02KreGKu54qsX4fgf7eKuZeWKreOSVvI qorirXPJK1xX9jIqpZcl/9H6vNmQ46ovwriq9VxVrFVTniqpirsVb5Ys3ccVXYqq88WC5sVdxxVt /t4q7FmsTFgvVcVXr8WKqfLFW+P7eKt4qqYqp4qu5Yq5eWKrv2sWa3lxxYN4s1bIoUuOSSq4Ga3C wbXhiwa4Ys3MuKr/ANrFW8VW/wCXiq7jxbIoX/YXJMXcl+wmKrsVb44q5VxVr/LxZqmLByr+xirs VU/9TFmr4qp8eWRYrl54pc2SSuxVvjgZtYWC1cVXr8eBm7j+xgVf/kYquxVb/r4Vb5YWC5eOBm5V wK5lxVZkmCpywM1uBW1bFWsKqjLwxV3+phYKS4qrN8HwZFis54qu48F/18Ur+Pf9vFWsklTxVc2K u/y8VXZFiuVskybVlyKFjL+xiqpyxVdiq1vixVfxxVrFW+OKtYq7FXcvixVtcVU1+3irf7eKu44q vVcWx3Lhiq/FVPFXYq7Frb5Yti/hirm/yMVdiq5sVW4qs/axV37OKr+XJeeKu4Yqs/yMVd+1irvh bFWsVVHxV2Ku54q7FXYq5MVdirsVdzxV2KuTFXJirl/kxVz4q7FXc8VdirsVdzxVZ+ziq9vtYq5V xVTxVUxVz4q79rhiqnirsVVPixVZyxV3H+fFWsWt2LY7FW+P7aYq5Vxa3R4qsVf28VXYqt44q7/i WKr1VcVWcsVXYqo8cVW8sklUyKFuSSqfbyKFL0+GSSq/sZFCly4ZJKxeeKuxV3w4qubFXcW5ZFC3 hkkuxVd+1gZqf7HPArbYtblxVzfz4tjuP7GKuXFXfb+DFVnHFV/HFVi4VXYqt5YquwKt4tx4Yq5l xVy8cVczcsVWrkmC3FXfb+3kWKz4ckhppMWbmbFVv+Xiwdx4YqtxZuxVvFg3+1iqz/IxVdiq1WxV ZizVcWC3jyxVrIsluSSpquKqrLgZtfDhaVnHn9jFXf6mKu+HFWuP8+LNcf28ihS+LJJdxxVan+Xi wXYqtbFV2Krf2MVU2xVv/IxVr7OLNdiwW8cVW4q7FVjYq1irbLwxVT5csWbf7X82LB3+virWSVbx /byKu/1MVWYqsZcVd8WKtYq02SVpW/nyKqfHFVNeXHhklXs2Kv8A/9L6vLmQ47fp88VVlXFWsVVM VVMVXf6mKtcfi+PFmtxVe38mLBfy/wAvFV/DFXfD+3irmZf28Vdiq9VxVvFVq4qqLiqz7WKtccVV FXFV2KrPgxZuZuWKuXhyxVtW/Y/YxYKyr/wGKqa4s3M37GKquBmo4WCtkUL2Vv58Va/1Mkxa4piz bxVbxxVV+FMWDXLFmuyLF3LFK7lkmLS4s2/2cWC/FXcuWKqmKqSYs16/HirfH9jFg79rFVvHFmqY Ga3jgVU44qtxVcq/Diqz7OKquKrWwq7j/wAHiq9fgxVy/t88CtYq2rcsVd8KfHzxVfwwqo8cCr2x Vey/F9jCq37eFg5VZ/sYq5f5MVd/l8MVXr/Pirf/ABLIoa/aySVy8sihb8WSS74cVbVlyKHf5GSY tK2LNVb+fnkUOXFXN/JirlX4sVW8eWKFVW4YpaxV2Kt8sWxzNirlxa3f5eKu488Wxr7OKqmKqbfb xV2Kt8sWtrFXYtjbL/Jiq98VU8Vd+xwxVUZsVdiqz/I/bxVfy/4PFXf6mKu/y3xV2KuxV3xYq7FX PirsVVMVU+GKu48cVXNiq3FXcMVc+KrOKr0xVe0eKuxVyYq7hirsVdzxVY2Kr1+LFXcl/bxVZ/qf FirmxVfwxVZ/kYqvTFXcmxVzfDiruGKu+xirm+HFXRtiqzl/Piq/jxxVTxVvjirm/nxVfiqnira4 tbuPxYtixsWt3H4ueKrf8vJJXM2RQ5cVb+LJJa/byLNbx5ZJgp8cVVsVU+WRQ7JJcy/5eRQ7JJbZ V5ZFCxskltuWKrOK4qqfDyyKFqquFsW/EuFguyKFPFVzfDkkruPwZFmpRrwyTBvIs1vLFV2Ktq2K ubFXccVawqtXFV/xYqsVcCub4sVcuKu+xiqnkmDTfZTFV3xZFC1ckxWc8WbuGKt4sHYq1J/PizWf E/8AqYqs5Jiqu+LBZ+1irmxVzYqs5Yq1w/bxZt/6mLBdiqxvhyKXYW1TxVcn28LS3iqx8iydwxVy YWxT5fz4GtU54qh2bJJdy/kxVfy+HFW/2cWCzh+xiq7FVPFWmXFXf5HDFVnw4q5l/wCAxVzL+xiq xsVX4q58VU8VaxZtft4sHf8ACYq5lxV328VU+OKqXHFV/FXxVZxxVrFW1XFVDjk2StkGKHX7OKu+ z9jFX//T+r8bZkOOq4q3y/nxVemKuTFV7L+3iqpizbxYN8fixV3HFV+KuVvh54qvZcVa44quxVpW xVUxZreKYq3xxYOVsVd/qYquZv5MWbWKtrirX2cVabFgr4G5bzwsFkeKqvPAza54Wlr9rFm7jxxV U5fz4sF2BuWLhaVRVXFXMvw4quxVauKrsVb4r+3iq3Fm38aYqqYsHYq1wxZuVsVXr8GKt4q0zLir S4qqYGapgVbyTFVirireKruH7eKu44qt/YyTBUwM1v8Arviq7FXYFb5c/sYVWf5GBV/7OKtthV2F guZm/byKHN/l4q5uGFsWszYWC5V4rkWa/iv7GLWs45JLcbYq5m5Yq02KojIoUvixVZ/r5JLmb+fF VTliqpkUOxbHYtbariqz9jFVbFsdiqxsVdx4Yq7jirSrz/1MVdi1qmLYsZcVaxVUxV3DFXYq5fhx VyYq58VWNiq/9nFXYq79rFVPFXYqqYq5V+HFVPFVTFXcMVVMVW8sVW8vgxV3PFXc8VdzxVz4VXcc Ct8eC4q5uXHFXN8eKrGXFV3LFXcsVcuKubFWmxZLvhxYrMVdirmZcVU8VdirfLFXccVXpirkxVZx xVfzxV3PFVN/sYq3xxVf+1irueKrFbliq98VU8VVOPx4qp4q7FXYq22KuXFXNi1tYqt+3iq77H2M VWtirmxVzLiql9tMklVVcih0n2cVUn+3kkrlbn9j7GRQ79rFWuPL7eKuySVvLFVvLjiq79n/ACMi h328VWvkkuxV32MVaZcizb44Vab4MCuX4MWtrFW2bFsaxV2Kt8fixVZx5YVdxxV3LFV2BXYqpK2K t/z5Jgs4pirmxYO44q3/AJGKrExVUxVTxVyYqs5Yq7/LxVpW/kxZuX/LxVzf5GKtsuLBT45FK/JI WqvxYquxVR44qrYqpNxRsVVG5fbwNylx4YWDmXjirSsv7eRQ7FVq/DkkuZv58VXMvP4HyKFHJJdi rXJMWC7FVv2MVdxxVbiq1sVb5fyYq5VxVrliq1m4Yq7FXN8OKrGxVzf5GKu/y8VU2XFm5sVaxYLV xVay4q7FVP7OKttiqzjirmxVY2SV3HFVmRV//9T6vcsyHHVFXFV/7fx4qv4/Biq9WxVrliqoq4q7 l8WKr1X+TFXcf58VX8v28VcmKufFV/w4q3iq5cVab4cWan/kYqr4sG/8jFVnLFV32cVaxZreOKrs VbjbFVXj8GBm7lxxV3DFVuFg7FWvg+3iq9cVXr8eBmt+x9vCwVsWC3jirbNywNykrYWCtiwbX+fF Wl+P7GLN3LFXcv5MVVOGLBpuGLNy88VcmKr1/kxVzfBireKuxVUVf28DNdgVRXFVRcVcq/t4quxV avLCq7FXYq3/AKmBVjLiq/8AaxVrFV37fx5Jg1+zkWbWFW/s4qq8sDWtfFXft/Bi2LckwXsuKqnJ 8ihvJJUuPxYq0zfyYqvZv2P28ihrJJXL9jFVjfHiqovF/jyLNtsWtpVXFVT/AFMVWft4qvXFXKqp 8eLYv4Yqs5Yq19nFrb44tjmxVey4qs+HFrcq4ti/jyxVT+1iqpirm+1irvi/YxVf2fFVmKuxV2Kr OPw4qv4Yq7nirnxV3FcVcmKu/ZxVerYq3iq3jirlxVdiq1cVbbkuKu/axVZwxVUxVT54quXFV2Kt c3xVy/HirTYqtb7WKqmKqeKqmKtMq/bxV3LCqxl4YFdxbFXYq7niqzjiq/hirsVU8Vb+NMVX4qsZ cVX/AORiruGKuxV3DFXcMVWLiq9mVcVWf6mKuVsVc2Kr0xVyriqxeOKtfaxVtvgxVr7OLWtZeC4q 5sVW8uXwYoVV+PFLWLYtZsWtT44q2n28VXt8Xx4qpM2SS5Pt4qq8ePwZFCk3x4oc38mSZNMvw8Mi hfy/YxVDZJKozfFiq5uGRQt/aySWuPDIs1rZJgq8v28DNTwK7FW1XFWsKu+zgVazfD8GFV2KreOK rcCqmKrVbFVJlyTBy/z4qvwM1qthaXfs4q1xxVbzxVzfFirsVdzxV3+viqnirWLNtcVb5c8WDuOK rcil2KreWSZNs3LFg6RcVXYqp8sDc5sVaX4/t4WlT4/yYs13+vkULVbJJbxYKHL4sWa/jirXF8Vd irbYq5cVdiwbZsVUsVab4MVc3+X+3irS4q7liq1lbFXPirv9TFXYq58VWfD9vFVnFueKtMuLNYy4 qtxYOxV2KrOXDFWsVdirfHFVJeOSVdxyKv8A/9X6vqvxZkOOq4qqKvH48VdzxVf/AJeKu48MVVcV diqpiqxlxVfiq/8AyHxVYq4qu44q2/28VX8sVU2b4sWaovHFgu4/FizWfbxVf/r4q7lirvixV3xY q7Fgv4/Bizdiq9WxVTZeeKt/5GKuTFXK3DFVXlgZtR4Wlyr8WKquKrFxZr/8vFW/jfFg7j8WKrsW azjirfHFgv4Yq1izVMVcrYsFnDFW2xZr2wM2viwtLsWa7Is1zNyxVzLiq7FVNvi+PJMF/HFWuOBm 7jgVezYq7lirWLW7Fsb+zhVvjirXwfYwsF6r+xiruP8AweBmt5LhYO/axVV5fFkULfstkkqq5FCn yxV3HFXLirm4/wCwxV3HFVvHJJbX48VRHHIoaxVTbJJVOPw5FDbYq7/UxVyrxxbHLiq9MVWLiq/4 sWtTxbHYq2rYq7j+xiq/FXYq7FXM2KuxVyYq7lxxV3PFXPirkxVZy7/t4qv+19jFXYq79r4/s4q7 kuKu4Yqu44qt+3irkxVf8WKrOGKu/wBf7GKr/wCd8Vd6eKt4qp4quXFW/tYq3iq74MVW4q18WKub /LxV3L9vFW8VW/6mKrV4Yq7FV6/z/t4q1yxVzYq7/IxV3LFV2KqOLJWxYrFxZN/axVY3L7GLFbxx VfzxVZ8LYqvxVTxVU4Yqp4qqN/kYq7FXYq7FVir+3iruP7eKtYq3y+LFV+KrOOKtLxxa1iry+xkm KouRZLOOKrsVWL9vFV+KreOKubFVvLJJW4qubFVy5FC7FVJlxVZ+1hbGlbk3PA1tftZJLStzxVfx /YyKFqZJLsVW4GbfFeOBW+WFWmwK5cVcuLW7j8OLYs+wuKrsKqbYWCpkWa1cVU2xa1zZJKxvs/Bi rvixVpsVVv8AUwM1PCwWYsGkxZufFW3xYLGXFWvhxZuXFW+OLBrFW+OKubFWsVaxZrv2cWDWKqDY s1uKq2Bm0uKqXDCwVG44sFDjizX4q79rFVn7WKtfH+xirf8Ar4qs44q2zYsHMuKrsVWqv8mKrOPP FVi/5eKufFV/+pireKqbLirsVcv8+KrJFX7eKrG/kxVplxZtsq4sFFMVbfJK0y5FVn+XirmxVzfH irWKreXxYqt48/jySv8A/9b6xR5kOOrYqp4qqYq7FVZfi+xiq9cVdx4YqvxV3H4MVXNira/zvire KreOKqi4q5m+HFXLirlxV3JMVa4fsYs3K3LhiruWKr+WKtYq2uKu/ZxVev8AJ+3iq5VyKHJirl/y 8VWq2SSqYqtfAzXR/B8GFpXquKt4s3Yq2rYq3x+HFg5f8jFV3DFmp/axVV54sF3HFVn28Wbv2sVb VvixYLmxVvFmt5Yqqf5GKruWRQuxbFL7OKr/ALGKu48cVcrft4VX/tYFU/i+xi1qn+Rirv8AIwtj lX9jArfPJMGmXAzVF48fgwNTlxVriz4pdx/YxVb/AKmSS7/iGKqv2myKG8VW/wCRirXw5JLfLIoX csklb/l5FDmxV2SSqccihzccVWquSSqZFDbYqsbFV/HFXL8GLY7jirWKqnPFXYq7hiqniqpzxVz4 qsX+fFXccVaxVU4Yqs+LFV7LiqniqpirnxVyrirmXFXf6mKuxVdxxVvivL4/sYq3irX2sVbxVbxx VbzxVdxxVbzxVf8A6n28VWYqvX+R8VWcMVXccVWt/Piq9v8AIxVevHFXNxxVy4qs+LFW8VU8VXcc VbVuH2MVWYquXFVsn/DYq7/LxVUxVrk328VU8kyX8sixaXFkvxYrcWTTYq1ixdx/YxVz4q5v8vFV n+WmKr+XwYq5MVd8WKu9T4cVU8VVMVdwxVYv8mKub4vjxVy4qvfFVi4tbWLY77OKreKYta9WxV3H FsWNi1u+3irl+HFV2KrWxVr9r48VW/t8MVX5JKz4k/YyKF64qsZea8MVWsuSSpZFmuVskwczYq7F VTjkUNfsfBkkuX+fFVi/z4q7j8GKuxVbkWbbYq1i1qnPFVjYq1hbFy4qtwK7FrdirsLYh/8AUwsH K38mKt/Diq//AC8VWfs4qt+xiwdirmb4cVdiqlizbbFWsVXccWDWKt/FirmxVY2Kt4s28WC3j8WK rsVU+Pw4G5VxVRblxwtLsWbuTcsWCn8fPFm7hiqxW4YqsXFV/LFXKuKreWLBdiq1sVXYqt5YqtxV 2KqfL+TFV7/bxVZx+DFVjYqv/ZxVZy54qs44q5vsYq5l5Yq3izUuWLBbirvsYqs4/FirlkxV3L4c VWKuKuZsVf/X+sS/DmQ46sq4q7hirsVX/Diq5cWa/wC1iwVOGKtt8WSVfkVU8VX/AGP9fFXM2Kt4 qqLizdiwbZWxV3w/YxVTVcWa/wD1/sYq5VxV3LFVq/DiwXccWarwwM1q/wAmFguyKHJiq/j8WKrO GKojC2LGXjhaVPjiqorfDireLNbx5YqvxYNq38mKtf5GLNy4q7gmLBUxVrFmv4/Diq3/AF8WDmXF VXA3LG+DCwc2LBV+F/t/byLJr9r48Vb5Yq5cWx3+pirvi+xhVdirl+3gVtWxVytwwq1gVtsWtrFs aXJMF6Yq5mxVz4qvZcVWYqvZcVa44q3+ziq74EyKHL7/AG8VW/Fkktf8SxVvg+Ktq3xZFCon+Rir lXjiq5eOKreOKuXFV/w4qs5J9jFV7YtjWLW2uLY7/Lxa3Li2L1XFXYq7nirmXFXcMVdirnxV2KuZ sVdiqxcWtfi2OxVUxVauKrVbFV3LFViZJkq4GK3lgVteOKu4Pirl9/t4qsVcVdiq9VxVpcVXq3/B 4q2y8vt4qs+HFVn2MVX/AGcVa/y8VXYqqYqt5LzxVdirsVUmXFV7Lirv8jFXNiruOKqPDFV3HFV2 KqfPFVTFVN8VVMVW4sm/tYsXfscMVd9nFVmKuWTFXfbxVerYVWc8VdwwK7FXc8VdirsVWfaXFV+K u54q7hiqxcVaxVUTFXcMVWNirXwft4q3+zi1tYqt44q5eWKuySV7ZFDmbFVjLyxVeq88VWNHirsk lS5fyYq3/wASyKHcsVa+BMkl3xYqsxV3+piruP7eKu4Yqu55FC1eeSS7nirsVaZeeKtZFm77WKu5 Pira/Bi1u5Yq5lxbFLjkmCpgZrWbFV2BVvH4cWtZkmLWLNvj8OBms/yMLBEYGahywtKzhkUt5JDu GKuxV3DFVPFXcsWbWKt8sVWrGv28WC/jiqn9vFmuxVd/l4sFP4vsYq38eKrP2cVbxVbxxV3LFVvx fsYqsbFWuTPizd/qYq5vhWuKtN9vFW+WKrVbFg5mxVz/AOXiruOKqbYq2y/yYq3iqny4f6mKufFX Yq7niruP8+KrOOKtfaxVd/xHFVPjwb4MVWcf28VWMq/bxVtMkqm2RVzLirv9TFVnLFV/7OKv/9D6 y8fhzIcd3H9jFV/DFV3HFVReHLFXKuKr/sfYxVev+XirlXhiqp8WSVT4ZFV6/wCRiqrirsVW/Hiq /jirl/y8VaxVYzYs12Kt8cVcq4q7/LxVUXj9vFg1izcq4qq4sF3xcsVWNx5Yqp4s1TjkUK2KrPjy TF3LFW8WbsVXLyxYO/ZxVpmxZtfaxVVxYO54q1y44s1zYqu/yP28WDvixVr7WLNvFV//ABHFg2vx /wCvkWTuOKuXFsdyX9jCrlxVdiq5cVW4FbXFW/8AiOKtLx/2GKu/18Ktr/kYWDnxVdwyKHScsVW5 JLvhxVeq8/gxVpsVRGRQtySVPlkUOySW+H7H7GRQt4/sZJKrx/4PIoU/8vFVRV4rwxVdiq3lz588 Wxpft4ta/FVvqfF8eKr+OKu44q1i2N8sVcv7GLWv4Ytjl+LFXYqp4qqYq5V/YxV3DFXftcMVdirs Vd9jFXJiq9lxVZirmb/g8VVMVdiqmq4qvbCqzhiq9VwKsb/UxVyYqv5dv28Vd9nFXceeKtf5eKqj L+xirv8AiWKu44quxV2KqS/HhVf9vAqnxxV3HFVRlXFVNcVVG+xirlb/AIDFXfbxV3HlirmxVdir sVWriq3FV37GKrG+xiqz7GKtriyX4sVvHFVv+viq/wCLFVn/ABPFV/FMVbxV2FVP/XxVfx4YFa44 qtxVz4q7FXYq77eKuxV3DFXYqp4q3x4Yq7jiruWKuXFrdxxbGsVb+HFVnHFrd/sMVd/l4q7jiq9V 44q5sVaxV2KrWXFVPJJWriqtz/YyKFLjkmKxlxZrlxVy4q2zYq5vgxVpl5fBkULV/nTJJaZueRZt 5Jg7niqxm44q3kWbTNxyTBv7D5FDsWxb/qYquxVbxwq79vFXceOBV2KoflkmDmxVvl+3ireKub+f Fgt5Ys2sWDuGKuxVz4q7FXcfh+PFVJft4s215OuKtquLBr7OKrPi4Ys3fC+Ku4/yYq2v/CYsHLir n/yMVUmxZt/DirmxYLHxZu/a54qsZsVb5fDkUNfDkkub/IxVYzNiqpx4fHiwWccVWcf58VabFVRe OKqbYq23x4q3irsVU8Vd+ziruGKrG+DFWsVbkxVZ/qYqs+D9jFWuOKubFWskrS/B9vIqsb/IxVzL irWKv//R+sv7WZDjr8Vdiq7jirlxVWX7eKtriq/nirkxVc2Ktq2KuVfhxVvFVvHFVT9jFXLiq5V/ YxZubFW+OLBbizVOXxfbxVyYq5vhxV3DFW3xYOVcVVGX9jA3O44q3iqxeWFguxYLlXFWvt/YxZu5 YqvxYNqvxYq038mLN3HniruPxYqqK3PFg0mLNyYq18XLnirfxYqq4sFnHFm38WKr1XFV37PPIod/ l4q74MWxdhVazfFirvt4q5vsYFX/AG/jxV3HFVnHFV7Li1u5Yq3xwti79rA1tZJi19vFmuXhgZu4 4WDuOKt/s5Fi1x+H48kyX/tZFCxskldirX2cVVft5FCxv8jFV/H+fFXL8WKrsVW8UxVfyxbHccWt YrcsVXri2NYqtVcWtf8A5GKt/wDEsVW4tipirTNwxVvFXYq7lyxVf9rFWuWKqfDFkuwsV/LFXM2B VnPFVTFVNMVXryxV3x/t4q77WKtNiq3FVTFXYq0y4q79rFWuOKqjcv8AYYq5cVc3wriqn/qYqqM2 KrcVXcv5MVczYq7l+xHirlX4sWtT5YtiuuKrF+z/AJOFVvwYWC5myLN3xcfjxV3+v9jFVuKtfE/2 8Wtf9vC2LsCrW4/t4q5W44qtxVd/kYqsbjyxVvFXYq19nFWuWKt8eeKu4pirub4qsZvhxVzLiq5c Vb4/5eKuZcVWYq7FXcf5MVcvH7GKufFXYq77eKuxV3PFXKuKrOWKtYqqKuKrFxVrFXYq3yxVrFrW /YxVd+3wxVtlxVZyxVdirfxYqsySVNV4L8eRQ02KHLiq5fs8MUu+P9jFWskl2KrWxVy4qt/yMVa4 /FwfAzb54WDkxV3+virm+JfjxVbkWbsVb5cPt4q1i1tqvPFsd+1iqx/8jCrlxVTXAruWKtthVZxw sG/tNirm/wAvFXftYq23+XiwbVuHwZFksxVbwySXYqv44sFuKrGXhirlxVrlizc3HFW2XFg5l/kx VYv8mKtf5eLNfiwW/wCpiqxWXFXfs4qq4qhfi5fBizX/ABZFDX2MkxWZFk38OKuXFV6/ZxVS45JL l4/sYqt4/wCXiwcuKuWTFVuKrWxVdiqn9jFXMq4qsVeXwYqv5fz/AGMVWf6mKtfZxVv4sVU1+HFm uxVSXFg2q4q7imKrP8vFXMuKuZcVU8Vf/9L6yrmQ46/FXYquXFW1XFV64qrKuKuxV2Kr+PDFWuOK u5YqqNirv8vFXN/PirvjxVr+TFmvb+fFV7c8VWYsF74s13PAzUu6YWCo3L7eLBr7eLNVxYO44G53 HnirmxVrCwcrKy88WCpizb+LFWsVXRtzxYO5YqtxZtr/ACYqqcMWDv8AIxVrFm7lxxV3H4MVcmKr 2xYN4s1rYqrYq5W45FDmb9jFsXYVW8f5MVXYFVF+zhVby/YwsGl+PIs3NiqzJMF/J8DNeq/Fiq39 nCwXfs5FC39nJJdwxVy/5GKqq/z5Fm5eWLWt/wBfFC74sUrOOSS2rYq7l8WKtNiq7FVT01bIod8P 2HxVe2KrH/yMWxdi1t8cVWccVXYqtVf20xbF/wAX2Hxa3ccWxevxYtani2Ki8MVWLirWKqmKuxV3 DFV3HFV2KqfDFXYVXtiqzAq7jiq3FV3+RiruOKuVf58VbZsVdyTFWuOKrcVXtxxVzLiq/jxxVzL/ AD4q48f9hirk/wAjCqxlwK7j/Piq/j8OLW7j8OLYtxVcq4qtxVUxVaq4VXYFWqv/AAGKub+TFXce LYtbm+LFsdy5r/kYVdxwK7jhVT5YFVOOKuZsVd+xirlbFXc/28VU1xVtVxVyrirvs4qvbFVuKrWx VtfsYq3irsVaZsVWN8WKuTFVy4quxVTjXFVy4q23wYqsZsVc3xYq7FXcMVc+KqeKu5piqp/qYq58 VWN/kYqvTFVNuWLW2uKrPTxbF/HFVn7GLWuxVby5YquxVZx4/YxbF/xvi1reP8+KrJMVVcVUlXFV /Ljiqkv8+SS02KuZVwM18mBrUnySXYq5ft/5eKuZcVcvPFVzfH/qYGaxvt4q5fgwK5lxVy/5eKu5 fF8GKrPt4qv488KtYq7FVrYFWcsKrGwsFRP8vFVNcVVW/nxYKf7WRSs4ZJk5MVVMVU+GKt4sHYq7 /XxVTZsWbuOKu+1iwbZv+DxVYy/FirTfDizb5f8AB4sF2KrVxVZizdirX7OKtM2RQt4ZJLfJvsYs GsWa5MihZyxVZkkttiq1mxYO44q5mxVrk+KtYq7FWuSYq7j/ACYqsxVzcvsYqs44q1irsVWNizbZ cWC3FXcUySuyKqf+virm+P48Vdiqzjir/9P60L/kPmQ47kxVerYquVcWbfH+TFg5V4fbxVWTFVy4 quxVpuOKu+1irlXFV7fFirvt4qu9PFm5VxVvliwcn2MiyVOGLYtbjxyTBY3LFV/2MVVsihT/ANTJ JXrgZt4q0zfFirm/kxVTVvsYWlX+PIsnZJK1l/YxVvh+3iwdw/bxVfxxV3LFVvF8WbeLBuP7eKr2 +HFWnxZu/wBTFW8WDuPx4quZcWbeKrlb9vFVzL+3kUO4/wAmFsXsvxYq1irsVW/Y+DAq9sVWccVd +xiq/u+KrPtZJgu+zkWa7JMFzNkULUySXYq5fs4qqtxfIoWsq5JLXLFVT/XxVdiqly/YxVvFWmXF XfDiqquRQuxV2KrfsYq5fs88VXYqt/1MVX8cVaxbHfZxV2LW38WLYvTFXYq74cVdx/bxV3PFXJir uGKrVbFkqLixW/8AEMVVMVabjiqzFV/Lhiqz9rni1r+Xf9jFsa44quxVbyxVU4/FwxV37GKrsVWt 8PwYquxVR44q7liq7FVrYqqcfhxVdhVa3L9jA1u44Wx3L4cCrsVW/bwq748VWrhYKn2cizdiqpx+ DFVnHhirmbFXf8aYq5lxVZGv8/2MVXYVWsuBWvsNi1tti2O/yMVc2Ku5Yqp8sVVsVUl+DFV/L4cV c2KuXFXcmbFXJ/l4q5f5/wBvFXfYxVYrYqvXFXNiqm2Ktq2KrOTft4q7FXL/AJGKrOXDFV+KuTFX Yqs5YqvfFXc8Vdiqniqpirnxa1PFsW/Yxa3csVVsVU+CYti1l4fHi1u5YqtXJJXcv+GyKFP/AI0x VX5c8VWL/wAJiruWKqLZJLuWKr1bIoX5JK348VW8sihZ9tfjxVdx4ZJK79rIoUlXJJdirsVX8UxV Zx+PFXcMVU2+xkWa9vt4Vdy4Yq1gVa32/jwqvb/IxVZx44q5VwKtwqp/Fy+DCwXKuLBpVxZruPb9 jAzW/DhYNtHkWKzJIaxZr2bhiq3Fg79nFVPFVTFVLFm238mKuxYOxVrl8P8Al4G5ysuKt4WlRbFX Niq5sDctZcLBpVyKGuP7aZJisb4MVXfDizXYGazjga1uSYreXNeGKu44q5sVW4qt44q7jiq3niqp iqny+LhirkxV2KrG44qp8cWbbcWXhiwcy4q5l5Yqt+y2SVr/AC8irk+3ireKqeKuxV//1PrR/l5k OOv4s/wYq3iq1V/kxVVxZquLBTxVW5Yq3/l4qvbFVi/Biq9cVcn+XiruWKtcuWLNe38+Kub3+3iq r+1kUKXFf2MklVwM1qrhYLsihbzySW+XHFgqccDc7lirl/nxV32sVaVeGFpVF+xkWTsklb+3iqpx xYO3/kxVrFW2xVy/yYqrK2KrPhxVUxVTTFXJiqo328WbariqnyxVzYq5cVVeL5FDbfE2Fsdx5Yqv ZcVawK7FW/s4Vb44q03LAqxVxVf+1irlXFVTjkmlpcWa3FXN8OKufFVVo+GRQs/axVUVcklT/wBT FXccVbVsVXM2RQv+xiq1cklc38+RQu4/z4q2zYq5lxbGsWt2LY23LFXLi1tYtjf+Xiq/FXYq7FXM uKrFxV3Lhiq98Vdiq5sVXYq03FMKu+HAqxv+ExVUxVpuS4qs+18GKr+XL9vjirmb/gMVWYqv+LFV /qYqp8cVd/l4q7FkqenixdI37eKu+xhVbgVdxxVyr8OKrcVVeWKtYVdgVbkmC/8AZyLNZ9luGKu+ PCq1vhwsF322yLNUbCq3ArsVVOP7GKrG+L/Z4qsb/L+3hVfxwKs4/DhVzYFdx44ta7FXYti1sVWc e37GKuZcVaXFV2Kqa/Fiq/j+xiruP8mKu4s3TFV/HFXL/Pirl+LFV2KqeKuxVdx/y8Vd+xiqmuKu /wBTFV2KqeKu54q7hirsVdiruXHFXPiruGKuX+fFXYq58VWKuLW5l/YxbHLirmxa1jccVcn+Riq7 FsW/bxa12LYtbFrcuKr+PPFsWLi1qLZJLmX9vFW+PxYq7j8WKu5fFiq/IoU/+NMkltlxVpsVWpiq 6v8Al5FDuPwYtjvsYta1W/YOSS77GKtLkWbmbFXfs4VdywK1iq348KrsVWv/AJeBXNiq3FV0eLW7 4l+xiqiuSS7jiq/Fg74siyWf6+SSt54q39jFg7hirlbFXJiq1uKYs1rfz4q22LBrFVi4s3fBiq/F gtf9vFVP4cWaxMVX/Diq/IoU+XHFXK2Kuwti1MLBd/qZFCl+1kku/wAjFVv7GLBdiq37TfHirk/y 8VWN/kYqp4s1XFgpviruGKrOWKuZcVcuKrE/yMVXt8GKrOWKuX+fFXfYybJZkErOeLB2KufFX//V +tGZDjuxVW/y8VU+WKq2KuxVUTFXf5eKruWKts2KtLiqo2Ku/YxVe2KtcfhxZrvhyKHcsVb55JLv 2ueKruGRQtySVXFg5mwNyzniqozNhYNsuLBZ9rFV6rirv28Vd8GKr+PxfHiqxW/nxVy4qv8A8vFW v2sWbWKrlxYL8VaZVXFm7/UxVUxVytiwWrizbZuWKrlwM2sLBU/YyLN3+phV328VbXlhYLmyLNZy xVdhVtsCu+LFrb5YWxd/qYqt4YWC74sih3+RwxVaq5JKpirXxYqu+zkULVb7eSS1yxVtW54q3iqp /wAPkUOVcVX8sVd8aYtjmxa1jLiruOKr1xVrFsb44tbT/YxbG1xa3Ni2NYtbfL4cWxfiqn9nFVTF Xc8Vd8OKqeKqq4smmVsWLsVc+KuTFVTFVvLFVuKu4YqqYq0vwYq1xxVtlxVfxxV3wYq7liq7FXYq tZsVXYqt+22KrGXniqrhVbhYLsihby44tinyxVU5cWxV0jYta/li2O44q5fi+DFXfs4q5cVdyxV3 7WKuVcVd6nwcMVWfHiqtxbFXfEn28VU+aYq2y/D8GKr1+ziqz9rFXM2KrP8AUxVdirv2OGKreXw/ Bi1uVf2MWxdiq39vFVuKrv8AIxVtvsYVU2XAq/l8WKqbYqv4virWKruOKrF/nxVfyxV3LFVuKqa/ axVzfFirv+IYq5MVdwxV3PFXcV/bxV3+pirsVU8VVOS4q7FVn+virX2sVb/yMWtrFXYq7FXYtjsV di1uxV2KrePw4q5uWKubFVi8cVWNkkqnHFVnH+fFXN8GKrvhyKFv7WSS74sVWKrYq7lxxVy/GuKr 1bFVmKtccizc2KtYqtVcWt3/ABHFsXYVbb/L/YxVrFVFm/kwKuxVUxVbyxVbiqm2SYO5YqqYGa1e OFpbxVS54s3Yq3iwdirsVWfDira5JVuRVb/qYqvbIpUuL5JkuXFg5f5MVb/yMiyU8klv/IfAzW/b +xhYN8cihazfz5JK3hiruP7eKrf2OeRQ1/r5JLm5YqtXFg77bYqtxVr9rFXMuKtNiq7FVPFXYq7/ AF8VU8VbZcVWL8WKu/y8VXfaxVa2KuZfixVbiqmvxYq7/IxV/9b60K2ZDjqv+XizU1xVEfDiwWK2 Kq2KuxVUxV2Krv8AXxVdiq1fibFXfBiq7FW1bFXZFk2uKt5JLnxVdHyyKG1bJJX4GbsVdirf7P8A k4Wlytiq7FVjfbxVzLizcuKr/tYsHftZFLa5JDvhxVr9rFmsZcVV/wBnFg5uK/bxVr/LxZrlxVU+ xiqmuKqmBmpsv8mFgv5K+Bms44WCIyLNavxfYwq7jiqpxxV3/EcCtM2KrOXxYqvXFW0yTB3DFVn+ piqrkUO/1Pt4ti9l5fYxa1L/AFMklc2Kqy/z5FC1sklc2RQ7JJUuP8mKqq5FC9V/2OKrG5Yq5P8A LxV3D/IxVzNiq77WKt8sVaT7GKtri2NYq22KuZcVaxa21xbHceGKtYqqJirl+LFXYq7FVrfZxZKv HnixabFV2KqeKqmKuxVa2KqnHFV2KuxVaq4q1yfFW2+JcVXYq7FVv/EsVd6f8+Kqaq2Kt/bTFXKu Kr/sYq5m+H48Vd9jCruOBV2LW1xTC2N4FWt8OKuVf5MVXfsc8VdirfL9vFV/7OFVnLAruWKu/wAt MVc3x4q5mxVzYq7lwxVrFW25fYxVZxxVfxxVfiqnirf7Px4q5cVaxVtWxVy8sVd/qYq1irl/y8Wt a3w4tjm+y/PFVvLJMF0fHIs12KrWX/gMVWc3xVf9j7GKuX7fwYq77GFVNsCr2+3irWKrf9fFXLiq 3hiruP28Vc+Ku4/z4q7FXf6mKufFXYq7/UxV2KqeKtszYtbWKuxVtmXFsWKv7eKrsVdi1rWbFXK2 KuXFXZJLlyKHcUxVT44qp8Mkld/r4quxVU+3kUKT/bySXMuKrOGKqq8sihSySXJirmbFVzcMihZ9 h8Wxp/sYq3/kYq7ky/6+KuZsVdyxV32v9lirm+Fa4VaxVbywK5l+3hVdgVQb+TJMF+Bms+JPsYWD TYquf7eLBTfFms5Yqv5fz4q5mxVt8WCxsVaxV2KuxVa2KrsVUX+3izVsWC1sVUuOLNV5fyYsFqt8 OBuWYqu/18DWp/5eSS77GKrcihpV+HJJX8V+w+KrfhxYNYqtb4cVc2KrcVaVVxVrlirlxVbirkxV 2KrJMVWf5GKu+DFWlxZu4pirfHliwWLyxVvFWmXFX//X+tPPMpx1zN+3ireRVcvF/jxVW/1MVcqt iq5cVb/18Vcq4qq4q7FVPFW+P8+LNy4qq8cihtVX9vJJdiqxVxVVyKF3xZJi3+1gblL7Xx4WCtgZ tNiq5cLSuxVYqrizVPhxYLFxVe2KubFXLirS4s3csVdiwVMVdirsVXLiruWKt4s1bAzU/jwsGmwM 1nHCwVlyLNdiq39jCq7ArbL/ACYVawK3xxVzYtbuOLY3kmDvtfBiruPxcMVXcefx5Fmt+LJMHcv5 8Vcq4qiMVWcv2Mihb8WSSu/vf9jkUNf5afYxVUVcVXriqzlirmxVd9rFsb/18Wty/HirWKuxbFTh irnxa1PFsb/yMVXr/Jiqzjiq/FXYq7hiqniq9V4YqvXFVuKuZcVXf5GKttyxVZiq7liq3hiqtx/n xVzYq7liq7FVqtiruf7GKrP8vCrlbAq/liq3FVzN+xiruWLW5f58WxdirXLJMGsVd8GRZubFV6/B irv9TFXccVczfyYq6T+TFXftYqv4Yqs5cMVWLiruOKr25Yq5uX7GKr8VWKv8+KrOPxYqv4/Firmx VYrYqvb4/gxV37WKu/Z+DFWuaYqtX+TFXceOKr/8j9jFXLiruWKub/IxVYq/Diq//IxVZ8GKr2xV Z8K/YxV3Hlirv28VXYqp8skwbVm+3kWa3l/PiruOFV64Fd8GKubFVuKrWxVdiqnirkxVUxVbxxVb irueKuxV37OKub/IxV32MVdirv8AXxVYy4tbWKuxVtWxbFNft4qqcuGLW7jirWKuxVavxYq7jiru WKrsVW/6mKqeSSqcuWRQpfB9vJJXM2RQ7j+3iq1VySXcf28VaZsDNbhYKnHk3wfYyKFP9nJJc38+ Kt8eTfBkWbXDJMGvsfBkWbWKt/6mKt8cKubFVP8AbxVdiq3/ACMCuX4cKubFVJuWFg3irTNirfLv +xiwdizU8Vb4YsG+OLNp8WDsVdwxVY38+Ku5Yq7lirlXFWsVWL8WLN3HFWvt/BkULm5P8eKFJsky b5cMVVP8jFgpN/l5FktySXK2Ktf6+RQt5ZJLuWKtP9jFWuXH7GLBcuLNSX7GLBrliq7FWlXFVnH4 ueKu54q7nirkxVTZsWazkmKqnL9vFg19rFVJv8vJsnL/AMFkGKpizUmxYP8A/9D62f6+ZTjqmFkp cv2MgxXqv7GKqy/yYq7j+3iq/wC1irv2cVX8cVdxxV3L/gMVdyxVvFmuyKFR8VW5JK7jyyKHcf5M Vcq4qu4rxyTFdgbmvt/HireKuxVtcLSuxV3xZFKz/XxVfkkOxVU4YqpYs22XFXLiqpiwcmKrPhxV f/l4qv8AsfYxVzfz4q0y8cWbXLFV2Ktq2Bmq4q7Aq1cVW/b+DJMF3+pkWa7FW+X7GKtYqu44VdhY OxV3PFXcMVdwxV2KrlX+TFW244q39nFgqYs3K37GRQp8sVVFb+TFXNiruXLFV2KuxVa3w4q7liq/ 4sVaxVvli2Nc0xa2+WLY19nFW+WLWv4/t4tjkxVTxVUXhirkxVTxVUxV2Ku+yuKr+XxYq3irsVdi rSfbxVy/5eKu4/z4qv8AsYq7jiq3FVTFVrN+3iruf7eFXLgVa3w5JguXAzW/5eFg7jiq5fiyLNdi q5V/Ywq1x/YwK1iq1sKr+OBWsVbX4MVa+zira/5eKtYq22KuXFXcsVcuKuXl9jFXcuGKtYq38WKu 4/sYqv4riqzivHFXLiqxsVX8sVd/kYqv/wBTFVjYq5sVa+1irfFfsYqv/wBTFVPFXYq3y+xirvh4 4q1irbYq5sVWccVd9vFV2FXYFW8k+xiqmrNiqtiq34MVb+HjhVvAq3iv7GKrGXFWv8jFW1XFWmxV tWxVZx/YxV2KrGxVfzxV2KuxV37WKuxVTxVtlxa3ccVdxxbHNirlbli1uVf2MVd/l4tjX2cWttV4 4tjuOLWsVcVXYqtbFVn2sVWcckldiq3/ACMVXKv8mRQqLiqkyrkkrGXFXSf5GKrmxVa38+KufFV3 H9vIoc3+Xi2LFxVzcsVc3x4qs+xi1r+WLY22FVP4vsYq5sVdywKtxVcuFVHlhYN/E2KqjN+3iwUc VaTFmq4sFNMVaxZtviwcmKrOOKuZuOKuVsVaxVv/AF8VU+WLNpcDNcuFpXYqt+F8VWYs2l+D40+x irXHlkULT+3kku54qtyKHfB+xkmK3Fmt/wBniq/7K4qtZuWLBpWX9jFm3/r4sHccVWP9vFW8VU/2 sVc+KuxVTxV2KrP2MWaorfyYsFP/AFMWbXH+fJMFrZFV2Kv/0frRmQ465cVVGX+fFV6riruOKr8V XNiruOKqi/Dirm/kxVdirlX4cWa5cihzN+xirf8AkZJK/jiwdx4Ys2uOKr2wM3f6mKrePw4WDXHF V32cWC//AC8Vcq4qvZsVU1yKV/2sVb+x9vJIdyxVpv58WbXBMVXKuLBevL7GKtc8Wap8WLB2RS2/ 28UuVsLY7/IxVrCwb5YGbeKrm/kxVzYFdyxVdhVz/YwK3yxVzSYVbwsGlXIs21Zv9hkmC5v8jAzd yXA1rFxbFRf58kwcvHFWlxVvj8WKq2LBayrkWTStkktckyKF3F8VbXFV/HFsc2LW7jiqxmxVyyf8 BirTL/weKqnHv+xirlxbGsVdiqpwxVZxxVemKrOXDFV/w4qs+HFWsVVOPLFV6/HirXLFW/hxVrji q3FV3HFVuKr1XFW8VaVcVXp/kYq5sVU+WKtrG2KtLiqpkmDv9fIs3SNi1rsLYt4t+xgVU/4lirXH 4v8ALxVf9vFVnHFXNirXF8Vb4/F8eKubFXcsVcrYq79nFVnLFV6tirWKt8f5MVa+zirfJkxVYuLW 5v58Wxyry+xirv2eGKrVbJMF3xcMihd8K4qqM2Kqf7X2MWxbkmC9myLN3w4q7/UxVzLirl+DFXK2 KrGbFV/L4fgxV3LFXcsVWcm54qvVsVa+zirsVbZWxV3xYq1iq7jhVQVcCr8kwc2RZu+w2KrcKruO BV2KrW+L7GKuX7GKqLNiq9f5MVaVfhxVvjwxVZ8OKrv+JYqtxV3DFXJirsVdy4f6mKrP8jFV/wDx PFVnH+fFWsVVMWt2LYp4tbfHFsaxa1vLk2Kr+P7eLYs4ft4tbv8AXxVeq8cVWf5GKrsWxav2ueKr F9/t4tbeKtMuKr+OKqTZJi3x54q3t/PkWSlkku54q7l/Jiq5MDNTwKt+1kmCo2BmtwK3x7/sYq5s Vcv+RirWKrf9fCruOKu5/sYFd+3iq7FVPCqz7OFgvwM3YqpYWlVyLJS55Ji1izd9jFXMvL48VbxY KCrizX/CuKuXFW+Pw4sFnHjirvsYq748Vc2KttkWTSr/AMBihrC2reOBrU+eSStZVb40xYOZuX2M iya/ZySVn+W+KqnFvsYsFPjizbZv58WCz4sVbxVUxVS4/wA+Ku5N9vFVmKqeKqnHliqniq1l5Yq7 lx+3ireLNr7fx5NCjkGK/wCHFX//0vrXxTMhx13HFm3/AK+LBdirfHniq/FVTFWlXFVXFVvHFV2K tf5GRZLl5YqqYqt4ZJKpGuLBbyxZt8sWC5cDc7jiq/lga3YoabJIbxZrmX9vFg0v8+RS3yxVpVxV tmySGmXFm3/kYsF6rirkxV3FsVcq4qv45FkuxV2KrP2skldxwM3LiqrgVa2Ku5/t4q7/AFMKr1XF Wvs4Fb/yMVaxVtcVW8ckwXKvDFW+WBm74sLBcy5FC1f58klcvw5FmtTJMFZsVWtkULf8vJJVuPL4 8ih3LlirlxVdiq1cVXYqtXFV2LY23L9jFWuCYta3/XxVeuLYv54qs44qvxVY2Kr8Vdirmb9vFXcM VdirsVXsuKrExVfy4Yq0uKu44quxVavH7eKtquKtK3w4quxVUwqpfawKv/1MVWcfixVev8mLW5W5 YWxbx44WC5cDNpY+GBV+KtriruLPirlb/g8VdxxV3HFVvLJMGmXIodJ/w+LY5cWtdi2LWbCruOBr cq4qvZsWxrFW/wBv4MVcy4q79rFrX8uOKuX/AC8VU8VaXJJXcWVfgyLNb+zkmDWKr1yKGsVa5ZJL fwft5FDf7OLY1irvtYq3/wAPiq1WyTBv7WRQ02SSsZsVVVX+fIs3ceP2/tYq7li1rMkldkWbbccV d6mKr+XwYqot9jFV2KrV5fYxVdiq3liqn8XLFVf4cVWLiruXw4q5fhxVZx/YxV32sVa/1MVXYqp/ 8QxVd/r4qtxVf8OKrMVdzxVz4q7niro2/bxVyYq7FXYtbsVU8Vdi2N8cWtrFsbZsVd9j48Vdxxa1 n/EcVXYqsX7eKr8VbXFVi/8ACYq79vFVq/z5JKz4vsYq1yxVUVcVUcVcmKufFXfYxV2KuZcixXq2 KrGwtrX+R+xirWBW2xVrFXYVdiq1WxV3HAq34ePx5Jg7AzW4WC7AzVMVUWwNbuWKrHyTF2KtJizd 9vFXPkWKx/sYq79nJMnL8GKuxYN8eGKrcilb9vFXcskyb+DFg77Xwft5Fkp/aySVzfHkUKXPJJXY GbnwNaxsVWfZySW+WKqeLBfizWYsHYq7FWm/kTFVnDFXYq5lxV2KrFxVf6nw/Hiqn9rFVrfYybJz fz5Bi5cmyWf5eQYv/9P63ccyHHXYq2n2MVd9v7GKr1+P7GKuZVxVc2Ku44qqLirv8v8AYxVczYs2 /jTIobVcWxvjhVcrft4Gty5JK9sDNZzxVy4WC/jz+PIoWq2SSrYsFif5eLNvl8WLBdirfHFXccVa f7GKtP8AYxZtq2Kr+GKt8MWC9l/bxVZirnxVevx4q7Fm7FVzfFiqxPt4qq8cihdirsWxcuFWuX7e BW2wq0uBXfDirmxVr9vnirvs4qqfCuLW7FXfa+N8VWvkkuX4sVXt9n4MVbxVrlkWKvilTxVdkkrW xV3L4sVXKuRQ77f2MWxfx54tazj/AD4qvZcWxYzcsWterYti/FVnHhi1r8WxyYq7FVP7WKqn7WKu 4Yq7lyxVZ8WKqvHFVuKruOKtrxfFW8VWtirlxVtfsYqv5Yq5sVW4quZfsYVU1wK5sVXfBkmC7FXK uRZq37WKqeKt8cVc3+XiruWKu/yMVcrYVawK2uKtYtbTLkkrv2cihpuWKqnL+TFVi/D8eKu5Ytjp MWt3+vi2OXFraZVXFW/9fFVv+XkkrvTyKHSYq1irf+virS/bxVrlkktYq22Krv8ALyKF+KqSrkkr myKFq8sklVZsihZxxVfiqnyblwxbG+X+XiruWLW5sVcrYqsySW1xVVTIoUeWLY5cWte32fjxbHfD 9vFXM2KuVsVWcfhxVbiq5sVU/wDXxVzYqrYqorirbfBiq9efHFV2KrW/kxV3Hk2KrF5Yq02KrcVX M37GKu/1MVb+ziqxVxa1PFsdiqpiqniqp/l4q7FXcMVU8Vb44q7lirvt/bxVrFrcv28Wxtf58VWc P28VXcv58WtT45JK7+TIocsmKuZcVc3xfsYtiz/U/Zxa3ceGKu+P/Z4q1wfFDskybX+fIoUvs/Yy SVytkULfh/bySXNwxVz4q7/UxVbkWbsVdirf+pirWKrWXCruXHFVP/IwKqL8WKubFVuFVTFVLliq xcLBb8WKr2yLFY+SZO54q3wxYNZFLeSQpYs22bFXccVdiwayKW8khb/xLFV2KqPHFXK2LNpm4tkU LeGSS2rYsG1bIslPFWuOSSs5YqqL/wATxYLFVVxVT/ZxZr+XH7GKrWXFg1xxVdiqnirm54qp4q77 OKqmKqWLN2Ktf5GLBzNir//U+tytmQ47m+LFV6rxxVy4qv4YqvX/ACMVaXFVdf58Vcyrirlb+TFV 6rzxVaq5FkvwtjuGKuVf2MDWtySVX4cDNZzxVr7Px4WlX+xkWTSf5GSYtKzYs2+WLBfyxVrFXYq3 xxVbizXYGa3CwVcWDvixV37WKr+P7H7eKtquRZLmyTFSZv58Wa9W5f6mBmtVsLBVVcihdirsWxb9 jCruP8+BV321fFXfB+3ira4q5/sYVaX7eBXYVXcMLBdy/nwM3cvh4YWC1vtYqv8At/YxV3B8Vcv8 mKuZcVXL/qZFDlXFV7R4q5VV8WxauSYKq5FDWKtt8Xx4q19rFW+OKu44tjl/yMVX4qsbFrX/AGMW x37WKrOOKr/8vFXK2Ku4/t4q7niruGKuTFW/8jFk3/kYsXf6+KuXFVuKqmKuxVauKqn7eKu5fyYq 5cVW4qqs2LWs44ti7Frb48/gxbFjL+3iqszYqs4/t4qsf/LxVfyxV3Lt+xiruP8AP9vFVnL+fFW1 yTBvIs3Yq3y4Ytbv2cVdy/nxbFjcsVXti1tYq2uKqXHJJVOPxZFDXHJJVeX7eRQsXj9t8Wx37WLW 1irfHFsa+1i1tr8GLY5sVaxa3cfixVtcVaxVcmSSsbjiqoq8Mihbx/nxbGsWtrlkkrv8jIs2n+xi 1t8cVWsvxZJLbNzbIs2myTBtf5MihU54qs+HFXftYqv+3i2LI1xVzLiruWKu44q7ji1rOOLY5vi+ PFVjLireKrmXFrcy4tjuP8mKtcXxVaq4qq4q7FVvHFVnxYq5vgXFWmxVtuX7GKt4qpt/l4q7FVjY qvVsVdzxVy8f2MVc3xYqs48MVXpiqniqpiqni1tti2NYq7FXYtaz9r4MVbVf28Vc2Ku5M2KuZcVd 8S/Hi2LsWt2Koflkkrm5ccihTb7H+RkkuZfhxVrj8ORZr8KreeFg7lyxV3+piq7hgZrFbArfHCrS 8WxVrFW+PPAq2T4MkwUv8vIs1TlirlxVe3HFVnHFVL7H28kwcrfFira5FDf7OKqX7WSSqYqpviq9 sWCx8ilZkkNYs3Yqqsy4sFPFVvHFV2KuxVa2KtfbxZqb5FDsVX/ZxVS4ZJK34cWDTceWLNzfA2Kt 8cWDuPw4qp8cWblxVvliwW4qp4qqYq7FVPFXL9nFVPFW2xVSybJcv8mQYu48cVf/1frc2ZDjuVsV X/tYq5eXLFV+KojFXYqtbFV7Yq1irlXFmvTFW8WDfDIsl2SSt5Yq7jirfHFgvyLJvj/JkmLeLNbx +HFW1xYL2xVrFXYqvxZrOWKtquLBfirX28Wa7jirXwc8WCrkWS3JJaVsVbxV2Kqn+Q+RQ5cVa5Pi 2NrywqvXAruSr1wq5v8ALwK1iq3jiqpkmDsVd/qYquyKHf5aYqtySXcWX7GKr/8AL/YxVzfB9vFV 3HnkULOWSSvjXIoX8cVc3HFXLxxVdiq37eKrsVbZcVWfYXFV/wAOLY1ira4tbuX8mLYv/wCIYq7F Xc8VU/s4qqc8VU/s4qqf6mKruWKrsVU1X9s4qu44quxVTxVUxV2KruXHFXN/wmKu4ft4quxVbG3x YVd9v7eBXccVd8eKq3x88VU1+3irfp4q19nFXYq77WKruWFWlZnwKsbFV68vt4q5sWtf8WKqeKtq vPFWm/y8Vb5pirmxVey4qs+HFXM3D4MWx3Lj9jFrWrkkonIs1N8Vdirm5fsYquXFVL7TfHiq9V/4 PFXYq74cVU8VVMVczfFiq5cVW/tYq7/IxV3xf7PFXfbxVy8W+3iqzji1rMklay/DiqIZVbIoUv2c klczfDkWa3lkmDv2cVXKvxZFDlbFXcv5MWxZkmC1VxVVVsihrFsbXlirlxVrFW2bnirmkbFXMuLW sZsWxdiq1cVd/PirlXliqz4sVX8sVd/l4q6PFVuKrVVcVb5fz4q5uWKrMVc+KuxV3PFXYq74sVdi rvt4q74cVd+zirkxVyYqp4q7FXYtbbN/Jiqxv5MWxdi1uxVtsVaxV2Kqci/t5JK7FXNkUO/18Vcz csVWN8eKtccVU/8AUySXcfgxV3LjirsVW/B+3kWapx/nwqsVeX28CrG44q5cVXriruP28Ktriqny /nxVzYq5V/bwKuxVaq4q74eOKrcKrF5fYwsF37ORQpsuSYu+y2KrlbFmo/FiqozYsHf8TxVZxxVp lxZr2VsVWt8eLB3LIpWcckh3LFXcv58Vcy4qpLizX8v58ihYy8mxVezM+KqTL/PkkufFVnL4cVbb +fhiwabFm22LBZ9vFVPlirbM2Kt4q7FVPFV3HFVuKuxVZ8OKu5YqsVsmyd+xkGL/AP/W+tvLMhqV FXFgvZsVcmKqmKrVxVWxVrFm0y/DiwX/AMiYq1x/kxZuVfhxVvIoVFb+TFW/tZJK/AzWrga1ytih v7GSQ77H28Vab4sWbuH7GKr8WDfHFWsVdirmxZuXFVTFg7FWv8vFm7FW0xYKnH4siyaySV2Bms5Y WlVXIsnNirlX9vFsa48vt4q2uFV7fHgVy4qsbFV64q2q/sYVdy/bwsHcuWKuxV3L4eeKruKf7PIs 3cW5cHxVWXFrWcHxVrJJVF4tkUKK5JKtxyKF2Kt8cVWMvHFsa+w2LW3xxbF2LW2q4q74cVcy4tju OKr+GKub4sVc32cVdirsVdirueKuZcWtfxwtjTYFbVcVWcMVXq3JsVa/yMVcqrira/z4qvXhyxVZ +3/l4q5f58VXrx5c8VXYqpfFi1r1+HFsdywquwK5lVcVb/1MKubArt/58Va4JirfHFVLjxyTBU+z kUKmKrPj+xi2LMkwXKzft5FDbYq7lirlbhirlxV3HFXfFirmXFV/7fx4tin9nFrVG+1i2O4Yq7FX cWfFXYq7l+3iruXLFXYqvb/IxVZiq9WxVy8sVcy4qsb4cVc+KuTFXL/wmKrOWKr/AIuX+Tiql/kZ JgqqvxZFm5Vwqs44GtY2Kt8ckly4q5cVXfFkUKXHlkkrsVXZFDXHJJaxVWTIs1nHFXK3P7eKu/b+ DFXL9vCqxP8ALwKuxVtl/YxVrFVP/IyTBcuRZuyTBzZFmtxVc38mKubFV2KqeKtP9vFWuOKt/tYq sZcVX/ZxVZiqpiqm+KqeKqmKuxV2KuxV32MVWccVX/tYq1+18H2cWtbx+Lhiq/8A1/t4tiz/AC8W tzLi2NYtbXHJJaZcihdira4qpN/Pkkt8uX2Mihb6eKr2xVZ+18GSSv5JkUKXH4cklZiq/wDyP28V c38j4qsxVdx9XAzU8Cqn+v8AYxVTxVtsVd/r4q0y8VxVay4Vb9NUwsGuORZuZcVd6f7WKrsKreWK qPHCwX8uGRQ3iqiq5JLueKt4sF7LiqzFXf6mKqfxYs1ThiwWLkUu5ZJC3FmuXk+LBZ6eKuf/ACMV W8eeBuW+phYLvtZFCk+SS5f8jFVN/sYq2y4qtbFgvbFVn+pirmxVZy/YxVfx/kxVT44quxVT4Yqu bFVuKufFVjfZ+PFXMvw4q1k2T//X+t+ZDUqquLB3Jf2MVdiqpiq7jirlXFV2KuxVfwxZrW44sFRM iydiruOSS7liq5cihzYqv4fsZJi7jiruWKuVVxVev+Rirm/yMVX/AOpiqmy8sWa/4v28Vb4/yYsH Yq0v+RizWriwXquKu4Yq3xxZrsVcq/t4sG8VX/EvwZFk7/UxVyri2O/yMKrsVW8fhxVerYFcuKrO OKrsVVV5ft5Jg03PAzU2+3ga1Xl/PkkrMVdwxVev8+Kt4q0vv9vFWmxVEZFC1lxV32MVX8cVaxVb 9jFV6rw+3i2LGxa16ri2O+LFXcsVa+1iqpwxV3H9vFXfbxV2KuZm/wBnirvi/YxV2KuX7OKrlxVa zYq7FVy4quxVT/axVW44q74v2MVcrYq5cVcn+Xiq7FVLjwxVWbFrWcv+AxbHR/8ACYqu4virsKtr ga3N/Pi2O/a4JirlbFXMv8+LWs4piq9vgxVyrxxVe+KqeKtNkkruORQ1irfH4sWxe3PFXPiqxlZ8 Vdy54ta/FXcfsYtjvhXFXJi1uZWxbHc8Ku5fyYFcmKu54q7FXYtbsVdirsVc+LY7FVyt8WKqPL+T Frb/ALrFsX8lxV2KruWKrUxVYy/yYqvZl5Yq5v8ALxVr9j48VbZlxVZ8f2MWtZkku+1iq9myKF+K qOSSt44qqquRZtfY+PFrbVf2MVWZJLsVXYGbf7Px4Fc2Ku+38eKuVv28VdxxVYq4quxVauKu/b+x i1ubFsW4quZcVW4q7FXYqppiq9eWKt4qtbFV2KqeKuZsVdirnxVyYq7FXc8VdirsVcy4q7FVn+vi rX2sVb/y8WtrFVvHFV2Kuf7GKreXHFXc/wBjFXcP2MVd+xirvhTFXfC+KrcVXfYxVRbJJcuKu+xk UOZvixVyt8OKub41xbHcf5MKrUwsFuRZt8v2MVcq4qsZcVXtiqxmwq7/AF8VXYFWriq3CrsVUuGF pXrkWSn8fDFDfDJIaxZuTFW/2cWCzliruOKtcsWbvs4sHYqp8cDc3ywsF2KrWXFW2bIsVnLnkkLs Dcps3PAq1WyTBY38mKts37aYsHKv8+KrcWa1mxVU/axYLFbFXN8OKrsVUvs4q3iq1sVWvirsVWf5 eKu44q5sVf/Q+tyf5GZDjr2Xliq/jxxVUxVcuKqa4qv44s22XFg0uLNWxVtvj+DFg39r4MiyW8eO SS7FV3HFV6rkUKmSYrf8jFV/qYqp/HizbVeOLBfxxVrFW2xVr/IxZrP8t8VV+XJvjxYOxV2Kt/6+ LNarZFi3kkKn2EwNy3g+Fgv4/wAmKrlX4sihTbFVRfhbFsc2FVvH4uGFgqr8GBm5cCt88kwaXIs2 sVb/AGsKt88LB2KruOKrWXFV7LiruPxYq5vi+DFW8VW/8SxVUVcVXL/PkUL1/nxbGsWtZyfFXKqr iqovwYq5sWx3LFWsVb44tbvixbF7N8XDFXYqpp9jFVTFXcMVcq4qs/18VXquKr244qsxVdyxVdir sVU+eKr/ALWKr/8ALxV32MVdyxV3HiuKuXCrl+HArmbFrcuLY7jhVy/YwKv5PhVyrw+3ga2uP7eK rW+L7eKrsVbX+R8WxzLi1rOWLYrf5GLWp/axVb8GLYuxa225ft4q7lirvixVerYtjlbFXM2KuxVz L8OKuxVeq8MVWfbxV3PFXftYq7Frd/l4q7FXcMWx2LW5MWxyYtbl+1iqpi2KeLW5WxV3+virsVWM 37eKr+P7eLYu44qtxV3J/wDYYq7/AFMVczYq5V7viqz/AFMVX/tYqs4/Dzxa13wfYxVaq4qv/wAj FVPFW+WLY77S4qtVskwXL8eRQ5cVd8WKu44q7/LxVZx+Lm+Kr/8ALxbHLirv8jFXfDirT/YxVvji ruOLW1i2LVVcVXYqtbFVuKruWKrPs4qv48sVU+OKt8efPFWuWKrsVa+1iqzhiq7jiq1lxV3xYq7n i1tN/r/Bi2N4q7FXc8VdirmXFVPFXYq7FW2xa2m/YxbFvwYta9WxVZ8P+yxVfy7/ALeLYsZf2MWt T/yMVab/ACMklXyKEPyySVZcihD8VySXcMVd9jFXYq7/ACMVd8fDFXYq7FVuRZts2Ku5fz4q7lir WKu4virsKrfsYFc2KrsKoflhYO44qvVueRQ0v8ifbyTFT+LFm7nirX7HwYqqNiwW4qp4q2uKu/Z+ PFVuLNbxxVytirmXFXfY+3kWLa5JCnxX9jFmuZcDNSb42wsHL/Piq3l+3iwXN/l4s1jLiruWKt/t YsFnHFWuPw4s1v2sWDeKrWxVy4qtVsVcrcft4q7/AF8VcP2MVU3+xir/AP/R+uPL4f8AIzIcdfy4 LiqxlxVf8OKrlxVU+DFV/Hh8eKu+HFWl44s1/L9jFW+PL7f28ihe2Kt8cLY3iqxVwsFbFgs4v9jF m39jFg7lybFV2KuxVtv58Va+LFm5/sYsFT4sVdwxVpfixZub42xVV/Y4ZFClkkqqrkUNZJK5cVXc eLZFDm+xi2LsVU2X+TJMFTIs1vwYVXrgVzYq1irbYtbar/JhbHJhYOVcVXcuORQt4rxySVy4q23L FXfB+xiqoy/DkUNsrYqpcfiySVVfhyKHL8WKuXFXf5CYq5cVXYq3y4fbxbFn7PPFrX8uX+piruOL YvTFVir+3iq9WxV2KuxV32MVdzxVTxVUX/IxVeq8MVa44q5sVcuKrsVdiq1cVXYqqYqtZsVd8GKr F44qvZuOFV2BVqthVy4Fd9jFV/8Al4qs5/sYqvVsWty/H9vFsdxX7GKrF5Liq9mxVemLWsVsVW8s kldyyKFmSSrZFm79nFXNzxVz4qubFVqYq7hirl/kTFXJirl+zirl+1wxa3YqqYtini1uTFXKuLY7 FrdwxbHYtbsWxUxVT54tbl+D4MWx2Ku5NirmbFXc8Wt3PFsdirm/yMWtzLirvhxV2LYpcskwVVXI s3cMVVMVU8VdzxV3DFXfFirl/wCHxVzKuKu4/wA+KuxVYy/sJirv8jFrWfabhiq9vs8MVaxVtWX7 GLY79rFrd8OKrGbC2LsCt8vixVe+KrOP7GKu/wAt8Vdy7fsYqocsVX/F9jFW2xVbiqpiqnhV2BVv HFW1XFW8Vaf7eKtLirmVcVW/tYq7FXL/AJeKqeKqnDFXJirv2sVWccVXpiqniqpiqxsVaxVtlxVr Frdirf7OKrG/4TFV2Krft4q74MVc2KqeSS19nFV2LBY2LNtm+HFW2VsihT48l4ZJLlXniruGKrue RZrckwaZeHxpkWblbCrlwK743xVyfYwq7lgVrFVq8cKuXliq7Aqj/qYqqLhVSZcLBZiqriwU8Va5 4s3c8Vb4YsFnHIpW5Jku+LFg5sVWNxxVtcDcuxVZ+xhaVjZFkvaTl8GSYrGX4vjxVytwXFVPFm7h irm+HFVJWxYO5Yqu5Ys3ccVWtiwdyxV32MVdx4/Biqjiq/8A18Vdy/nxVZirsVdir//S+uPL+f7G ZDju+LFV6/5H2MVVMVdiq7/XxV3HFW/s4s1R8VcmKrm5f7LIoXr/AJeKr+OFsUeeKq+FpaxZtKq4 sHKuKr+OKr2bhiqnzTFWsWaqrc8WCn9rFVRMVdirWLNey4q0vDIoW/Fkkr1XFV64qu/YyKHfHiq7 FsWs2KrsVdhVvlgVpvjb48Vb+1hVr7WBXcv28Wttf50wtjaYWC5fs5FC3JJd8f2MVXcW/YxVUyKF zYqt/wBTJJXft5FDlXFXLirn/wAvFXcuXx4tjmb4vgxa17Lirf8AxHFsaVv5MVWccWtzfYxVeuLY v54qp/axVUxV2KuX7OKuTFXYq79nFXJirsVXx4q02Kt/s4q1xxVzYqqLiruOKqa4q3+1iq/jhV2F g5cizXYqtXFV/wC1iruWKrOLft4ta/8A18VX4qpf6+SSu45FDuWLYv4Ytaniq3JJdiqsvPIs3NHi qpiqnzxV0n8+Ku/a54q0y88Vb/yMVdzxVYy/z4qvxa3Kvw4q7FsdirStzxVv/ieKqmKrWxV3HFV2 KuxV2KtfDirXHFXNirlxVvg+KtKv8mKu+Hliq7FVq4quxVbxxVay4VVMCqdf8vFXMv8APiruPw/H irlXFVPFVTFXYqqYqp8MVd9n4MVdiq7/AC8VWfsfBiq3ji1tcfhxVtlXFsczYtbXH4sVb488Vdyx Vpvt4q23v9vFVvHt+3kkrmXIs3M37eKuZcKu5fDgVYy4q77eKu/1MVdyxVbiq77GKu5K/wAeKuXj iqmuKrsVdirsVWtirlZcVW/tYqu/18VXYqp88VW88kwWNiqrkWbsVWK2Kr+eKufFXc8VU/tYq7FW 2XFXf5GKtYtbati2OXFrWMuKr+OLYs48cWtSZviySWuOKqjLiqz9nFW8VW8cVWtgZu+LCwdiq7Az d8HDA1rGbFsaxVv/ACMVaxVvjirm/wAjFVnx4VX/AORiqz48Vcy/t4Fdz/bwqt+PCwU+WKqmRQpZ Ji0+LN3H/gMVdx+PFW3xYO4q+KrGxVzYq5sVU+OLN32MVdx5YqvxYLPsZFK3jzySG8Vab48VU+GL NYrfFirmX+TFXceGKrG+xirv2MVb+3iwWcV44q03+XizVOSYsFNsVVOOKqbYq3x54q5mxVZzxV// 0/riq/yZkOOrfFirlXFVXFXYq7j8PN8WblxVfx4fYxVzfFiq7IoWr8WSSq4sHYq1/qYquZf2MWbm ZcVb9PFgv/y8VU2xZr2xVviv2MWDuP2+GKr+LJirvT54q1yXFm3iwa4/BkUqmSZLsihZx4ZJK7lg ZquBVv7PDFVirireKrm+LFV2FXYq7ArsVbXFXLirl4/t4q2mSYOfFXfDiq5cVVv8hMihdiqgzcMk lVVcihyq2KrVXJJVMiha32eeKu4/FirvgxV3L+TFXfbxVdi2N8cVX4qsZsWt3LFsX4q7FXfbxV3D FXYq7FV/FMVbxV2KuxVbxxVv7OKtccVbX7GKr1bFVitirXLFW1X4vg+xiq9l/k+xirXJ8VVFxV3p 4q5uWKuZsVaxa1Nskldiq/8A18ihpVVMVVGXl8eKrFxVe+KuxVZxxVf/AJeLYv8As4qs+LFXcMVd y/4DFXYq5eGKuxV2LW7FXL8OKuVfixVyYq7FXc8Vc+LYqYq1y/nxVpsVVMWS3Fi1y+HFXLIuFVmB VbjxxVYvF8VVcVU8VWriq7FWmXnirXHFV2KtM37H82Kub+TFV/Hjiq3FXYqppi1uxbHc8Vc+Ku/1 MVdi1rmxbFv+RirsVd9vFVi8cVXpirvhXFXcf23xVZ/l4ta//LxV3DFXYqpyNirXLJJXM2RQsySX N/wmRZr29/t4qsb4vjxVe3x4Vd8OBWsVU1yTB37eKruWBmuwKt44q7j/AD4qp/6mKqnL+fFXM2Kr cVXNiqxv5MVc3+Riqx8VXs2Ku+1iqzFXK3xYqv5JiqzhirsVcmKtMvPFW/8ALxV2KuVcVczYq58V UWxa164tizjiq9lxV3HFXcsWtZxxV3HFVJVySW2+DFgtZf28Wa/kzdcihS+xkkrvsYGa18LBz4qu 5fyZFm5V/YxVZxxVrFW2/wAvCrmwK1irfw4qpLkmDlbFVTAzW8cCqf8AqYtap8KYqpt9r4MkxW8s Wa/7H28DNSVV/YwsF68cVWfD/s8Vb4YsHYqp4q7gmKrOH7eRS2zYq1+3kmTXF8VW8eeKttHyxYLu ORSs45JDfxcsVUfiRsVXPizb4/z4sFPf+TFm3xxYLOWKr+K/t4qsZeWKu4/yYq1yxZtriwW4q0n2 8Va44q7jir//1Priq/z5kOOvTFVZcVczNiq+P/IxV3+piq3Fmqt/kYsF/wDl4quyLJrJMXYquVVx Vy4qtb7eLNtsVVFxYOXFWmbFm77b4q3xxYL+X7GKuTFXYq7FVTFW8iyWq3w4q1xyTF32cWa74cDN ezYquwKtZfhxVdirsKtsuKrOSYFXr8eKtYq3y54q3xwquwK5VXCq5cDWpfFx55JK/liq/wDy0yKF qrkktcsVVFxVd8GRQ748VcuKubiuKr+PxYtjlXFXKuKuXFWsWtvji2OZcVcuKu/ZxVfiruGKu+xi rvt4q7hiq7/LxVvj+3ireKuxVTxVW/18VUlXFkr4sVvHFXL8WKrsVWqvxYq5/wDLxVy/H/qYVXrg Vr7OKtt7fYxVS5ZJgqL9vIod9nFWlySVnLliqryyKHfDiqly45JK7n+3kUL1xVev2cWxdxxVbx/Y xV2Kuxa3fDirv+IYtizji1r/AIcVdi2OZvixV3+Xi1uxV2LY7FrdirkxbF/2cVa44quxVauKrsVa ZsVbxVbxxVtuOKuX+fFVnPFVTFVvHFV2KuxVbiyXYsVv+Rira/8AEMVbxV2KuxVpW5Niq9fixVbi q3jirmVsVW/F+3irl+LFrdxX7GLY7Frc3PFXclxV3DFsdiruXHFXcv5MVdy+DFXf5eKuxVyriql6 eSYLv2cihrk+KtLkkrmyLN3HFrd/r4q5f8jFsXr8HwYqp4q7FrW8cWxfxxVrFVuSYOVcizW/byTB cy4Gbmb4cCu5Yq5sVd/l4qtxVb/qYqtb4cVVMVW8cVb5fDiqxv58VdwxV3DFXYq7FXc8Vc3DFXYq 5lxV2KqafYxV2LW38OKubFWsVWtyxVy4q5m/bxVzLiqnxxV2SS1x+LFV3L4sihZxySVuKufFV3+R gZrOXPArmXlhVt8LBr7HwZFm77fwYqs+DFXf6mKr2XCqz7GKu/4lirlbFXf6mBV2LWor/PkmLsWa 3liqpkWa3JMFP9rFVXFgp4q79rFVLFm3iwb5Yqp/ByxZuVuWKqn+XiwWMv7eKt8siyU+P8+SYu+z iq3jiza+LFgprizbbFgv+HFVnw4qp8XxVv8AYxVdiqgzfsYs1Vl+HFgsblireKuxV2Kv/9X66ZkO OuXFV2KqmKrVX4sVXYqvxZu/y8Vb+P7eRYuVeP28khc2KqkeKtYG53HCwb44sHNxxVdxxZu488Va xVdxxYL+GKuVcVa/1MWbkxVU4svXFg2q5Fk1xxbF2FWuOKr+OKu44FXYqt5Yq7n+3iq7Cq308VX8 uGKtYFd8f7GKuxVcv+XkmDsVXcvgyKHcf28VbVcklV/byKFNuX7eKuySWlb7fPFVVm/nyKF2Kt8c VWfz88VX/wCpi2OXFWvs4q2v8+KubFraxbFT4cVc+Ku54q5eGKuxVyYq5MVdirl/kfFV3LFW/hxV pcVcuKqnL4sVdy/nxV3L4sVcn7GKrcVXf5H28Vdywq7/AF8CuX7XDFWm+3iqviqnirbNirv8vFWu X8+LW3/qYq1iratirlX+fFXMv7GKtYq1yySVdcizWpirlbFVPFVRMWty/Fiq5sWxavDFrd8WLY7n irsWt3DFV7cXxbHfZxVpcVXYq1+0+KrP2sVVMVdirX2cVabFW2bFXftfBirv2cVd8LfbxVr/AC8W trjwT4Mklv8A18izc2Kq2KqXL+fFW8VW8cVXYqtbFVvw/wCzxVdyxV3+virfHhirS4qt48cVVMVW 8cVbX+TFXSL+xireKqeLWu44tjv9fFV2KqfLli1ufFsXt/kYqsfFXep/l4q7l8PDFXJirkxV2KuT FVzYqpfs4tbl5ccWxrFrdirf+virvi/b+3i2LGxVdirbNiqz7bYquxVv7b4q7jw+PFVn+Xiq7FVv +Rwxa3Ni2LsVUeOKu/y8VV2xVY2KrOX8+Kub7GKu/axVZiq5sVW4q7FVPFVRMVdirkxVZyxVrFXf ZxV2LW7FVvHFXfD/ALHFV6tirWKreOKr1xVY2KuySVFsVVsVU2yKHLirTLkktf6+Bmv4Pga1JMUO yTJd/l88izd/l4tanxfFW2XFsd9n9jFXfs4q1zTFXYVU+H7GFgu+xkWamuKqjYtak2SYtLizRGBm ofawsFuLBpMWbuGKtviwWM2KtYq2q4qs/wCNMVd/kYq0vLFmu44GbXL4sLS7/IxVTZcWa9vsYGax lwsFvxYsFPjizX88VWenwxVYqtirWLB2KtYs1zYq3/qYsFuKtftYqtbFm//W+u/2PgzIcdvFV3H4 cVdxxVpWxZqi4sFz4s3f5CYq2rcvgyLFfkmS/wBPFg5fhxVS5Ys1blgZtccLSuxVzYs2sVbxYNti q9MVbbFmt/axVcuKrsVa+HIsV3HC2tYWDUfwYqq/YwM3KuBV2KrWXCq3l+xHhYKvHt+3gZubArWK rVxVf8WKuj5Yq3wyTBd8WRQ7jx+B8Wxy8fsZJgq8m4ZFC1f9fFVv7WSS79nFVXj9jnkUOXlirv8A iWKr1xVYq4quxbG1xa3ceP28VX8MVU8WxXZcVWYq7FXYq7iuKu4Yq5V4/Hiq/wCLFVmKub4sVXMv xYq7lirbLirl44qv5YqsZsVdy4/7DFV/2MKu/wBTArmxV2SYO4t+xgZu4/DgVe3wYq79rFXcebYq 7lirX2sVbb4fgxVrFrb4t/s8VaX7eLY23+XiruWLW7lirWKqit+wcWx3JsVdzxa3KuKu5ccVd8OK uZcWxyrx+xiq/wCBMVd8OKub7GKtLiq7FWm5Yq0uKt/tYq3iq3/LxVdirX7WKt4ta1sWxUXFVOmK OBU+PFK7FVvHmvDFXccVU6Yo4FRvsYrwLPs4sG8VaZea4tjeLWuXFXfBi2LcVXccVU2xVtvjxVpc VXYq19nFXftYq3irsVVMVUWxVzYquxV2KqfDFXf6mLW5mxV2LY5Vxa3cMWxzfyYtbsWxy/Fiq7li q3FVPFrb5YqtXJJbbjkUKiri2LP8jFXNi1ub4/t/YxbHfFy+DFrUm+LJJXMy5Fmu5M3wYq3+ziqz /IxV3Flxa3fYxbFvx5JgqZFm7Cqz4vsYFX4q7CqH/wBfAqIxVRbFXNirmb9vFV2KqbNzxV2KuxV2 KrFbFrX4tjsVdirnxVZ/r4tbWLY3yxV3LFXNirWLW7FVvLFXccVWrkkrP2cVVf2f8nIoXYqpcvhx VZxySXMuRQtySWv8vAzX8WXhiruP7GBrWccVd8b4tjvhxVYvxNiq/wCHFVnH4cKreOFgqYGa1vix Vr4kwNbfHliqxmwtjuWKu4/sYGtplbJMVNuP+xxZr1+P4MVW4sHPiqnirarzxV3xYq7liq3Fmt+w uKr8WCj8f7GLNvlkULeOSS0mLBvjizbVVxVZiruS4qtXFgs44qs5c/jxVdxVcWbuWKr8WCnirsVd ir//1/ruq5kOO3iq5f8Ah8Vdx4NzxVf/AJaYq7/U+3iq3Fm3y/kxVfiqp8WLBeq4q3izabFguxV2 KuxVrFm3iwbXFV+KtcVfFm77GKub/IxVFZFmtVsKqeFguwM2uXDFV/HjgVdiq3liruOFXcuOKrsC rckwX/tYGbTfG3x4FbVfh+DCrfDCwcrYq7hirvi/YxVdxxVdiqo3xZFCjxySW2XFV6/z4q7jiqqy 5FDWKuxV2LY22Ku44q5cVXt8WKuxVyYq7FXYqsZsVcuKr8VdiqpirX7OKu+LFW8Va+1irSquKuXF VR/8jFVP/IxVv7f2MVdy/YfFV/L+TFXZJguyLNv7H2MVc2KrOXw4VdhYL+PP48izWNi1uySV37HD Is21Xji1uVVxV3+RiruXb9jFXcueKuVv28Wxe32cVdzxa3Ytjnxa3Yq77eLY7l/Ji1ruOLY3Jire KuxVcy4qtxVTxVUxVauKrsVW8cVVOOKrcVaT7eKr/wBjFrU2xbFT/LxVdirsVW4slvHjiq5cWLmx Va2LJaq8MWHAqf6+KV2LWtXFV2LYt44quxVarYqpriqtiqky4tbX+pi2K2KqPLFXcsVdyxV3HFVT FktxYtM2KuVsVX4slHj/ACYsV3LFVuLW7nirlXFscmKufFrd/qYq77bfHi2OfFXc8VdiqlyyTBvA zVP9fA1rF+PFXNirWKtKuSS3kUOxbHYqtVuX+virlxVfyblirvT4YqsbFVn7OKr/APUxVy4q7jir uPxYquxVRXFVRWxV3LFVn2cVWPiq/wDY+PFXKuKuZeHwYqsxVyYq7FXPirnxVTxVUTFXcMVWccVU 1ZWxa1RlxVTb+R/t4qqf5GKtYqptkkruORQ5uWKrFbFV6tiqnkkqfPFXKuKu4Yq18ORQ3/l4od9v JMnPirmbFWuPDIs3N7fYxVzYq1iruCYqt4ft4Vdy4rirbfYxVvAqk32uGFW8VU/9fCwXL+6xYN4q p4q0+LN2KreOLBc+RSp5Jk3yxV2LBb/xLFXf5GKu44q7jiqk2LNd6f8APiwbXA3LeWFpabFmtVuG Krfh5c8WCzjirm+x8eKuZsVcy/z4q5cVW4qtXFXccVf/0Pruvx5kOO1xxVUXFWvst8eLNf8A5eKq i88WDeBuW8f5MLBVxYNKuKr/AI8VbXA3LuOFpc2KtNizdxxV32sWCpirsVcmKtfYxZqmKubIs22+ DCruXxYq1hYNrgZr+P8AJgVdiq3jyxV3HCq9WxVy8cVU2+3gVU/yMVd/kYq7j8WKt5Jg77eKrlbi uBmtfCwXqrYq1yxVUyKFNm/kySW+P8+KqrfyZFDuH7GKrsVW/wCvirl44quxbHYqqc8VdirkxV3P FXYq77GKuxV2Kub7OKuxV3H/AC8VXLiruWKrcVX/ALOKt4q19j48VaXFW+b4q5m4YqvXFXNiq7FV vHFV6rzxVYzYqvVsVWNiq/8AZxa3MuKu/wAvFWk+xirfHFXccWxeq4q5MVcv2sVa+yv+RirbLiqn +xwxa1TFXf8AE8Vdy44tjl+ziq5sWtvj8XwYWxzLgVvFXYquxZLGbFi3irXxYq1xxVdxyTB2RZrW xVdiqpiqkvLliruPPFrXr8f+vi2LsVU+OLJc2LF3xft4q77GKu5Yq7Fk5vhxYu/yMVdx/nxVdiq3 Fk77GLFdiqmuLJc2LFdiq1sVd/l4quxVR/y8WtvjhbGmX4cDWuxbFq4quxVpvgxVvFVvHFW/2cVb xVT4/Hi1u+H9jFsdzxa3M3w4tjl+HFrdi2Oxa3YtjsWtTxVU5csVdxXFsc3DCqnga1TFsWK38+Ku 488WtYv2PjxbG+P8+SYNcuP2Mizb45Jg0y5FmvZcWta2SS19vIs1/wAOKtYVb44FdxxVrFVq4Vcu Ku+DArvgxVzYq79rhirmbFVuKrWbliq7FXYqp4quXFVvDFXMuKuTFVnHFXcvixVe+KrFxVfirsVW csVdyb/YYq7ji1tfZxVb/qYq5V5ri2L2xa1irirmxVZy/YxVrJJbblkULOOSS7jiq1lxV2Ku4qmK uxVdx/4DIoW/8Rwti3Arf7fwYqs+3iq7FW/hxVZ9vCrv8vAruOFVL7f28LBf/l4qtxVrliwWfFiz dzxVvFg5MVUsWaomKrWxYLJGxVSXFmr4sFrcsVcy4q79jFVPjirfJMVc/wBvFVNm+LFm79hsWC3/ AFMVaxVv9v4MVWf6+Kr1/nxVY2Ku/bxVbir/AP/R+vGZDjrmxV3Lliq5sWa/7GKu+LFXLGuKu4Yq qfDiwX8cVa/bxZu4viwVf+I4q1yxVp/sYqqJirkxV2KtMuLNzf5GKuxVWyLNZIuSYOVcVbxVdkWa 5/8AIxVdiq1lxVdhV2Kt/F9tMCt/8Swq0y/sYFaxVvj8OKt5Jg58Vcy90xVeqs+KrG/y8VX/AGsV czYqr5FCHXJJVvgyKF2KrV+JcVXYq7FW+OLY7j+xiq/nirm/nxV2Ku4Yq7nirueKuxVzLirsVXLi q1v5MVX/AGWxVvFVPFV/L4sVdx7/ALeKtcsVb5c8VVcVUuP7eFW8Crm+38eKuVcVX/s4tbv9fFsd +zirlbhi1rPh44tjlXFV32sVdx/bxa1Tj+3iqz9rFV6/5eLY58VdxXFVn+phVezYFc+Ku+LFXYq5 8Wt2Ku/yMWxcuKqn7eKqPPFXM2Kr1bCrl44FaXFW+PL7eKu/axVzcH+DFW8Vdiq3/XxV3LFV2Ktf DireLWtbFsVOWKu44quxVa2KrcVVMVW8/wBjFXfsYVXYqtXArlxV3LFV2KrWxVdiq1sVdyxVbyxZ NL8eLFvFXNyxZKmLFR44q2y4qq4qo8sVcuKt/tYq5WxVrjirafbxVvFVNf5MWt2LYuXFW+Pw8MVd t/JirTYq5sVd/r4q38D4q5WxVzLw+DFVj4tbmXFVTFsU/hxV3PFXL/kYqqYqp4tanyVGxbG2/nxV 3w4tazJJXfZyKG1bFVnqYtisvHliqxWxVrFXN9vFVrN8WKr+X8+KrP2eeKub4sVU+WKuVuOKu5Yq 7lirmxVdirS8uWKtNiq18VXNiq7FVPFVnLFV6rirueKuVV/bxVTxVUxVTxVUxVT+1i1uxVvl/Pi2 O+LFWsWt2Ktsv/AYqsVlf7eKqTcckldiwXtkWS3jkkqPDFXJiq58DNb/AKmFg5VxVz4qtyLN2KrV xVfx+HFXNirbYVU2blirlwKuxVS/awqt488LBdxwM1PC0ufFVzNizWPireLBTxVr7OLNbxxVtcWD n/yMVawNy7CwaZcWCzj8XPFVvPA3Ob/LxVrj+2+Fpc+KtNyTFmt44sGv2cWbl/nxV2LB2KrWxVpW /YxZv//S+vS5kOOtxVcv2MVbxZt/6+Kq/L/LxYO+P9vFXfZxVcv28VX4qt5cvjxVe38mKu5Yqs5Y qvXFV/PFXM2KufFWl/yMWa/j8WKt4quyLNTXJMF2KqnH+fIs3Nyf/Uwqoqv8mFgrNkWa3FV3HCqo uKrcCtsvH4MVd8XLFWsKrnwsFy4qtZcVd8OKuVfhxVUxVvFgsZueRZO45JKsuRQu4/FirsWxbyTF rXYtja4q1i1tsuLY7/UxVzN/weKr/wDXxV3H9vFXcv28VdirlXFVTFXYqp8MVXK38+Kt/DiruPPF WmX9jFXKv/B4q7jirfH+fFV/HCrlVcCrcVXcsVc2KrVbJMFX9nIs3ccVdxxVrFrW/ZySV65FDlxV rFW+OKuXli2LmXnireKuxVbwyTBcy5Fm77eKuTFVTFVPhiq7jiruOKrsVaVcVWcMVXq2KrV5cskw VWwM12BrUuP8+Kt4tjXLhirvtYq3iqmmKr2+xireKuxVdxxVTxZKn+vixc2Ku/yMVcv8mKrcVXM3 xYq5f58KrVXCwXNkWbuWKrsVWt/Jirvh+3iq7FVvLFXLiq1cWSrxxYrOOKrsVW8cVU2xVvj2/YxV y/a+PFWv8vFW/s4q3iq1cVc2KqjLiqm2LW5eS/5OLY38H28VabFW1bFW8Va+zirv2sVa5YqqM2Ku 5NzxVTbFW+P7eKuZcVWcvgxa3cMWxzfZxVZ8OLWvxVzLi2L/AIcVWfYxVrlzXFrW8sVcvx4qt45J La/A2RQ3+zirmb+TFsdyxV3JnxV3HFXfYXnirl+P7GKrFVsKr+PxfHgVZ9jFXcuX28Wtdi2KPHFV 2KqmKqLK2Ktr/JirvixVvFWvtYq3iqmy4qs5ft4qvVsVdirsVU+T4q7Frdi2OxV2KrVxa12KtsuL Ys5Yta7FVvHFXLiqzjwxVa32Mkl3B8Va44q5sVW8cDNyrzwsHYqu4r+3kWbmXCqz/XwK5cVaxV2K uxVbxwquwKt44qs+P9jCqzlhYL2XAzabA1t5Jitb4MWazFW254sHYqp/5GLNzYq7Fg22Kqf2MWbm bFV+LBRbFV3HA3O/18VU8LSu+HFmsXjyxV2Kqa/bxVvliruPPFWsVXMv/B4sFjYq/wD/0/r1x/kz IcddiruP7GLNev8AkYq5WxVUxVdgZqbN+xhYKi8sVc2Kqi/yYsGvs4q7FW+OKr0xV2Ktqv7eLNby /YxVyriqquBm3irStiqriq3jiq7Aq1fh+xiq3FV3+virlwq79vAq9sVWZJgqYq7FXfFirsVc3+Ri q5f8vAzXquBrXsuKreWSSp8cVXYqqfHkUL1xbGsWtb8P+yxV3wYquxVyfYxbG1xVrFW+OKr/APLx VTxVUxVr7X+pireFV6+/28CrMVcvJvjxVUxVd/qYqp8sVbbliq/kzYq77eKrF/kxVVxVT/18kwXL kWa7FVir8XPFrX4tjfLFrd/qYti3jkmDWKqyZFClxySV3HIoXrGuFsdwwK7hirsVd/qYVdga3fDi 2LP2cWtfx+DFsd/qfbxa1TFsW8cVd/qYq38WKtcsVW4qqYqt44q2q4VVcCuxVT/1MWS5cWLmxVzY quxVbyxVdiq3/LxV328VdyxVdiq3jiruWKubFVPliqpyxV37GKu+xirmxVbiq1sVbVueKquKrfUX FXM2KrsVW8sVczYquxVa2KrsVWs2Ku44q7/IxVdiqjxxV3+piqtiqn9jFkuVcWK34MWS5l/YxYrc VaZsWt3FMWxy/HirXHFXNiq1m5fHirsVVuOKrOK8sVbxVb/r4q5V/kxVyr+3iq3FXcMVcmKruOKr fsYq7FrdirnxV3+vi2OVcVWceDYtbWKu+zi2Oxa3Nx/2eKtsv7eLY5lbFWsVb44qsVW44qvVuGKr 1XFVFVxV3L4uGKrcVVMVW5Jg7lkWaxmxVf8A5eFVuBVv/EsVbZfh4Yq1yxV3w8eeKrf+J4q5MVc+ KuxVTxV2KuxVvli1ubFscv8AJzxVZ/l4tbn/AMjFVrYoXf6+KVy/5eKreWKqXHv+3kkrviyKGv8A LxVb/l5JKtyTIoU+OKqfPJJdx/bxVUXIoW4Wxa+Fg03wZFm7/Iwq3+1hYLcizWsuFXNiqxfb7GBV XFVvLjhVdiqniqxfsYWDeKqbLiqp8H2MWCzk37eKuxVTxV2KqjfaxVTxV2KtYs1v7P8AlYqsbFgu VsDcpN/l4WDbK37GLBtmyLJ2FsUv8vCwb44sHd3xV3LFVuLNpsWD/9T67quZDjruOLNU49v28WC9 fs/Hirl+1ira4s2/gfFVRf58WDbfF8eBuWt9jCwX4sG1X4sVcv8APiq/i32MVXfb+xizbb/LxYKf wtizd9vFVbAzdgVb/wARwqt44WCsuRZrsVWrirv2MVXYVWp/l4q5cVXYFW/sYqvZcKtty/YwsFvJ 8izXc8kwdiqpkWLat8P+tilb8OSSr5FDsVUE+3kkt4qqck+3kUO+DFXcsVc2KuWPFV2KqnH9jFsW Liq98Vdiqzjiq/nirsVd+zhV3+vgVyYquXFV2KruWFXfHgV3HFXK2FXc/wBjA1rP2PgxbF/2GxVz Liq3FV3H+TFV/HFrX8lxbFPgmKt/5CYqtZskwVW4ZFCz/LxVZkktquKqqrkWbmb+fFXLwxVerc8V Q2SYK3PIocqri2Oxa13HFsWtwxVev2MVXq2KrFbFVXFVPFVq4q7lirlxVU5cWxVdiq3Fk5v5MWK7 FXYq7FVvHFVuKqvLFVi4quxV2KreOKuVf58Vdyxa1n2cWxf9vFXfbxVy4q5sVdyxVzfyYq5cVXYq tX4sVd8X7GLWv48MVUOOLYrriqxcVXYqtXFXKv7GKubFVjfz4q7jwxVzfBiqrirsVWtirsWTuOLF 37GKuX+fFXLiq7FVv+XiqnyxV3LFV2KtKuKuZcKr/gwNaxv8vFsWc8VXLiqovxYqsbl9hMVaXFV2 KqeKu4/BiruK8sWty/ZxV2LY5Vxa1/H9jFsWYq7hirueLWp80xVtV/bxVrFW+XDFXLirS8cVbbFX fs4tjl+PFVitiq/j8WKtYVWtiruPHAruKYtblbFscrYqtVfhyTBc2RQuxbHYqtZlxVYq4q02KrcV XLiq3FXN8OKu54q77GKuxVY2LW1i2N/DirWKreP8mLW7FC9lxSs5YquxVbJiruTfYfFXP/l4q0zf Diq1f58Va/1MkxU/2cWbvi+wmKqvLt+3kULMLYtb4cLBdJyyKFnLnhbHcfixV3HArWFXYq7Aq3ji qxlxVtvhyTBTbFV6/BgZtccCqb5Jg77Xx4q3/r4sHYq7FVNVxZu+ziwdirvtYqs5Ys1zYGakuFpc 2Ku5c/gxZuZmfFWuGRQt/ZySW+TfYxYNPizbfFgsbFWuWLN2LB//1fr5mQ47WLN2KqnPFXL8WKr/ ALfwYquX48ihcq/DkmLmxVy8cVX/AORiruWKu488VX8eOKtJizd/l4q7FV2BmuwsFP4+eKqmKqnH 4cDNy4Fc2KuX4cKrsVXccVW4Fb5fyYq79nCruPL7GBW/sZJg5VxV3L+fFVy/a54q5fiwM3NHgVtv 8vJMGmb9jFV2KrV+1zxVW45FDv8AXxbF2Kt8cWtYvLFXcsVXr/Pi2O44qvxVzf5GKrGxVfiruXLF XN/O+KuxV2Kr2bFXN8eKu5Jiq9v53xV3L4cVU+WKrm5ZJguX/I+xkWbv9TFrdyxbHSNiq7FW1xVy r+2/28Vc3L7D4qpft5Jg77GKqrL+xkUO5c8Wxy4tbWLY1yyTBVX4Pt5Fm5vs8MVVMVU5PgxVZxxa 1/DFV/2sWxvFVrYquxVb8PHFW+PDFXN8eKubCrlbArlbFWmxVU44q7jirS/bxVtcVXYqt44q7/U+ xiq3FV3LFV2KreOKrsVU8VXL8OKuVcVWfs4qv44q5cVc32MVcq/Diq/jirWKt8v2MVczNirWKt/5 GKuZeGKuXFWsWttsVc3FsWxyrirWKt8f58VWccVc2Kr1/wAvFXcvsYq7k32MWt3HFVnHFsXYVU/s YGTmxVcuLFdiq1cVdiydiq7/ACMVUVxYuVf5MVXYq7Fra+zireLYt44qrYqp4q7FXYqpq2KqmKqf DFV/H4sVWN/OmLWs5cMVXvirmVsLY7lxwK7FrdzxV3L9jC2LFXjgV3+Ri1tYq5PsYq1xySW145FD fLFWl+BsVWtyxbF2KtsrYVX88CrFbFXLirmxVrFVHjiqtiq3l/weKrsVU8Krk/yMCrG/nxVrliq3 FV/2mxVrFkt/1MWKniqpirkxVY2Ku/yMVa+1irvs4q7FVrYtbv28Wxy4tbuWKrVySV3w/sZFC1vh ySWuPw5FDf8Al5JK7FVFcVbb/IxVYy4q5VVcVd9n7GKqeKon/IdMizWL/kYVU8DW2vLC2LOOKuXA q7FVnF8Vb5csKrcVU+WFgv8AtYGbeKuxVR5fBhYN4sHYq7FVP9rFm7j/ACYq1iq5lxYNYq7FVrNx xVSXFm2y/sYsG15Liqm3xYs1yYGbsVaTC0qfp4s1jYquxV//1vr1+xmQ46/k3HFWsVVOeKrlZUxZ tcsVVlyKG8kxbZsVcq4q5cVaX+TFmqfYxYOVcVaxZr1+DFV3xNgZrFwsF2Kq2BmpN8GKt4Fdiqph Vv08CtYq3+38GLW03+Xiq1sWxevwNiq9VxVav+RkmDuPLFXf6+Kub7WKrvg+PIs1/Ff2MWtfy5fH irSquKqfLhkkqnF8ihtlxV32MVXYqt5Yq5VxVU/4liq3l+3iqpzxbHc8VdiruGKqeKqnH48VXccV W/5eKuZcVVMVWrirf7OKr/8AUxVrjy+3irbLiruOFXM3w4FU/wDiOKqjLirlwq7iqfY+3gVfJ/l4 q5lxVr9vniq1mxa3ZJK/jkUNL/PirbLi2NL/ACYtapi2OxVZ/kYqvr/l4qp4qqL8bYquVfhxa3Ni 2N/Y+xireKtK2Kt8cWSmv+X9vFiqYq7FrW8cWxWxVauKuxZO5YsXf8RxVy4qtZcWSpixUvtYqqr8 DcMWtaq/t4q7li2L/wDIxV3HFrWLhbF7Lga1jL+3i2O5Yq5vs88VdxxVdira/BiruWKtYq3yxV3+ Rirv8jFXcueKtYq2qs/2MVdxxVzN8WKuXFXcsVWccVXq2KrMWS9sWLf/ABLFVuKrcWS/9nFi7jir WKuxVTxVa2KqnL4cVd/kYqp/5GKr1XFk2y4sV2KrW+LFXYsl2LFaq4q7liruOKrcVdiq3jiq7Cqm uFgubIobZsWx3H4sKu+zgVrjiqtiqi2KrsVWsvxYqt/y8Vc3xYq5v58Vd9jFXfbxa1NuWKtrirv2 cVXviqj/AJGKr2xbHceTc0xV32PjxV3wriruPPFXcsVd+ziruOKtYqtVv5MVcy4q5mwq5sDW79vF sW4qtXFVv+viq/j+3iqzFV6/5GKrOPHFXYq7/IxVzLiqzliq/niqxsVcv2fjxVpv8jFrdiq1lxV3 7GKrsVdiq34eOKqK5JLat+2mKtf5eKu44qu45FCn8WSS7i2KuVfhxVdxVl4ZFC3hkkqiriwU2b+f Fm0rNkWbWKtr8eFVnx4q5VwK7/IxVbirXLhhVvFXYqtwsFPFW8WDmXumKu4Yqs44q1y/kxZtYqu5 fz4sHccVU+PFsWaxsWCoyr9jFV2KqX7HPFXNx+3iq3l+2+BuWsy4WDf7OLBrhizWMvxYq5WxV//X +vjZkNSomLBp8Wbar/P9jFg5eeKojFXYq7FXNizdy+HFW+WLBemKtf8AEMWbv9fFW8WCpxfFmsbF XcsVX/5eBm1hYNrgZr1VsCu+xhVU44q02BXeni1tYti1W/kxVytyxVdhVtfgxVvCwdiq7lw+xgZr fhwsHKuKrlxVdiq9vt5FCn9v7GSSq/BkULsVWr8OKr/hxVT/AGvjxVfirarxxbF/L/gMVdirueKu +L9jFXf5GKuxVzLiq7liq7FVP9rFV6riruXDFW8Vdiq7jhVT/wAjAqoq/DwxVe2Ku+LjirlXFrWc fixV2SSu5fDkUN/6mKu/axV32vg/YxVrFsVFXFV7fZ+D7eKrOP2MVd/kYq7nirkxV3JsVdx+DFXN 9rFrXLi2LsVdirS/5GKu+HFW8VW8cVVG+FsWtbiqpi2LeOKtKuLJvjixcq/t4q5sVdiyc2LFy4qu xVb+3irv9fFV/wBj7GKtYq22Ku5Yqs5YquxVRXFVRsVX8sVXtzxVT+1iq1WxVercMVc2Ku44q5sV axV2KttirlxVzN+3iqxVxVdirsVdiqp/l4qs5Yq5cVczNiruWKuXFXN/PiruLJiqlxxZLv8AiWLF diq1sVdyxV32MVdxxV3HFXJ/l4quxVb+z/lYq5W5Yq7jirlxVdiqzlx+3irfHFXcsVXYq7FVq/Di 1qbYti7FXYqtxZLsWLXxYq7l/JirXHFXcsVXYqp4q7FrVMWxTTFXYqp8Xxa2uOSSu45FDWKtq2LY tXJMFnHFVVsihY2Ku+3i2LsVcrL9vFW/t/YxV3Hniqz/AC8Vdxwqt/YwsFrZFmuxVa2KtsvPFXM2 Ku+LFVj4qvVcVWYqsZefwYqvTFXcmxV3DFXPiqxf58Vd+zi1u+LFXNiruOKrOXw/Hi2L1xVZyxa3 MvL40xVT/wBTFW/2/wDLxV3B8VcrYqs5fFzySW1+P7GKrPh/Y+3irlbFV/JMVWfbxV3DFWm/yMDN ZxwKv4/FwfFXfG+KtYVW8sCu44quxVa2FVFcLB3LFW2bFVn7WKu4/wA+KqnJv28WCzFVNsWbWKt4 sG1xVYuKr2bFVjYqsZfixVvjgbnf6+KqXPCwbVf5MWDXH4MWbuPLFW1Xn8D4sFNcWb//0Pr6vwNm Q469f5MVd+1zfFV/2sVdxTFV6rx+xiq7FW/hxVrl+3izaxVV54sHN9nFXJirsVXfZxZtsq/t4sFT Fmo8cVVMDNpVxV3HhgVevHCq7ArfHFXc0wq7jgVy4q5l/kwq1gVd+1kmC7j8eRZrfsZJg7FXLgZu TCwX/FirTYq7/XxVy4qrR8cih2SSuyKFv+RiruH7eKrsWxU54tazji2NYqqYq58VdiruGKuVsVXK vLFV2KreWKtquKr1Xh8eKrG/yMVbxVdx44qt45JguXlkULsVd9nFscn2MVVOeLWo5JK77ORQtT7G SSuyKFjfbxbFRY8VX4q5MVdwxVzceOKu+LFVv/EsVXcMWt2LY5MVdiqIxVTxVb/kYqqcsWtbirTf 5GLY1/qYqqN/Pi1rPixbF+LJbyxVUxYreOKrsVW/5eKrsVWtxxV328Vcq4q7/UxV3HFV6/zpiruW KuZcVdxxVZ+xiq7FXYq2q4q7jirm/kxVzfz4q7lirvt/HiruWKubi2KtYq7FXYq2zYq5fj+3iruW Ku/yMVa+zirsVa+03x5JguaPAzX8MCqfBMVbbFWvtYq2y4q1irsVbX4MVa+1iq3jiruOKu44qv49 /wBjFXMuKtYqt5fz4q5eP7eKuXlirlbFXccVcy4quxVav+R9jFXccVcuKu44qt44sl3LFis4Pire KuxVbyxVzYquxVauKrsVdirXLhiqxv8Ah8Vc+KuZsVdi1uXnirueLYsVeOLWvxbHcVxVYzYqt48M kwXKuRQ79rFXcuH28WxY2LW5sVX8cWxzYq5f5MVWLiruOKreWSYLsVdxyKHLi2O/18VWNyxVpl+L FW+X7GKu+HFVnDFXYq58VdxX7eKuxV3DFVjYq19rFW+OKtc0xa1vwYq7jirmxVri+Kqn+RiqxuOK rsVUG/kySV64qtxV3wt8eRQp/bySXc8VczYq77GKrmbAzW/6mFg7hiq3Is2+PP7eKrWX9jJMFmRZ qmKrVxV3H+TFVn+RhVrCwW/6+KubFW1/y3xVb/qYsHYqp8sWaxlxVXxYLGXFXLirXF8VWrirmxVb 9nA3O/axVrCwd/qYsFvH+TA3LXwsHcfh54qs/wBTFX//0fr/APtc8yGpZy+LFUTgZqat/wABiqqz YWl37X+Viq9VxVe32cVWcsVX4q1izc+Ktqq8f8vIsV/H+fFWlXJMm8VVsDNQb4MLBpcVXccizVsV WthVd+xzwK7Cra4FXNyb48VU1VskwVeP8+RQtTJJdzxVvniwX5FLsVU8Vd/qZJkqMv8AweRQqfsY qpKuSSqrkULsVW8vhxVzYqvXFsdyxa3Li2O44qvX/IxV2Ku54q79nFXPirv9fFXKuFVy4Fc2Ku44 qrYqo8sVb/axVvFV/JMKtMuBV/7PwYq5m+F8Vcq88WtZkkuxVezZFCzJJXrkUNYqqcMWx3xfb/nx Vy/yYq5lxV3DFXKuKuVfhxV2KuVcWt2KqmLY7FWm+xirS4q7/IxVdi1ruOLY7jirsWTv9TFi7l8O KuxZOxVdixWszYquxVbyxVf8OLW7jiqzkmLYvXFV/wDkYqs/ZxVv/iOKtcsVcuKu+x9vFXNirv8A XxVrFW+OKu+P7GKuXFXK2KuX/LxVzYqs5YqvbFWsVdiq348VdyxVfyb9vFVi4qv44q1irfHFXcsV cv8AkYq1irbfHiq/niqnirfLhirXBMVbXFXK2KtYq2uKtYq3+1iruOKuZcVaxV2KuxV2Kt/Fi1rP 8jFXKuLYs+x8GKqv2cVW/Hiq7FXYqtVfixVdiq3Fkt44qt44sXMvw4quxVplb9jFXNxxV3wft4q5 VxVvFVq4quxVT5fz4tblXFXYqqYtiniqm3HFrVExbF3LFVv+piqn9rFrdiq3JJVkyKFPFXN/kYqp tkkruWRZr2b/AIPCqzCwcuRZuVf28VcuFVPjgVUkxV3+XiqmuKrUxV2KruOKrcVaZuGKtt8OKufF XYqp4qqSf5eKqeLWqYqsb4MVaxV2Kt/s4qs5/t4q5lxVzfFiql9rJJd8WKrmbIoWccklcy/z5FC3 /LySW2XFVq8vsZFDb4qtySXPiq1/sZFmtb4sVXfaxV2FXYFWr/w+KtcnxVvj/JiqnkmDTLiq7l+2 mBmsbCwafFg7FVLFm2zYq7jiqzliqpyxYO5Yqp/t4s12Ktf7D4MWC3FWlb4cVXZFkpvirSZJi3gb nYq//9L6/r8OZDUqftYsG+X7CYG5b+x8eFgqLy/bxYLsVVMVdzxVTX7eKqn7WKruX8mLN37OKrv9 f7eRQ5P8v7eKtZJKtgZqeBV37GKrsVW5Jg7/AFMDNf8As4Fa4tx+PFW2bCq3/LwsGmyLNWWPFV2L UpvkmTsVXquKuVeGKuZeOKrm+D7eRQt+JcklfkUKa5JK/j9tMihW44qsZsVXYtjvtYq7FVv7GLWv /ZxVfi2OXk32MVdirlXFXYq5l7piq7jirfH9vFXceGKrFbFVTFVrL8WKq2KrX/y8VX/5CYqsb+R8 VVl/yMVdiqnira4ta3/XySW8ihtmxbF74taz9nFVVcWxzYqtTFXM37AxV3DFXKuKu48ftviq1VyT BdkWa9Y8Kt4FW8sVW88VdzxVUxVauKqjNyxVT44qrYq2zYqo/wCQmKr+WKu+3iq7FXcfixa1q4ti 7Cq3jga1z/YxbG2xVrFXYq2uKuX9jFWvtYq2q4q77fx4q7/LxV3LnirmXFrd6f8AJiruOKtYWxv4 ft4Fa4/yYtbfHFW/9TJJW5FCoqtiq1WySWv8vIs1iriq9VZMWtby4Nkkt5Fm38WKtfaxV2Kts38m Ku/y8Vdx+HnirWKt/s4q7jxXnirvh44q5l4Yq7/UxV3LFV7fFiqz9nFWsVbX/LxVrFW1xVy4q1yx ZN/s4sXLiruOKtL/ACYta3ji2OXCq3ArTfHiq/jyxVri+Kt8cVXYqt5YquxVRxZKirxxYu/yMVd9 vFVuKuxV2LWt44tjbfB8f7WKtK3/AAeKrsVWtiq1lxa3Ytjv2sVa4/F8GKt4tazli2L6f5GKub4/ 9TFVHJMF7ZFDlxVbxySV3HhkUOZcVaxbG/8AXxa3ftYtjm/yMVWNi1uXFWl+3i2N/BhVdgVa3wti qnxxVavxYquX+dMVbb/LxVZwxVd/r4qpccVX4q5MVU8VVHxVT+FsWtb9jFV7Yq1irsVb44q7liru WKtYqoNyT7eSS74cVaXFVZl/kyKFJlySVVl+LIoWN7fbxVrjiqn/AK/2Mkl2KreL5Fm2uKuVfhxV zYq1hVTxVUwKt44q232MKqbYqt+zhYOZsVc2LBzYqotiza+1irfLm2KtL9vFVy4sHM2Kqfx4s12K tN/wmLBY3H9vFW+WBuWM2BrdirTLkmLeBuW4WD//0/r+mZDUqJ9vFg7lz+DFXcvid8VX8cVXrirl +PFWmXFmqc8WDvhbFWvt4s3Piq9VxV3N8VXfF9v9jAzWqvNsLBf8P7eKruOBmuxVT4+rhYKqrkWb mxV3+vi1tYti1lxVUXCq77P+vga2uXL40xVdyyTFYqq/x4s1X4P28ihfkkqStxxVV/YyKFn2/gxV SySURxyKF/7WKrOWKrsVWriq/ji2NYtbsWxU4Yqs+yuKr+PwYq7FXPiq9WxVr7WLJbyb9jFiu/yM Vb5fDiq/jyxVdiqjxxVvj/Jiq/jiq9cWtrFsb5cPjxVrl/Ji1t8cWxrFrb5YqtVcklrFVzf5GRQ2 uLYvxVcuKrUxa3fbxbHcMWt3PFXYq7FV3+pi2NtxxVpcVb4/Firv2cVbxVdyxVdiqmuLJV44sWsV Wq2KrsVdirsKrVwK6T/JxVfv/PirWKuxV2Kt/s4q7/LxVY/+Xiq9VXFVnHFV2Kt/Zwq1gV32sVbX /Iwq2uKuwsHJiq37ORZrv+I4q0rYq19rFV3HCq3ArfL4vgxVYrYqv4t+3irWKuxa2/sfbxbF7f5e Ku5fBirv2cVWenirWLWuj+z8GSStyKFzL/J9jJJc2Bm1+zgV3LFXcvhxVdx5/YxVZirsVb5Yq7ji rX2sVWsv7GKrsVb44qs44quxVvjirmxVy4q1wTFXYqtXFrczYq5m/nxbHN8WKrsVW/Hiq7FXYqtX FV2KuxVbiyXYsXYqp4q0q4qs+xiqpiq3jiq7FVPhiq7jirf2cVWYtbueLY7FrcrYtjkxVy8f2MVX ccVUmZcWtrj+3iruP8mKt/6mKu5cMVX4qskXFscq/YxVrFW2+DFVn7GKubji1ubFsXYqtVv5MVd9 vFVuKuxVpfjxVZiqxvjxVfzxVZx+LFV/PFXYq58VU8Vdi1uxV2KuX+fFVvHjiq1skldxyKHfbxVz fC2KqPLJJbVVRcVXL8C5FCzlkkq3+pkUNcV/2OKqDL+2Mkl2Ku5f8HirXF8DNzYFa5fDi1t8sWxS ZviyTBdxwM3ceOBVNl/YxVtsKtYWCp8GBmpM2FgsxVzNx+3iqz4WxVU4/t/t4sFjYqtxZt/Diq1m /nxYOZsVcq4q5lxVzL+3iq3/AC8Dcs+HA1rOOKt88klcrYGb/9T7AK3PMhx16rwxVb/kYs1X/IxY LsVbXFWsVd8PLFm7FgqcfgxVrFmu44qtfFVVv8jAzWt7fbwsFVP8vIs3cv58Ku5fz4qvX+fFWsCr mwq0v/EMCu48ft4q2seLU58kyXKuBm5uP28CuxVyr8WKu4Ytatkkqf8Ar5FC5sklc3xZFCmrft4q 2q4quVfhxVfiq37eKrsVWr8WKuf/ACMVXYq22LY7liruXDFXccVX4q7FV68cVbxVTVcVXq2KtcHx VUXFV6/EtcVUsVXKvxYq5VxVeuKtYqtX7GKr1XFraxVv4sVabjirsVW5JKp/xLIs13+RirsVdi1u TFsd+zi1uX/IxV32MWx3DFXN8OLWuxbl2LF2Kuxa2m/nxbFXFXYq7FVrYq7FkuxYrf8ALxVeuLW1 i2N8cVa4viqzk+KqnH4cVaxV2Ku/y8WTsWLfHFW+PwZJguyKHf5eKrOWLY1irsVdiqp9jFVi4q19 nFW+WKt/8SxVbirariqr/qYqtfFXfE2KqeFW+Pw4FX/a+DCqz7H28Cr2+zirkxV3H48VczL+3iru X7eKuZv28VdzxVZxxVe3w4q5f8vFXcMVUmXJMFzZFDWKrWxbF2KreOKuVcVX8cWtrj/l4qu/18kl bkUN8cVdxxVfwxVTxbHYq3+1hVrArfHFWsVd9rFVvHFXf6+Ku44quxV2KrWxV328VW8sWTlbFVzc cWLsWTlXFiptiq7FWuOFWuOBVbFVq4qtxVb/AJeKrWyTByZFmv8AtYqsxa3PirkxbHfD+3irv2sV diruGFVjLga3csVdx4r8GLY7ji1u/wAjFWl5Yq3xxbHccVd+zi1qWLYuX+TFXf5GKu/18Vdy/nxV birsVdirStw+3iqx8VdirkxV2KuxVYy/Fi1u+39vFsX4q7FVJlyTBc2RQ5l/bxbFi4ta7FVL7CYq v44qs48FxVv48klT/wBTFVsjfz4qq8e/7eRQv44qsbliqlkkrm4YGaxvtcMVbXFVr/YwK22KrOOK uZcKrsVdgV2Kof8A18kwVMDN2KqOFg5MVdxXFW8WCz7Hx4qtxZuxVc2LBzM2KrcWbeLBb9j7eKtM 2LNT+3kUO4Yqt+J/jySXcMVf/9X7B5kNTmVcWC5cWbariwX8fixVv/iOKtccVXpiruGKu+LFVRcD c5sVW/Y+3hYLv2vgwM21+xira/bwK2uFW1/YTCwXcfiyLN3+XhVrArsVVP8AX+xhVbwwsHcf58Vc 3PFVyt/weRQtySVX7CZFC1W55JLXLFV2Ktq2RQ7j8OKr1/4TFVT/AIjirXw4q7jiqxW/bxV328VX Yq3yxbHKuKr8VcmKuxV32MVcq4q7nirXLn9vFVT7OKt4qtXFVTlirlbFVq5Jgu45Fm7j8WKr2XFV nLjiq7FW/hVsVaT7GLW2q4q1iq3i+SSvb7PPIoX/AOXi2OxVevwYqsxa3cufwYq5lxV2KuVcWxz4 qv8AtYq0uKtrhVpl44FXYta3ji2K2KrcWTmxYu5Yq18X28VbVcVXYtbf+virWLY7FW+OKu44q1ir sVdirfw4q74sVd8b4q74cVX4Vc+BrdwxVz4q77eLY7kz4q7/AFMWtTwtja4Fc3wYq19rFXYVVOPH Arv2/jxV32MVcv8AkYq5mxV2Ku4/yYq5fs8MVdx/YxVy88VdwxV3+Q+KuZe6YqvVsVWcf5MVdx+H 4MVc32cVdx/bxVUxVTVcVdwxVbwyTBdkULW+zwySVjYq3kWbbf5eKr+Px4qs5cPgxV3HFW/sZJgu +xkULP2cVXr/ACYq7jxxVTxbG+LccVd+1irWKuxVy4sluKr1bFi7/Lxa3fs/HiqlxV/jySVzZFmu xVauKrsVW8cVcuKuXFVvLFkqYsVHli1qnLFVnD9j9jFsc38mKt4VdgVa2Ktq2KrExa3cMVVMWxr4 sVWPi1uVsWxytirsVdhVz4Fd/wATxa1Jfb7eSSu/ZyLNzYtbuOKrGbFV7Li2OVWxVZkmCzl/PkWa 9lbFV2KrW+HFXfbxVbirsVW8cVXYqpt8WKuxVZ/kYqvxVd8XLFVLli1ub4MWxzYq1irsVWs2LW5P 8vFV6tirWKrGX4cVUmySV2KtfZxVcvx/YyKHfAmKu4/Diqky90ySVPFVTFWuORZu48MVb44VW4FW 8eWFXK2KuVcVXYFdhVS5Yqt44Wl3HFVr4q0mLNvFgp4q22Krl+zizWM2Kt8cWDWKrP28WbuL4sF+ KqSrwXFXM38mRbm+PDFrWPir/9b7B/FmQ47sWbXHFgqK2KrsVbbFXNiq/wDZxVz4q7FVRlwNzlxV ZxwsFZsDNdgV2FXYq7FW+Xw4Fd+1irlxVvJMHcv5/sYqu5Ki/wCXkULckldx5/byLNfy+Lm+LW1+ zw/bxVa2SS2q4q5lxVvFXNkULuOSSqrkULPsYq0y/DiqorYq1irsVdi2OxVvjiq9MVU/s4qqYq7F XcMVdiq/l8WKt4qtXj9vFXf6mKu44qqccVWtkmCpkWbf+pirWKtsuKuXFXcl/bxa1q/BkkruWRQp N8C88klUyKFRfs4tjsVd/kYq77eKuxa3fDiq7ji2O44q7/UxVU44qpriq7FVq/yJiqorccWtdi2L GVWxVfiq3FkprixcuKqjYq7n+3i1r/8ALxbHLy5Yq7jirl/kxVemKrFbFWsVb+H7eKuVsVa+1irf LFrX4qsVcWxf/l/YxV37fx4qs5Yqv4Yqu5YqtbjxxVyr+xiqyPFV6YVWceGBXMuKr+GKuxVy88Vd x44q7j+2+KuxVytiruGKu/ZxVy/DirvixVdyxVtv58VWcWxV3DFVzL/Jiq2Nv5MVU8VVMVd+1irk xV2Ku+3irvsYq7FVirirWFV2Fg1x+HIs3M2KtL9vFW2/nwqvTA1u+Dhi2OxVZxxVcrJix4HJivAt 4/t4snfDxxVrFXYq7FW+OKtYq3yxVZ+xiq7i+Kt8sWtrFW1xVZxxVyr+3i2OXFXLiq7FVrfz4q7/ AF8VU+OKrsVdiq5fh+3iq7FVPFWuP8mKt4q7FVvHFVvDFVi4ta/FVPFVThi2OZcWtZ/qYqtXJJdy xVd6mRQ5m/4PFXce37eKu44ti/FVH48Wta2SSuZcizdkmC3Is1y4q5v+Exa1NsWxdiqnwxVcuKre PLFXfs4q7lxxVz4qs44q5v8ALxVfiqn9nFrdi2Nt8GLWsXliq9cVWZJK9cihZx+LFVL7OSS1/r4q 2rYqvyKGuPw4qv4/DiqHb4ckl3PFV3w5FCjxfJJVFwM3cMLBT45Fm5lwq5sVXYqt44Fcy4VaZcLS sxZuZcWCxuXLFWuGLNvFg58VU8VaxZruXPFgsZsVXYqsXFmqMuLBSb+fIslvLn9vJJa5NkUKmKv/ 1/sJmQ4639rFmqLyxYO5fz4qq4s1nLFW1XFgvxV2Kr8Wa7AzdywsHcmbFVTIoW8cLY5lxVe2BXfs /HirfHCrXd8CuVfhwq23+RhYOVsVVMVU1X+TFV6x4q5fsYq1xxVvl/JiruPDFXfs4quZcihfxxV3 xcMVXYtjbfz4q19nFXYtbsVdirbNiq9VxVy/z4tixV+HFV6r+xirsVdx+DFVTFVq4q2y4qvXk/2M VaZf+DxVv4uWKuX/AIfCrvgwK7h+xiq/jwxV3HFWsVW8sVXq2LWsySVzf5GRQ5PsYqqfZXFsdiq/ 9rFVnxYq79rFrd9vFsVMVaVsVaxZN/tYsXenirX+Riq7FVvLFV2LWu4fsYti7FVvHFVnL9vFV7Li q3FVTFW/8vFWsVbZcVaxVUfFVnHFrdyxbHLirm44q1irv2+GKt/5GKr+P/B4Vdxb9j7eBXN8f+vi rv8ALxVyt/wGKu4/8Birv9fFXJirsVc3J8VdirsVd/r4q7FXM2KubhiruXP48VdirlbFXM2Ku+3i q9f5MVWf5GKr/s4qsTFXclxVpW54q39vFXcvgxVey4qs4Yq7niq7/LxVav8APiruPLFXL/PirsVX t/Pirv2cVWcv2MVc+KuVeLYqqYqpt/Jirvhxa3Yq7FsdzxVzfFiruS4q5v5MVd9jFXMuKrG5Yq1i rfH4cVaxVtsVWNirv8vFV2KuxVv7b4q7jirlxRwO5YrwLOPLniwd9vFscuKuVcVcn+Riq3FV3HFV uKtsvNsVWccVbVcVabFV2Ktfs4qvbFVnLn8eKukbFVmLW7Fsdwxa1zYquxbFJl54tbeLYsZcWtzM qYtjWLW77WKt/DxxVa2SS3kWbuaYqt44q7JMF2RZrft4q5fixV3LFVHniq9fj+xiqxlxVytiq/jy bFVmKrFXFV6Yq7FVjYtbv8jFsaxV2Ku+1iq3n+3i1rsVdirsVQ/HJJVGxVZx54q0y/yYq2v2MVbx Vr4sVayKHcfjwti18LB3HAzW4q2rfz4FaxVbw/Ywqt/yMLBd/JgZrsCofjkmCr8X7GLBZ6f7f7eK rHxVrnizdx/YxVtv5MWC/l+xiqg/2MVdirfLFWsVU2wNzatywsG2xYLOPPFW2bA3OXFX/9D7B/6m ZDjr+X8+Kr1xVrFXL/Jizd/kYq3xxYL/APLxV3H48Vdira4s0RgZqceFguX7eKuVcDNf8WBXcuX2 8VaxVy/bxVtVwq3zwsFyrgZrV54WDueKr+D4quX7PwZFDeKrcklr7WKtccVXrx48Mihf/l4q7lyx Vdiq3l+2+Kr2X4vgxbFkfxYta9sVcy4tjlX4sVc2LWv4YtjnxV3DFXf5eKu4Yq5VxVdyxVdi1uxb F37GKr+OLWoccWxUX/h8Vdx5Yqub7eKt8cVdx+LhirWKt/DiruXPFrW8sklv7H28ihv9rFV6/wAm LY7nirm4Yq7FXfYxV3DFrVMWx2Krv9TFVuKtLxxVpsVdxxVvj+3iq/jirmxVzNirlX9hMVdxxVyr i1ubFscv/CYqv+LFXccVc2Ku5Yq7j+xiq/8Aaxa1P7WLYtyTBW/18ihyYq7hirnxVTT7GLY7FVdW 4f6+KrG/k/bxV37OKuX/AITFXf6mKu54qvZmfFVnDFXN8WKuX7OKu4tiruX874q7FXN8WKu/yMVd 8WKuZvhxVcrfDiq34sVdy/YxV2KuZsVdiqzjiq9W4/YxVf8A5b4qs4/Hiqz/AC8VXqv8mKu+3iq/ 9rFVnxYq79nhirnxV2Ku54q7hiruXw88VdzxVeqryxVvFVrYqtVsVdzxVyrirueKub4/sYq7FXc8 VdiruP8APiq18kwW5Fm7FW1xVplVcVXf8RxVcq/DiqzjirlXnirWKqfLFkqYsW+WKtYqtb+fFXcc VdxxVdiq3jirlxV3LFVPliq7FXYqp/5GKojFVFsVd/qYq5sVczcsVbT7eKuZsVdwfFXL/Piqx8Vc zdkxV3PFXN9nFrWNiruOKub/AC8Wx3LFra+x8eKts3+Xi2O/18VaaPFrWyYqpti2KnHFV2KrVxVy txxVT5Yqt+3iqpirXH4sVWfbxVzLirsVdwxVZx+HFXcsWtemLY5MVWM3xYq038mLWtZsVX8cVWtk krV+3kUKjYqh2XJJXc3yKF7fz4qp/wCXirbf5GKqTfzvkku4Yq7FXcfgxVY2KtccDNdwTArsVbX4 vgwqs+PFXfHgVdi1qf8AsMkldiqny4YsGv2sWaxuLfHirl/4fFW/+J4sHYqs5Yq5cVaxVYzK+LNy 4q238mLBzKv2MVawNzXHFX//0fsFGuZDUrYsFq4quxVtcVX4q1+1izVPtYsHcsiyVsLYo4WCtgZr VXAq/jirv2cVW/Y+3kmDa/byLNdkmC7jxwM2m5cvgwNa74sUObly55JksP7eKqvxPzyKFq/yZJLX HFV3w8cihb/qZJKouKrl+xkUL1xVYuKrsVdirfH9tMVWJ/kYqvWP4v8AIxbGvs4q3xxa16YtjsVc rYq7nirv9fFXKuKuxVcuKqi4q5sVU+OKr+S8kxVtV/nxVbirmyTBVZeWRZuZeWKu/ZxV3xYq5vgx a3csVa+2+KrcklWb/IyKFi4tiq2KrXxV328WtyYq7nirl+HFsXM37eKrVXFVTFWlXFW8VXcsVWri yXYq7lixU2xVU5Yq77eKu44qt/yMkwVeWRZtYq2uKr1bFVnL4fgxVzYq2mSYNcuGBm7jga3L/Pi2 Ob/IxVe3wf6+FVPFW+OBV+Kr1/kxVY3xYqvX+TFVi/yYq7/LxVe3HFXfA+KrOeKr25I2KrP8jFXf YxVy/wA+Ku/y8Vdx+H4MVXfFyxVby+DFVTFVP4OeKufFXf5GKuVsVXqq8cVWJirkxVdyxVvl+3iq zhiq7j8PwYqt+xiq5sVW/wCpiq/7WKrHxV2KuxVyYqs+Ljiq/FV6/wA+KrF+NcVdX/LxVzfDiro+ OKu4/Biq5sVWs2Ku4/t4q74v9nirv+J4q58VdxX7GKuZcVU+aYtbsWxvjirlxVy4q7/LxVrFW+OK tYq23+RirXLFk7Fi7FW1+NsVdxxVrFrdi2LV+BeeKr+OKrOOKuX4cVdiydiqnyxYu44tbv8AXxbH Nirk+3iq3lz+xirv9TFV/wBj7GKu488VbxVr7WKrHxVzNzxa3cMVdy/YxbGv2PjxVvFVn7OLW5vj xVzL9jFXf5eLY7/Lxa3KuKu5c8WxZy+xiq7FVjfbxVby+HFWuWKq2Kofj+xiq5vtcMVb5fsYqsxV 2Ku54q7hirvixVZyxV37WKtYq3xxVrFrU2+HJJc2RYqmKW1xbFnw/wCyxa3ccWxyqq/Yxa1L7OSS q8P28ihS+zkkrOGKu/yMVdirsVdirX2/gTIs3cf2MVcy4q5mxVzfHirWKqeKrlxa12FsUmxVpvsY WlZirXDFm7FW8WCn9nFWsWbfHFW2xYLGZl+xira4G5b/AK+Fg3/l4sFPj/Pizf/S+w3FMyHHcuKr 1XFWsVVMVd9r4MVc38+KtcMWaqq5FDWSSuwM1zYFXYq3+1irlxVy4q19rFVzL+xkmDueKuxV2RYr uXw/bwtq1VwsEQqtkULP2sVa44q0q8MklpsVVVVcihU44q5cWxZyxa3csVXYqt4/8Hi2LsVVOP8A PiqzlirXJ8VVMVdirlbFXJirm/y8VXt9jFVXFUOmKrlxVU+PFXN8P28VdxxVTXFVzZJgqZFDf+pi 2O4/yYqsXFV/HFrW8ueSS3kUO/1Pt4qtySV65FC/jwbFscrft4q77eKub4cWt3PFVTFsa4pireKu xa1rYtiouKrsVdiqmuLJdirvt4sXLiruOKr/APUxa3Ni2NYq2zYq7jirmbFXK2KrGxVyf5GKuVcV XYq7FW2X9jFXccVbVf2MKrlXArsVdirlbFXN8OKuVsVc3/EMVXq2KrPt4q7i2Ku/y8VXsy8sVcn2 8VWYq5mxV3PFXK2KuxV3PFXfbxVen28VWK2KuxV3PFXYq5VXFVjfbwq3wwsHRq2Krv8AIwM3MvNv jwKtVckwVFZsizd6iYqtxVzfFirlbFXYqsZsVXsuKuVVxVcrfsYqt5fsYq7FXNzxVc2KqTNiq9ee KufFXYqv+x8eKqas3HhiqpzfFVn+Rirv2cVdx+PFXcMWtZ+zirXJ8WxbxxVf/kYq1irbfa4Yq5l4 Yq7lirWKuxVy/bxVvliruXf9vFXcfixVr4P28VWt/PiruOFXfHgVdiq3kmKrWxZLsVc2LFdhVS9P FV/x4GtT5YquxbGmXFWmxV3LFXf6mKubFXNiq3Frdirvsti2OTFVjLiruOLWsySV2RQ22KrWySW+ X8mRQ5/sYqp8cklrg+RZr/t4q7jy+PFXfY+3irmxVTbFVv8AqYqv/ZxV37OKrMVdirsVdirmXFXf D+xiruP/AAGKu48cWtZxxVzLirlxVrFW19/sYtjlb/g8WtY3w4quxVb8L4qp5JLfFMihrJJW/wCR iq37GKuTFVzcMihZ8OFsdxwK7jirl44qs5ccVU1xVWxa1JlbC2LOOFguxVZx+Hniwa4Ys3cuOKt8 uWLB2Kqat8WLNrFW2xVb8eLBvFmtX7GKu5csVbbFg//T+w/HL2LS4WldirsVVOeKu54q0v8Aw+RS 7hkmSpiq1cVRGRZrV/nxVf8A5eKu/axVrFWuWSYO/ZxVfy/nxVU5ZFCnwySXL/kYqqYqu5/sYq16 nDIobXJJWtkUNryxVd8SYqqLiqzjirmbFV/HFVnH4kxbHccWtfxXji2L+GKrFxa1/PFsU8VVMVdi rlXFXcMVXLiq7FWmZeWKr/sYq7l/PiqmuKq2KrW+L48Vcy4qv5fz4q5f58Vczc8Va4/t4taomKrP 2sVab/IxVUxbFnLFrX8MWx2Ku+3hV2BXYq5uGLW74cWxdyxVbybFVy4qt4YqqLiyXYq7j8OLFbxx ZNs2Kr8WK3/IxVdiq3ji1r2xbFmLJdixbVv2MVaxV2KrfsYq5cVX8eX+phVzccCtYVXfbX48LBr/ AFMizXqy4taxVbC2L2X4v58CuxV2Kr+Pw4qs/wBTFXf5GKuZf2MVcv8APirq/wCXiq/b+fFVn2MV XcsVdxxVbirsVc32sVdirmXFXL9nFXftYq5mb9vFV3+viq3j8GKuZcVdzxa3cckl3HFV2Kqariru Px4qrZFm19psVcy4qs48cVcvDFXc8VcmKqafYxVUxVyYqu44qtfFXMzYq7niq5V/YxVb+1iq7jir fwJiqxl4Yq7FV6/Hirl5IuKrGXFWlXhiq/jiq3FXJi1uxVZyxbG8kwdxwM2lwK7lirlXFXNirWKu xVtcVdyxVSZcWSpixb5Yq1irf+XirWKrfgxV37eLWuxbFPliyVMWK3jirlxVdiq3Fkp8cWLmxVzY q7liqtiq3jiqxlwqsb/IwNbsVdiruXxJzwtjsCub/hMVc3+R9jFVi4tbWKtt9r48VdJi2Ob+TFVn D9vFV7N+3i1tYti1lXFVnJMVXsv7GKrPs4q1/wARxVarc/8AXxVf9j7eKrMVdy5Yq7FVnHFXLiq/ FVn7WKtYVb44Faxa3Yq2zYqs5Yqv/wBTFsWcuWLWv+Lli2KXHJMFjNwxVd+3zyKFqrkktLiq3i/+ zxVdkUKXHJJX8MVWt9vIs3Yq3xxVY/8Al4q5vhwquwKo8cVa48/jyTBrjirmxVdxZeuLBZwxV3Ll iruGKrOPxYqtxZtcsWC7FXcvixZtYqs5YGaphaX/1PsRmQ47f+Riq/FVPFVRfhxV3PFVXi+KrGb4 cWbeKrsDNpvg+xgVWj+DFVn28VXr/PirfLCrS4FcrfsYq3kmC74OeRQuXFVvHJJXceP2Mihrl8WS SqsvLIoU8klUxVey5FDmXlirWKuxbG2xa3M2LY1i1tqvHFsd/l4q1iqo+Ku/1MVdwxVyr+xirkxV pfg+PFVXFVPFV/2ExVpV/nxVUZvh4Yq0qrx/y8VWquKr2xV2SYL1+Bsizd+1wTFXLiqz/Uxa1yfY xVU/1MVWMv8AweKu5YqsySVbhkWbkxV328KuTA1u+Pni2OVsVd9vFrcqriqpi2Lf8vFXf6mKqjYq uxVbiyXYsVPliyXNixc2KrsVdirsVbXFWsVdirsWtUTFVir+3iq1f5Mklf8A8RyLNrj8OKtcExVU fFVPFVZV+HFVrf5eKu482xVyYq5f5MVdirnxVy/Dirl/kfFXcvjxVz4q7FXPirsVcvxYq74/sYqv 49/28VWcMVaZuGKtvirvixVdxxVvg+KuZcVabFW+D4q5lb7eKtKvw4q2q4q3irXL4uGKr2/kxVYv HFW8VXcfixVZy/nxV3Ff9hiq39rJMGuGBmtb7OFg7j8GKrsih3w4qu44ti3iuKufFV/Hhirv2sVW ftYq7kvHFXN8DYqv+1iqzFVTFXYqp4qv/axVY3DFXf6mKuZeX2MVdi1uZsVUeOLY7JMF/LIs3csV axVU4YtaxsVczfFi2ObjirmxVe+KqeKuxVT5YslTFi22KrGbFV64taxsWx3H+TFXNyxV3HFXf6mK u44q7/ITFXYsl2LFR44tbuWLYuxVbyxVdirsVW8cVUcWtzccVVFZft4tjuX7eKu/axVyriqzjw+P FVmSYN8cVXccizcvLFVLjkmC79jIs3MuKub4f28Wty8cLYs+1gV3L+T7GKtf8SxVdirTN8Xx4qs4 Yq5VxV2KuX4sVd+zirnxVZ8WLWv4Yqs/axbF+KqP7PwYta9lxbFP4nxa20/y8VX8cWxZxxa1L7WS SqrkULcVa5fDiqkvH9jJJb+02RQ3iq18klaqryyLNuRVxVyt/JirX2cVWthVdiq1vhwKs44VWNhY LsVWYsF3HFVvPFXJiqxlxVrlizb44sHNiq37GBuWr8OFgvXFVvHFg//V+xGZDju+1irsVVOGKu+H FXKvDFW+OLNdirXJvt4qq8sihdi2OxVdywq1xwK74cVaxVUaT+fFVPCqpy+PA1t/aySVy8k+xkUN ZJLv9TIodkkqi8ft5FC37fwYoVMUuxVzLzXFVP8A18klUyKFq4qvVcWxrFXYq7FXJ9jFW2XFWsVV MVczdkxVfx+LFVnPFVTFV3LjiruXHFVNW/bxVU4/z4q5m/nxV3JMWte2LYv54qp8v5MWtbkkr1yK Hf6mKu/y8VWZJK9vjyKF+LYs5Yqv5ftviruPLFrd+zirsVXLi2LsVWrirmxVdirbNiybxV3LFi5W xVT44qqccVXYq7FXfaxV32cVb4/sYq5cVcvv9jFraZV44tjsVXLhVZywsG8izVGbFXcMVXq2Ktcs VWviruLYq74cVcmKu54quXFVr4q5v8jFXYq7l8GKu+3iruXFueKuZsVXcsVWt8OKubhiq9VxVZwx V3FsVc32sVXryxVpsVVP8vFVnHniq9Y8VU+OKqjfDiqnxxVv7X20xVvFVvHFVbFXYqpL/JiruP7G Kr+KYqpriq7FXYqu4/DiqmuKt/ZxVvFVrLxxVUXFVjLiqxl/bGKuTFV/7WKtf5GKrfj+3irsVa+D 7eKtr8OKu+Hj8GKu54q5V+LFXcMVVMVWtiq3l+3irueKu54q5MVWcvh4Ytblb+fFXK2KtcmfFW+O LY7lirmXFraxbG/sPirX2cVbZsVaxVuT/LxVy/yYq5cVaxVYq/t4o4FTlivAsVsUu5csVd+xiqny xVUXFXP/AJGKrsVWqvLFXfHirm/kxa1jfYxVzNi2NLirf2sVdx/nxVZirTcUxa28Wx2KuZe6Yq58 Vd9jFXNHiqk2SYNYq7jkUL+P8+LY7liqxsVWftYq3iqphVTwK7FXYqt5YquxVTb7WKu4Yqp/axVU X7WKujXFVjR4q5sVX88VWNirmxa3Liqz4XbFV32sVW/s/Hi2L/8AIxa1nqK2LYpNyyTB3+QmKqvL IoWZJipN/Pizc32sVc3w4q5v8jFXM3/B4q5sDNpf8vAqzjhV3LFW+SYq19jAqxsKubFVvHhhYN4q pt/kYq79rFW8WDkxVTbFm77D4qsb+fFXK3w4q5cVXYq//9b7E/6mZDjrE/y8VX8cVX4q7FW1xZt/ tYqqq2BmuwKtVv28VU+WKq32sVbb/LxVYzfyYquxVdkmC7lxyKFv28klU4t+xkUNKuSS3/kZFDsk lU5fz5FCnkkuX+TIsVy4quXFLuKYq5mxVyry+xiruXHFV/HFsaxV2KuxV2KqmKrFXFV/DFXcMVX8 f58VaXFV2KreOKqn2Pt4quxVS4piqrhVTVsLBV/yMizdyxV3LFXccWtpPsYq02SSq5FDlXFsdirs VdwxVf8AFiruXw4qs+LFXcMVVMVdirsVdiqnwxa1ZcWx3HFVv7GLJUxYrY/53xa12LYt44quxV2K uxVvlirvsPirljxV3+piruXD/Xxa1nHFsXYq7FXYqqM37eKu/wAvFXYq7FXYq5MVdirueKuxV2Ku b4sVX8v5MVWPiq1MkwXrxxVY3xYqu9P9vIs3NH8OLWu44tipz/YxVZy+LFVir8PPFXcV/bxVz4qv VsVXt8OKqbYqqcv2P28Vd8GKrG+DFV/w/sYqs/axVrliqozYq79vFXLiruf7eKrI8VX/AGFxVdiq krYq7m+KquKrVbFXfHirl/1MVXYqt+3iruWKrsVUVxVyr+xirmX4cVdxxVvg+KrOPwYq7j8XDFXc mxV3LliruGKub7WKr1bFVnDFXfFiqpiqmmKufFV6tiqxvtYq58Vd9r7GKu4/8Hiq1Mkwa5fyZFmv /wAjFrWccVWNi2L+PDFWsVWriq9WxV3H9jFWsVdirm+3irf+XiqxmxVzLirv2MVX/ZwqsbAqz9nF VXFVv2MVaZsWTa/Dixd8eLWp8cWxbx+Hhiq7/LxVzYq7/XxVtlxVY+KuxV2Ku+1zxVyrirmXCqly wsFXhkUKTf5eSS1irmwM3fHga3MuLY5mxVT44qrYVUmXArmVf28VbxVrm+KrOGKub4cVdy/4PFVP 7WKqmKuVsVdiqni1tti2O/y8WtZxxV3HFVy/yYq7FXYqs48vt4q20eLY5W44ta3l/PkkrOORYtNk mS1lxVf9rFW8VU3xV2Krciza45Jg3gZuxV2Krft4FW4VXYWCz/LwM1rf5GFgsb/h8VVPs4sHcueK ofFmqfDiqxcVdx+HFVjYq5cVf//X+xLfz5kOO5VxVrFVRMVd8OKrlbFmu/y8DNpcCqg4/wCwwq5V /wAvArvt4VXYq7Aq5f58kwa5cvt5FCt+1iqlwxQ7hkmS9l54qvbFVnH/AIbFVVuWRQ79vFXcf5MV U1xVWxVT+3kkrv8AIyKF2LY77WKqfD9vJMFX/LyKF/w4tixvjxVfirkxV3PFXftYq5MVa+D+bFV/ HFV2KqeKuX4cVVlbFVn7OKr2XFrdxb9jFsXsv8mKrPgxVe3HCqz7eBW+OSYNcfhyLNzLiqti1ufF sdwxV3+virsVdi1u4Yq5f8vFsXccVXYqpquKqmKuxV3D9jFk5uP2MVXcsWK3FV32MVWfY+PFV7Yq uxVvjwxVZyTFXLiq/wC18H7GKu/awq79rArWKttyTFrb44WxTbAqti1ufFsd9jFV/wC1irSr/Piq 18VcmKr3+3iqxlxVY2KqvHFW+X8+KrOGKruOKqbLkmC/9rFWl55FCpiq7ji2O44qptirfxNirv2s VX8f5MVUf2sVVMVa/ZxVf/r4qtxVtZOeKrOWKqiriqnxxVUZcVWN8GKr2/kxVbiq3jiqpy4tirlx VbirS8mxVeq4q5V+HFVnB8Vd9rFV/wDqYquxVSbliruXD48VX/EmKrsVUVX9vFW25Yq3iq3lirfD 9v8AbxVezfFiqmytiq3jwbFXceWKqmKqeKuxV3pvirsVdirv8jFXclxVz4q7i3HFXL/PiqpirS+/ 28VWcMVcmKu48sWt3L48VU8LY2y4FX/FhVYy4Fcq/DirvU4Yq74cVaxVvjirWKtsuKtYq7FVrYqu xVb8eKu/1MVc2Ku5Yqt44sl2KrcWLsVU2/kxVfx/nxV32PjxVpW/YxVtWX7GKrPsrw/bxV3L/gMV dirsVdiq9v50xVDft4tbfH4sklvIoVMVUfsYti//AC8Vd+1iqxlxa1vFMkl2RZtKuKr+KYqtxVTf FV7NireKqfHlirnxV2Ku54qp4q2rYq1irfLFrczYqsVcVczfFiq7FVrNiq7FVLj/ACYq3/qZJK5s ihS5Jkkt4qt4/BkUN8VT7eSSsxVzM2KqfLIs1/7OKrP2MVcy4VVOWKqa4Fc2KqPHJMHf5GKu5Yqt 54q7FXc8Vb4riwWNirXHFmv4YqsxYNsvxYq//9D7EZkOO38OKr8VdiruXwYqv5ZFkuwti5/8jArv 8vFXftc8KrsCreOKr1XFV6rhVb8WFg7FXZFi7JMlzYq5sVb4/D/qYq5fgxVdiwayKVy5Jkq/FkUK fxfYxVvliq7FW2xVy4ti/wC3iqzlirvhxVemKufFVitiq/FXJiq/j8WKtcsVc2KrsVW8cVVP8vCr mxV32/gwKvX48WtzNi2O+x8eKrP9TFW2XJMFy5FDlxVS+22SSq/s5FC9vgXFsXccVWpi1rOOKrlX hi2KitireKtMuKt4qtXFXccVVG4ccVdx/kxVdiq1WxVfx/nwqs44FXYq2uKrFbCq5ft4FVFX/Y4q sVeeLW77f+piq3l8OSSu4v8AyZFm7/LxV37Px4q2uFV3H48VU8CqjNirsVdiruTYq7k2KuxVyYq5 ftYq7nirv9fFV6riq/liqz9rFXftYqv/AMvFV2KuxVR5YqrYqp4qqYqtZsVWN9jFWvh5fBirarir XLFVTjyxVzcsVWMuKu+2mKr/APIxVdiq1v5MVcuKrOP8+Kr2bjiqxmxV0jYq7jwxV37WKr+OKu5Y qpriqtiqly+LFWvi4/HirfLi2Ku/ZxVvFVyriruWKrGXFV/x4q79rniqz4mxVzNiq/imKrcVab48 VUnyTBdT/IwM1v8Ar4WCniqI45Fm3+ziqzhirsVX/ZxVZzxVy/DiruPLFXK3w4q7/ieKr2bFW8Va X48VWcf28Vcy4tani2N8ueKrV+PJMFXhkUKX7OSSu/ayLNrFXYq1wTFk3ixbVvixVZ8eKrsVW8uX 28VXYq22KubFraxbHYqt44q5lxVZx/kxVvFV3HFrU+OLYqfYxVTXFVuLW7hiruGKu4Yq7jxxbGmb hiq1cWtyrirlxVZkkr+WRQ74uWLY1hV2BVqthVdgVay4q79jFVjNirS4q7liq3hiq/lhVzLgVQxV UxV3DFVPFVTFVPFW1bFXNi1tYqtZV5Yq5m/nxVf+1i2LPjxa1L4skltWXIoa48PjySVj4qsbFV7N zxV2Ku5LirmbFWm+D7eRZtYq1xTCrX+RirmXArmxVbhVbhYKjNgZod8LBzfz4q7niq/jiwW8MVUs WbsVVeP7D4sFi/5GKv8A/9H7E/C2ZDju44quxZuXniq9VxVyfbxVdy5fYwM2uWBVTlhVyriq9cCt Yq7Cqo3wfbwNa3JJdiruGKr1VcVX5FCm2SSqsq5FDeSSsxYL+ORZL29/t4tixsWtdi2LVxa3M2Kr 1XFWv2+eLYqJirvj+xiqxsVX8mxVTxVUxVzf5GKu54qu/wAvFVvL9jFVTFVy4q7jirv9TFV6/Biq z/UxVercm+PFVi/DhVd9rA1rcklU/wCI5FC3l/Piqp/qYqsZsVXr9n4MWxSVckwVcih2Ku5fHirl bFXK2LYrcsVU2xV3HFV2KrsWS7FitxZOZWxYu44q7lxwqvZmwK1irsVdira4q5cVdyxV3HFXcsVa xVUZueLW7ni2O54qsZsVX/6mKuxVTxVU+3iq7lirat8PDFVP4Pt4q3irlXFXYqqYqtXFXNiraf5H 2MVbxVcuKuZcVWN8GKtLiq/jx+xirf7P8uKqfLFVRl+LFVn2/jxVevw4qptiqo3w4q5/8jFV2KqX 7WKr2+38GKqf+vircmKr/T4fHirv8jFXcfh+DFXNxbFXLiq7FVFcVVGxV3HFXft4qs5fsPireKrl xVT5Yq2/28Va/wAvFW1XFV6riqxm4Yqvb4vt4qs4/t4qv5fyYqsb4MVbxVpVxVeuKu+3iruOKrPs fbxVeuKqa4q3ix4FvEYrwNcvjxZL15cvgxVZ8OKrP2cVX4qubFW+XPFVnH4MVXK3w4qtTFVTFWv8 j9vFVmKu5ft/t4q77GLWsVcWx37OKu/axVzLywq5l4YFaxV2Krv+I4qu48sVWcf58VaxV32sVdiq 3Fk5vixYu/18VXYq7FXYqp4qu/y8VWfZxa1/LFsU/wDIxa2/hxbHM2KrMVdirlbFrdwxV3L+fFXL /wAJi2Obj+3iqj9j4MVW/CmSYKnF8izdiq1m/kxVerNirmxVSXJMFyr/AD4GaxlwKs4Yqu44q7ji ruOKt/s4q1yxVbirsVd+1irsVc32fjxVZy/bTFWsVdiq1fg/1MWtr4kxVfirfH4sWxzL/Pi1rGxV 2SSpN8H28Va+LjiratiqzFVyZFCzji2NYq7FVjfbxVv/AFMKtqvPCwabAzcuBVn2sKu+ziq1Vb9v CwXcfhwM1LCwa/Y+DFW8VbxYOVuLYqp4q1izbXFX/9L7E/6+ZDju/wBTFV2LNft/JirXHFV2Kt8l +3/PgZtsvH4EwsFTAzVOPx4qt5YqtxVdhYLkyKFrNxXJJcf28VRGKqXxYq1yxVW/yMihTxQqKuKV qr+xkkrvjyKHLiqp/wASxVrlirWKuxVtcWxrFXN9vFVR8VcmKu54q7nirsVXf6mKrcVXcsVb+ziq /jiq7FXYqtZft4qvVVxV3p/z4q7j/JiqzlxxVtmyTBVyKFnHFVvHJJVUyKHc8Wx3+pi1u4ri2LP8 vFrX4ti9VxVvFVrYquxVauKqi4qt48cWSpixW8cVXYqt44qv+JvjxV3LFWvs4q3y4Yq1irsVa5ZJ g2vHIobZWwtjWBW2xVrCqpgVz4qs44q7jiq/hirl4Yqu/wAjFVvDFXftYq7j+3iruPHFWm+D4MVb X4sVX/axVYv874qv/Y+PFXcf8vFXft/5GKub/UxVe2Kqa4qqfYxVpvi+DFWsVXNiqxfgXFXKuKqu KqeKrvifFXccVcrYq5cVd+xirmXFVnFuWKquKrWZsVdxxVdiqniq7/IxV3HFVjccVabFVRVbFViq vLFVXFVFlXFV2KuxVa2Kq2KreOKqfHFVReWKu5fyYq77HwYqtxVdHiq7FVqtiq7FVFlXFW1bh9jF V/8Alpirv8vFXNirmbFVP/IxVUf/ACMVUeGKu4Yq7j8eKuxV3JsVXccVWt9nFXMuKuxVzfFirm/y 8Vdy/wCDxVcrfsYqt+xiqzjirlXniq9MVd8OFVPFXYFdirXHJMF//Eciza488VcrfsYq5cVdxxV3 LFXLirmX4cVWfsYquxVbyxV2LJ3LFi5lxV3LFXNiqxlxVpcVW/s88Vd8WLWqYtih+zi1r+GKu4Yt jv8AiGKufFrUuOSS3kUN8sVX88VUVxbF6r+w+FVjYFXYVW8sVWP9vAqzFV3LFV2KtM2KrOP8mKr/ ANnFVFsWtfi2O/ZxVT+1iqpzxVZ+1i1uZsWxrFVvLFrdxxVzNiruP8+LY79vFrUpPh+xkkt4q1+z iqzhiqr8ORQs+FcWxb9jJMF3Hm2BmsVeH2MCu+HFXN/l4q3/AMRwqtxVR44FVOP7D4qs44Vc2Kqu KoVmwsHN/kYqv+HFVuLB2Ku4YqprxxZrOWKv/9P7E8syHHX8MVc+KtcMilcuSZL+XDIs1/8AqYq5 cKtqv8mFg0v2MizXYq3y+xirfFckwXrx5Yq5WxVZiq9V5/HiqvkUOxVQ5ft5JLfH4fjyKFTliq9m 5fYxbHLiruOLW7jiqzFC3jkmSquRZr8VU8VbX+fFV/PFXcMVdiruLYq7FXJiq5cVdxxVzYq5V+LF VRmxVTXFV6/bxVv/ACMVX/6+KtN9vFW+WKtN/Pi1u/b4Yq2q/sYqv5fz/bxbHcl/bxVzN8WLWu5Y tjf2/gxVZwxVf9nFWuWKu/18VXYq7FXYq7FV3LFXLiq3jiyVMWK7jhVbgVvlirmb9vFXfGmKuVv2 MVd/kYq7/IxVzccVaxa1TFWlbFlwN4snK2Ku5cGxVYzYqv8AhxV3Ljiq7jiq37XwYq6Rf2MVd9ls VdwxV3+Xirvs/BirSx88VVPT4Yq74WbFXcfixVpcVVOOKuVcVU/iVsVb+HFXcl5Yq5eOKr/hfFXf 5GKrsVW/bxV3HFVP/XxVy4q5l/nxVU/1MVd8eKuZcVU+WKqnHFXccVXrirWKt8f2MVWKuKrsVW8c VczfFwxV3HFXckxV32/gxVdiq3jirvTxV3HFXcsVcv2MVczLiq7FXYq7FVq4q5V+LFVNcVVP28VW 4qtbFVRsVW4qu/yMVc38mKqar+3iqtiqniq1l/bxVbx/kxVbkmDlbFVRcizWqvw4qqYqpviruK4q v+38GKrMVdiqpiqny+DFXPiqzjirWKqzYqt/yMVWf5GLW5v5MWxrFW+WKrG5Yq5lxVfxxV3qc8Va xV2KuX7eKt8cVaxVTxVUxV2KreH7GKuxZO/YxYuZcVW4q7FWmbFWuOKrWXFXYq7Frd9jFXYqpMuS S1iq/jkUObFVvHJJWMv8+KojIs1nHFVjN8OKuXFVNsVXYqtXFW1bFWo/5MVb+2mKrMVVMVUFxVfw xV32MVdiqnirvs4tao3w4tini1qfHJJXNkUOXFXK2KubFXNxxVSVsklRbFURx/kyKFLhkkuZcVcr Yq5sDNT/AG8CrsVdwTFW2XmuKqTZJguVcizd/l4ta3jkkrft/YxYOxZuVcWCmrYs3Piq9sWDuOKr V+LFVLIpf//U+xirmQ465cVW88Va4ZFKrxwtreBV3+phVzLirmxVW/ZxV328VW4WC5l4ZFC1lySX f5GKu4/HiqI45FCkrccklV48sihSVsklVVcihdiruT4ti3li1rsVWq2Kr/ixVy4q7ji2L+XHFXfY xVyYq74sVdiruP7GKqmKqarirl+1iq7lira8cVVcVbVsVWcsVd/xHFXcP2MVdyfCq/lgV3L4vjxV b/kZJgu/y8ihy8cWx3HFrc3wf6+LYv8AsYq7FXYtbv2sWxey4q1xxVtY8VaXFV2LW7FsXKuKreOL Jy4quxVpVxVv4f8AZYsV3F8VdirsVWtiq/jzwqv+xga1Pj+3iqoq/tnFsdirsVc+KuZsVWcl5Yqu +D7GKrMVdiqpirvt4q7j+3irsVdwxV2Kr+PxYqsX7WKrlVcVc2KuXFV2KreOKu44qrYqt+xiq7FV qtiruWKrcVXK2KrOPDFV/D9jFV2KqX2cVVcVW/5eKuZcVcq4qt+DFkuZsWK7FXYq7liydixbXFWs VW8cVc3w4qv4/t4q7l+3irWKqStiqty/kxVrFVqrirmXFXNxxVy4quxVtVxVZiyc2LFyt8Px4q5V 5YquxVbxxVyr8OKrcVXccVXYqpM3DFVXFVLl8OKr2+D/AFMVcuKuX4cVWcWbpiq/l8PwYqos2Kq3 L4sVU/8AIxVtfs8MVWYquXFW1VW+PFVnDFXN8OKuWTnirm+HFV7LiqzFXftYq7FXfZbFXcWxV3Js VVMVU/t4qsb/AC8VbXCq58DW5lxVZ+1i2O4/sYq1ira4q1irbYqs/wAvFXM3/AYq7/IxVdirsVU+ WLJcy4sVNcVXYq7FXYqtbFXMv7eKuVeWKrXxa3ceOKu9Phi2KTNkmDbMv28izdwTFrU2ySV64qq5 Fmp8ExVv9nFWsVW/b+DFVuKtcf5MVbxVazNiqorfFiqnxxVdiq1cVUlbhiq98VWMuKr/ALeKuZsV WcsVcuKtYta39vFXfsYq74uGKr1+PFVFvf7GKuyTFrFm38SfYyKFrfHkkrP8jFXc8VWfs4q0rZFm uxV2Kt8sVawqt+L/AIHAq/8Ay8WtQ4/z5JiqYs1JcWC7FVL9nFm5lXFVTFVNWxVUZuWLBrlir//V +xatmQ1OxVdyxVd8XH4MWC7A3KmBVvLFV/8AqYVWft4FXqvHFW/sLwyTB2Kt/sfBkUNZJKqrf7PI oWf8Jkkts2Kr1xVdkWLskydy5ZFDl+HFV6tirXL4cVW8cVc2Kr+Pw4tjuOKub/IxVf8AbxVz4q7F Xc8VVMVdirS/a+PFVn+Riq5sVVF+HFXR4q5fsYq5sVcrYtbuKti2O/YxV3HCruH7eKuVuWBV/Lh8 GLW1irS5JK7iq9MizX8MVdyXFXPi1uxVUxbFvHFV2KqeKqmKqmKqa4sl3HkuLFdiq1cVXYq7FW+O Kr+X7GKqPLFV2Ku+1irbfHi1r154tin9nFW+OKr+GKuTFXcMVc32cVcvw4q7jyxVz4qqYqppirlX nirsVd/r4q5vg+3iruXLFWl5fYxVf/l4sYN8eeLJyriqz9rFVZlxV3x4qsblireKreOKqnH+TFXc sVd/qYq5uWKub+fFV2KrOT4q2rYq7lirv2MVWKuKr1xVy4q7/IxVfyxVZx5Yq5sVX8sVWfBiq7FV uLJ3+vixczYquxV2Kt/5aYq1irbNxxVrFVrK328Vd/r4q77Hx4quxVay4q74MVcuKuX+fFXccVW4 qqYqtT/LxVT5YqqMvxYqs4q+Kt4q0q4q5WxVeuKrOXPFXN9jFVXFVPFVzYqp8sVdxxVdirX7WKqX DJMGvh5ZFC/4sWxzL3TFXcMVc3DFXYq19r/UxVtl/YxV3DFXYq7j8eKufFV68cVWLwxV3w4q5mxa 1HJJXsrZFm5lxVvjhVbgVb+xiq9cVd/kYq1irsVdiq1eWKu48sVXYVU+OBkuxVTXFi2zYq5VxVZi q9fsYq1xxVcuLJbxxYrWbFXf5GLW5MWxTxa2/wDUxV3H4sLYvTA1rGXFWuTcfgxbFTFVn7WKrOLL irmxV3HFXccVU5P5MVdxxVamKufFVTFVPnirm+HFXYq5V/kxVZ8WKu44qvZsVWfFi1tYq7FXYq7F Vv8AkYqp5JLSryxVyyYq5WxVzNkWKznkmTv9fFWv9TAzc3+XgV3LFWsVWtiq7FXYqp4VXYWCnirf LAzU8LS7hiq5m5/6+LNy+/28VWs2LB2Kv//W+xbNmQ1O/wBTFV6/YxVdiwXtgbnK37GBXcv5MKu/ YwKv+HFV+KrW+zzyTBcuKrf2sixVOK8cUqjYqoq37eSSuxVUxVdx/nyKFPjihcuKXcP28VcuKu44 qv5Yq5VxVpft4tjfLFWuT4qqKuKuxVTxa1T4sWxUxVr7f28VaXFW/tYq1yxV3LFVT9rhiqmuKq2F Vv8AsMCr+Xw4qt45Jg1irsVXL9vIoabJJXNkUNYqqcMWx2KrFxa1fFsab48KuZcCquKqLYquxVcq 4q5cVXYq7FXYq36eKrFX4cVXYq22Kr/8vFVnHFWuL4q7FXYta9u+LKDb4slP7WKqmKrlxVa3xLzx V2Kr+PxYqs54q79nFXPiq9vjxVZ9vFXftYq7FXL9n4MVd+ziq7JMHKzZFMG/ixZOVcVbxVpVxVVx Vaq4qp8cVVF+HFXLiq7FVvH/AIDFVNcVX8nxVv8A18Vd+3iruOKu44q5VxVdiq1cVdiyd+3ixcq/ DzxV37eKu5YquxV3HFk22LFYq4qv+HFXMuKubFWsVWtiq77WKrVXFXL/AD4q7/X+xirvhfFV2KrU /wAvFXfbxVdiq3n+3irsWS7Fi7FVv28VXYq7FVvHlirlxVdiqkvwYqv+PFVuKrv8hMVWcvhxV3Fl 64qvVcVW4q19rFXK2Ku4/wAmKquKqTNirmbFVnDFXf6mKuX4cVczft4qvVW44qs+3irsVd9jFXYq 5f5+eKu4Yq5VxVy/DiruPLFXceDYq77eKuxa1PFsc38+LW7C2KnDA1rP9fFVjL+3i2L+OKtYq2rY q1irsVWtirlblirsWTsVXYsVH/LxVv4f23xa2uWLY7liq7FVvHFVvL/g8VU/2OeKqmKrFXFrd/qY q79rFXLirmZsVd/r4tjWKuxV3x/7DFXYqt48cVd/kYq74WXFV2KofFV6rireKqeKuxV2Ku54q7ni qz9nFrX4tin9rFVPjkmC5lyKF64q1iq3j8WKu44qpfB+xkkuZsVd8OKu5YsHceGLNr7GBm5mxVYy r+3irlwK7lwxVyrirWFVrYFW4q1xwq5fjxVrCwWcMWDvhxVfizU/2f8ALxVvFg58Vf/X+xmZDju4 tiq/Fm5sizVFwq2uFg3gZts2BXcsVbTJMF3PIoW8v2Mklc2Kr1b/AIDIoWf5GSS38WKttkUKnL4e GKrsVW/YxVfyxVYn+Xiq7Fsdi1rVxVerNirWLY7FVThiruPwYq7FVPFVf9vnireKqbLirkxVey88 Vd+1irXHFXNiqp8P7eKrsVW/6mKu+J8VXLH/AD4q7l/Ji1t8cVdx+H+bFWuXxYq2uKr0xbHcmxVy Yq5ePHhiq/j/AD4q5eKYq3irsVWqzYqrYqptiyVMWLsVW+niruOKrsVdirfLFV6riqnirfw4q5cV X4tbv9fFsc+Ku/1MVdirl+LFXYq77GKuxVf8WKrF5fsYquVWxVay/wCRiruXLFV6riqzjxxV2KuV fhxa13HFVqYtipirsVXfbxVZ6eKu/axV3+WmKuVcVVcVW/sYqtxVd8S/YxVzK2KrsVbVcVWNiq9f 5MVc2KtYqt+DFXccVdyVsVdxXniq7FXYq2uKu44q1iq1sVXccWS1cWK7FVuLJdixWtiq7FXYq7FX Yqt+PFV2Krf28Vd8GKr+OKrGxVdirsVWtiq/lirWKrePxYq74P2vt4q5sVXYqt44q5sVdxxVyriq nxxVyr8OKt/t8MVa/wBfFW+KYta/li2LFb4eGKr1xVz/AORiqz7OKuX3+3irpPs/Hirv2PgxVZzx V2KuVeLcMVXr/PiqzhiruGKu/wAjFXcMVc3w/wCVirm/nxVzM2Kr/tYqotiq/FXJirueKqPp8cVX tiq/l8GFVPFW/hwK5VxVT5Piq/7OKtrirmXFWuX7eLW3yxVYzYtjlxVdiq37GKrsVUf+JYta7FsU 8VXcsVVOWKqL4talxySVX9v48izdy5Yqt/4ji1tLirlbFXLiqzJJd6mRQv8Ah+x/Ji2LOOKu5Yqp rirvh5YqqKuKrOD4q5uWKuX/AC8VWJirsVcmKu/axV2KufFVnLFrdxxbHcfixVrFXYta1sVXYqt/ y8VWf5b4q1Gv8+KtceeSS5Pt4q02KreP7GKrnyKFv7OSSp4qv48Mizdx/bxVZ9jFVq5Jgu+DIs1N sVXYVW4WDsVczYsFPFmsXFV7fZxVT+1ir//Q+xnFUzIcdcvLlizabFVbjkWaouFVuKrfjwKv+1hV vhhYOTFV/FVXFXKvLFVy/wCXkULeWKF32sUu4/sYqq4qtXFV2Kttiqxv58Vc3HFXcsVc32MVXYq7 Fsb5cMVcvLFV74qp4q3y/nxVfiq9vgxV32sKrOTYFVMVU8VVvsYq7lxxVazZJgq/6+RZu5YqsT9j FV/xYtblXFXfFirv9fFWl44qqN/kYtjl+zirvh/bwq7/AF8Cu+LFrcvw4ti5sVdyxVtf5MVVcVdi q3jiq7FVPjiydixVVXnhVrArfHFXfFirWKt8sVd9lcVaxVUTFrd/qYtjsVdwxV3H+fFXL9rFXcMV cy/sYq7/AC8VXccVW/s4q7/UxVz4q5VxVyr8WKu54qu/18VWsvdMVcq93xa17Li2Nf6+KuXFVRcV WM2Kr/gxVdiqkrYqv5/sYquxVazNxxVzNirv9f4sVd/wmKuZVTFXcfhxVdirsVbXFVjYqpriqtir sVd/l4sluKrsWLsVdirbNiqxmxVdiq3Fk7FV2LFrl/PiyXLixWclbFV3LFk2uLFZyxVtmxZN8sVW rixd9jFV2Krf9TFV2KuxVay4quxVvlzxVY2Ku44q5vhxVyt8WKrPt/bxVVxVazccVd/l4q7in2MV d8P2MVd/l4qp8cVb4PireKrlxV3+viqx/t4qv+H7GKrsVdirsVW8vh4Yq7jiqnyxVdirTLiqzjyx V2Kr2+DFViYq5f8AIxVZyxVey4q77Xx4q6v+Xirl+1irm+LFXcMVd6fxYqsbFXf5eKtquSYLviT4 8izU8VbVcVczYq1irfHFWvtYqtbFrU+OLYrYq7FVuLJdixU8WtbyxbF2KuxVT4YtbsWxyYq7k2Kq a/5eLW3yxV3+Ri2OX+TFV+LWo5JK7Is3Yq7FVJPt4qv+PFXft4q5lxVbiq1cVc2KrsVU/t4q79rF XJirlXFVP9vhiqpiqxsVcy4q79rn+xi1qXLlkkqvw5FDmxVYy4q748VU8kldyxVaytkULW+HFVvL 9jJJdiqzlzxVczZFm1irsVa5fyZJg3kWa1cVWM2FW8VawtLsVWM37eLNy8ft4qtTFVTFX//R+xmZ DjqmKrVXFmq8fi+DIs3ZJg5ft/HgZr1wK1iqpzxVb6a8ckwX8f58VXtiqxmZcVd9nFWlxVWxVdkU LVxVy4q74XxbHLi1rsVW8cVX/tYtjWLW2y4tjm/nxVrFVT/XxVyYqsVsVVVxVdiq1sVXYqp4qrKu KuVsVcq4qv5Yq1irsVcv28VWt8OKr+OLWsySV/8AkZFC/l/Ji2OX7WKuVsVcmKruOKtsuKt4q7FW vhxVvFraVcWxvFVTFXYqt5fFiruH7eLW7li2O5YqrYqp4qtxZL+OLSsb+fFsVsWtyYtjsVd/qYq7 hiruLJirv9TFV/H4v5cVWYq7k2Kr/wDLTFVjN2TFXcMVdirm+LFV/wBpsVUskwXcWwM1uFgq/DkW buPPFV6rxxVdiq1WXliqxfjXFXcfixVrjirfwfbxVf8A6+KqbYqqcsVWL8eKr+OKrsVW8sVXYq3y xVrFW1xVrFVvHFXYsnfYxYu5fDiq9sVdyxVrFVqrirmxVfyxVZyxVc2LJ2LF2Kt8cVaxVbiyXYsV uLJfxxYuX4MVcuKrMWS7Fi7FW2xVZy5YqvbFXMuKrP28Vd9jFV/+viqzjxxVdiq3/iOKr/sf6mKr OWKu48sVcuKu44quxVa2KrPsfHiq9sVWL9n48Vc3wYquX4fgxVb8WKu/axVy/YxVr/IxVUXFVuKr eP7CYqqK2KrcVa5cMWtrjiqnkkuTFV3PIs17/wCR9vFVmKu5P/sMVd8P7GKub7WKuVsVcvL9jFXP iq5cVW4q7/LxV3DFrUv9TJJVf2cihYvHFsczYq7jiqxvixVdirl/kxa2+WKqDcf2MWxU44q7Fk7F V2LFSVcWtvFsdiq1sVWtyb7GKuZWxV2KuZcKrOOBraxVvjiqzJJXM3FeCZFm3x4Yq79nFVjYq7j8 OKt8Uwq1ywK748VXYqp4qtVf5MVb5virXLFVuKrP2cVX88VdiqxcVX4qsZuHx4qsZcWterYqsbl+ 3irv8jFV2KrW/kxVS/Y4ZJLbceWRQ03x5JLbcuORQ3/lviqlzySV3PIoWccWx3LFWsKt/DxxVrFV qr8OBV2FVPFVuFg7FWmVfsYqsTFXf5GKr/s4q//S+x68syHHabFVfA3LVX4sCrW+L7GSYLuOBmu+ 1gVcq5Jg5lxVcy90wM225YWDTYq232MVXN8LUyKFnHJJdyxVUZmxVzLkWKpil2LYtVmxa12LY7FV vHFrXqq4q5sWxytiq/8AyHxV3+pirsVcv8+Kr1/nxVZiq9fjxV3Fl64q3iq77eKuX4fjxV3+Ri1r /s/AmLY1irbYq7ji1rlXhiq1sVWZJK/4eWRZr+GKu/Z54qv+1iqz7bcMVdzxVc2Kt/s4q1yxVv4W +xirS4qu44sl3LFiuxVbyxV0eKrvtYq3+1iruTfYxVpo/wDLxVvjirWKt/5CYVd9nFV+BXf5eKr1 bFVP9j4MVb+z8b4q5v58VX/tfzYq5fgxVZirsVdxZ8Vc+Ku4/t4q7FVyr/Pi1u44qp8MklezYqvy LNr4sVXqrYq5cVWfDiq/lirXJ8Vb+F8Vd8eKrOP7GKr+XLFXft4q79vFXfYxVzNiq/liq3i+LJvF it+xirlb9jFV/L1VxV3HFWuWLJ2LFtcVaxVbiyX8cWLmb4cVaxV2Kts2KubFWsVb/wBf7eKrVbFk ub+TFi02LJbxxYrsVW8cVcuKuXFV64qsbFXccVX/AOXiqxm/YxVdirbNiqzFk77GLFzccVXccWTs WLsVW/5GKu+z8H7GKuVVxV3+pirlxVdiq37eKrsVUuTfYxVWXFVFePH48VX/AAYq748VU+WKrsVV MVUeWKqi/wAmKrP8hMVX8sVcuKrcVXf5eKrcWtRZsklzLiqr9nIoWN9rFsc38+Ku5csVd/r4quZv ixVbyV2xVUxVTjX4cVd+1iruX8+KuTFXc8Vcq4qsZW+PFXfFiruOKqS4slT7OLF2KuxV2LWtb7XD FXf5eLY79jFVqtyxZLv9fFitxVrj/PireKreOKrUxV3PFrcyti2Obj+3irmXj9jFVJskwX/8RyKG mbFXf6+Ku/axbHf6+KrGXn/qYqvXl/Jiqz4ft88VWr/PkmC5lyLNbirXH9jFWlbjiq7FVrYqtfFX Yq58VWN8eKu/axV3LFXf6+Ku/wAvFVjNyxa3NyxVzL+3irv2MVdxxVR/18kl3HFV2KqjZFCn8PLn irsklT4Yq1x+LAzdxbjgV3LFXP8AYwqs44qs5c8VX8sCrGwqt+HCwdy54quVv28DNSwsF3HFVuKv /9P7IN8H2MvYtYWC7Is1TCq3liq7mmBW1/YfFW1Vskwd+1irsVXq2KtLirfxfY/YxVVbIoUeOSSu xVWyKG1X9jFsWM3/AAGLWuxbHYtbatirv8vFXKrYq5cWx3+v9vFWsVVFbFXfbxV2Ku+3iq74eWKr sVWsv7GKrsVaX/IxV3L9jFV/+pirl44qv+39jFWsVW8fhwqv5YGtr7WKuxVv/UxVfi2ObhhVyYGt 2KruOLY39j4MVaXFVv2MVVuOLW5WxbHYsnYqt44quXFi7jirlxVdirsVXf8AEcVW4qtVeWKrsVbj xV3LFV/LjirsVcq/sfsYqu/1MVczfsYqpfFiq/lxxVe3HFXM2KrOTYqubFVvHjiqn9rFVdeWKtf6 +LW7/UxbG2+PFWmxVUVcVXYqtVfi54q7jiqzj/PireKqmKrVxV3+Riqxm5/Hiq9cVXtiqxuWKubF V6tiqzliq9VxVYzYq5VxVdirsVb44q1iq3FkvZcWLXHFk7Fi7jiyW8vhxYr/ALf2MVWNyxVfxxVZ xTFWuXL7GKt8cVdiydiq7Fit/wBfFVy4sm2xYrFXFV7Yq7j8WKtYq2uKuX/LxVrFW2bFXNirWKrW xVdirsVbbFWsVWtirmXliq7FXYq7FVrfFirmxVzYq77eKu/yMVXYqpfs4q0uKtr8f28VXtiq3FVz YquxVR4/sJiqp9tsVWfB9vFXcvi+DFWv8jFV2KqmKqP+Xiq18WtbkkrnyLNzLirviRsVcvH7eKub +fFV/L9vFVnDFXYq7/LxVf8Ab+DFVnH9vFXcf28Vc3DFXYtaxm+LFsaxVv8A1MVaVv2HxVv9nFXf s4q0zc2xV2LWt5YtjuXHFXMuKrsVW8sVXYqp4q7FVNlxa3YtjnwqqYFQ+LW3xxVy4q77H28WxzLi ruaYVc2BXKvw4q1hVb8PL48CubFXKuKrP2sVd8WKtcsVbb9jFViYq7FVi8fsYqv5NirsVdirlbFV jfHirWKt8cWtZyxVb9vFC5mxS7JJd/r5FCizft5JK7g+RYqbfyZJk5WxVcq/DgZrcLB3w4q0rZFm 1hVvjgVYy4q7n+3iq3FWlwq1hYN/tfHgZrFwsFvw4q5mZmxV/9T7HcuGZDU3iqp9vIs1/L+TCruO BVn28VX8cVb4tkmC7/ieBm5V+HA1tqq5JKqrfFkUO5Yq7/Z/BiqxvgXFVvFuWSSv+PFVTIs1vLFr XryTFscy4taxWxV3wYti/j+3irf/ABHFVytirsVdirkxVy/FirsVVMVUv2PjxVe2Ktr8eKr1wquw KtyTBbyxVVZsDNzf5GBV/Ff28VUuWSYLviyKF+KqStkkqrL/AMLkWbueFVka4FX8MWtdyxbFuKrm xVdiq5P8vFXYsnYq5lxYrcVX/wCRkmC7j/JkWbXx/t4q7FXYqsXj/Jiqpx4/b+1irmxa3LiruOLY rfZxVZzxVy/Firv8t8Vcy8P9TFXPiruP/B4qs/Zwq1iq58LByYqu+3kWbv2sVWrzyTBUbIocuLY3 9nFXepiqriq3/LxV3L4sVWceeKuVsVXq3w/Biq7FXYq7FVrNiq3FVy8WxV3wpiq7FVv2PjxV3LFV 2KuxVav2MVXYq7FXYq7FXf6+LJtsWKzFk7FV3NMWLsVb44q1irarirWKu4JirXH9jFku4/Dixdy5 4qp8uX2MVX4q7FW+WKtcnxV2KrVbliruWKr25Yq1irsVb5YqsxZO+3ixXYq2rYqs+DFV2KreOKrs Vdiq1WXFXL9jFXfbxV3+XiruX2MVc2Ku/bxVyq2KrsVU8VW8cVVOKYq5uX7GKqfLFVRm44qsX4MV aZvhxVdiq5W5fHiqzj8WKr/8jFV2KqLYq3+x/kYq5eWKt4q18OLW6TFVj4tjSrwxVv8A18VdirsV d8HPFXKv8mKu4/sYq7nirsVdiq9l54qsxa1Hji2L+WKu/ZxVrFVvLFV/H4sVc2KrGxVzYq74uGKu XFV2KqbYsl2KqfHFiuZcWTsWLTNiqxvs4tbueLYvX/IxVR/ZxVyti1uVeOLY03+Ri1uxVtftfBi2 OZsVU1+3i1r+aYtil9rFV/HFV2FVv+vgVZx4Yq3irsVU8Vd/qYq7FXcMVdiqzl/JiruP8+KtP9jF Vv8AqYta74/28Wxby/4PFrXYqpyfz5JK3FVT/LTIoUvh5YoVWxSh0ySXcfgxVdkULeXHJJaZsDNv 7eFg0v8AJkWbX2sVW/t4quxVv4cVUsKtLiqzjhYLeGKuxV//1fsfmQ1NquBmv5fz4q3x/bwsF/8A xLIs2m+1/l4Vcy8MCubFWsKq8eBrWr/JkkuZcVa4/t/sZFCt8X+xxVa38mKF37GKXf5GKrsVW8v2 JMVd8X7GLY5vhxa3N8WKu44qv44tjWLWqc8Wx3DFXf8AEMVdiqxeLYqqtiruWKt8v58Va/1MVXYV aXk2BV/+pirv8jCq9eWBXcsVcq8PsYq74cWtYv28kltv8vFV3LIoa+1i2KnPFXfFi1u4Yq7FsXry /wBnirS4qqf5GLW7ji2OVsVdyxVy4quxVtsWtfzxbFnH4cVaX7eKqisy4qsb+fFXNiq/kq/Ywq7n ga3Yq5v8jFsdiruGKuX7WKuxVzLiqxv58VX8lfFVvPJMF3HFVTIoa4/sYqtZcklZwxVV4/5eRZr+ OKrFjxVey4quxVS+P9jFVXFVrLiqmuKu44qqclT7eKu/yMVd8eKrsVW8cVXYq7FVn7Xx4qvxVtcV Wcf+AxVyt/wGKr/ixVzcsVcrYqpt9vFW8WS9sWLWKuxV2KuxV2KtMuLJcuLFYy8fgxVdxxZLcVXY sXfaxVzYsm1+PFi1irsVbX48VaXFk7Fit+x8GKr2X4cVaxVauKuxZL+WLFZ/lviq7FXYq3xxVY/+ Riq7FVrL+xiq7FXccWTf+XixcuKrPt/Birl+L40xVdiq34nxVdiqxft4q5ft4q3+3iq7FVvHliq7 FVv28VczYq1+18eKtYqovkmCo2RZqjYq748VczYquxVS5fz4q77OKr/gxVTbFVv+Riq9f28Va44q 5l+HFVvHlirvhXFXJirkxV2Kr1+xiqzFXK2Ku+3iqpiql8H2MWtauLY7jirXJ8Vb4/z4q1irbLir mXFXLiqxsVcy/wAmKqa4qqNirsWS7Fip8cWS3jixXYq7FVjdMks1NvgyLWvTFsd9pcVWccWtay5J LuX7GKuZcVXcf58izd/qYq7liruWKrGxVZ+ziq9cVd9vFXNirlxVT5YquxVTb42xVTxVUxVTxVUT FXf6+KrF/wAjFXf5eKuZsVaX9vFrW/HirmXjirXF8Vb44qpckySWmxVb/qYq74/sYq7FXK2KuxVp v5MDNrFXYFXNhVT5YGtdi2LeOKrOOFW1VcLB2BmtwsH/1vsd9rMhqVePHIs3fsYVVOOKtceX+pgV a2SYKqr+xiruP7eRZuXJMG2VVbFW1yKFytkkrP2cVVGb4eeRQ1+3kkt8cWCozft5Fks44qvbFXcs Va+1iratirWLY7FW+OKr1/yMVd/xPFXf8QxV3FsVcq/DiruTccVVMVdiq7lyxVYq4tbuXDFsX/Zb hiq/jirS/bxVv4sVaxa1uSS7FW2xVUXl9vIs17YqtZcVWfDi1rWySVX7eRQuXFsdyxVU44qt44sl 37GLFdirf2PgxVYuLWv48MWxzYq7jiqzjiq/9rFXM2FW2xVrjwwKvVsVdiruPHFXMuKuVVxVzKuK uTFXYqtZckwdiqvxyKeBbivAv5YslnH4cVd6eLW5lX9vFV/wYtinyxVv4cVX8fixVTVeWKqn2MVW bfz4qvXFXccVWfbTFV/28VXYqt5ccVd8eKu+xiq7FXYqt+PFXfBiq/liqz/LxVfxxVyrirl5Yqsx ZL2xYr+PLFVHFk39rFVzYsW8WSniq5sVbbFi7jirWKt8cVWYsl2LF2KrcWTsVdirsVXquLFb+ziy XN8GLFy/F8GKtfaxV2KrcWS/lixWYsl/+Rixc2KrWbFk3ixdiq3FkvXFi1wTFXYq7FW/9TFWsVdi rf8AkYqs5YqvbFVJv58WSo/2MWK1l+LFXccVcq4qv44qs+DFXccVc38mKubFV2KrOXH7eKtYq1x+ HFV7Lirv+JYq7liqnxxVdiq1sVVOf7eKrcVab4MVabFXKrYquxVT5N9jFVzYq39rFViYq7hirm/y MVXM3xYqtfFWmbhi1rOL4tio+FVnHhgV3LFXMuKrOOKuxZLWxVV44sXN/kYqsXFXK2Ku44qtb4cW S5f50xYrcVdiq3jiq7FVN8VWf5eKr/sYqs44tbSfYxVtWxVa2SSu/wAjIs3fs4q74cVcqriqzjir l+xirmX/AIDFVNsVVOWKu9RsVWfZxVytiqzhiruGKrOWKr2+LFXKvD/XxVy/5eKrOWKr2+BsVdi1 qeKtq2LY1iq39jFrcq/DzxV3HFXZJKzg+RQpfa+xkkruP8mBmtfCwcmKrpF+L4MizWceGKtYqp8s kwXcvhyKF2LYtbFVi4VawsFrYqv5YGb/AP/X+ya5excrLgVf8OFXN9vFXL8eKt/DhYKi5FCn9jJJ cv8AqYqv/ayLFcqsuKVi5JLbYsFXIpc2KV2Ku+P/AGGKtrirWKt8cVWLiq/jirX2cWxtsVcq/Diq /j/Pirv2sVczfFirsVdiqpiq1l/kxa1bFsUuXb9vFVXFVq8sVX/FirWKttirv2cWtevw4qh/28kl U/4lirfLv+3kWa/nirkxVYy4VX4Fdi1rmZsWxbi1qy4tjvsYq77GKrsVdiq3lyxa12LY2vwrTFXM 2KrPt4qv4/sYqs+zkmC9vg+3kWa/l+3i1rFxbF7L8WKuVfixVfx+LFVir8WKu+P7GKuTFV3w8sVW r8H2MVVuPw/Hiqmy/wA+Ku5YqqLiq7FVL4sVcv2eGKr2xVyryxV3+RiqmzfDiq7FV3Hliq3FrXL/ AD4tjm5Yq5sVXYq22Ku/18VaxVbxxVy4q7lirvsYqu5YsnYsW2XFXLiqzFkvXFitb48WSrx/YxYu /axVZ8OKtLiyb44sXcsVbb/UxZNccWKzFkv5YsWsVdirsVXL/PiyW/ZxYu+1iruOLJzYq7Fi18WL Jfiqniq9sWLX+viyW4qvX/LxYrGX4eGKr+XPFXccVWYsl7R/Fixcq4q5W5YqsxZOxVdixdiruWLJ 2LF2KuxVbiyXq2LF3LFWuWLJvlixWcf248VczYq7/XxV3HFXMuKrsVW8sVcuKub+fFVn20xVfx/b jxVT/wAvFVTly+3iq3FVvHFW+b4qvVv5MVd/r4qpriratiq9l5Yqs+LFXftYq5eOKu+x8GKu+HFV nx88VdirkxV2Ku4/BiruXwYq6RcVX8eTYqs54qp4q3yxVzNirl/nxVrFW1xVri+KqfHFkq/6+LFQ bFVT9jFV2KuxV2KreSYqo4tapi2LVxVU44qor8HwYq7j/wABirsVWcsWtfiqkrZJLfH+fIobVcWx f8OKrJGxVZxxVyr8WKu/YxVZwfFVXFVrYqpriq7FWuP8+KtcsVW4q5MVWN8K1xV3HFV+KrOWKu44 q5v58VdxxVTb7eLW2/8AkYq5WxVzNiqmuKtcskxbZf28iyU8klc2KreGRYu+3kmTX+vkWbmxV3H4 cVWccVc3L7eKqfHFVTh+3hVavxYWC3FW1wM3/9D7JrlzFy4VXrgVrCrat8WKt4WDv+IYq7/iGKoh lyKFrLihplxS2328kxXcsiybyTFc2RZLOOKu/wBTFV/LhirWKtrirvsfBi2NYq2v+Riq/FXYq7/I xV2Ku4s3wYqqYq7FWl/yMVX8sVU+WKu/y8VVG44q5cVX8sVdyxVzM2KuVcWtzccWxpuPH4MWttcV Vv2sWxYvDFXfYwq7Arvt4tbueKqmLY0y88Wtev2MWcHfsYpd/kYquxVaq4ta9sWxrFXYq7FXYq3/ AJeFXcf5MCu5Yqv/AGuGKu+FsVcy/FirsVVMVU8VXK37eKt/abFXM2Kr3/y8VWfs4qv+3iqxuOKu b/IxVy/z4q5pMVXriqxWxVe/+Xiq3FVTFXYqpce37GKquKqXN8VX8cVd8eKuXFV2KrVxVdiq3jxX FXfbxVevL9vFWsVW4snf6mLFfxxVrFXYq7FXYq23w/Birv2sVa44sm+WLF3H4sVWYsl/LnixWYsn YqrYsVjYqtVsWSrybFi03FMVW8sVXs2KqOLJdixVMVU/sL8eLJtcWK37OLJV54sVuLJbixVMVU8V dyxZLcVXYsXYqqL/AJGKqOLJezfsYsXKuKt4slPFV3HFVuKr+OLFZxxVdirsVdirsVdirv8AUxZL VxYuVf2MVd8K/YxVzYq7l/JirmxVdiq39jFXNiruWKu5Jirm/nxVZ9nFV/x4qsVeP28VXsuKu5fD iqxW54q7j8WKquKrG+3iq1m+3iq/48VU+WKt/tYq0zfyYqtX7WKqmKqeKufFXcv2MVdzxV3L4eeK u4Yqs4/Fiq/FrWNi2OZvtviruOKu5fDirlXFXf5GKuZv2MVcvx4tbWLYtVsVcuKuVsVcn+Riqnxx a1bFsUv2PjxVvFWuOFViYGtzfFi2OfFrWLiqzJJXyZFCzli2L2+P7eKr+P7f7eKrGXFrUOOLYqfs Yq7jhVdgVtWxVQ44qt/yMVXNirv9fFVr4q7iuKqeKuxVUxVzceWKu54qp4q7FrWqvLFXcsVd8GKu 44qotkkttybIsVVsUqLZJLf7OKrfibIoaXnkkrmXIs1PFWuWSYN4Ga1sCuXFVNcVXYVW4WDsVf/R +ya8svYr1+DFXL8XwYFd/l4q2vwLkmDsVX8uHx4q7jw+DFWuOKr1bIoVMkxaxZu45FDuH7eKr1XF WsVW8cVc2KuVsVXquLY1irl+3irvtYqqYqp4qqYq5MVX/Dirm/yMVa44qrYqt44qs5fsYqv4s2Kr 1xVrFW1xVy8sVdx54tblXFV+KrFXFV/PFsXLiq3FrdwxVyri2KmKtN8GKtccVVGbFrXYti1sVcvH 9jFVuKruOKrsVbVeeKtfaxVbz/bxVU/ayTBy4Ga7A1u+xi2OxVzfyYq5v8jFV/ZMVWcV/bxV3DFX YquXFXNiruOKqjNiq7FVL7OKtccVVsVdiqlt/Jiqz4Wxa1bl8PPFsd/kYq5sVU+WKq2KreWKqatx xVUX4cVXYqtVsVVP+I4qprybFXK3w88VcvxYq7jirlxV2LJdixW8sVXYqtX+f9vFV/H+fFXLiruO KtNiyXYq0zc8WLWKruGLJ2KrWxVpmxVtsVXfYxVbixdiqo3w4qp8sWS5MVXYsXPiruX8mKqOLJUV f5MVXYsVi8f58VcrYq1irv8ALxZOxYt8ueKr8VU8VVGXFXPiql9rFkq4sVPFXccWTsWLmxZLcVXY sVRV4r8eKqfHFk7FitbFV2KuxV2KrVxVf+1irWKrVxVcuLJ2LFbxxVdiq1cVXYqt/bxVdirsVdiq 3j/JiqmrfyYq2qrxxVf+3irm/nxVbiq7jiq3FVzNiqxmVMVd+zirS4qrYqpMv28VWPirvt4q5lxV czfFiq3hiruTYq5W/kxV3+viqzjiq1m45Jgu45Fm74cVczYqvxVY3wYqsxZL1XFi1iq3lhVzYFdi yWriq7lixU2xV3LFV2KuxVTxVzNi1u+HFsUmyTBvIodirfFW64tjWKuwq3y+HAruOKrPifFXcuWK rGbhiqrhV2BVPFWl/kxVyr/kYqsxVdxxVbxbFXfbxV2KuxVTxa1RlxbFPFrdiruaYtjsWtayrxxb Hf6mLWsX+TFVvH4ckly/A3x4qs+xiq/9rFWlXIoWfFy+PJJayLNtsVdxxV3+RiqxmxVbiq7l8WLW pP8AbySXfs4q/wD/0vsjl7Fcq4quwKu55Jgu/ZwM1qYWC9f8vFV64quxVRZf2MVVsVcq5FC7FW+O KrPt4q7liq77WKrV+HFV7Yq1i2OxVU4Yq7FXPirvhxV2KuVcVdzxV32ft4qqYqtXFW5GXCrlbAq9 lxVeuKtYq2y/YxVzYq5fjxa1rZJLv8jFVzZFC9m/YGLY79rFXYtbsWxeq4q3irT/AG8VaXFrVsWx TbFk7FiqYqtX4sVX8cVa+zirfL+fFXcufx4q5lxV37WKuXFV6Yq74/sYq58VczYqu/1MVWj9jFXc MVXr9n48VWfa/bxVd/kYqqM2KrGbFXcUxVe2KrcVXccVd+z8eKrOPBuGKr+SYq5cVcuKu44q5Vb9 vFXN8OKqf+Riqp8eKrsVWp/l4qu+ziruWLJbxxYtcX+3+xiratiq/lirWKuxVav2eeKrsVbbFWsV dxxZO44qtxVev2f8jFisxZOxVWZeGLFT44sluKqyrixU+OLJdxbFV2QVyYq58mxUcWS7Fi2uKtNi yVMWKjiyVsWKjiyXfZxYtfFiybxYt/s4q3iyU8VXYsVThiql8WLJVb/h8WKxV/bxVrliybVcWK/F VJfjxZNYqrJixU2xZOxYrcWS9cWKzFkv5YsXLiqzkrYqvZWxVrFWv2sWTfHFVvLFiuxVaq4quxVt sVWM2Kub7GKr/wBnFWsVW8cVXYqt+xiruWKrsVW/BiruWKub+TFXNirv8jFXL9nhirmVeOKuVsVW fDiq9mxV328Vc2KqPDFV7LiqxW7PiruP8+KuVcVdxXFXYq7i2KuZcVWpkmC7/IyKFPFW+OLY1irm Vv28VbbFXf6+Ku/18VczYta1VySVnLItqpixWtiqmuKrsVWtiq7FVPFVPFrVOGLYp4tbfHFXccVd +ziq1VySWlb4cizXtxXFV/w4qoyYqs+zirTYq7/LxVdiq7jiqzg+KtMv7eKuXFVrfDirnxV3w/t4 q7FXYq79nFVv/EsVW4tbf+Ri2O5c8WtZkkubjkUKatxxVpmySWmX9jFV7NkULfiySWv8jAzWt/Jg alTJMlHAzdira4FWcsVd9jFXLiq7FrUW/nTJMWvt/Bizf//T+yf28vYu+DAq/l8OKuXFVTli1LV+ 18eKV+SS2zZFDXL+fFCrkkLviyLJT+HjihtcUrsVW8cVcrYq5V/bxVfxxVYrYqvXFsc2LWv54tjk xVzL3TFV/L9jFVmKrlbjirmxVWxVavw4q5cVWfs4qv8AgxV2SYL/APUyLNytiru6Yq1wTFW1xa3c cVdxxVevw4tjvt4q79v4MWtUxbFqr+3iruWKq2Krf9fFrd8eLY7jiruWKqfHFVbFXYq3xxV3LFXL ira4Vd/xLAq7hi1u5cPt4tjuGKu5ccVdy5Yq7FXK2KuxVy/axVr4PsYq2q4quZeOKqjNiqzl8OKu Zea4q7jwxVvFWm5csVXsuKuT/IxVY37eKquKqS/C1cVVmxVZyxVy4q5cVXtiruWKu44qs44quxVt sVaxVazcfjxVe2KrGVcVd/qYqvVcVaxV2KrcWTsVXNirfJU+3ixaxV2KuXFku/4lixXM3/B4qs+H IMl+KufFXYq7/IxVZxxVysuKr3xV2TYuVf5MVUcWTsVVsgrkxVbk1U8Vdiqpiqniq77OLFbiyXYs VR8VU8VXL8f28WS7hixWcefwYq1iq5vhxZNf5eLFvFkp4quxYrcWStixU/s4qtxZLsWLsVb44q5s VWYsl/HFi1iqn/r4sl3/ABLFi5V5fBiq7FVq/Fiq/liqz7eKubFXfbxV3HFV2Krft4q5l/bxVy4q ptiqo2KrsVWMq/7PFW0/y8Vcv++3xVTbFW1XFXfs4qvX7GKrOKYq5V4Yq5vgxVpm/YxYzcy8cWTa /wCRiqxmxV3LjiqpiqniruPHFXJiqxmxVrgmKttirl5YqsyTBdkWbfLFWsVb/axVrFVrYq5fhxVd iq3/ACMVWftYq3irsVXcsVUW4Yq5MWtz4tini1uxVv8AyMVcuKu9P9jFXLy/2GLY2uFWuOBXccVW ccVcuFVuBV32PjxVY0eKu+zirTK2KtsuKrOGKruWKrXxV3DFVjYqvxVTxV2Kuxa1vLFXP/l4q7li q3/UySWuPw5FCxcklfx/YyKFvHnkktZFCjkkqjNiq3Is3YtbTNxySVy/z5Fms44qp8sVVsWtbkkv /9T7K5exb+LArvU54q3kmDvg4ZFi58kyX/tYq5viauKt/abIsVyrkmSpkUN/Fiql8P2Mkld8KZFD vjxVdirsVbZcVaxbG2XFrdxxbF+Ku4Yq7FXYqvVeGKt4q7FV3H4eeKu+DFV2KqTf5GKr+PFsVcq/ Fiqt/r4qs/y/2MVcuLW5VZWxbFL9vJMFT7WRQqN/l4tjl/yMVc+FXJga1TFsdirTLiq9ft4VWKuB V/7eKubFXfBiruWKuXFV6rirmxVrFW1bFXfs4q5lxVe+KuxVcyriq3jxxVUxVpm4Yqs+LFXL/l4q 7/IxVfx+HFXN8fx4q5f2OGKt4q7FWuKYqv8A8tMVd9jFXcfifFV2KqTccVc3x4qq4qt44q5sVc2K uxZOX4cWLuKfbxV328VX8sVaxVv9nFVmLJeuLFy8ft4qs5YquxVtcVcvwYqsZlxV2LJU+LFVv+vi q7FV2LFYy8sVW8f2MWS/FXceWKu/axVtMgxbxZLOOKr/APIxVZxxVe+KrGxVfirXPFit44snccVX q2Ktc8WLeLJrnixWq37GLJfiqz7OKrl/yMWK3liyX4qsXFV7cMVcq4qs/wBfFXKuKt8f5MmrXH9v Fi0uLJbiqt/kZBVjYq74cmxaxVtcVaxVzfD8GLJtl+HFi5cVaxVtsVdyxVrFW1xVZxxVzLiq7FVv HFXLiq7FVrfz4q5WxV2LJdixW4snfD9jFi7lirsWS7Fi7FVv/EcVXYqtVcVdz/bxVTVvixVU5Nzx V3+XiruWKuZvhxV3LFXfsYqpN0xYzdx/kySGkyLN2KufFXN9nFVzYqtXhirm+zirpF5tiqnirfHh irWKqmLWsbji2NYq2uKtYq038mSYN5FDsWxZ+18eKttiqm2LW5V+LFsdyxVdirsVW8sVWsv7GLW5 V/YxbHc8WtTxVrjkkrmyKGsVb/1MLY5mbArXJ8Vdiq3j8WKub4sKqa4FbZvi54VczYFa44q5cVd/ xHFVv+pirsVdirsVcrYq7niqni1t8sVa+N8VWsv8+Kr2+PFsWccWt3x4q5cVUf8ALySVqYq5lxVz 4q5fs4qub4cih2KrFX+TFsaxVtvjxVrFVvHFrcy4q//V+ya/EuXMV2KuX7eKrvsZJgv+zirXw8sV b+1irS4qvX4Mihf6i4q0q4oabFVXli2u/wBfFrWq37eSSuXIocq4qvX4sWxTxVUxV2Kub4PjxVzL irsVcmKruOKrcVXr8eKr/wDIxVbiq1sVVsKuwKqYqp8XxVb/AKmFV7YGtzYq5l5YtjuOLW5f58Wx ezYq5v8ALxVy88VXquKrVXFk3yxYq2KqbYsl2KrsWK3/AC8VcvxYta9cWxr7OKtr/JirfLCqnhYK v2MingbfFk7hiruTYqu5Yqt+19vFXYq7hirlXFXftYq6NcVcmKrm+1wxV3LFW/j/ANhiq/jxxVdi q39vFV2KqPHFVRm44q74MVcrfyfbxVzYq3x/nxZNcv58WK9fgxVY2KubFV2KtrirlxVzYq1irsVa /axZN4sVvHFV2KuxVz/YxVbiydiqomKrPtYq3xxVU55BXYq5vhxVz4q5eeKuxV3PFVnLFV+KrFxV emKu54q7nirueKubhirsVc+KuxVTxVUxVY2Kr/8ALxV1P8jFXcMVaVVxYtt8fwYsli4qvxV2KuxV zf5GKu/18Vdx+DFXcv5MVaxYrMWSo+KtJixWq2LJvhk1abFi1irsVbbFWuOLJvl/l4sVjYq7/XxV diq1cVdxVsVXfaxVv/LxVrFXYqtbFV2Ktriqzliq7FVrLiruX8+Kr/ixVZxxVyriruWKrsVWq3w4 quxV2KrV+1zxVdiq1lxVYvLFV64qs4/Y54q74sVdyX9vFXfAmKuX7GLW1/xLFsW4q7l8GKqmKqf+ XirlbFXf6mKu+xiqniq9V4YtazC2OwK2zYq5uOKtfaxVvlirWKuxVay4quxV2KrW+HFrU2xbG/t/ BirXLFV2KqbLx+xhV3+viqmn2MCtMuSYLlbIoa5fsYq2zYqpceWSSu4/FkWao2FWl/y8CuZcVWL/ AJH2MVd8eLW7/UxbHfbxVbirsVdiq1sVW8mfFXc8VdzxVyrirlbFVPFXYta1sVXYqtXFXK2KqT/b ySWuWKq2KqP+Riq1m/bxVfx/kxVrivHIoWvkkrcizdhVv4m+3irWBXYVdgVbxxV//9b7LNlzFzYq 74sVb55Jg77eKuxVc2KuXFV+LB2KquRZLcUO+3il3HFXL/Pi2L1xVy4qv54q7jyxV3DFXYq7lw+P FXYq5MVVMVdirXwfsYqq4qtbFXL/ACYq7imKuXFV6rirlbFXf6mKrf2ckwd/r4q0y5FC/umLY5Vx VVVvhxVRxVUZW44VWphYKnLIs3Liq18VRCqvx4q3xxVY3xYVXYFbXFXcf2MVdxxV3w4q77Xxpirv 2sVX4Va+D7eBW0xVUxVTTFV3HFW/2PjxVY+KuZcVc+Kt8e37GSYKnLIpg38L4slHl/Jiq7jiqp9h cVXYqpcueKuVcVVcVW8cVdyxVy/YxV3+pirl+1/k4qvbFWsVWtirsWTS/bxYr8VdirsVb5fFirXH FktxVdyxV2LFb9vFV7Yq1irv2OeKtt9nniq37OLJV+P7eLFbiyXJkFaTFi3iyd/r4qsbFV6Yq7FV PFVTFXJiruGKuxV3DFXcMmxXccVW4q7jz/18Vc38+QZLOOKu+ziq58WK39rFkvTFXcf2MVd/qYq7 FXYq7FXcMVcmKuVcVdzxV3PFXMuKu4Yq79nFXYq7FXcMVWLxxVfiq3JqtxYrsWTsVWfZxVV54sVH FkvbFi1irfH9vFVnH4cVXYq7FXcXxV2KttirWKrVxVevwYq1xxZOxYrF+xiyX4sVrfFiq7FVvH4c VXYqtXFXfBirmxVy4qtxVr9nFVy/bxVfirsVUeWKqjfB/qYqtxVpv8vFXcfixVZ/qfbxVdxxVbxX jirv2cVc3FlxVzcMVcvJMVc3DFV/FMVQ/LJMFzcvsZFm1irsVVMVU1+3ira4q1iq3j8OKrsVU+Pw 4sm2+3ixbX7GLWp8cWxdirX7WKt4qp4q58Vc+FVnHA1u/wAvFV6/5eKu+xiqxlxbFi4qv/18Vd/l 4qsb+fFXcl/Y+3irvt4quxVSkxV3xYq02Kt/DiqzFV7LiqznirsVWceHwYq7/XxVpvt4tbsVdiqx VXFV+KrWxVSZsklzNirv2sVa5Yq2vwYqsxVzNiq3Azb4/wA+BXccVcrYq1hVrimKt4Ff/9f7Lccu aXccWxf9vCrmb+TCwWftYGbaYWC7jiq7lkULvgySVzcvt5FC1VySVTIodirsWxarYta/4cWxytiq 5W54q2+KuTFXYq7FV/xYqsTFVTFWl44qvbFXNiruOFXLgVf/AK+Ku5Yq1iqzly+xireSYLsih37H PFscq8lxa1T/ACExbHfbxVdyxVS/axVfi1r1+PFsd+1iq/Fk7lixdyxVeq8FxVrFXYq38WKtcXxV 3wfsYq2vwYq5cVc2LWvXhi2O54q5ueKuXhiq74eWKrcVVMVWriq34f8AYYqt4ZJgqcsizVGXFVnH nireKrmbFVnLguKr+XL4MVXYqt44q1+18GKt8/2MVcq4q7/IxVdiq3jirsWTl+HFi74MVcuKr+OK u44q7lirWKuxV2Kt8sVdxxVrFXYq7jiycuKtsv8AJixX88VW/wCpiyXcMgqniqov8iYq7FVnLFV/ DJsXfFirvs/YxVbwxZKir/JixW/bxVbiydiqniqo+Krvt4sVzYq3+ziqzFXYqtxZLsgrsVdk2K3F kuyCuTFXZNi77bfHirv+IYqtfFk2q5Bi39vFks+HFV/DFVPFVTniruKt8eKrP9TFV/DFVjYqvxVp V/YxYrMWTsVXf6+TVpsWLlxVy4q0uLJy4q7FiqJiqzlirWKuxV2KrcWS5cVa488VXMuLFYy4q7Fk uxYrcWS7Fi7FVrNiq7liyW8cWLmxVdiq1sVdyxV3wYq5VXFVPjiqorYq77C4q79rniqnxxV3LFW+ PPFWv8jFW2+PFVjcuPDFXf5GKrmxVavx8MVX/tYq7l/JiqzlyxV2Ku+3iqxlxVzLx+DFXftYq1+3 zxV2KttiruOKtYqt48cVXYqtbFXN9jFVP/UxVdiq1sVWsuKu4Yq74WxVdxxVbI2FVnw4Fdyxa3cc Vcrf8Birvt/6mLY7l/PirWKrWXFXccVdw/YxVYrYqq4qtbFVFlxVUxVa2KrcVWcsVcuKr/2cVWcc VdxxV3HFViri1r+OKrPsYq6Pk2KqPHJJVPsYq18WRQpZJKpiqnxwM13+Xga1vPJJW5Fmt/1MWtfx +LC2KbfDhaW+WBud/qYq/wD/0Pst8OXNLlbFsbb/AC8kwa+1gZtphYL+Pw4qr5FCjkktLkWKr/qY pWrkkqmRQtxQuxbVTFVnHFrczc8Wxfx5Yq79nFXK2Ku4Yqv5cMVbxVTfFV/xYqvXFXfs88Vd8T4q t/yMkwXf5GBmuwK7k+KuxVyfYxa21bFVmSS5sDNfx4YGtcrc8WxvFXPhVyYFdwxVUxV37X+ViyXc W+2mLFy4quxVz/YxVtcVWP8A5GKr25fYxVYq4qv4/t4q1irfL4ueKr0xVY2Kr3xVYuKr8Vd+1iqn iqomKu4/BiruP8+Kr/hxVy8v28Vc3+XirmbFWlxVdirTcsVXcmf7GKrP8vFVT9vFXMuKu44quxVb /l4quxVauKuVcVX8sVd8OKrOP7cmKrsVa+1iyaxVdixdirsVbXFXcf28VabFk5sVdyxVr7WKtYqu xYqitirueQZO/wAvFXYqsbFV/wBjJsXf5GKu/ZxVyt+wcVcmKuTFXJirv9TFXJirsVdirueKr/2c VWcMVdirsVc+Kr+Xw4q02KtryxVZzxVf9rFVmKufFVTFVv8Al4qtb+fFXf5GKuxVyriq3hiyXZBX cMVUcmqpwxVcvDIK7nirsVdwxVTxVUfFVn2cVb+z9jJq02LFZiyVMVU8Vdirf2cVXLixWYsl3LFW vhxVc2LFb9rFkuZcWKxsVXrirWKqfHFkq8sWKz4MVXYqtXFV2KrcWS7Fitf/AC8VXYqpKuKuZsVX r/Piqm2KqnLlirmXFVP/ACMVb5fsYqq4qp4qu/yMVU2xVUVcVUW+zirmXumKuZsVd8OKr2b9h8VW KrfsYq7lxxVzNirm+P4MVWfH9jFXNiq3lkmDeRZttirWKuxa1rYti7FXYqtXFXNiqnxxVby+PCru P7GBXMq4q5l/bGKu4/Birl+zirueKqeLW79v/IxVUxVZ3TFsWsv8+SYLuORZtYVW8f2/28Cr/wBr m+KrOPLFXcsVcuKrsVU8Va+ziqxvtYq5MVc+Ku54qp4q22Ku488Vdxxa2sVW/wCpiq7FXYqhP2Pj ySVbl8ORQq4qo5JKnzxVe2RYrMkya5fFkWbm/wAjFW2wq0y8sDWsVf5MLYuxV//R+yuXMVy4VVVb A1qS88kleqt/s8Va+LjirmX9jFVy8lyKHNiqtx+LFW2+PFXcv2MWxY38mLWv/axbGsVbZcVc2Kr8 VczK64q7FXYq7FV/2sVa44qqKuKu+wuKrFbFV/LFV2Kts2Ku/wAvFV/7WKqPHji1uySV2RQ1yySX Lira/wA+RQqfYxbHYq7l+3i1uxVUxbFTFXYqpM3NcVX/AORhVbz/AGMLBUyLNtcVaxV2Ku5pirl5 YtbsWx2FVf8AY+PAqznirlb4sVd/kYq5MVdy/nxVzK2Kr/8ALfFViyt+3iq5sVbX+fFWuWKrsVXc uOKu+PFXM2Ku/YxV3+XiruXw4quxVauKubliq7FVvHFVzMvHFW1XFWsVdirsVc2LJvjixWcsVXcc WS3jyxYrsVW4slbjxxYqeKuxVy4smuPPFV3LFit/ZxZLlxYrMWSsvxZBXfEuKuZsVW5NVXj8OLFZ /l4q7FXYqt54sl32MWLuP7GKuxV3PFXK3w4q7hiq3niyXc8WLsVWquLJUXFi38WKrMVdirnxV2Kr +Pw4qs4Yq7/UxVz4q7FXfFiruGKuxVcuKrft4q7FXfabFXfbxVa+LJdwxYu/axVbzxZLv2uGQVT4 viqpiqxcVaxVvjk2LvixVrFVuLJ2Kr+WLFzN8WKtYq2zYq7jiq37WLJrFV/L9jFis4/yYquxV2Kt suKrP9TFXfYxV3+piq77WKu+1iq3FkvXFi6RlxVYzYq7liq7FVrNirlxVzYq7lirmxVbiq5fhxV3 LFVNm+LFVbFVJeP7GKrOXHFrc+LY5uGKuZcVXLiq1lxVpV4Yq2v+Riq/j+xiqzhirm+1i1qeLY38 XLFVmSYLuL5Fm7FXYta1sWxytirlxV3HFV2KqLYquxV2Kqb4tbsVdi2OfFVPFW+WLWt/aySV3+pk WaxfsYtbmXFV/LFsaZl44q7FVP7eSYOyKHYti3jiqp9tcVW4q0y4q3iqHxVU54q74sVWfY+3irv9 TFrdxxVYy4q7/XxVdiqmy5JKxvgxVtcihUZeWKqX2/jySWmxVR4ry54qqM3w4q7/AIlkWbTfbfFX L/JhVzN+xgVZ8eFV2Kv/0vsty/Yy9i2zfsDCwcrc/wDXxVV+D9vIod+zirv2cVd+ziro2xVVxVv/ AFMVaX7eKt/5eKtfaxVUxbFjf5GKu/b+DFXKuKr8VdirsVdiq/7WKuZcVWPiqsuKu+39vFVn2cVV cKtsuBXM2FXep+xgVyrirXL9jFrdirbf5GLY7lxXFrdy+HnirlXFV/Hji2O+3iqmv8mLWrLi2Nqu KtLiqpx5LirvsYquxVbyxa12LY3+1irlxVrFW1xa1nNMkldgZtrgVevw4quVv58VW8uOKr2bn9jF ViquKu/y8VcrYq79nFXYqrK3xYq5sVd8eKrF+PFWmxVy4qqNiq3FVzYq5l44q7lyxVTXFVTliruW KrsVU2+LFkqYsXYq22KtYqsVv+DxVfirsVbbFWsVW4slTFXYqtxYrcWS7Fiu4YsmlXFi3iydirmX FV2QVTxVUxVUybFTxV2KuxV2KuTFXfs4qv49v2MVdkFWfs4sl/H9vJsXP9vFXLxxVZ8X7GKuxV3D FXPirsVcy4q7FXPiq5cVU+GLJdixc+Ku4Yq7FV/H4cVWfYxV2KuxV2Ku/wCIYq7FXJiruGKuxV2K uxVay4sl2QVrl8GLFvFks/18VX/Firm/kxVa+TVbixdiqorfyYqp4qqYqpriyb5YsWsVd/qYsnYs XYqtbliruWKuxZO/1MWLv9TFXK2Krvs4q7mmKt8sVaxV2Kt/DiqxlxVdiq3ivPFWl+3ira4q5lxV 3H7GKuXFVjLiqriqiuKqjL8OKqf+piq1skwXr8GRZu2/nxVZ8OKu54qv4tyxVZx/kxVev2MVWcv2 8VcmKu5cGxVZ8OFWsCuxVb9nJMFPjkWau2KrOSsuLWuxbFPliyVMWK37eKrcVdirTNiqzFV/7Xx4 qs54tbsWx2Krf+JYtankku4/D8eRZr2X+TFrczYq1i2KmKqeLWtySXccizU+WKqn2MVcv8mKrOPP 48VWYqvb4MVUMVVExVzc8Vdiqz/Ixa2sWxtlxa3fs/Hi2LOPNeeLW74MVc2KrPixVvFVuSSt/wBf FW/hxVZwxVc32sizW8v+DyTBpWyLNrFXYVb/AGcVf//T+y3w5cxVfs4tSnkmS5cVVMihY3x5JK7F gvbIsneouKr2xVRZsVVcVb44tjmb/g8VcrYq1irfHFWsVbVsVX8v28VX/B9vFWuX7aYq7jirbNiq /liqz7OFV/HAruPHFV/7OKtYq7Frb44q03+XirsVW5JK7IoVMWxyrirueLW5VxVUxbGm44qsxVWV v2MVXYqtxZLOXw4sVXFW2xVrFXYq2vHFXMuKuZsVd/l4VdywKvbnirsVdx/bxVf9v48Va5Yq7jiq 3/Xxa3c8WxWVcVd+xiqxvgxV3+WmKt4q0ys2Kr+OKu5Yq5V44q1+18eKr8VUm+zzxVey4quxVvji rmxVZ/r4qv8A9TFWsVbVcVaxVv4cVaxVa/8AkYq2rYsml+xixXccWTbYsVv7OLJcq4sVmLJe2LFv Fktf7GLFy4slTFip5BkqcMVdk2Lv9TFXcv28VVMVWriq3nirXDIKv488VcrMmKrcWS79nFi1yxVz Yq2rccVWpiyXcHxYubJqt54q7FV7e/2MVWfDirvhxVd/r4qtZcVdwxVz4q7FVTFVP4sVczYq7FXf Diq/l8OKtccVW4qubFVuKuxV3DFXL9nFXYq7FXYq7niq7jiq1MVdiqnkGTfLFV/w4qo5NV6rixWY slZeGLFTxVv4sVc2KtLiydixdirariqzFk74MWK7FWuP7eLJvFi7FXYq22Ku5Yq1iq3Fk7FXcf8A g8WLlbFV2KuxVbxxV3+zxVzLiq3FVvLFXLiqtiqjxxVvjwxVZ9vFXcufwYqqYqp8MVaX4/gxVtvj bFXft/Hiq9lxVY+KrGX4cVX/AGMVdiruGLW5fixVY2KuXFsdxxVZyxVdirsVWsuKrsVWri1rP2sV WPi2O4ti1u4/t4tixsWtf/qYtjkxVYy8MWt3+Xiqzkv7GLYvbFra+1i2NrxxVzYq5sVWNiq7Cqng Vd9vFVnL9jFVnL9jFV6/z4q1/l4qtfFXPiqz/LTFV+KuxVY2KqSrx/18kwXfsZFC7FXYqp/6mKFn HFW8kyU+GKuZcVXcvsZFmtb4GyTBpvgyLNr7OKt/Fy54qvxVDt/r5Jg//9T7Mpl7Fz4GtZ/r4WxW /Y+DA1rGySW1bFVXIsXccUr2+PFXLi2LGX7GLWvXlyxbGsVVExVY2KubFV/PFXK38mKr2XFViYqv +D9jFXcfixVY3w4qubFVRv5P28VWfs4q2uSYKvLIs1nJf2MVX8cVdxxV3Hni1uVlxV3+viq/FXPi rmb9gYtjsVdi1r/s4tjXLFW+XDFXeni1r+OLY7jxxVdiq1VxVdirfHFWsVb5ft4q7/Lwq5ftfB9v FWvtYFb+HlhVpV5tgVU5K+KuVsVdirm/nxVevLjirTYq0q8/gyTBpv50yKF/xYtjeKtL9jFV6/D8 CYqtxV2Ktcl5Yqq4qo8vh+PFW2XFXfZxVf8AY+DFV2KuxVz/AGMVW8/2MVaX7eKts3HFV7L8OKtY q2uKtLiydixbXFXccVWcsVXccWTuWKrcVVMVU8VVuGLFZxyDJzfBiq/FXc8Va54sW+GTVfy+LFVn PFXfDirTcMgqpirsVU+eKr+SYqv5/t4qpceC4sl/+virXL+fFi5lxVrliq7FVmLJtm/bxYts2Kqe TZLuGLFdwfIK5W+HJqs/1Mgq/jzxVrjiq5lxZNMy5NitxVfx4Yq0rL+xkFdxyatsuKrePxcMgq7F WlbFWuOKu/4jirX/ABDFk79nJsXJirueKrcWS7Fi74cVdiruGKrXxZLsgrsVc3+Riqxl+HFVmTVW TFi5lxVT5YsmvtYq3ixW4snLixXYq3xxVrFW2xVYuKr/APXxVZx+LFV/HFWsVdirsVbbFWsVWquK r+WKrF5LiruXw4q7jirv+I4q7liq7FVFcVb9P4vgxVzLiqriqz4vsYqt48vt4q7j/JirXHFXKvLF VrfyYq5W+LniqxsVXpiq74eWKrsVU+PLFXc8Vdy/nxVUxVQ5YqvVcWtTxbHYqvbimKrMVW8cVWp/ kYslTFip4tbsVU/9TFXf5eKuxVUxbFNlxVzM2KufFrUf58Wx32ckwdiqtx/nyLNT+zirfL+fFWsV W5JgprkWapx/nxV3L+TFVjNirXLFXKrYqtfFXM2Ku/ZxVZ9v7eKr8VWccVX8MVdiqni1reKYq5cV XfZxVbxb9jFVn2WxVY2SStZsVcv2cVVWXIoUuGSSp8cihdi2LuOFVPi+Fg//1fsuq5kNTuGKr1+z /Nirv2sixaZv2MkyRGRQh1ySVRuP7eKqmRQ5eOKttirv2sVdxxbF+KqeKqnDFVjLiq//AC8Vdiq/ 9nFW8VWrirlxVtvsYq1/r4qqMrYta/j+w+LY5vi+BMVczYq1irvsfYxa2+OKqXLJJVMihtcWxf8A 6mKuVe74qs4/Fiq/FV7LirX+Xiq1MWtEYtjsVdirsVWrirsWS9cWLuOKu+LFXL/PiruOKub4MVcu LWvjXFsdx/bxVz4q5l+HhiruX8+Kub7XPFVL4fsZJgvVvixVEMuRZrPs4qvVsVdxxVzYq7lirm/k xV3HFV2Kt/6+KqP2cVXsuKuXliq7FXYqtxZOXFiubFktZv8AgMWK9sVb/wCI4qp/6+Kr+Sr1xVrF XYqtxZLsWLX2sWS/FVyYsVr4slyYsVJfjxZKvL9jIK7FXK2Ktsv8+LFrhk1VMVWriq1W/YOKr1b4 f5sgyaVf2/s4sXKvxf6+KrFXniq7/XxV3+viq7FWvt/bxVpsVdxxVv4cVa44q7/UxVrhiyX4sVP7 GKt/DiydzxVd+3zxYrOGKr2xZNcsWK3FV/FeOKu+LFW8VW/6mKrsVaZeeKquKqPLFXcv9imKuXFV bFVL4cVdzfFW8VaXlxxVvkmTVvFVPFXYq7FXM2Ku54q7nirnyDJ2KuxVTxVv4P2MVXpiq3Jqp4q7 FV64sVmLJdixb4/FzxVzLirWKtrirWKt/FirWKuxVtlxVrFW2+PFXLiqxV44q5cVd/qYqvZeGKtY qtbnxxVdiqlyX9vFV7YqsVef28VbxVd9tsVW4qqYqtVsVW4q1x/bxVT+F/jxVUX48VabFVvJcVd9 jFXYq79nFXM3ZMVcytirl+LFXYtani2LWxV3+piq/liqz/LxVdhVa2KuXAruWKrcVW8sVXYqp4ta 5sWxa38mLW5MWxyYq5m/nxVTxa22xV3+Xirv2cLY0vJ1wK2vx4q5VbFWsVU+WSYOyLNUxV2KqXxY qsxVz4q77TYq5vh+Phi1uxbHYqp4q23w/wCpirWKtriruPD4MVU2yTS22RZKPLJJXYqsk4/t5FDW SS79rFXZFis488kyXcv2MizcvwYVcvxLXFX/1vsu3xZkNTsVXq2KrmZuORQv5fFwTFVnH+fFXZJi 2q4s1Vf8jIs2sWtb6eKr1XFWk+xi2Nq3xYq5uWKu44qvxVYq4qqriq37GKqmKuxVvi+KrePw4Va/ 18CqmSYL+ORZubFWvs4qqcMVUuOSYN5FDfHFWuX7eKqmLY5l+HFXYq1x4f6mLW5m4Ytiriq1VbFV Rf5MWtbyxbl3xcMWK7FW1xa2lZvt4tjf+XirlxV3L4cVcuKuX+TCq/Aqz/XxVfirlZsVX8l/YxVY v86Yq5W/bxV3H/g8VdwxV3L48Krft4WCr9j48izbxVaq8sVVFxVTZf28VVOWKu5Yq7jyxV3Ljiq7 FXYq7FXYq2uKrMWS7Fi22KrFXFV/2/8AUxVZiyXccVb5YsWsVW4slRWxVtW4Yq0+KrcWK7Fk0uQV f9jFXcuOKuZsVcvxYq7i2KtYsW3xZO5f8Hk2LsVcrcvjxVdyxV3L9vIK7j8OKu/y/wCXFVv7WLJv jixbXjirvtNirl/y8Vc2LJYy4sVRVXFk74cVa4/yYsWmxVzYq238mKuZsVWviyb44sV37OLJ2LFp vjxVvFVq4quxVbxxVv0/28VXYslqtixaXj+3irmxVcv2eH28WTsWK1sVXYq7FVvLFVuKqmKrPs/b xZNYsW8mqjiyVnxYuaTFXPiqpkGSlixbxZKeKuxVUxV3PFVL7OTVzNirWKuxVcuKtfaxVcy4sXce eKtcXxVvjirWKu5YsnYsVuLJfy4YsWuWLJtsWK1PsYsl3HFisxZLsWLsVdirfHFVBW44qqf5GKrG 44q3iq1cVVsVdirsVUeWKuVlxVvl/JireKtcf9niqzniruK4q5V/bOKu+3irvj4Yq5lxV3H9vFVL jz+PJMF3L+TIs3ftYqsVf5MVXtirm5Yq1iq37eKrsVW/sYqtxVay8cVXYq7FXYqt44qt54q7j+xi rsVU8Wtbkkr2Xj+xkWbuOKrGbFV/L9jFV6YqsVsVaxVb9tcKu44FcuKqbL/JiruWKrcVcy/Fiqzi v2MVdxxVzYq1i1t/6+KtYtjsWttlxbGsWtSyTFeuRZOySVJuP7eKuT7eKrGXFV/HIsVj5Jk0vwNk WbuWKubFX//X+y7N8OXNDv8AIyTJdwwM21ZcDU3kmS3liqsrfz5FC2NsULvgxS77H+xxbHK2LWvX Fsdx7ft4q1iqo38mKu4Yq5MVWNirv9fFrV8Wxrjy+3irlXFW8VXcft4VW4FVeOKr2X4f8jFVnptx xV37WLW5vb7GKu+HFVmSSv45Fm5cVX8MVd+1irSrwxVvhiq7jiq7FWlX9t/jxVytiq/l+xHiq3ji yXcf58WK7FXYq2uKtYq3yxVrl8WLWqfH9jFsXt9n48VWfa+PFXMvw4qqYqp4q77eKu4/yYqvX/L+ xirv2OeKrOGKuXj9vFV/H+TFXP8AbxVfyxVy4q7lirv28Vcy4quxVby/nxV3J/sYq77fwYqubFkt xV32MWLmbFV2Krf9fFXcePx4qu+ziq39jFV2KrcWTsVX/FixbxZKeKuxVUxVdx/kxYuX7WQZLFxV zNiq9f5ExV328Vd/r4q7hirueTYrcWS7Fi77eKtq37eQV3LFWmb9gYsnKuKrlXlixWcMVVMVdiq3 /UxVU/1MVW8lTFk1y4YsXfbTFWuWKu44q38WKuZeeKt4q5mXFk7Fi7FWub4q1xxVU+L9vFVPlirf Hniqriqn/qYslTFiotirv9TFW1XFXKuKu/axVpsVdxxV3HFXLirarireKuxVTxV3HlirfL+fJq7F VzN/Jiq18VczYq7k2QZLuWKqbLzxYrueLJ3DFXcMVU8VXceOTVbyxVr7H28VXNixW8f2MWTvhxVr FV7YsWsVdirX2cWTWKr1/nxYrVXh8GLJvFi7FW1xVpcWSnx5Yqu44sV2KrVbFV32sVWsuKubFVjL iq9W+3iqxmxa17Li2O/bxVY3x4qq4q7FVHlirarwxVY+Kr+b4q3iqmv8+KtfB9vFW8Vd+1iqpiqh xxV3+XirX2sVVG+LFrWKuLY5mxVytiqnxfFW2xV3HFXYsluLF2KtMuKtccVdxxVay4tbsWx2Ku/b +DFXN/kYtaz9rFXceGKuWP4cWxyry+DFXL/Jirlb9jFVn2MKrPiwK1yxVUVcVU2xVay4qubFVqYq 77eKrGxVf9vFWl+P4MVWri1r/hxbFPFW2xVrFrWsvL4MWxTyTBWyKEPxySW2+BuGKrviXIoUnySX faXFXN/JirTN8ORZuZviwq//0PsuzZkNS5fibngZt/awsG2VsihplySVVsih2SSuyKG2Xliqz4eP P+bFsdyxa16ti2NYq7FVTFXJirueKrFxVerYqqYVaXlgVVxVbyb9jFXJ/kYqvXFWsVbXj9j9jFXK uKreWSYO5Yqu488ihfiqxVxbF74q7FXPhVTwNav9nFsdx54q3irXLl8f2MVVuXP7GKuVcVWP/l4q 74MVXrirWKt8cVd9h8Vc2KtYtao0n7GLY7FXMuKruWKrsVU2/wCExVev2uf7GKrOPLFXfAzf5eKr uOKt/s4q1yxVteWKuk5Yq7l/Jirv2cVa/wBTFVRl/nxVbiq7/IxV3+Q+Ku44q7j/ACYq5VxVdyxZ LcVXYsW/U/bxVrFVv28Vd8GKrsVbXjirXJ8VVMVUcWS/lixX4qtTFkt5YqqM2QVY2Kr+eKufFXN9 rFXcMVa48sWK9cmq3FXc8VVMVW/5eKtccgrlxVv4Pt4q1xxVU44qsZsVaXFW1X+TFk02LF3LFV2K uxVpmxV37HPFWuOKtsuKt4qsZf8ALxZL8WK7lxbFVn2sVcv+Xirl+DFWuOKqn+piqmuKt/tfHire KtcmXpiq9VxVbirTNiqzFV7f5eKr2xVYvx4q5f8AIxV3xYq3iq5sVU2xV3+pirfN8Vczfz5NVuKr 1/nfFVjLirmbFXcv58gycy4q1ixb5csWTl/kxVrnixb4YsncMVcy4qp4qtyaq3DFis/1MVXsuKrO OKr8VUcWS7Fi3y54qsxZL/hbFi1iq37GKrmxZNt8GLF3+virWKrf2MVd6mKuZcVXYq7FVLkmKr+O KqPDFrVm+LFsWSLyxVvFWuKYq3irTfyYq3iqmq4quXFXLiq3l8P28Vc+KuTFXcVxVz4q7niqz/Ux Vy4q5vjxVytwxV3L+TFVjL8PwYquxVTxVV/y8VUv2MWS5mxYqbYtbuWLYuxVplxVvFVP/IxVzL+x irsVc3/CYqsbFraxVtsWxrFW+PPFXN/JiqxuS4tbvjxbHMvxYqprirfFMVa5Yq7/AIjirariqx8V cmKqeKt/6mKtYq2y4tbWKrfjxbHfYxa3P/kYqosv+Riq7JJVOXxZFCxV4YqpK3xZJLueKruGRZre GSYLuGBms+38eBX/0fsvmQ1OxVe3x4q02KuXFW1XFV7ZFiqYpbXFVitiq7FXYtipiqnirsVVGVsV WNiq9fs4q5m/bwqvVm+xgVrjiqoq4qtxVUxVvl+3iruXxYqs5Yta/jirmXFXfDiqzJJbbFVX7GRZ u54q7FrWKv7eKr8VdwxVyYquXFsVsVW/6+KubFXL/Pi1u+xhbHNgVfyxVys2KtYqqL/Ji1u+3i2K f2cVVOGKu4Yq5mXFWv2PgxVtvs88Vd/kYq7niq3JMHcf58VVfhyLNzfHirS4qqL/AKmKu5Yq79jF XNiq7FXYqt+PFXft4q5vixV32MVaXFEG1bFK9cVWYsl2LFbiyXLiq3jixXquKrMWS5sVb44sWuWL Jbiqtx+DIK7nirkxVrhixbxZOxV37WKuxV2KuXnirv8AIybFamLJdixcmKruWKu45BktxVtcWKti qkrccVa5Yq5sVbb7GKt4q1yxZNccWLbNirvg/bxVpsVVsVU8VaX4MVaXFVT/AC8VWcueKtccVW4q qYqu44qp8sVd8XLFV2KtM2Kt4qt44quX7GLJbxxYrl5YslTFip8lRsWS3/LxYtc8WS/FitbFVfFk occWLuWKu/yMVbb48VWcuOKt/D+xk1cmKqmKqbc8gyc3x/6mKu4rirv2eeKubhirTN/l4sW3xZLO WKr8Vd8WKu4ZNitxZNKv8+LFzYq2mLJpsWLWKuxV2KuXFk1yfFVy/wCRixaxVtVxV37OKtf5eLJb iq7Fit5ccVXYqt5fFiqxftfbxVe3wtirlbFXccVdxxV3xceGKrFbFV/LFXcsVU2xVtvjxVVxV2Ko dlxV3xYq58VdzxV2Ku/y8VcmKrGxVe3H9vFVP7OLW2y4tjl+1zxVy4q7jirWLW22KtYti37GKu5f F8GKqf8Al4qtVsVXccVWsuLW5vhxbFjYqvxVdxxVSZcWtr7OLY38TfHirWLW7FsbVm5YqpN8K5Jg 0v8AJkWa/liq3FWuWFWuWBXLiq3/AF8Vc+KuxVZxxV3+Rirv8vFXLiqxWxa17YtjvhxV3HFrUW+F ueKtt9jJJXNkULG+FqYqpf6+SS5f9fFXYqu5c/8AXyKFrf5GSS0zYGb/AP/S+zStmQ1NLiqp+xiq imKqqr+wmRQs/wAjJJVv2MihdyfFXYq2q4q74cWx3HFXM3xYq1irbYqvxV3DFXf6+KuxV32MVVuO Ku5YqsXliqtxVPjxVzL+xwxV3HFXLi1rFxbFZ8WtYq4tjS/z4tbfLniq/j/Pi2O4/HirsWt2Ku+L FVy4ti7FVy4tbmxbHcf5MVU+WKqir8X+Ri1r/wBnFsdxxV3w4q7ji1ubFsab+fFrVMWxdxxVbzxV 3PFXc8VdzxVdyxVb9jFXcubYqs44tavi2LuWKu5Yqs+ziq/7eKrPtYq5VxVfHiqm2Kq2KqXLt+3i qriq3liq9sVWNxxVdiq3Fkv9TFi74cVWLiq9WxVpsWTlxVbiq9l5YsXNiqzFku5Yqv4ZBisxZKjf DiqxsVa5PirbYqv48cVX8fixVZirUbfsYsW8mrvj+xirkxVeq4q77OKuyCtL/wAFirfx8uH2MWTX LhixbxV3w4sly/8ACYsXf7DFXN8OKrOKYqqcVf48WSmv8mLFe3w/bxVZx/nxVrlirf2cVczYqv44 qs9TFV64q7/IxVdiqj/kYqub+fFk7Fi7FV3FMVc2KtYslv7WLF3L4sVX8cVWsv8AkYslitiq7j8W LFtV+Hniya+JsWLXHFW1/nxVrjirf2cVdyX7CYqv/wAvFVirx+3irXLFWueTV2KuxVyZBk77eKu5 ft4q7FXN/JiruGKuxV3+viqzjiq/nirl+19jFVPJsWv5OGLJtV/YxV32sWKpirmb4sVdiqnirmxZ Nr/kYsWlxZO/1MVW4q0zKuLFfirf+XiqxsVdxxVzYqtxVtWZ8VWNirvi44quxVd8X7eKuXFV2Krf 9hiqyTFV7Yqs+BMVa/yMVcuKrW+LFXcfi4Yq5v5MVdirsVcv+Riqxf8ALxVe32sVaZufxvirm4vi 1rPtYtipyZ8VWKv8mKtYq7FVvHCqnywKv4piyX4sVv8AkYta3FsW8cVW4tbmXFXYti7liq3l8GKr OOLW7lirv9TFXeni2NfB+xirsVbbFrWcsVc2LY5l44qsbCreBVrKuKt+niqzl+3irv8AIxV2KufF VitiruWKubjxxa3M38mKtYq3xxVY32MVUl45JLeKtr/JkUKTL8Xx5JKo3JcihT+1/r5JLmXFVy8v 9hkULOWLY//T+zTfHmQ1LmX/AGeRQt+38GSSv5Yq5cVXL/PkUO/1MVX/AOpirlxVZyxVdwTFsdir fLFrdxxbGsVVMVXKv8+KrsVdirX7WKquKuxVay/sYq7/ACMVXt/kYq7jirXNMWtrlkktYq22Ku44 qu48MizXqrccVU/tYqqN8H28Wt2KuX4cVcmLYqYqu9PFXcsVd8GKubFVy/bxV32cVdirsVVOK4q5 8Wt3PFsXt9jFVmKuTFVnHniqqytiq1MVdy5tirnxVdxxVaqsuLWqYtipiq1sVU+OKtr8a4Vc3FMC r/8AiWKu/wCJYq7/AC8VcvHFVNlXFVTjirlxVzLirv8ALxVe2Ku5cGxVrFW2xVrjiyb/AMvFi1yx ZNN8eKqq/axYrF44q5V/4DFXM2KtJ9jFXZBkqfs4q7FXYqsXFVRcWK3FW1XFk5fs4q5m/bybFc2K u/18Vc2KuXFVnDIK2mLJvjixVP28VWK2Ku5c/gxVy8sVaXFVRcVWL/kYq5eOKtr/AKmLJd/kYsVv H4cWTXN8WK//AGeKqf8AqYq7liq7lzyar+WKqf8Ar4qv/wAvIKp/FxxVtl/nxZOX4/gxYr15Niqx cmqpy/bfFVNlyCtLirfL4cVXtiqnyxVv9v8Ay8VbxV2KtM3xYq1xxVzYq39nFV/28VWcft4q79nF XfZxVpcVdyxVrl+3iyXr7fYybFvFVPhirv8AXyDJY2Kr/t4q7FXfDirsVaxYt/FiydwxVzfZxVTx VUZcVW5NXYq0uLFZiyXccVb+LFiv54qt/wBTFkp4qvZcWLmxVpl4rirf7WKrPjxV2LJdixWtiruP HFVPjiqpxxV3x4quxVTxVcvx/wCpiqzj8OKquKqXH+TFXfFiq/liqmq/t4q39nFXNx/bxV32sVWc uH+virv2uGKu5fsYqv5L8eKrP2cVXcsVWviruGKu4Ytani2OxVtv58VaxV2KuxVarYq7jiqmy4om 5sUq2KuxVDpi1u4Yqs5Yti9mxV3PFVi4tbv9TFscrfFirvixVfiqxsVcv874qsbFXfF/scVXYqt5 JiqxVxVpsVXYqp8fjxV2KrPixVfzxVZ/kYqsZuOLWv44q7lirmxVrFsUv8j9jFrcvLl8GKr2+HFV P7WKHZJktP7eBmtZcLB3H4MVc2Bm/wD/1Ps36aZc0qj/AORiqly4ZJKriqjyxVWVcihf8WKrFxVf xxbHcvixVyt+xirWKt8eeKuXFV+KuVsVX/t/5GKu4Piq/wDbxVTbFVbFVvHFVq5Jgqr8GRZtYq2u Ku/Zxa1qrkktr/PkUNq3w4qsVf28Wxf/AJeLW7liq9MVd8OKuxV3PFsXLiqovHFXccVW8sWS7l8P PFi5VxVy4quxVvjiruOKtYqqYq5vixVyYq79nFWuXD7GKt8mfFXN/Piq/wCJsVcvLliqzl8GKuxa 13LFsVPgxVdiq39vFVn2cVaXFW144qv5Yq5WxV37GKu5Yq5lxV3+RirS/bxVtW5Yq2zYsly4sXL7 fbxV3HhiruP8+KtYqtxZL1bFi3iyU8VXNiq7FVzLixW88WS7IK79nFVjYqvxVyYqu+1ixW8MWTsV aVW/2GLFv/UyauTFV3HFVr4qvyCuxVr4cVVcVWriqz9nFWuOKubFW/hxVr/XxVrniyb44sV2Ktcc mrbSLirXHFVRcVU1xVdirS/Biq9f+ExV3xfYTFXfHirmxVbiqpiqkrc8VXriq7FVJPt4qqZBVL9l 8VbZcWTTNixa5Yq1+ziybZv2MWLf7WKrm+3iqz/LxVvl+3ireKr/ALDYslmLF2KtfDiq9l/bxVYv t9jFVrfDk1c3w/B+3iq9ff7eKrG+LFWmbIK3zxZOfFWsWLeLJ3LjirmbFXYq7FXc8Vcy88VWcsVX /FirsVdy5Yqt4ZNWuPxYsXcsVWYsl64sXcsVabFk7Fi0y4sl3HFis5fz4q7liruPHFWuT4qqcsVW ccVXYqtXFVjfyYq77OKr244q74MVXYqt4tzxV3LFXfbxVT44qvb7eKrFxVdiq3jiq3l/JirsVX8f 2MVWYq5v58Vdy5Yqs/axVey4tbsWxY2KubFWsVdiqzk+KtccWS/FhNZilpWxVpW/nxVby/kxV3PF rcy/z4tixfjxVfx44qo8cVXfaxVpf8vJMFzNxyLNzMr/AG8Vc38iYq5cVc0f/AYqs44tbuWLY7/L xVTXFV2KqeKuxVyYq58VU8VVOXLFVnHniqxWxa3csVdxxbHcP2MWt3LFVFcklb9jFVb48ixWfFkm SzFXfbxV2Krmb7eBm//V+znL+fLmlZx+DFV/2cVWcsklWXl+xkUO5YquxVvliqxsVcuKr/8AUxVf 8OLY7hiqzl8WKr+eKu5ccVXf5GKqnHFXLirlbFXceOKrcVbb7eKqnLFXcv28VWZJgvX7P+XkUObF V+KrOX8+LY79rFrdyxV3+Xiq9VxbHc8WtyYtis2KqPDFVfFEFnHFmuZlxYrsVb5YtbWLY77OKuVe bYq3yxVrFV7LzxVv4sVd8HDFXfs88VXf5eKraf5GKuX4sVd+zirvt4q7FVzYqqcsVWfZxVfyxVYv x4Va5YFcuKqn7GKubFVi8cVVcVdiq1/8vFV2KrcWS/jixWLirv2MVcq8/jxVzYqu5YslrfyYsV6/ Hiq9MVdiq3niyaVuWQV3xYqvfFXJirueKu54q7j+w+KufFXYq1zxYt8v5MWTuLYqubJsVr4q7hiq +PlirXHhkFWYq5V54qrf6+KrOXDFW8VabFkv+2uLFT/y8VVOH7eKrPtYq77OKtcsVb/y8mq7FW2X 4vjxVay4qvZcVc2KrcVaVcVd9nFWlxVdirsVXK2Kqa8v2MVVOTfsYq7lirmbFVjfBirm5Yqv5ccV dyxVZy4Yqv5YqsZsVcv2eeKtK2QV32sVbxVpY8VabFW2bFW8Va+1irTYquxVyriyWftYq7JsVTFV Pl/wGKr+SYqp/wCRkFb4YsmsWLfDFk7FXfYxVTxVvl/l4qvxVz4q7j/Jirm/kxVyrirkxV3/ABPF XfHzxVarZNVuLFbiyXsuLFZiydiq7Fi3xxV3LFVmLJfy54sVNvt4qvxVtm+LFXf6mKubliqz7eKr sVWv/kYqtxVr4/8AYYqvbFXKvw4q7jiqm2Kqn+Riqm2Kt/tYqs+Pnirl+P7eKr2XFVnPFXf5eKuV cVd8K4q7/LxV2KqeFVq4FXYq2y4q1iq1mXFXfBirmxVzYqo/Z+3iq9mxV3+v9jFVn+pirm+Dnirv t4tbkxbFn+vi1tYqtySV6/5GRZtrhVpuOBXfb+PFXM2KrOWKqa4qqLiqm2KrsVW/6+KrXxV2KrOX DFXNirm5csWtr7WLYtf/AC8WtzLyxVevxfBi2LP9fFrd8GKqbYqqZJLuPxfBkUKPLJJX83yKFL4+ GSS5WxVcrZFD/9b7NtlzS3x/nxVZ/wAPkkr+PxZFCrx/kxV2Kts2KrOPw4q5VxVfyxbHL/kYqvxV 2KrFxVfirlXFVTFVq4qqcsVcrYqps3w4qqcfixa3ccWxf/r4q19rFXcnxVvji1u/1MVd+1irX2Pt 4q77WKt+nzxbF+LW7j+3iqniquvx/Bi2N4q0v+Xiq7lyxRBpcWa74MWK7FW15Yq1irsVb44q7jiq zJMFbIs3cMVWfY+PFV/2fsYq7FXYq5l4Yq7FXcMVXf6+Ku44qqMuKrOX8mKuX/IxVyriq/j/AMHi ruf7GKu+2uKu5ccVXtirWKrW44q79vFXK2KuZuOKuxZL+OLFrFW1b9jFVmLJvj+xirWKuxVU48sV W5BVTnirsVWcsVaxVUZcVd8OKu48sVd8HPFXcMVdwybF3DFXMq4q7/UxV2KuxVvlkFXcf28WSxv5 MVcrfsHFV+LFpm+LFWv9fFXLiq5WxZLv58WKzjzxV3N8Vb/Zyau4/Fiqriq37eKrcVXM2KuXFV2K qK4qqccVd9hcVa5Pira4qp8sVbXjyxVe2KqfLFXccVbZcVXriqnxxVfxfFW/T5YqsZsVdx/nxVps Vb/a+PFWv9TFXcsVbyCtJ9vFW/UxZNK2LFzNiruXPFW8VWriratirlXFVvPFkubJsVrNiq9uOKt4 qt/18VW4q7FV/wAOKrOGKqeKqjNkGTuGKtJixbxZLP2cVXPixb4YslPFV+LFtMWTsVU8VXMuTVbi xXcMWSnirafYxVcuLFrFVrYqv5YqsxZL+PDFi5cVaxV2Kt8sVWMuKu+xirmZsVdyxVzN/wABiq7F VL4sVd9rFXcl+3ireKrf+JYq7jiq3j8GKu4rirsVdirl/wAt8Vdiq/lwxVZ+1iq3jhVbgVtcVWNi q/8AyMVWM2LW5sWxri+KuaRsUTWcsUt/axVvFVN8Wt2LY5v8vFXN/l4q7hi1rf8AiOKtNirv9fFX K3/AYtjm/nxVr9vhirbfF8eKrOOKuZsVU1xVtv8AIxVpsVb4/FiqxvjbFXYqvZcVUf8AXxV3+piq /FVi4tamvLjwxVvjiq9lxVS5ZJLm+HFVjf5GKrvt/byKHK2KquKoXJJdiq9vj+PIsX//1/s3/l5c 0qnH4sVWfscMVXqv8mKu/YxVdirsVdirbYtjuXPFWsWttvjxbF74qp4qqcMVVMVW/wCRirmxVUZc VU2xVU/4fFXft4qv/axVrFW1XFraxbFT4OGKqP2skwXL/l5FDfLFV+LYp/axVU54tbueKrlxbHYs luLSrLyxbFn7fDFXL8eKr2/nxVev2uGKuX/IxVrFXcXxVpckwVVZsihTxbFRvixV3PFXM2KuVv28 Vd8fDFXfYxV32MVWs3PJMFXj/JkUL/8AXxbFjfF8GKuVsVX8v+AxVY3xNXFV6/z4q7/XxV3+W+Ku b4+eKrsVW8f+AxVzNiq7FXYqpriyVWxYrGXFVq/DiyX/AGcVbxYuxVvjiqzFkrPixWcsgyXq2KuX +TFVjN/Piq/hirsVdirsmxW4sl3PFiqYq19rFVmKu48sgyb44sXLirlxVt/t4q0uKrsVU+eKqit8 WLJ2LFpfsYq3ireTVa2Kqn28VU+OKq2KreOKqf8Ar4qqcsVcuKrOb4qv/wCI4qtxV2Krv2MVWcfi xVeuKrOb4q79rFW8Va4rxxVe2KrsVUeWKu44q7/IxV3+XirbfHiq/iv7GKqbYqqNiqz7OKu+D7GK tNx+3irfH4cVd6eQZLv8hMWKkmLJezYqqYsVPFVvLFXcsVVOKYqsVvixV37OKrMVXcsVaxZOTJsV 6/YxVvFVH4sWS74sWK9Pt4qs+xiq9eOKtNiqniyb/wCIZBi3zxZO4Yq5MVcrc8Vc+Kubj+xirsVW K2Kr8VW8MmrXHFi1irf2lxV3LFWuOLJ2LFby44qvbFXcsVUm+HFku44sVn7OKr2bFV/LFWsVWsuK u+xiqz9nFV64qptirmxVvj+3irl/nxVvFVpxRNbwxS5vhxVzfFiq/wCziqxmxVytirmXFVjfB9vF XKv8mKu5Yq5mbFWsVWp/kYq74f28Vdy44quxVRbFV2KtfFirXLFVvDFVjN8XwYqvfFXfE2KqOSYL 1XIocuKrMkl3x5FmvaPCruS8cCrOWKuZsVWK2Kr/ANvFVjcUxVpsVbVsVWYq7/IxVZyxVe3PFVnH FWsWta3H7eKrsVWtiq/ji2LPt/7LFrWN/JirWSS7FVq4qt54qu/y8Vb4/tvkWL//0Ps58X28uaVv 2WySVjN2TFVbj8OKrmX/AIfIoc3/ABDFV7YqsX7b4ti/liq/9rFXYq7FXYq7FXf5eLWqYtjsVXKu KqbYqrtiqxf+BxVfyxVe0eKqKriq/wCLFrc2KuVuWKuVf5MVaxVv/XxVt8kldkUOfFsdzxVdyxVv kzdcVbxVbxxa1ReWLY7liruOKuZuTYqu+1irvtYq2v2fjxVy4ta/iuLY7FXcMVc+Ku/18VcrYqv+ 38GKrG+1irm/kxVbkmCo2RQ5cWxtV4tirm/nxV32f9TFW8Va+wmKquKuxVb9vFV2KrWxV3HFXfD9 jFW+aYsm8WLlxZLW+HFi7FkrfZ+3ixU8Vb5c8VaxVbiyVv8AIxYu5ft5Bk77X+piqxV/bxVezYqs /wBTFW1XJqu4YsXYqqYqp4q7FVy4q5eWQVvFVvLFXNirfw4q1xxVbiq7jiruOKtq2Kubliratk1a /wAjFW/2vjxVvFVvLFVbFVJuOKuXjiruXxYq0uKt8vi4Yq1J/JiruOKtr9n/ACMVVcVW+nirvsfb xVY3wYqv4ft4qs/ZxVzccVVcVW8cVU2xVU5Yqs/axVeq4qs4PiqriqkvHFW8Vab48Vd9j48Vcy4q 1xxVf9tsgrXH4eb4q7Jq0zYq0yriq9cgq3FXKvw4smm+xixWYqvZsVa44q2n28VbxVr9rFWuWKt/ tYq7g+KrP2eeKt5NXPirkxVaq4sl3H4MWK9l+LhiqzhkGTuP/AYqs48MVX/YxVY2Kr8VdzxVrFi7 FW15fbxZOZcVcy8MmxU+WLJtsWLWKrcWS/8A18WKz/IxVzLiq7FVvLFV2KrVZf8AYYq5uP2MVXYq tbFXNiruWKu44qs+HFW8VXcsVW4q0vxNTFV/2/sYqps3xYsZt/b+xiyWYqqYq0zYqsX/ACMVd8fD FV3LFVLk7/bxVzYtbuPH/IxbGsVdiq1uOKrsVdiq1uT/AOviqz9nFXL/AD4q2uLJbxxYreGLW5MW xzfyYq5v5MVU2kxa3Yq0uSS7jiqrzyKFFfixVy4ti7Cq1mb9vA1u44tjlxVT/wBfFW/2cVd9rFXM uKrHxVY2Kr+eKrG9vsYq1irbNiqzh+xi1uVlTFsc38mLW5fsfHiq1sULckyaVebYq3iqn9pcVcmK u+HIsX//0fs/xy5pU8kltfgyKFZVxVzM2KtYq22KrPt/5WKqz4tjsVc+Ku4Yq7nirsVdiq7lirmx Vdiq7/iOKu5f8BhVeq4FX4q77PwYqoL9vFVRWxVrFWmbJMF3HnkUL8VdzxbHN/kYVVMCqb4q7FV3 HFXccVbVcWtVxbFPFV3LFV/+Xi1tYtjbYq5cVaxVUxa3K3FsWx328Vcv2cVcq88VX/FiqzFXft/H iqpiqhx/YxVUVVyTBfkWbsVWty/bxVtpP8jFXf5H7GKquKqXxYqv/YxVYvLFVXFXYqtbFXKuKr2X FVnLh/r4qv44qsxZOxVdyxV2LFc+LJa2KrcVVHxVcrZBXYqs5Yqv5fHirv8AIxV2KuybF3FsVX8W 48MVWYq74cVW4sl/LIMV2KubjiyU1X9jFiq4smlVsVdixdiq3/UxVd/l4sl6r/l5Nis/ZxVf8L4q s/axVeq4qs/axV32cVX/AG8VWfFiruX8/wBjFV/+Riro2xVyriqxlxVf/qfbxV0jL/sMVWL/AD4q vb+TFVPliq7FVytiqz4cVX/5eKqf+RiqorMq4qpsvHFVReOKuVsVUft4qrKuKuXFVNsVc2Kqi/8A CYq7l9t8Vd/l4qtxV2KqmKrftf62KuVWxVZx4fbxVVxVauKrMgrsVdirsVW8cVa/y8WS/Fit44q2 y4q02Ku5Yq2zKjYq7/Xyau44qt4rirsVdirueKuxVrIK2zdkxZKeKqj4qp4qqYq58VWKrYqv5ft4 q1+zixb+02LJTybFdiya44sVrfBiyaxVdixd9nFW1xVpsWTsWK3FkuxYt8fh4Yq1iq1vi+PFV7fz 4qsX9vFXLirv8hMVWdnxVVxVR44q232MVczYqv5LwxVRTFV3LFVvqPirkxVzN/PirmXFXcMVWd0x V3HFWsWttcWxY2Ku/wAvFrcv++3xbHfsYquxVbiyUXxaVTFsdiqni1uxbHYqpLxyTBdHkUL8VUmy SXNirfwft5FDfHFsWcef7GKu+39jFrcvFsWx3p8/jxVdiqHfFVTFVPFV3LFVrLirkxVTxVU+HFVj LirWLWo8fi+PFVRW/YxVdiq1sVUlXJJcvLFVXj6WRQh+X8mSS74cVdkWL//S+zfHLmlv4cVWq2SS r5FDsVU+OSSu5ZFCti2LFxVy4q5cVXr/ACYq5MVdirsVcmKqy4q5vixV3HmvDFXcsVXtiq/FXcuW KofjkmCquRQ77D4tjuOLW7/IxVzYqv4ri2OfFXJi1u/y8Wxeq4q3irsVdirSriq9lxVy4qvX4Pgx VrFXYq3yxV3HFV+LW7FsdwxV3DFXJirmbFWlk4Yq3irl+BsVcvL9vFrcrft5JK9VyLNrjiruOKqn 7eKrOK/7PFV/+Xiqn/r4qrYq7FVvFV/1MVXYq7FXYq7liybXFi74sVcuKtYq7FW+OKtq2LJdzxYq a4sm2yCr2j4Yq0+LFtWxZOVfixVen28mxUvsYslzNzxYuZcVdxXFXfa+PFVzYq38SL8GKrWyCrl4 8cWTsWK3/LxVzYq7lirfLl9jFWuOKqq5NXfZ+NMVU+OKqki/sYq1+18GKt8uOKu/yMVdy44qtxVc n+Rirn/y8Vc2KuVmT43xVe2KtYqp4qu9TFXcW/YxVyquKrPixVe2Ku/bxVy4q5lxV3H+fFVnH+TF XL7/AG8VXr9r/JxV3wYqs4piq9sVWNxfFV/7eKqbYqrYqtXjiqn/AMSxVWxVSblirlbFWlxVdiq3 jiqo3HFVNcVVPt4q7h+xiql/kZBW2Xiv+XirTYq3xTFXfb+DFXNyxVZiq/g+KrExVc2Krm5LiyU/ hxYqn+viyW/6+LFb/kYqqfFk1WJiq9fgxVZ9vIMnf8QxV3FcVWNiq/FVnHFXfGmKr8Va5ccWK39r FkvxVp8WKxsmyW4q3+zirfLFVuKr+OLFrFW+WKrMWS9sWKxcVcy/FwxVdirsVW8P2MVcqriq7FVJ lxVrjiqpy+HFWl+3ira/D9vFVi8sVVcVUckwWr9rIs3f5GKu+z8aYq58Vdy5Yq58Vczc8VU8VbbF rdyxbHMvH48VdxxVY38+KujXFV2KrWxVTbFXcsVVOOKqPp/Diqpiqh8L/Bi1u/1MVW8sklvIoW5J K9cih37WKu/18Wx3+piqjy+LCq9eP7GBXccVczcsVW4q1+ziqzFVTFVNl/bGKqeKuxVtviWmKubF raxVbxxVy4q5cVcy/sYqsZcVWLkktt9n4MVa5Yqu4/DzyKFq/wCXir//0/s3/qZc0tfY+DJJVcVd 9jIoX/6mLY5lxa3KuLY7jiq9Vb9jFVnH+TFV+KrOOKr2XFV6tzxVZiq7/XxVdiq7/LxVdiq1cVXq 3H7GKuVeeKubFVjYVb5YWC5sihzYq7lirlxVfi2KeLWqYqqYti5cVU+WKqi4q7Fkp4qrYsXYq22K tYq7FW1xVyriq/FXPiqpiqmv+RirkxVTxVUVuTYq7l/Jiq5sVWq3DFV3/EsVXYquXFVnLnirm+xi q/jxxVy8cVcrfD8eKuZsVXYqtbjiq7FVrNirsWTsVdiq/l+xixaxVcmLJplxYub48Vb/AOJYqu4Y qs5ZBk7l+xiq/wCLFXYq1wxYt/YyaqmKqeKu5fyYq7hiq5W/YxV3+piq34sgyXccVbxYtcvixVvl 8Xx4snYsWuXDFW8VbyarlX0sVWMvPFW8VWtirfN8VX/z4q0y82xVb8WKr+Xw4q5cVcuKubFXf6+K u+DFXfEv28Vcq4q7jiq9v58Va+1iqz1F/wBhirZ4/wCwxVfyxVrFVv8Al4qv+x9vFWsVd9nFW+P7 eKtYqt+DFV/HiuKtYqpM2Ku5c8VXtirmX+TFXccVcn+XirlbFXfs88Vd/l4qsjb9vFWmk/YxVUZf 28Vdw/YxVzN8OKu+z/q4qu5piql9v4MVXyYqptx/YxVevLIKp8cVd/qYq39nFW2j/bxZNfF9v9jF i79rFVmKr/gTFWmxVpueLJczYsW8VWMuTV2KuxVys2QZOTFVPFV6YsW1XFk5uP7GKu54q58VWcsV dxxVev8AJirvt7J9jFVnLt+xk2LlxVpsWS3FV/JeOLFy4q5sVc2KuVeOKuX+fFVjYq5cVXtiqzji q7FVL4sVX/5eKrsVU8VaVl+3iq9lbFVnB8VbxV2KqaYq7hiqpiqmzYq7kuKu5Lirm/y/t4qsVcWt ay5JLTM2RZrsVb+38GKrGXFVPliqoy4qt5YsmsWE28UtKuKtM37eKrXxVy88Vc+KrOPPFraxVvf+ fFsdx7ft4tbvs/6+LYsk+HFrXfaxbHYqtZcVdx5fHiruWKrFb4cKuVsCu+HFVmKufFXYqp4q3+1i ruXJcVaxa3Yqt44q5m/bxVzKv28WxTyTBviyLkUNrkkrGZcVWfD+3iruS4q//9T7Ncf5MyGpd9rI oXqvxYq7kv7eKtcXxVfirarirWLY3xxVemKufFXLwxV3DFVTFVP9rFV/Hniq9cVdx4/Birl+HFXc eOKr2xVyrirWKtMuSYOVsVXcsihrFXP9jFW1bFV/+Ri2LPTxa1ZmxbFi88VXf6+KuXFXNiq7FV2L Jy4sV/HFVjYquxV2Kt8fixVauSYN5Fmr/b+3iqzFXf5eKruTft4q23LFVitirlVcVX8eeKu4/sYt a9f+HxbHMy/sYq5/8vFXfsYq5sVXYqpftYqrcsVWccVXtirWKrcWTvt4sV2Kt8v5MVa5YsluKqjf DirTNixaXFkuTFXYquX/AITIK7hiqniqpirnxV3DFXfbybFz4q77eKu4YquVf5MVa/y8grXL4MWS /wCzirsWLXwfsYq2y4smuLcfgxYtLira/Hirl+DFVT/IyaqaryxVtlxVzLiruP8APirSr/Piqtiq kq4qv5fFzxVyt+3iruK8MVW4q0q4q74sVa/18VVOPJcVcqrirvt/Biq7FXYqtVf+AxVdirbYq77S 4q79ngmKtYq22KrOXHFV64qs+PFXLirvtrirvgxVyt/wGKrsVWtirvt4q7/XxVdirf8AkYqpYqub 4sVWKuKr2XFXNiqz7Hx4qv8Ah+3iqn/xLFVTliq7FVLl2/bxVrjiqoy/t4q7/XxVT5ZBk3ixW8sV bX3+3irXHFV2KtMuKtNiq7FXN/PiyU1XFiu5Yq2uTVbzxV3DIMmsWLvsYq7FW8WSxV44qu+3ixbV sWTueKuxVzf8PiqxsVb55NV3H/g8WKnyxZLWb+T7eLFfy54q1irsVW8fixVdyxZN/b+PFis/Z54q 7Fk77eLFdiq37H2MVaVuPwPiq/FVrLirl/kxV3HFXMrYqtxVa2Kt/Dirm+PFVmKu4Yq5MVdiruGK u54qt+H9jJMFz5FCz4cLY1gV32cVdi1uxbFNsWS7lixbxRNT44Ur2wKs+2mKtNiq3FVnHFrXqq4t izji1tLyxVtsVcuKtYqt5csWxfy54tali2Lfi5Yq5cVVsVUvixVzfHirS4quxVTfFXPiqzjiq/FV nwtirWKreWLWuxbG1xVDs2SYNcsVbblirmbFWv8AUxVb9vFX/9X7P8P2MuaVPFCtila2Krmb4vjx VtcVa+38eKt8sWxy8cVX88VU8WtUxbHcMVVMVaZvt4q3iqpiqjxxVWxVv7b4q5uP2HxVzLirvhbF XLirl48f8jFXccWt3HFXccVXs2LY58Wt3DFscqriq5l44qtTFrXccWcF32MWa3FVRsWK7FVq4qux V2KuxV2KqmLW5MWx2KuxVcuKt8v2MVWf6+KuTFXR/bxVeq4q3irsVXccVd/l4q5sVdxxVT5Yqqce OKrsVW/t4q5cVXYq2y4q0uLJ32cWLsVXcuOLJdy/kxYrcWS7FivZv2EyDJYv8mKuZcVdzxVZ/kYq v+HFXYq7FXZNi7hiq3FkuxYt8sgrfLnirTYq2zfFirat/P8AbxZLVX+TFi39nFW8VdireLJvjyxY tqv7GTVZGq/t4qvZWxVbiq5uSrirv9TFV2KqeKqmKqPHFW/2vgxVvFV3+R+xiruf7GKu4/F/Niq7 FVq/yYq77eKubFXL8WKr1XFVkjfD8GKuZVxVzfz4q77f2MVdy/nxV3+pirvjxV32MVXYqt5YquxV vlirl44q5WXFVn2MVd+xirvi4Yq7imKrsVWp/kYquxVTxVdyxVYzYq5mxV3xYqvb+fFXccVWL/Ji q5ft/B9vFW/9fFV2KrWb9vFXMv8AJirvt4q0y5BVNsVXMvD7GLJpWxYrMVXLirfHh8GKt4qt5Yq3 8WKtcsVXL/l4snceeKrOeTYuVcVd8OQZOTFXPiruLfYfFXfYxVyYq7FXJirm+1iqniqp+ziqmuTV vlixWYsnYqv44sWsVbVcVWf6n28VdyxVvjzxZNfBixXrirWKuxVSb/iGKquKreXFcVWLydfgxVe3 8mKrsVUuK/bfFXfB+xirS8f28Vbbliqxv58Vd+1wfFXf5GKu4Yq5MVcmKu/yMVU/s4q2uLW0328W xvjw+xiruOKrPstzxVdirsVdiq1/8jFrU2xbF2KuxVTxV3+virkwqs/yMCrf8jJMHLiq7lkUObFV mSS77GRZuVf20xVz/t4quxVauKuZsVU2xVtv5MVWPiruLYq7FXYqs44q1irfHFraxV2KreXw4q7J JWceeRQtZsklc32MihS/18kl2Kv/1vs0y5kNSqv8+RQ77GKrsVb44q5VxV0eLYvTFVnLFV/DFVnL FV+KrlxVamKqmKtceGKt4q7FV2SYOT/IyLNcrcl/y8VbXk/xvirWKuXli1tt/l4tjWLWtySVZMih 3H+fFsU/s4taomKqmLY7FXYq19nFEFXFLsVWtHhV3+pgVdiq1mxVfxxVr7OKtt8f2MWtVZWxbFJm xVemKu+xirsVd+1irvt4q5l/4PFV8eFV7NxwKtxVczfsYqs4q3wft4qq4qtT/LxVZx+LFV/LFXfs Yqv5Yqsbjirv2MVXYq1yX7GLJcq8cWLWKtMuLJtsVXL9r4MVXPkFdirkxV2KufFXYqsZsVaxVUbn iq/g+KrPhybFey4qsVcVXKuQVr/XxVv7WKrOGKr/ANrFW/ixZLeOLFvjzXFXfDirmbFV6rirbZNV nLi2Kt4quZsVXYqpMuKr2xVzL/Jirv28VU2xVU44q7l8WKu+y3PFXMuKuVcVcy4qv/yMVdyxVzfz 4qo/Fiqriq1eP7eKu/18Vcvw4q79jFXcv58VX8sVd8OKrGbFV2Kt8cVWfYXFV64q7jirlbFXcsVd y4Yqs+H9jFXKvw4quxVv7H28Vc2KrOOKub4sVXYqt5YquxVauKqf+Riqp9hsVU/sf6+KqjfB/r4q 748Vdx/kxVZy4Yq1xxVzLxxVy4q3G2KqmQVb8eKrP2vjxVtv58WS1sWK7FVvHFW2bFXft8MVbxV2 Kt5NVrL/AD4qtTFXcMVdzyDJyYq5v8vFXYq7hirmXhiqniq/4sWLeLJz4qtyarcWLmxZKj4sVuLJ TxVc2KuxYrVbFXK2Ku/bxVdiq3/IfFV2Kt/Y+DFVn28Vd8eKuX4vgxVdiq2RcVd9vFVP/LxVU5Yq 7j8OKrG5fsYqs4Yq7nirsVdirnxV3FcVWccVaxa2/wDXxbHccVWf5GKrG/yMVa5YqqcsVd+xirmb li1rG+DFsWck5f5eKr/stiqxMVXccVW8MVWNirWLWptkkqmRQ5/sYtjatiqxW/nxa12LYt5YquxV R5Yq2y4qsVsVdwxV3DFXYq58Vc+KrGxVZxxa16t8OKrFxVevwYqs+DFVLj8OSS3kWLTLkmSzniru Xw/Bir//1/s3xy5pVsVdiq1WxVe38+LYs+xi1r+OKuX48Wxf9jFXcVxVy/a+PFVjNiqryxVbx5/B iqpiq5cVU+OKq2KreXw4qv8A8jFXLirlxVZkmC3liqrxyKHKvw/5eLYvTFXLwxVzK2KuZsVcvLji qt+xiq7FVvLFVuKqmKuxVav8+LWvVvhxZwaxS7FW2xV3L9vCq5VwMYN/F+3iydwxVzL+xirl/kxV 3PFXPirkxVb8X+zyTBEK2RZqa4q5sVVsVW8cVd8GKu/y8VXYqtXFV2KreWKrsVbb48VWYsl2LFbi ydiqomKreWKqnDIK7FVPFVTl8XPFXK3xYq79rFV+LFZiycvxYqu488WK1MmqpiqmzYqvVcVW/Fxy CrsVdiq5cVUl+z8GLJd+1ixbxV2KreOKq+TVRbFVRsVWftYq1yxVdirS/wCRiq/h+3iqxf5MVX/B irvjxVy4q77C4q5W+Lm+Kr/8jFXMuKrG4csVdx+LFV/+RiqxWXFV68v28VaxV2KrWbFXN8OKr1/n fFWsVdiq3lirv2eeKuXjirmVuOKrsVWt/Piq7FXYqt+39jFV3F8VW8vixVdiq39vFXN9r/KxVe3L 7GKrOOKrsVW8sVU/9TFW+Xw4q3iq77bYq7h+xiqzl/Jiq/4uWKuT/LxVdiqlx4r8eKr+WKrcVdiq 7lyxVyriqn8XHFXM38+KtcsgrfHhirXLFXN9rniq77WLJZy/nxVv/LxYt8f28VbxVy/YxZKar/Ji xX8cmq1lxV3PFXJirvt4q74nbFXYq7FVJfg+xiyVW+HIK1ixbVv+DxZO4YqsXJsXKuKrMWS5sVb4 4sV3Li3+RiyWYsW2X4sVaxVbxXnirmXFVzYsnYsVvHFVi8sVX8vhxV3FMVdyxVT44q3I37aYq0uK ubFW2Xh9jFV/28VQ+SYLm/kyLNZ+1iq/hiruGKu+LFXcMVd+zirsWtRbFsX8v5MVWK2Ku/YxVyti q3jiyXK2LFy4tajx/YxbFTFVPni1uTFXc8Vczfz4tjnwqo4WC7IodirsWxtVxVYy8sWtT5Ytio3/ AA+KuVeWKu5f8Liqzj/w2KrMVVMVU8VU8VVP8vFVPFW/ixVZ/l4ta7FW/wDLxVYvHFVL7H28klr/ AC8VVFxVRZcVXrxxV//Q+zbK2XMVf9nFXcsWtYuKu5Yq7n+3iq/lz+xi2NYqqc8VU/tYqqfF/s8V cv2vjxVey/7PFXcuH2MVX/HhVzNgVdirsVdirfHFVjYqu/Y4Yq3y4YtbuOKrMkltsVXK37eRZr8V Weniq/Frdi2L/ixVf/r4q7jxbFXfb+3iruOKtcv2/wBvFVRcVWN/Jiq/jirvhXFWsVbT7GFV3+Rg Ywb+L9vFk7hiruPHFXYqvX4mpiqzkuKu/ZxVb/l5Jgu4tkWa9lxVpcVdyxVWxVb9pvgxVYvt9jFV /P8AbxV37eKrVxZLsVXYsVv+viq7FVuLJtvjxVvFiqYq5VxVzNkGTWLFtMWTlbFXJirmX4sVd9jF Wlb+TFi232uGLJr7X2MWLXDJslVWxYrFbhiq7lirlXIK3x54snYsWvtYq7j+wmKuZsVVcVUuOTVt W54q3irsVa4/sYqvX+TFXc/2MVcvFcVdy5Yq7j+wmKtN9vFVRsVd9t8Vd/r4qsXjirl5ft4qv+HF VNV4Nirarirn/wAjFXfYxV3FMVdxxVdirfLniqzjirl/kxVf/qYqs5Yqv/1Pt4qp8XxVvizLirlx Vd9nFW1+DFVnx4quxVa2Ku5fz4qv+x9jFXcsVWLiqp/xLFWuLf7PFVnP9jFV/LFVnL+fFXKuKr1x VZxxV3D9jFXfYxVfxxVZx44q7j+w/wBvFVnFvsYqvkX4uGKrOKYq1yxVtlZMVbxVcy4q74v2MVWJ 9vFXcv58Vc3LFVvLIKu+P9jFktbFi3x7fsYq5v8ALxVpcVXYqt5Yq7lirWLJdyV8WLmVf2MmyW8W xYu+xirlXFV/2cVbxVr7OKqSYsnPiq7nkFaxYt4slL7OTVv/ACMVdyxV2LFc+LJbixb4/FiqxsVd iyX8cWLWKrePH4MVdxxVfxxVrFXYq7FXYqp4q19nFXfF9jFXcv28Va4/D8eKqjcsVU8kwW88izXr 9jFVnPFXclxVz4q74cVXcsVUlxVauSYLuX8mRZrOXxYq5sVXYqt5Yq5fixV328VWN9jFWuOKrf8A iGKu5fHi1u4YtjvixV3PFXYtaxcVabj/ALPFVv8AxHFsc3HFXf5GLW5uOKqbYti/9r48Vc328VWc cVb+LFVn7WKubniqxuOKr+GKrOWKtfZxa3Yq7FVvLFXfsYqpL/l5JLl/nxVYmKr/AIvsYqs4/Fzx V//R+znFm6Zc0r+OKuXFV2Kt/wCW/wBvFWuL4tjbYqvTFXYq7FXYq5f58VX8W44q71P28VX/AG8V cq4qsZuPx4qvXFXfEmFV8bfz4FcuKr0xVZyxa3LyxbGvt/Hi1uT7GKqnw/7PFsd+zirvstirv+IY q7FrXLi2LsVVMVUf9fFV6/bxVvliq/7fwYq5v8jFXLirWKt/GmKtYtapxbji2O4Yq7FXcv8AgMVd /qYq7FXfs4qp/axa1f8AyHxVpsWxtmxVytiq9VXFXcsVd9jFXcsVd8GKu48cVdiyXLirsWLsVdir bN+xireLJrlwxYtLiydkFVMVc+Ku/ZxV3Ljirv8ALxV37WKr1+P4MVWcMVdzxV37OTYreeLJdzxY u54qu+zkFbaPFktXFi39nFW2bFkp4sVbl8WKtZNV3HFVNm+Lh+xirca4qv4/DiqxfsYq5VX9vFV/ LFXLirmxV37eKu9TFXM2KrvtYq3y/nxVZyxV3D9jFVzN8PDFW+OKtceH7eKreP8AwGKuX4lxV3Fv 2MVXYqt+JmxVzYq7jirmxV3LFXN8OKu4/D/l4q5mxV3Hjiq/jirv8jFVnLFXfsYqvX48VWK2KrsV diq1VxV3L/g8VXYqt+PFXLirTfbxVvl8WKu9T4cVXq2KrPi4Yqu+D9jFXYq7i+KrWX9jFXfBiruP /B4qskVeOKu/axVe2KrcVXKv8+KrOKYq1yxVU4fsYq6T4sVdx/kxVS5ZBW/2+eKu4pireKrVxVt/ t4q5VxVv9jniya5Yq1xxYrsVdirmbFkp8uOLFezYq5vg+xiqjxybJUxYu54qvb/IxVZ+1kGTsVcz Yqs44qvfJsVHFkv+38GLFvFk7FVnH+TFXKuKrmXFi74cVaxVtlxVYuKrsVW+niqxmxVf+3iq7FVi rxXFVi4q5cVVsVUv2sVXriqmrccVbbliqmzcMVb/AMvFXPiruGKu4tirkxVYzYtbXL9vFW1xbGsV b+HFrWNi2OVcVdx/4DFXYslNsWLlxVby/bxVyYq7FrdGvNeGLY5eGKu5LiqnzTFrb44qpcsklUyL N2KrWbjirmXFXfYxVdiqHfFXYqubFVH7WKqmKuX/AC8VWMy4qvxVRbFrXYq7FsbXFrWcsVWsuSSp /FyxVWxVD8MVf//S+za5c0q7L/PirWKt8uS4tjWLWtVW/bxbF32cVdirfJnxVfwxV3+QmKuxVevw Yq5vsYqvZfhxV3HFVn7XwYVbwK0v28kwVmyLNr7OKuxVtmxa2vtYq3xxVrFVT/ieKuxV37OLY7Fr XLi2N8uGKr1ZcVdy/bTFXYsl2LFteLYq3/xHFWv2cVd/l4q74cVd+zhVfgV2Ku+3irsVd9n4MVc3 8iYq74sVd/kYquXFrbxZQbxZOxV2KtLxxVf9vFXceOKu+xiq7FW1XFWsVbVcVaxV2KuxV2KqnH9j FVnHFXcf58VayDJf+zw4YsW8WTsVdirsVdirm+1irv8AUxVcq4sXccmq37Px4qvX+fFVmQZN/wCR ixXfs4slvLFi5sVd/wASxVdiq1sVVV5ZNXcsVU+OKtq37f7GKtf5eKrsVXcv5MVcvHFV32cVW/E+ Kr+P7eKrFbFXfBiq/lwxVZ+3iq9WxVYv8+KuZv8AgMVd9vFXfsYq7l8OKrsVdirbScMVWcsVX/Fi qxvi4YqvXjirTLxXFVvLFV/+WmKu/wCNMVWcsVcy/wDAYq74v9jirmxVzMuKrsVWq38mKu5cWxV3 28VaX7P+Tiqp8Sf6mKtYq7FVrKuKrsVWcXxVtfsYq5uX28VXtiqxcVXYqt4fsYq5W5Yqv/a4Piqz jirv9fFXfbxVf9pcVWK2Ku+DFVnxLiq9eHLFXfHiqn/qYqqM3JsVXYqosvD4MgqriqlwfFVRsWSl xxYrl+zwxZLmXFisZcVWs2LJfixW8sVcuKreeKufFXc8VX8cmq3FXYqvZvi4YqsxVyrkGTsVdiq3 Jqs+LFVXhixWN8GKu5YqtZsWTf8AqYq2v8j4sVjLiq7FXYqtbFXLiq7FXYqpfYTFV7YqtxVcy4qt xVd/r4q7jiqxfjxVrlirbLiqzj+wmKqmKqSr+3+3irbcf28VdyZMVdwxVzLi1rfhySVuRZt8cVdx xVrFXYVW/b+xgV3wYq5sVWK2KrP8jFXYq7ni1u4YtjsVczYqs44ta/FVPFVy4WxR5YWC7lgZrsCu xV2KreOKqPx/y4qvZsVUWxVfzxVTxVvjiq98VU8Vdi1uxVtsWxYzfsYtanx+H48Vcq/yYq1xxQsZ ckyf/9P7MrmQ1Ilsih32/t4tjmxa1nHFXLiq77WLY7FW2xVfirkxVfy4Yqs/1MVXNirmxV3+Rirm xVvg+Kr48VX8fi+DFV6/zviqiuKrlbmuLW5vt4q3y+Lhiq/hiruGKuxV2Ku4Ytipiq3liq/liiDe LNy4sXLiq/4sVWcsVX/FiruWKu5Yq7/UfFW/+JYta7l/Pi2OVuPx4q7/AF8Vczc8Vdx/bxVytwxV b9vJMFX9rIoa44titiqizLira/5GKr+WKuVcVdx/kxVdiq3jiq7FVjNiyX8sVWsy/YxYuxZN8XxV dx4YsWmxZObl9t8VVG/nyCufFXYq7FXK2KuZcVdirXDFi3iyW8U/2GTVcmLF2Kr/AE+eKqfDIKqY qu4/8Hiqn/xLFVzLzxZNcfixYtcsVXNxfFkv5N+xk2Kn/kYquxV2KreOKu/yMVVOWKuVfhxVdiq3 liq9mxVy4q5cVWKuKr+PP7eKqfF8VVPixVrFW1xVy4qsVcVX/tPiruX8+KrOP8mKrsVW8cVXr/J+ xiqxsVXtyxVr7OKreWKuZcVXs2KrP8jFXLirmxV3HFXfb+PFV/HFWsVWv/kYqvX+fFVnLFV7Yqsb FV/LFWsVdirat/PirWKuxV2Kt8f2MVa4Jiq3l/PirvsYquxVYv28VbZcVX8cVWfYxV3+Riq//LxV ZyxVy8cVcuKqfxccVVP2MVWN8H28VcvH/Z4qqZBXYqtb9jFVHhiq9VxVyrirmbFXM3DFWuOKt/tY q3wfFk0vLFisfFV6ryxVYmKt/Fk1Xs2KrExVft/PirmbFVNlyCrW5JiyX8v58VU8Vb/y8VX8MVd9 vJsVP7OKtftYsly4sWuWLJa2LF3HFXf5GKr1xVrFVvLFXfYxV3HFXfByxVdiq37DYqp8sVb4/t4q v5Yq7kq4qoviq+RVxVZ8WKr2XFVjLwxV37OKu/yMVdiqni1tti2LGbFV64qp/wDEcUTb4/8AAYpd xbjzxV328VW/BiyXcsWKnxxVYy88VbTFrWccVX4tjl/nxVTxa3cfhxV3H9jFXN9vFW+OLY1iq1vg X4MVdxxVczfF8eKreTfsYqp8cVbbliqx8VWf5GKr1b+TFVPFrdi2NsuKrP8ALxa3ftc8VXcnxVYz Liq3g+KuVsVWcsklv4sVf//U+zq5kNS6TIocn+Xiq7FW+OLY7ji1r8WxTVfh4YqqNwxV2KuxVcy/ Fiq7FWm48cVX/bxVdirsVW8cVX8cVdxxVZ9j7GKr1xVyri1tYqqf5eKu5fHirsVd8OLY7Frcq4ti /l+3iqriq3liq7FVP/LxZLuOLFdira/HiruPL7GKtYq38aYq3ywq0rcsDWv5Ni2O+18GKtfsLirf 7OKuZeGKuZeP7eKrUyTBV4qvx5Fm79rFW8VaXlyxVerfsYqsVsVVcVUuPPFXcea4qrfDirWKtquK tYqt/Z54quxV3LFk3yxYtYqqfFiruX8+QZLFXjiq/FXYq5vixVzfaxV2KqeKqvHFisybJcv8mLFU xVTVeeQZL+Pw4qtXFiuxVd/xLFVnH9jFWuOKt/ZxVrliq77H2Mmq/liqmzfFirmblirfxYqv/bxV yryxV3FMVXL9vFW1XFVnD9vFXcvixVzNiq5/sYq77WKt/Y+3irX2cVW8cVcvH9vFXfCmKr+Pw4qs Vf2MVdyxV3xPiq7FVvFMVXYqs5Piqo3HFWsVbbFWsVWsv8+Ku/kxVfyxVY3HFV683+DFWsVWrirl ZcVXt/Jiqz9n48Vc2Kr/ANnFWsVW8cVc2Krm+0mKrft4q5VbFXLiq9sVWf5D4q7jx+B8VX8cVWfY +xirv9TFXLiq7i+KrV+JcVXsuKrOT/bxVfxxVYy4q5cVWL8GKr/sfBiruPxYqsbjiqriq1sVd+3i q3FW1yCrcVaVcVVP8jFksxYtLxxVtm5riya+LFiq4qh/ixVUxVr7WKtccVayauZf2xiq9VxVYrYq 7k2QZOZsVdiruGKuxVzL8WKrOOKtpk1W8cVVHxYqeKuxV2KreOKruOLJ2LFvjiqxsVXYqpKuKr/9 nirvhfFXccVWfFiq9VxVZ+ziruP8+KrG/wCExVz4q5MVdx/nxVzfZxVezYqoYq22LW5sWxzYq5mx VzYqsXFV2KuxVbiyU2blixd8PHFVuLW7FXH9vFV6t/w+LYsZV/bxVTxa3Yq3yxVpvjbFW2xbGsWt T/YySVrN+xkWap+z8eKuf/IxVri+KrW+L4MVc3+RiqjxxVfiqzl8WKtYq22LW7jiqz/LxVdiq3JJ Wcf58ihYzfz4ti9vjxa1n7OLY//V+zqrmQ1KmRQ7FVvHjiq7Fsb488VXr/l4q5f5MVdiqnwTFVf7 OKt4q7FVvLFW+Pb9jFVXFVHji1qnLFsX/tYq1iq1WxVerNi1rPtZJLvtYqv/AGcih3x/sYWxfwwN buGLY5MVdH/l4VRGBVPFrXYty7Fi7FVq4quxV2Kt/Dirvh44q5ftfBiq1V55Jgq8V/YyKHcf5MWx 32fgxVzfZxVyYqqYqp4qvVcVcrYq7g+KuZuC4qs54qv+ziq/liq7FVqrirm+L48VXt/PirWKrV+z zxV3LFXYsm/2cVcv8mKruXPFi79nIMl/JsVcmKuxV2KrOOKrsWLb4snf6mKuxV2TYuZueKruOKuV uOQVZiq/7aYq3iq3jirf2cVcy/DirvsfbxVv9nFk5W4fYybFey4qs/axVfx5/wCpiq7FVFcVXYqq 8cVa+1iq3k/2MVdxb9jFV/8AqYqs+3/ssVdxZsVdxxV37GKublirlbFV68sVaVePwfsYq7FVvLFV /LFXNirWKreTcvjxVdiq1sVXqvPFViriq77OKt8f5MVWN9nhiq9WxVrFVvwYqu4Jiq7/AIjiq3FW /wDXxVY2Ku+DFV7Yq5VxVy/yYqs/18VXYq77OKrfjxVy8lxVy4q74MVXq2Ku/axVYuKuXliq/j+3 irWKrePw4q5V/YxVey/sYq5sVWL8OKr+WKrP+I4q7jxxVzfsYqptiqtiq1sVXYqosvxYqqN8OKu4 4q74uWKrcVdiq3l8X8uQVVxVSX4MVcy88VX/AGMVU+WKt83xVvFXcHxZNJ9vFisxVv7S5NXYq7hi rWQVvFk7/XxVz4q7hirsVdzxV2Ku/ZybFTXFk5sVW4q5cWLn/wAvFV7Yqs+3iq7FVvw/sYqvbFVN vt4q39jFV2KreWKu+22KrsVUeOKu4/sJiq7FWv2cVWcf58Vd8OKu/wBf7GKrv+JYqtZf+DxVyYqs blirWKuxVtmxVzN8OLWpYtipirsVW8cVU2xVy4qtTFXYtbv8vFscv2cVWK38mLWv5fD8eKqP2ckl fxyKHcefwYq5cVWZJK7Is1rNiruWKrsVUvtYq5Vxa1Hjiq/hi2LP2sVczYq1iq1lbFrXYqt/YxV3 +viqnkktM2Ktf6+KrV54q//W+zPLMhqVuXHIodx/YfFXKuKr1xbHccVa+1iqo3+XirlbFXYqqYqs ZcWS/Fi7FV3H+fFXN8H+piq3FV3+pi1rsWxtVxVy4qv/AMjFrUckle3LlkUL2X7GLY5fj+PFrd/q Yq7Fsc3+Xiq9fgxVytirmXFrXcXxbG8WTmXFivXFXNirvixVy4q1irsVb44ta9MWx3PFXYq5eeKu 4Yqp4qrLx+xirfH4cVd9nFVXFVPFWmbFXL8eKu+LFV/D9jFV2Krft4quxV2KuxVbyxVeuKrMWS7F i2uKr2XIMlPFVT/UxVTxVUxV2Ku5NirsVdx/kxVpMWLf2fjyauTFXfs4q22QV3+RirlxVd9leeLJ pcVd8WLFfxTFVPliqqzck/yMmq7FVv8Aw+Ku+3irmxVY3v8AYxVev8/7eKu/y/28Vdw/YxV32MVX 8v8ALxVZ/r4q7jirv2eD/sYqv/1MVdyf+fFXfDiqnxfFV+KuxV2Ktt8eKu5c8VaxVv8AZxVZy+Hn iq7FVq4qu+1irarirS/bxVb/AK+Kr/8AIxVrFVqr8OKr+P7GKubFXNirSqv7GKtt/JirX2sVbb4P 2MVWckxVfxxVrFVvLFXfYxV3wYq748VX/tYqs+Dliq7FVqriq9VxV3Hn8GKrP8jFXcP2MVcvFV+P FV/LFWk+xiq1eOKu5Yqv4/Fiqxf2HxV3HFXf8RxV3wYqsZsVVcVUv2sVabFVbFVr/wCXiqmuKu44 q5sVbZsVVcVWN/wWQVbiq1sVVGxVZ8OKtNiq/Fks5YsW2XFWuOKreLYq3y/bfJqu/wAvFVuKtc8g reLJ3DFXYq58VWccVaxVerYsWsmyU8VVm+HFio4sl/7OLFrFVrYquxVbxxVeyrirWKttiqiy4qv4 4qpqy4qqN/Piqz4vt4q3iq5eWKqfw8uGKr2VWxVSTFV7Niqz4mxVd/xLFVrf8Piq5l/nxVS/y8Kr 2XAqz08VUvt4slVvjxYrOOKr1xVZiyXYsVPFWlXFVmLW7hirsWxYuLW7jiq1cklcuRQ5lxVrFW+X 7GLYpcckwXLkWa7FVvLFVjLirXHFV2KqeKqeKtriq/FVjNirWLWsVcUL8Urf9fFVHjkkt8HxVXyK FL4vsJir/9f7MtmQ1K2Kr2yKGm+3ira4ti9lxVy/yYq7FXM2Ku+HFVTFVPFV3HFW2bi2Kr14/t4q uxVb/kYqv+LFWsVW/wCQmKr+PPFrc2Ku/wBTFXccVcq88Wxfx/nxV2LW7/LxV3+Xi2Lv8jFXf5eK uXFVTliq7FXYq1iiC5mxS5cVdxxVrFW1XFrXcfixZQb54snJirl/k+1iq/8AyPs4qsxV3H9jFVTF W+L4qsZf2MVbZsVaZf58Vb+1irTYqqKuKu+DFXcU+3irlxVe2Ku5Yq1irXL4cWS5cWLeLJdixWcV Xpiq/nkGSz4sVX/Z+xirmX9sYq74cVcy4q1ixbxZO48sVW5NV2LF3DFVzfz5BWuOKtsuKu4/FirS 4qrYqt5fD8eKrG+PFVTl8WTV3H4sVdxxVbiq5m+xiruPLFVuKrv9hiq/jzxVYvHFXKvw4q7/AF8V XYq7FW1X9vFVnLjirlZcVdyxVfxxVrFVvH+fFVZfhxVZxxV3HFWsVdirf7WKu44q19nFW1bFXcvh xVrFW1xV3HFVi4q79jFXcebfHiq9vjxVy/A2Ku+FsVa+1ira/wAmKtYq3/qYq74WxV3LFXcf5MVW LyxVey4q5VxVrFVq4q5sVcrYqvbFVnwYqv44q1iq3h+xiq7FVv7GKr/2sVWLiq/ly+3iqxV+H7eK u5Yq7liq9W5YqsbFVn7WKr1b4cVWKzfYxVr/ACMVVP8AiWKuVcVcrYq5sVU+OKu5Yq74sgrn+3ir uXw4qv8A2fjxVbx4/G+LJr4cWLeKruWKrPsfBirmbFXfB+xiq3hk1Xf6mKrf8t8VayCuxVvhiyc3 PFVPFVRvs4q79nhiruX7GKuxV3L4MmxUcWSo+Kqf+XixXq2Ku/yMVd8f2MVd8PHFXccVWMuKu5Yq 5vg/1MVdxxVdiq1VX7GKrGbFWv8AIxVU+xiqz7H28VaXFVv2F4YqvX48VWc8VdirkxV3Ljiqxvtf 5GLW1i2N/s4q74cVaxVay8sWtzNi2O44q7FksZcWlpsWxby5YtbkxV2KqfL4sVVOP8mLYp/Zxa1R 8VUcklfx/kyLN32Pt4qskxVazZJg0y5Fmq4qt+D+fFVjLiqzFXJirmb4vgxVYv8AJiruOKtYqtbF rXYqsb7eKts38+KrG5YtjXLFrXLih2KX/9D7PqvxZc0u5Yq5v5MVcv8AJiq7Fsb44qvVcVWcv2MV XpirnxV3JcVdiruGKr+yYqvXFXNz44q5WxV3+Riro8VXr9n/AC8Vaxa2/hxVrl/Jiraf5f2MVWcs VVkxbHYtbuP7eLY5WxVerYq02Kq2KrcWTsVWP9vFpVv2sWxT4viq/FW+OKr2/nxVTxVe3fFjBvFk 5VxVzfz4q77Px4q7l+xiq9WxVY+Kr+XPFV6/8Piqxfs/5eKt4quX7GKu5Yq7/LxVzN+3irsWS9cW K1WxZNcsWLf2cWTWKqmKuxVbixXcVxZLsgqnirsVVHxV3DFXL8S/5GKub/IxVzNzxVd9psWK3/Uy au54q2q8sWTfHIKt+H9vFW/9TFiqccVW4q79nFk19rFi39nJqv5fFiqzj8WKu+HFXfB+xirub4q7 7LYqv+LlirmxVzfz4quxVa2Ku/1MVXs2KrGZXxVy4q7liq9sVWLiq7FW/wBr+bFWsVb/AGsVWL8O KrsVb5YqsZfhxVfy/kxV3+Rirv8AIxV3L+TFWsVb4/sYq7n+x+xiqxsVXqvPFWvtYq7FW144qsX/ AF8VXrirl+FaYq7jiruS/bxVy/HirmXFWvs4q77OKuxV2KuxVby5Niq7FXYq7FVvLFXcsVXYqtbF Wm+3iqpx4fYxV3Jv28Vd/r4q1irsVd9nFW+OKtYqt+PFVjMvHhiqriq1vhxV3H+fFXcv5MVa5cfj /bxVY2KuZWxVU/a4Yq5eOKqaquKtv9vFWub5BW8Va488Vb/axZLmxYrcVXN/w+Ku48cVWsv+Xiya +zixcuTVb+1irsVayCtt8OLJe32MVUMVb5YqvxVY2Ku+HFWuL4quyarcWLsVc2LJazft4sV2KrcW S7Fi7FXYqtXFVPliqo2Ku4f5GKrOX7eKr1b9vFXceC/Hiqz7WKuX4/t4q3iqnx4/A+Ku5fBirlVc Vcq/DirsVd/xDFXcf58Wta2Fsa/ZwKsXFV/7OKrGXFVuKqmKrfjxVTZeOKJrsUqf28Wt3DFsX8fi xVY+LWs/1MWx37OLW1irfLn/AK+KuX2+3iqkv/D5JKq2RZrOXxYqpti1qiri2LG+xirvhRcVcvwY qs54q5MVWccVc2LW1i2Nri1rGbjiq7j/ACYq3+1i2IdWX7eSYO4/sYqq8ea8MihSb3+xkkv/0fsz xzIakRkULfsYqv5Yq1y/bxVU/wAvFsU8Vb4/yYqvZcVc+Ku5f8Hirl/4fFVTFVP4lxVUxVd+3iq7 FW+OKu5fFirm5Piqz1MVX/Fi1u5Yq5lxbFrZJgqquRZu/wAjFXf5eKu54qqYq1y4YquVsUQbxZqe Kt8sLFW+HArv8vFXccVWYsl7YsXLi1r2/wAvFsdx+DFV/wDO+KrHxV2KufFXceWKrmxVyt8OKt/t fHirlbFWmb+fFW1+P7GKquKqXH/IxVf/AMSxVyrxxVy/Dirvt4qvXFWsVW4slZ8WKnyxZLcVX8cg q/FWl/kxYt88WTStixbb7WLJ2KuZsVafFi2v/CZNXYq5lxVrIKv+1irlX4cVbZm44sly8v2MWKzl /PirSt/PiqrxVcmrlX9jFVNm/YxVtVxVrjiq7FXYqt44qqKvJfjxVdiq39jFV6riqxcVcuKruaYq 7FVPFVXliqxWxV3HFV/+QmKtYq23x4q79nFXccVdyxV3H4sVcuKrG/nxVdiq37eKr+P8mKu/axVy /G2KtYq2y8sVaxVvliqxV/bxVev2fjxVy/yYq74sVd+1iruWKtfZxVv4cVaxVd/xHFWl5Yq5WbFX cfhxVzN8OKuXFXcsVWceWKrsVbXFXN8GKtL9vFXYq7FW+Pw4qs+JV+DFXcvixVy8OWKr/wBnFXcu H28VWKy8cVcuKr25Yqs/Z4Yqp/5eKqisvHFXL8OKrcVa+1iq/wCx8eKu/a54q5f58VWcvi4YqvXF XLiqn/xHFWuOQVv7H28VX/Hiqzjw+3irl5Niq9fhxVZy/kxVzfZ+DFWuOKruLN0xZOT7eTYqWLJd ixcy4q5MgydwxVTxVU/18VdirueKqeKtt/Piq9f8vJsVHFku44q77OLFtsVW/tYsm8WLsVdiq1lx VzYq03xfBirfHFXccVU2xVvj8OKuZuGKr/2v8rFXc/28VWfH/sMVU1Xhirf2MVdirsVdy/nxV2Ku ZcWtTxbG+WKuXFVDliq7liyVeOLFSxVczYqptiq3Frcq4q7/AIhi2O4Yq74OeKub4cKrFwNa3jkk t/t8Mihtfg+xhbHMvLAqxm+L4MVdxxV3+RiqnxxVzYq3+ziqxuGLW0y88WxuNeGKrGxVzNxxVpl4 Niqzi+LWqN8eKrGXjiqkzfDkku+LlkWLub5Jk7lwxV//0vs+v+vlzSuxV2KreWKr1xV3LFsX4q7F Xc8VcmKufFXL/Jiq9fgxVvFV32MVWL8eKr+K88VX/DirXBMVbbFXfbXhiruWLW5vgxbGv8j9vFrV PsYqsX4MWxe+LW5vhxV2Kr1bni2O5YVXsuBV2KreOKub4cVc2KrsVcn2MVb44q5VxVy4ta/j/P8A YxbFPFVRWxV2KqeKqjN8OKrmX9jFVq/axVeq4q5l+LnirX/EsVcuKuXFVT4eOKu44quxVby+HFXK vHFXfsYquxVv4cVaxVbiyVsWLsVdy45Bk7FVjYqvxVf8H28VU8WLa/yYsmsWK/j8OKrsmqnirueK r+KZBk0q4sWuWKt8cWS9m+LFip8sVb5fz4q39v7GTVfyTFVNcVbX+fFXLyxVfHyxVzNiro8VXYqt 44qv4/FiqxcVcy/DirlxVerYq5uP28VWfBirvgxVfv8Az4qsZeOKrsVW8sVXYq7FW/ixVrFXfZxV tVxVZyxVdirsVbX+TFXNiruOKtfZxVvjirWKuxV32sVdirbccVaxVtlxV32/gxV3Hnirm/yMVd8X H48VU1Xj8D4qqN7/AG8VaxVtsVWKv8+Kr2bFXcsVd/qYq7jz+DFXcf28VWMvP9vFV2KreWKu+DFV nqYqrMuKubFXfFiqz/XxV3J/t4q7n+xiq/8AZxVZ9jFXccVWcv2MVXtirlxVzLxxV3L4sVXYqtX/ AH4+KrsVW8cVdz/YxV328VWfZ/1MVdkFW8cVVF+LFVPjiq1MVXriyXt/JixWKuKtcsVabniydk2K 3FkuxYrmxVb9vIMnYqp4qvVcWLeLJTxVezLixbxZLF/yMmxd/l4qsxZLsWLSriyXcsWLuWKtYq7F VvH+fFXcsVcuKu44quxVauKrsVUWX4cVVOOKrsVUv8v9jFXMzcsVa5YqtVeS4q79nFXcf2HxVYuK t8fsZJg1xyLN3+pirWKreH7GKreOLJ3HFV3Lj8GLFdiqi2KrW+1irsWt2Ku/a/yMVd8X7GLY77LY qptxxa3YqqYqpfFkkruXFfjyLNZ8K/HirmX+fFXcvhxVdiqi2Kt8f58WtZiqni2N8cVdyxVzNi1t YqtXFsXYta3l8OKqK5JLf7ORYtNkmS3/AFMVf//T+zSfbzIalXjkUO5Yq74MVXYq7FW/ixbF74q7 FXYqu5c/t/bxVamKrlVcVXYqu44q77GKu+3iq/jirmbFXcsVcuKtc0xVtlbFXLi1u/Z4Ji2L1XFr cmKrV4ZJK7IoXqvxc8Wx3H4cVVcVWquKu4ft4qvXjyxa3ftYtjvhbFWsVb4/t4q1iqpybFrdi2Ke KqnPFXfC2Krv9TFVvPFXcvi54qvXCq/lgVRxVf8AB9vFV7LyxV3x4q5lxVZ9rFV64q7n+3iq9cVU vjxZKmLF2KuXFk2uLFvj/PiyXcMgrsVcmKu4Yqp4qqPirnxV37WKuxVd9rFipquTZLsWLfHIKtxV U+JsWS1sWLfxYq5WbFWlxVWxVpW+HJq5W+Lniq3FWuPxYqvVWxVri+Kt8f58VcvJsVc2Ku+FMVc3 +R+xirmXFXf8b4quxVbyTFV2KrfsYq5uOKuZcVcrYq7h+xiq/wCLFXM3L4MVcuKrGXFV2Kt/Diqz 4MVVmb+fFVPFVTFVPFW+OKu44q79nFVjK328VX8cVaxVv9n4MVcq4q1zTFW/8vFXL/JiruOKtYq3 yxVy/CtMVdxxV37WKtL9vFW2+zzxVr7OKreWKrsVb5fDirlbFXccVdxxVrFVrfY+PFXLiruOKu+D FV2Krf8AIxV3H+fFV2Kt8cVWfY+PFV7fz4q5cVWN8X28VdxTFXfbxVy4quxVb8eKuXFXfEqf5GKu b9hMVU1X4cVVPTZcVU2xV3Jft5BV64qt+B8WTSrixczYq23L7eLJ2LFaq/z4qu/18WTlbh9jFVmT YuxV3HjirueKrmxVarZBk58Va54sW2X9jFk58VWccVXviqk328WKr/xDJqp4qtbFV2KreX8mKu/y 8VXsuKrMWTuPw4sV2KreOKrsVUeWKqnHFXNirl+HFXLiqnyxVdiq1sVW/BwxVe3L7GKrGb9gYq5V xV3+RiqxuOKtYq5V5tiq1sVXYqtbFV2Kqfx4sl3HFitxVTb4cVcvxYta7ji2LcVdirpGwqsXl+xg a3f6mKqKri2L/wDIxVdiq3jx+PCq7Aq1uHLFXMuKqfLFVuKuxVz4q5mxV3JcVU/tYq7Frdi2KbZJ gu5csih3qccVUZPsZJK7FVNmxV//1Ps3mQ1K65FDWKuxbHYtbuL4q22LYvZcVd/qYq7nirmbFXL/ AMPiqtxxV3+vhV3LArmbFVuKrlxVeq4q7j/JirlbFra4Ji2KnPFrU8WxtW/nxa3K2Kr+eKuXni2O xa3cuOKrmXji2KjNirsWS7Fi3y4Yqs44q5cVX/FiruXw4qs5Yqrf6+LW5f8AieLY5l+Lniq/lw+P FVirzxVf2fFVmKuxV3L/AIDCq5cCttxxV3L9vFV/L4sVWLyxVf8AsYq77GKrsVdirTLiyXM2LFy4 q1irlxZKmLFbxXFk1y/YyCr+eKubhirsVdiqniq/Fi5MVdwxVv4cWTueTYrlxVpcgq7FV3FPt4qt xVauKuXFXcsVXfs5NW8VW/5GKr1+3ira4qp8cVVOOKrsVW8fixVyf5eKrsVW/wCX/Niq9WxVTb7e Kr8VW8V/kxVcn2MVW/Y+PFXN/wAJiqp/xLFVPir/AGMVXtirlXFXKvHFXK3w4qsbFV/HFXcueKuX 48VdyxVr7OKtsq/Y/bxVyrirWKtrirlxVy/BiruPFcVc32v8vFXNiq/FVPFW+OKuXFVn2MVXrirv 2cVc38+KtYqqYqs44q5uOKtYq3yxVrFVqt8OKr42/nxVrFW+TL9v7eKuZcVc2KrOWKrsVbXFVi8c VXsuKrGXjirvi5Yq74OWKuXFV2Kt8sVaxVavHFXc/wBjFXceWKrsVdyfFVrf8Jiqz4ExVfyxVdiq 1cVU/wDiWKtM37GQVdirSr/Jiyd9rFi0uKtq2KtcsVb/AGcVa44q5sVa/wCJ5NXf6+KufFVzYqtx V2QZNc8WLeLJy/axVTxVtvjxVd9jFisf7GLJcmTVTxVdixb5Yq7lirlblirmxVzNirWKrfTXFV7Y qsXFV2KrfgxV3/EcVWcf28Vc38mKr/8ALxVYvv8AbxV3HhiqzFXcV+3iruP7eKufFXcMVdxZ8VWc cVc2KuZcVaxVa2KubFV2KrOT4qtX48VWc8Wt3DFsd9vFrcyri2OTFXMuKqTfHkmC74sihzcsWxrF W/2cVWN/JirmVsVXYqtbFVNsVdyxV3LFVHFVTl+xirueKqbN8PPFXYta3j/Piq1sklb8PH4Mihtu PHm+KtZJLsVU3xV//9X7OKq/Yy5pXt/JiruX8+KuySV2RQ2q/Di2OXFWsVVMVdzxVd9rFkt+xixX /Fiq/wCL9jFV2KrVxVy4qu+zirarirWKqf2MkwVV/nyLNrFXYtba4qvTFsdxbFrdhbHMuBrXcsWx dyxZO5Yqu5YsXN8OLWuxbG1blirWKt/tYq1iq1ft5JgrJkUOb4cWx2KuxVzcMVdy+PFXc8Vcv2sV d+zhVfy4YFVcVUWxVzK2KrsVWqv7eKqjNiruWKr+Xw4q79rFVnHFXcsVXrx/2GKtLiyW4quT7GQV UTFXcvjxVTxV2KuxVfixbxZNJixbTFk7/IybFd/kYqtZv2Biq9f58gyaZeOLF37OKtcsVbZlxVps VVOOKrfstk1XcXxVtV+LFVP/AFMVVP8AIxVdiq1f5MVcy4quxVZx5fbxVfiq3liq/wD18Va+D9vF W1XFXM2KuZf28VWccVcrfz4q5ftcExVevx4q5cVaxVbxxVfx4Yq1iq3l+x+3iq/l+xirv2cVWM3x YqvZeGKu5Yq5eOKuZcVaxVvlwxVzfa4Pirv2sVa5PirarirmbFXf6/2MVdy54q1irbfHiruOKubj irvixVYrYqv+w+Ku/wBfFXNyxVrFW+OKtcnxVvi3LFVnHFV6/wA+KubFXceGKu/yMVdx+J8Vd/l4 qsX7GKu+x8GKu4p9vFV2KuxVbyxVdiq1v+ExVf8AFirWKtr/ACYq1irfH4cVczLirTfbxVazfsYq 7j/JirmbFV2KreOKuZv2MVUlyCqn+Riqn/qYq3x7/t4q0uKrub4sl3HFiuxVa2KqPPFW/sYsnMuT Yu54q5W+Hhiq/lxbFVPIKtXFkvTFVPFVTFXM3ZMVdirsVWf6mKtZNit/bxVfyxVrFWlXFk3ixdir uaYq7FVrNiruWKrsVUuD4qvblirmxVT/AMvFrbVuX28WxyfbxVZy44q7l/PirsVU8VVExVczfFiq 37eKrOOKuZv58VaxV2Kttx/YxVQ/1MVVsVWr8WKuxZKP2lxaVi8uWKr3xVfy4Ytizl+3irmbFVPF rd9nFWlbJJaVsizXJ9jFVRMVQq4qqfY+DFXMzYqp8cVcuKu44qtxV2KrGb+TFWsVb5Yq1i1rVxVR 45JK9WyKFq/5eSSu5cMihSTJJf/W+znLh8GXNKri2N8sWt3w8vgxVy4q7/XxbHfs4qvxVTxVU54q 3/qYsmlbFiuXFW1XFWuWKqnHFVJWxZIj9nFi7/jTFVn+p+3iq7j+xi1t8sVcuKtcnxVpmySVXhgZ u4YGty/FirvT54ti5cVVsVU+OLJdx/nxYrsWtvji2NYq22Ku/wBfFXK2KrP28KrsDWr/AB/t4tix MVdzxV2Kr+PNcVWcMVd+ziq3lhVUZfiwK5cVc2Kr25ceeKtq37eKqbKuKqisuKuVcVcvL7GKrsVW cXxVU5YqsZlxV2LJdyxVUfIK58Vc+KuxV2KuVcVdxbFXK2KuxV3Hjirvt5Ni0zcMVVPs4qt/18gr mxVzYquxVUxVR+Lliqpy+LFVv2myar2xV32Pt4q7/LxVYqsn2MVXqv8APirvib4MVcq/sYqvVcVW SfH/AK+Kr+Xw88VaxVtsVWNiq/7f2MVWLiruP8mKrsVWtiruOKu5ccVXriruWKuVsVaVV/YxVv7S 4q5WxVr7OKrVXFV2KuxVbyxVWxVYuKtL9vFVTFVi4q7liruX7GKrP8jFVT/iOKrV+3ira4q5mbFW sVbX/IxVfiqgqsmKq6riqz/IxV37WKuVsVaxV2KttiruOKuZcVdxxVri+Kt/FirX2sVdirsVW/Yx Ve3L9jFXcv23xV3HFVPk+Kt/5eKu/wAvFXf8RxVdiq348Vcn+Xiq9mxVY32MVd+z8eKr2xVZJJiq xf53xVf8eKu/y8VWcf2MVa5Yq77OQVtuPLFk1+x8eLF32f8AUxVrliq5W+HniyW8cWLuOKu44q2r YqsxVvhk1XKvxYq2rc8VWN8WKuyDJ3w4q5MVdirWLFv9nFk77GKu+xiqnirSrk1bxYuxVvjirmxV 3LFWsVW4sncsWLv9TFXcv5MVXYq7FVFsVb+ziqxvixVc2Ktp9vFVnH4eeKuZvixV2Ku4rirmjxVy rirWLGa1cWTv2sVc2KuZf28VcuKrFxV3HFXLiqn/AJGKrcWtzLirv8jFXc8Wxd/kYqpccVcvwYtb XH4cVdx/kxVtcWx3LFXM2KrOPw4quxVR44quxV2KuxVTTFXYqp4q7FrW8eOKtfbyTFr4kxZtM3w/ HkUNZJK3jiruWKrcVf/X+znH9vLmlf8AYxV3xcsVX8uGKtcfhxVtV44tjWKqiYqs/axVfirlXFXY VXKvxYFVOOKu44q7/XxVZy4Yqv5Yta9vb7GLY7/IxVZ6nxYqv48PsYtbvixVrj8OKt8l/bxbHK2K r1XFrd+zi2L/ANr48VcvwYVX4GS3FiqYqp4qqquKuXFXccVdxxVY2Kqi4VXYGt37WLY7FXc8Vd/r 4q7j/Jirl+18eKuZsVXK3w4qqM2Ku/YxVZy+LFV7csVdxxV37GKuVeHx4quxV2Krf8vFV2Kt8sVd y/kxVy4qvX4sgydiruTYq74sVdirm/kfFXfF+3iruGKrvtYsVi/DirfPJq7FVzL+3irfLniqz/Xy DJfixa+JcVcvwYq1/r4quxVdy+LFW+WTVbirXL9jFV/2MVcv2eGKu/y8VcrcsVX8sVdx/nxVzfz4 q3/xHFVPl/weKu5ccVXYq22KrFbFV2Krfi5fBiq5uTf6mKuxVYv28VVFxV3H4cVcy4q7/IxVY2Kr +OKtYq77WKuxVvjiqz+Thiq/liq/FVi/5GKu+N8VaxVav2MVcy8cVcuKr2X+TFVnH4uCYqvVsVcv +RirX2cVWr9jFV/HFWm+3iqpiqzlirl5Yq5cVd9j7GKubliqz/UxVerftviqxmxVe3x/BirWKt/D 9vFXcv58VWM2KubFXfyYqv8A9TFVnw/YxV3FWxVdirf7WKrP8jFV32cVWt8OKu4/Diq/4mXFVFVx VVxVarYq5fh+NMVa5cF+PFW/9fFV2KreXHFXfYXFXLiqkuQVuP8AkxV3H4sVbxVr/U+xirf+piya 5Yq1yxYt/DireKtNyxVbk1dirm/kxV3PFWsgrnxVvi328WTsVdx5Yq58VaZe6YsW+eLJZyxVrjk1 c2KrVXFiuxVteX7eKrMWS7Fi7FVvHFXfYxVzYq1xfFV+Krfh/bxV3LFVNm/YxVto2xVTb4/jxVtv 9fFXPirkxVy/z4q7FXYq5eGKufFVPFW/2cVcvx/bxV3HFXcW+3iqzliruPHFXLiqjwxVyYtbsWx3 PFXcMKu/ZwKs/wBfFrd/r4qt45JK5f5MizcuKuZcVWfY+PFXM2KrPh+x+3ireKreOKrcVdiqxcVc uKr8VWccWtbkmLXLIsljNirWSS1+zireKqfHlir/AP/Q+z6t8XwfYy5pcy4q6TFXcvhxV2KFbFtU 8Wtvli2L8Vdiq/4sVcvwYVWYFX8uGKr+OKu44qptiqouKr/t/YxV3Hn9vFVJWyTBV/18ihrj8OKu f7GKqfLJJRH+vgZqmBVPFrdiq5cWxcuLJUxYuxVTxVUxV3NMVdiq3j8OKr+OKubFV2LGDb4sncmx V2Ku5P8A7DFV/wDl/sYqp/Dy/wAnFV7Nx/1MVcqriqpxxVTbFW/ixVf8T4q5VxVdiqk3+W+Kr1bF XLiq9sVaxVv9n4MVWfsYqvb+fFWsgyX4sW8WTsVdiqxsVXpirWLFa2LJ32cVX5NiqYq1y4YqsxVf kFWriqtiql9nFWuWKqnHFVn+pk1bZm5c8Va/y8VdyxVU/wAh8VWfZxVf/kYq7l/P8GKtLy4/Biq/ FVq/Y+PFXMuKu/18VdxxVdiq3liq/l8PPFXf5GKrPh/YxV3+RirmXj9vFXf6+Krk+xirsVdirari rmxV3p4q7/LxVzLiruWKtYqtX/hMVXYq5ft4q7FW+Pw4q7l8WKrP8tMVdy+3zxVf+1iqzi37GKr2 +18GKuXFXf6mKu/axVytiqxcVXt/kYq7jirmxVrFW15Yqs4/FwxVfyxV3L4sVcq4q5cVd+1irWKq j4qsVsVWMzYqv5K3TFVNft4qqcsVdxxV37WKu/1MVWeniq/l+wmKuVcVdy/bxVZyxV3wr8GKrsVW r9v4MVd+xiruOKu/Z+PFXfbxVzYquxVSbkuKr2xVT+LIKv5/t4qs+1iq9cVWceeKukxV3L+TFWlx Vy4qqNiqn8XHFWkyauxVzL+2MVXccVUcgyVHxV32MVdirv2sVaTFi3wxZO54q0y4sVrYsm8mq3Fi 7FVvHFV2KuxVy4sluKu/YxYubFV2KqXH4sVVcVU8VXcuWKrF+xiq/h+xiqimKuXniq/7Xx88VWfB wxVyrirsVWftYq1wTFW2xVrFW1b+fFXccVWf6+Ku44qtVsWS5mxYqKti1u5ccWx2KufFXfD+xhVZ xwKpNkmCITIoU8VW/wCRi2LsVW8m+DFVP/IxVU/YxVYv+RiruPDFVmKqeKqnPFrWcsWxy4q7liql yyTBVZsihyrxxVR+LFVnHJJc2Kr/AFOGRQpZJL//0ftDlzSt5LwxVe2KtcExbG1bli1uVeeKu44t jWKqn7WKu54q2uLJfixaX/LxVf8AH8eLW7ji2LcVXcsVU/8ALxVXZsVX4qsXl+3iqlyyTBfxxVv7 Hx5FDXHJJbyKERiq3ji2LeGLWqYtjfLFEG+WKV2KuxVS+LFVXFW+OKtcsWTfLFi7ji1tYtiov2sV dy44q7/LxV3L4MVdwxVfx/YxVYq/sPiq5V+LFW1bFXKrfbxVvFVTFVH/ACMVdxxVU5Yq6NcVXLiy bb+fFi1iq3lirm/nxVeuKr3yDJ3DFXPiruGKrGxVrFVT/UxVzcMVcmKu54q7j8GKruWTYrW/18Vd wxVr7GQVUxVrjwxVe3w4qsVcVaXFVy/5GTVVxVb+xiqxo8VbxVcrNiq7FVvwYqv5YqsVuOKu+3iq /wDZxVT5Piq/FW+LfbxVZw/bxVdiq34v9liq9VxV3LnirWKuxVtcVdyxVrFW+XxYq5l5Yq1irati ruOKu5fyYq1irsVb+LFXcf58Vdx+HFWv2OGKrv8AiOKrcVb4/FirlbFXNirWKtr8H2MVXqvw4qsV f28Vcq4qv+HFVn7OKuZcVdyxVy4q1wTFXfaxVv4sVdyxVzYq7jirmb4cVd/l4q5WxVYq8cVXYq3y xVR+LFVXFXYqt/yMVXYqt4fsYq5sVcq4qv44qsZf20xVYvxNTFVXFVrYquxVa2KqfLFVbFVrfCuK rGXFV7f8Piqn/kYq3kFcrYslq4sXcsVd/r4q5cVXYq5WxZOxYuZePxpiydy/b/nxVYq5Ni7FXYq5 vhxV37WQZO+0uKu+xirl+zirkxV3JcVdzxVYzYq5cVXKuLFrjxybJbxxV2LFbiyXrixWYsnMuLF3 7GKuX/fb4quxV2KrVxVYq4qq4qt44qtxVa2Kt/b+xirm/wAvFVn/ABPFXceWKqafYxVX/wAj9jFV mKrGxa1L7eLcqsrYsXcsVdx+HFXNiqz7eKubFVNsVXYqpt/l4q58VU+aYtbvtYq2q4q7jiq/niqn x/bxV2LY7mmKt/5GKtYVWqy4FU1xVbirmbFXfbxV3/E8VWf5eKr8VWNiqxV/bxa3cP28VWMvPFV/ H+fFVHjkkt8v5MVdy+HFVnPFX//S+zPHMhqVv2Mihyf5eKrsVbXFXNirWLYqcMVdzxV3DFV8a4q3 irsVaVsVVcVWquKu/wAvFV2Kt8W/bxV3LFXftYtaz48LYv4J9v8AbwK5f58Vdxxa1/FcVc+KuVcV VMWx2Kr8UQbxStxZO48sWK7FVq8cVXc0xVvlirmxVfyXli1uXhi2OX+fFV3H4uGKrWXiuKuxVy8e OKubjxxVevwYqu4viq3k3LFWlxVtv5ExVVxVSVm+3iq9WxV37eKrsVWq3LFV2KrV+L7eKr2xV3HF V6Yq7k2QZO5fHiqzliq/j8eKuxVz4q5W/kxVrFi3iydy/YT7GKt/6mLFp8mrmb4v8jFVzYq5uWQV psVbf7eKr2XFVjf5GKr1xVYy8cmqorfz4q7jiq3FVzYqv+NMVaxVtmxVYvw4q77bYq74fsYq7lyx VfxxVZHiq/jiqg2KqjLiruWKuVV48P2sVXL9vFVvHj8eKu5LwxVeuKubFXLHirv9fFXLiruP8mKt Mvw/Hirvs4q3/kJiqxW44qvVsVWfBiq9VxV0nx4q5cVdyxV3xYq1irat8OKu/axVrFW1bFXLirl/ kxVzf5GKuZsVdx7/ALGKu+LFXL/JirvixVrFXYq7FW1+PFWsVW8cVX8sVaxV2KreH7GKuZeOKuZc VXYqtZcVd9vFV32cVdirsVb4/Diqzliq7FVvHFV38nPFXfaxVv4cVcvx/Hiqzlirm/4fFV2KrU/y MVWN8H2MVdx/k+xiq/8Ay0xVT+zkFa44q5sVXYq7lw/YxZLVxYtKv8mLJd+x8eLFpcVb481xV32c VW/5GTV2KuXj+3iq1vixZLm55BXf5eKub+dMVcmKtKzccWLeLJ3DFXJirsVdwxVbwyarcWLsVb/a xVSbl+xiyVf2sWLmxVrjiyW8fh4YsXcsVU+WKqnLFXfbxVZxbj8GKr3/AMvFVn2PjxVr/LxVU44q s4/FiqxMVc+Ku/18Vdx/4DFXM2KrGxa3csWxy/HirmxV37WKrP2MVd9vFXM2KubFVuKuxVTfFrdi qjkkrsihyfYxVvjirWKtqv7eLY7kv2MVaxVR44quxVrj3/bxVy+/28VWK2KrFxVf/l4q7FVjYq5s Vdxxa3KuLYs5Lzxa1L9rJJcq8MVdx4Yqs/yExVVf7eRQ/wD/0/s0y5kNSpyfIoVOOKrPU/4PFV/L +fFsa+1irfLFV+Ku54q7FXYq7FV7NirXLFW1bFVXFVrL8WKrsVVOeKrP2sVWf6+LWu4/z4q2rfF8 eLY18aYtaov+pi2O/ZxV3L4MVd/l4q7l/Pi1r1+DFsVcVWryxVzKv2MVd+3iq7j8OLWtZf28Wx2L JdixWtiq5fjxRNUZf2+GKXf5eKuTFV3LFV2KqHHFV7fyYqt5Kq5JgqcsizbXjirvhxV32sVXqv8A JirlxV3Llirl44quxVb/AJeKrsVdirsVdirariq//ieQZOfFXYq7/ieKuTFXKuKr8WKz9rFksZsV XK2LF2Kt5NVvH9vFk3zyDFUxVr7WKrW54sl3x/t4sWmxVXyaqeKreOKrsVXKqviqn/l4qqfYxVdi q1lXFXLiruWKuXFWuXL7GKuZuLfHiq/FW/8AXxVpvt4qtZlxVfx54qs5K/2MVcv8mKu+FfgxV3Lj iq9cVWcUxVe3+XirSfYxVtlxVy4q6T/LxVzLirSfYxVtmxVrFW2xVrFW/wBnFV+KrGxVZ/qYquxV 3J8VVOGKrGb9jFXcsVaZWTFXfaxV2Kt/C/x4q74ft4qp/F9jFV+KuxVaqr+3iq5PsYq7FW1xVzYq 5fjbFVn2MVc2Kr+XDFV/28VWMy/bTFVi/wC/HxVyriq9cVdyxVZ9j7GKu4/YxVfx54q7lyV8VWNi q9l/nxVrFVvH+TFXL8OKr/8ALxV3FeWKrOP8mKrGZfsYqq4qosvHFW/hxV3L9jFV6fsYq1xyCrF+ xirf+Riydixa+HFXfZX4MVcvHFWuOKqrL/weLJT44q5m+LFit5fHk1WviyXYsXYqsbIMl+KuTFXN /kYq7j8Xx4qp4q7FVRWxVyYqp4qtyar+WLFy/wAmKtYq7FXYqt5Yq5mxVdiq1W5Yq7jxxV3+piqn yxVUbFVNsVVOXxYqs5fDiqriqj/kYqt+DnirnxVUxVT48cVd+38GKqLNiq77WKuxV2KuxVb/AJeK u5Yq5lxVdiqni1rWxVS44qt45JKqmRQs5Yqv4Yqo/Hiq7FW1xV3LFscuKrP9TFVnHCq9lwKo8uOK u54q7/ieKu4YqsZVxVrFrbZuOLYsX4mxa1/+RirWKqP22+PFXN9rhiqm38mSS7hiq9lxV//U+zeZ DU2vx/BkUL/sYqu5pi2Lft4ta/l/Ji2ObFV/2fsYqs5Yqv4Yq5ftYtbsWxUxVbxxVy4quxVc38+K r1/kxV3HFWvs4qt5/sYqv44tbWKtt8GLYvX/AFMVdirsWt2KuxbF6/Hi1r8W53x4sVrLiyXf5GFi uwK77WKuxV2Ktcmb4MWTf2PjxYTVHxS5MVd/kYq5VZ/gxVzfyYq5v58VdirfHhkmC5l55Fm708Va /wBfFXcfh54q5sVVFVsVdx/nxVyf5eKu/wAvFV2KrfsYq5eOKr1xVy4q5V5fHiruXw/5GQZL8Vc+ KuVcVdirvt4q0rYsW+GLJr9nFi7FV3+pirXPJqu/yMVd9nIK1xxVtPt4q02KqnLFVP8A18VXN/Jk 1crYq3iq1sVXYqu4fsYquT7GKreWKuZeOKu5Yqv4/FirlbFVi4qvbFXcv58VWNirl/nxVy4q5sVX riqxcVXs37GKrOOKrsVb/wBfFWn+xirsVW/t4qv488VdyxVzYq7/ACMVaxVav73FXLiq9mbFXcvh xVrFW1/yMVaxVtW/kxV3LFVn2FxVzL8WKr/9fFXKv8+Ku4/FirX2cVdiq1P2MVXcnxVarYqv/axV r7WKuxVvjirWKt/tYq5sVc3wYq5v8vFXccVczKv28Vc2KtYq3/lviqxV/kxVerfD8eKu5cMVaT7G KrePw/HirS/bxVvk/wBvFV/Lnirm5YqsbFXfYxVytirvT+HFXP8A5GKu5fFiruWKqa4qqLirmb4c VW4qtVsgrTYq5sVb+ziqriqnirX2cVXq2KrOX8mKtLirb/bxVv7fwZNVnPFXYq5lxVyZBk7hirsV WccVX88VWLirlxVf8OKqeKqmKuybFY2Ku44q0uLJ3LFXYsVq4quxVtcVWN8WKu48cVc3wriruK88 Vc2KqbYquxVpVxVvFVNl4Yq7l8eKuxV3xYq7nirv+J4qsZf23wq5cCub4MVa4virfL4sVWM38mKt Mvw8/wBjFk3z/YxYtLiibbKqYpUfs/Yxa3MvxYq7hiqjkkrWXFVVvjyKF/8AxPFVjLirTfyYq2v+ Xi2OX/IxVrFVv28VW4q7FVPFXf6/28Vc+KrGxVrFrVGbFVH48VXYqtbFXcuDfHiqlxxQ02SZLWX4 cVd8WKv/1fsyuZDUvVm/byKFZV44q7jiqzJJXZFmqM2Kuj5Yqsbjiq/FXL/PirnxVey4q1/xLFW2 XFXL8H28VX/YxVdhVtf2MCu+LFXccVU+L4q39nJMHcuPwZFCsq/FzxbHN8Hx4VcrYGt2Kubni2Km Ku44smvixYruPH7GKt/6+Kr1XFXKuKubFWsVdira4om1iltcVX/5eKu5ft4qv/a+DFVP4uX+Virf Jvt4qu/y8Vbb41xVytiq9vhxVbiq1V/kxVU5Yq7l/Piq7FVq4quxVv8AyMVaxVb9jFV/HFVmLJWT IK7FXNx44q77eKqeKts2KtYqv+xixdiq/wCziq1fixZO/wAjJsXK2KrlbIKt+18eLJd9nFi74HxV y/5eKrsWS5/8vJsXNxxVy4q748Vdy/nxV3w/bfFXft4qv5ft4q1iq1W/kxVdirvs4q7FVrN8P28V XqrYqsbFV2KrPi+xirf8+KuT/IxVezccVWfHiq9eK4q7jiruWKu44q5sVdyxV3NMVWJ+xiq//XxV zLyxVrFW25fYxVpvt4q3x+LFXN8eKubFXLirSfYxVtVxVr7OKttyxVrFW+PDFXLiqxsVXK3xfBir sVVHxVYy/FirmxVZx/kxVey4q7lirlXFXL7fbxV3L9vFWk+xiq3/ACHxVe2Kubjirl9/sYqsbl9j FXLiq/liqxsVd9tcVXYq7ivLhirfLFXL/JirmXFXcu/7eKuZsVWccVd/xLFV7Yq0n2MVXf8AEcVU /jxV3Ljiq7FVv+wxVT5YqtVcVXt/PkGTsWLsVVMVUWxV3LFV2Ktcv2MVd+1irX+virl+1zxVpMmr uTYqqYqo4slVvtfHkFWcv5MVa+JsWLfDFk5mxV3DFXcMVU8VVMVU8Va+zk1VWXFip4qt/YxVdirm xZNyNixWNiq7FVvHFV2KreWKu5ccVdx+HFVuKruH7GKqfHFXfF8fDFVPJMFytkWbuXwYqv8Ag+xi qzFXYqvb/Lxa1Hji2O5Yq1irfHFVjNirvjxV3L4sVWtiyaZsWlYmKu5fHi2O/Zxa3f8AE8VW/wDE sVa5ft4tjWLW7FsbX48VcvwYqsXCq/jx/wBTAqzj/JiqzlhVzNiqzl8PDArnxVZ/kYq5l/YxVrFW +PxYqs5Ytbn/AMvFV64tihkmDfJMiha3x5JLX/EcVWr9nFX/1vs3mQ1NMzft4qqr8ORQ5fsYquxV 2KqnLli2OxVy/wCXirkxV2Ku+3irlbj9vFV7f5eKu/ZxVWVvh4cMVUsVXLiq7FXYqtZsVbVskwXM vP7eRQ6PFW0ySV3PAzdga3cMVd/l4qu/yMWxUxZLsWLsVW8sKr+WBWsVb5Yq7lirWKuXFjNfisG8 WTuGKu4Yq7jxxVzLiq/7XDFVnw4qv+zirTYquxVbyxVUX7HwYq5l/kxV3LFVnJMVX8cVd/l4q0v2 8VVFXFXNirWKrcWSt/kZBXYq58VdwxVyqv8As8Vd9n4MVdiqxmxVfiqxfgxVevHjirq/5eTYuxVd /kJkFc3HFV/JMVWfFiruX8+Kt/scMWTXHJsVRsVXYqpJ9vFV/wDl4q5sVXt8GKtYqtVVxVeuKtL9 vFVi/bxVtuL/AGMVa4viqo2KrP8AiOKuVcVXtiqxcVcn+Rirv9TFV/LFWsVWyN/weKr+S/YxVrFW 1xVrFW19vt4q7lzxVzNirXNMVb4/yYqs/wAvFV/7OKu5Yq0sf8+KuxVvlirlXjirm+P4MVdx4fHi qz/XxVU/4jirX+virvhxVyrw+xirv2sVa+ziratirlXFXL/Jirf/ABLFWmxVr7OKuxVv/I/YxV3L FXcf2MVWfYbFXcVT7eKr1/yMVcvwrTFXMqvirmbFVnHFXcP28VXYqt5fDiq7mmKtqv8APirv8vFV nLn/AK+Kr1xVrFVv7GKr1+PFXLiqz/UxVzf8PiruOKrsVWquKu/YxV3Hj/sMVWK3/D4q0q5BWmX+ fFW2+xirTYqqLiruWKrfhxZLf9TFi7jiqp8eKqa4q1wyaruWKreGKu/y8Vcq88gydirsVdzxVTxV UTFXf6+KuxVTxVUxVz5Ni7FVPFVvL4sVXYq3xxVrFVvLjiruOKu5YquxVay4quxVarYqs+D7eKt4 q1y5/HirTMuKqf8Ar5Jgqs2RZrGbniqpiqmrYq7FVjN/Pi1tKvNsWx2KuxV2Krf9fFV2KrfgxV3L FVnL+fFrWPirsVdiqnirl5Yq2y8F4Yqt45JK5m+HIoWKv/AYti9VxVzNiqz4v2MVc32v8rFVnHhh VzL8WKrG+HArsVcmKuVsVWccVaxVa3w/bxa12KrVxVSVW/bySXceeKr8ihTbj9jFVv8AxDJJf//X +y/+pmQ1Lv8AXxVWVf5/sZFm7l/weLWuxV2Ktri2NYq2rLiq/FXfFirsVc3xriq/jzXFXfZxVeuK rcVXLirlb4sVXYq2zYqv+19vFXN9rFrU8Vb5cMVWq2SSqquRZu48PsYq77eKruXw8MVVFxVy4q7/ ACMVXYq2uKtYq7FXYq7FW2xa16quLY7iqYq7/LxV3DFXN/wmKuxVf9nFXLybFXemrYq5v5ExV320 xVpl+LFW/ixVrjiqpx/kxVdiq3lirvi/2WKuXFV2KuxVtvjxV3HFV/L9jIMmsWKzFk7FW1+L4MVX 4q7hirsVbXFi0+LJy/E3wZNi7nirsVXMuQVpcVbZeC4q5vh+PFW8VW8sVVsVU1XJqv5Yq7/UxV32 /jxVdiq1sVXYqtXj+xirv8hMVczYq5lbFV68cVd8OKrG+LFWuL4q3y/4DFV7L8OKrPt4q7/IxVpf t4qvxV2Ktsv28VaxVuTFXf6mKu44q5V+LFWsVbjxVy4q1zTFXYqqfYxV32MVU8VdirsVbZv5MVdy 5/BiruOKuVfhxVrFXP8AYxVtm54q5sVaxVtVxVy/yYq74cVaxVarccVXr/l4q5lxV3LFVi/F+3ir vsNiq/4cVd+1iruWKuZsVaxVuT+fFVnwYq5cVdGvPFWuK/7LFVRcVWMy/t4qv/ZxVrFW+P7H7GKu +HFVjfF9jFV2KrVxVdirfHn/AK+KrFbl8eKubFXNiqxm4YqvXFVnL+TFV/LFWuWQVT44q5sVX8Xx VY2Ku44qrYqpftYq3irXH+fFVuLJUybFT4riruGKuyDJ2KtYsW8WTWLFauLJfirueKqeKr+eLFZi yW5NV2LF2KuxVzcv2MWTsWLfHFVjN/Jiq7FVFsVVOOKu+xiqz4sVX/Hirv8AIfFVjcsVd+1irXLF W/ixVZiruGKuxV37OKuxV3PFrU8WxtsVdyxV37OKqfJ8Vb/4fFXYslq4q1x/bxYrP2cWt3/EMWxy YtblXC2OwNaz/IxV3HFVv+Xkkrl45Fm7jiqzli1ub4sWxdiqk32MVd+ziqx8Vd8WKu/ZxVZxxVrF rWtirlxV3H+fFV2KqLKuKu5fFwxVWxVDtkkrcVf/0Ps/x+HLmlZx/kxVr/IxVU48vjxVe2KrG4/7 PFXfBiqt8OLYp4qqYqp4qqc8VdzxVd/kYq5cVVFxVbiq1ZP2MVVGkxVWb/LxVZxxVzf5eKu/yMVc 3L9jFrWZJK7IoVP8jFscmLW7jz+PFsXrx44qq4qp8cWSpixdhV2BW+PxfHiruOKtYq7FVRf8vFrc rYtjvixVyYq74OeKuxV3FcVczNiqIxVR/wAvFW+Xf9jFW8Va+ziqriq39vFVnL9hMVX8sVd8X+xx Vvk3H4Pt4smlbFiuxVvjirWKt/tYqv8A2sgyc+KuXniqxeWKr0xV2Ku54q1ixbxZO54q58mxc+Ku xVvjkFXYq7FWuSYqq4qoriqo2Kr8mq3lirmX4sVd9j4MVXs3HFVnHFV2KreP8mKuf/IxVd9nFXYq 2rYq5WxVY3w4q5WxV3H4ueKrsVWN9vFW244q7h+3irvt4q5cVc2Kr1/nxVrFW/8ALxV3LFXcvhxV Yq/Dirmb4cVX8sVc2Ku+LFViqy/bxVey4qsbFV/w8cVcuKuVVxV3H9vFXNirl+PFWvtYq3y54q5f i+DFXf6mKu/axVy4q7/UxVzYq7liq9f5MVWLirWKt/FiruWKuZsVaxVvlirmXFWn+xirvs4q3+zi qxuOKr/2sVWcsVdx/wCDxV3HFV7K2KrGVmXFXccVX8v2MVd8OKrFxVzYqu5PirsVbb7P+Riqz48V dy/kxVy/EuKu4/z4qsVcVdy/YxVr/IxVvIK1xxZNfFyxYtsv8+LJZzxYq3LFVjfYxVZiq9f8vFWm xVbirfw5NXYq7FWsgq37WLJc+LFvFk5lxVTxVteOKr8VWcsVX4q5uGKqTLk1XNixaxV2KuXFkt+3 ixX8f58VcuKrGxVdiqi2Kq2KreWKrsVW/bxVZ9nhiq/l8WKrGZnxVZ/r4q03F8Vb54q7jyxVz4qs ZcVX8eWLWp4tjsVdira4qsT/ACMVc2KuxZLsWKHfFXcMWt2LY7ni1uxbFrLkmDS5FDuTft4q19pc Vb4/sYtjmxVTb7eKtsuKu4piqxv50xVvFVN8VdirsVWNiq/ni1rPixVrFXYqh+WSSvb48ihzfBir X/EsVU+Xx5JLsVf/0fszyzIalZWyKFLlzySVX/LyKHNirmbFV/LFXLi2O5c8VdxxVe+Ku54q7hiq 9WxV3L/hcVbxVd8eKuZvixVpVVcWtUX4MWxyt8OKr2/kxVZy4Yq7/XxVrFrVF54q79nFXcMWx3PF rd9vFsVf9fFEF+KVrLirlxVdhVtWwK1irbYq1irm+3iqsq/yYqt48cVc38+Kr1+FfjxVZzxV0bc8 VdiqIxVa2KrOPw4q79nFV/8Al/sYq7imKu5Yqp8sVd/wmKq2KqfHFkqYsXMvLFk2q/7HFis5f7PF V2Ku45BW/tYsmsVb44qvTFVPFVT7eKtrixaZsWTXH48WK/lk1W88VVMVWM38+QVdiq2P/LfFXcsV bVsVXtiq/Jqs4viq39nFV/2PjxVYsnDFVXFVi/bxVtWxVdiq1V/nxVy4q74MVdxb9jFWuT4qqcvi xVZx5Yqv/ZxVy4q1ira4qsbjiruWKuXFV2KrV/4niruOKrsVb/18VXqrYqs5fDirmxVZx44qvZsV a+zirsVbXFXLirv2cVWccVdyVPjxVfyxVZ/fYqv5Yq5W+HFXf5f7GKuXFWsVdiq1l/Y/YxVevwYq 1irar8WKu/y8VdyX7eKu48MVWK2Kr+WKu+0uKubFXNxxV3HFVnL4sVc2Kr2bFVnwYq5f5MVXsvDF VjN8OKu/kxVy/YxVd9rFXYq3yxVyr8WKrP8AZ4quxVvliruS/YxV3HFXMuKrOOKuVcVU2xVU4/z4 qs4/yYqvb4sVUuWQVy4q5cVVf2fg+xiyWYsWuXPFW8VabFk3ixWtirbNiqnk2S58WK/4cVU8greL JrFi3/l4sncvgxV3L9jFWm+HFi3iycy8MVcv/CYq0rfDixbfJqo4sl2LF2KrWXFVn7OKr+WKu/y8 Vd/r4quxVSZsVXt9jFV2KrVxVdiq37H2MVWfFirlXFWmX9jFVv7XDFXcV/kxV2Ku+3irvhxa1KRs kld/kZFm5V/YxVrFVnF8VVGbFWsVWs2KuxZLGbFi3iq3jiq3FrdzxbHcMWtTxVrjkkrmyKFnLFsX t/l4q1iq37eKub+fFVHFVTFVN8VdirueKrFxVzYtazjiq9lXFVjYqoqv7GSS7jirfLIsV32PjxSt ZsklY3xYq//S+zStzzIal/x4qprirf7OKohWyKFjNiruX8mKu5fz4qv+Hli2L0xV3w4q18H28VX8 sVb+1irS4qqcsVcuKrsVU8VVVxV3H+TFWl+3irfH+fFVrZJg1iqt+1wyLN3xYq5MVdi1rlxbF2Kr uPLFV2KrVxV3x4quxVv/AFMVaxVv/IxVyr+3hVfwwK74cVcrfFiruX7eKuH7GKu+JcVcmKrv9TFW 1+DFXdkxVf8AbxVYy4q5v8jFWlxVUZWXFXL8X28Vcq4q7/LxVdirfxYq1iq3FkvXFiv+FsgydwxV ZyxVrFVTFXf5eKqeKuxVUb+TFV3JMWK3Fk58mxXcsVd2TIK02Kt8f8vFVT/X+xiyUmxYqnLFV+TV R/y8VVFX9vFXfC+Ku5YqvbjxxVrk+Krf28VXYq39j7GKu5Yq1irbcsVdy54qsVf5MVc32/jxVc/2 MVWq2KuZfixV3HFXMuKr/ixVrFVvx4quxVtcVaxV2Ktt8eKtP9jFXfZxVb8SYq5V/wAjFXM2KrsV bVmxVrFXYq3/AJGKtYq36avirm/y8VcrfDiruWKu+Hlirv8AUxV37WKtfaxVvjiqxcVXYqqYqs/1 MVX4qs5N+xirv9TFV/8AkYqotirlbFVbFVjYq7lirTfbxV2Ku/Y54q3/AJeKub/LxVYrf8BiruOK uXFXfEmKuX4fjxV3FMVXYqt5clxVzL8OKu5ccVXYqt+38eKu5Yqptiqoq4q7liqzj8WKr+X8mKqf /EsVbyCtMvPFV6/B/r4qp8cVdyxVtf5MVb2/kxZLf8vFi3xZeGKtcsVbX4PjxVv4smqx8VdzxVyt kGTTNixb54snYq1ixbVuPwYsnYq19jFi3/kYsnPirueKqeTYuxVv/UxVr/UxZLX/AMvFi5m+HFXK 2KubFXf6mKuVsVd9v7GKrsVU8VWtirbfBiq9v+HxVT44q39nFVnJsVcvwfYxV3+Riq9v8v7eKqfL n9vFWskwa5ZFm7jwxVrFW1/y8Vab7eKqa4sl2Kqf+pixVPt/YxVRxV2LW5ePwYtjsWtY32uGLYsy TBfJkUOXkrYtizJMF6tkWaxsVdy44q74MVczft/sYqo/s4q7nhV2BXYq58VdwxVZyxa3ccVcuKrO Xw88VUuS/bySXN8C4q1/r4qtZm/2GKu/yMVc3w4q/wD/0/s43LLml32cVa4/Fihc3L7GKrsVdire SQ0v+/HyLJdi2KnPFVPFVZV+HFVrfZxV3DFV/wBnFV7/AORiq7CrsVU+OFgq/wCpkWbWKuxV2LW3 y/YxbFq5Jg23LIoVGjxbHfs4tbsVX8ueLYv44qt5YslTFitbFV2LW2uLY0v28Vbb+TFXN/PirX2s WtUxbFjfBiq9WxVzceWKr+XPFVP4Pt4q3y+Hniq/lzxVyrirSr8WKt8eXPnireKtL/r4qv8A2MVd 8GKrsVdirsVdirbYqsxZLsWLf7WKt4sluQVtcVaxVU5LiqxcVX8v58VWLiq7Fi58VaVmybJVb/Ix Ytcf58greKqeKr2+Jq4q3y/YxZLWxYrvs5NW8VVMVWL9vFW/2MVcq8Pt4quxVbw/YxVzNirmxV3H +fFXM2Kr2xVzfBiruOKubFXcvixVZxxVzYq5fhxVdiq2P+TFWv2efPFW+P8AJirmX4fgxVe2Ku4/ D8GKu7viqxvhxVdirbfB8eKu5Yq5sVdx/kxV3HFWsVb+LFXNirT/AGMVbbFWsVbVmfFXcsVc2Ku4 4q7jiruOKu44q74uOKtYq2uKtcXxVZxfFV/2cVb44q79n48Vdx/kxVrFXfZxV2Kt/wCRirm5Yqvx VZ9lfg+3irSsvHFW2bniqizYqv5Jiro2xVdirsVWxtwxVeuKqfxfHwxVv9jFV2KuxVtsVWcv5MVd +3iq9sVab7eKreOKrGbFWv8AIxVWxVTxVb6nDIK5eOKtv9vFkt/1MWK7FVjNiyXK2LFpcVb5c1xV 3x/sYq0uKrm+D7GTVZiqjiyVsWLv2sgya4YsW0xZLGb4sVX4q7FVnLFXf5eKuVsVc2Kt5NVq4q7F itXFV64qsX4cVcuKrsVdiqizLirfHniqrirsVd9rFVPFVTFVLjxbFXM3xcHxVY32sVXfFxxVby/n xVdxxVbirsVU/tYq7FVq4qv44q1yxZLft4sV2KreOKuZsVWN8HwYqsfFXcf+AxVzL/wGKuZsWtTx VU/1MVWKuKu5YqsX+fFsVlX9jFVn2/jxVrFVJVxVezYtaizYtjnxa1i4ti/FXKzcsVdzxVYzfDir WLWp8uOKHYpVMVQ/+vkkubFVvLjiruGKv//U+zXJMyGpvFXckxYNs2RZL2xVrk+KtL9rnihV5fF8 eKWsWxU54qs5Yqv5Lx54qvb7GKu5viqzkuKq32PsYquwqp4qu5JgVf8A6+Ku9TFXepzxVys2LW7l +3i2NYtapiqxmxVfy/4DFXcuWLYvX4MVbxVdiyWK3/AYsV+LJy4sXcsVXeozYsluKr+X7GLFrFrV MWxT4vijjVP2ueLBT/yMWXGiMWSmq93xVzfZ4YVczYGt3L4ft4WxerfD8GKuX/IxVZyZ8VX/ALOB Vnqf5eKq3HFV/LFVnLjirv8ALfFXKy4q74MVXYq7FXYqtxZK2LF32MVW4sluLFtWV8gydy4Yq1iq py44qp4qqN9nJsV3+RiqnGuLJdixXLirfL4cVbxVr4cVa5Yq232MVd8OKu+D9vFWvh4/Biqpy/kx Vfy+LFVjNiruOKr+WKqf7Xx4qqNiqxvi+PFXM2KuX4mxVzccVXYq3+1irv2sVaxVav8AJiruWKr2 xVT/ANTFjxt8sWLlxbHfYxVWZsVWcvhxVzYq74ft4q7liq/FVNPsYqtXj+xiq9vb7GKu5c8Vdy54 q7kvH/IxVy8V+3irv9f7GKtYq7FW+OKtYq39t8Vdy+LFXcsVWcvt4qv+w+Ku/wAjFXK2KtYq22Kt fZxV2KqmKrP8jFXLiq98VWcv28VcrcsVcrYq5v8AIxVZ/wARxVy4qvXjirWKrVbFV3BMVW/sYq79 nnirvst8eKtMuLHjbf8AyMWLXHFlxuZlxYqjYqoNx/YxbFXFjxreOK8bbN+xiyWK37D4qvZlxV3q L+xiqxuKYq1yxVpW/byCt/ZxVdk1U0xVcvLl8eLJtmxYrMVXcsVd/qYq3kFdy/kyarGZcVdiqpiq nzxVytzyDJpMWLaYslPFW+WKrVbJqq8VxYrFxVf/AJeKqOLJWfFipMuLJvFi7FXYqtbFXccVX8sV axVa2Ku/YxVzLirmxVZ8S4qq4qotiq7FVNMVXs3+XiqGyTBe32fjwM2sCt/F+39jCq/k2BXJiqj+ xiq7FXYq7FVPliydyxVd8eLFTXFXf5eKrW+HFrczft4q1yb7eKt/HwxVT+ziq3JJbVsVXNJkWaz4 uGKrsVW8vhxVbiq3/UxVtVxVZirueKufFrU8Wx2KuxVa0mLW7liqn8TYoVOX8mKXcv8AgMVU8klr 1MVWclxVz4q//9X7NcueZDU0zfsYqv8AUyKF7Yq7lxxbFJWXlkmCqy5FC7FsbZVfFXK3P48WtrFs VPs/HirueKuVsVdy/kxVd/xLFW144VcuKr/gxV32MVcq4Fc2Ku+DlhVerYGtevL9vFVjN/Jiq9m/ nxbFit+3iq9Wxa1/JfsYtjtv5MWt3L+fFW8WxdyxVb8GLJdyxYuVuWKruPDFjBv4cWS+P7eKrOWK OBfzxYO+LFXPi2N8hix4FuK8DfPFkv8AhxVyt8XwYqs/yMVXsuKtccVb5c8VX8k+xiruX8+KubFV i/Hiqriq1WxVdirbLiqzFk7FV2LFbiyX8cgrWKuxVU54q77X2MVd9jFXL9nFXPk2K/4fgxVRXIMl Xlk2K3FXYq3/AK+QVpVxZLvhxYuVVxVf/l4qt+B8mruS/YTFV/2MVczLirmVcVc2KuXiq4q708Vd yxVrjix4Hft4rwL8WSzlx+3irfJeeKubiuKrsVbZWxVZJirX7XwYq3x5Yq5sVXccWPAs48cV4G/t /bxZL2Xhirm/kTFWsVbVW+3irX2cVVP8vFVnJft4q74sVWcvi54qv/axVrFW+Pw/Hiq9mxVRZuf2 MVX8sVcuKuX4MVcvLjirm/y8VaxVvjirl+DFXKvw4qv4YqsbFXN/l4q1irbNirmZcVcrYq1ira4q 1zTFVv2v9XFXKuKr1/nxVzYq7/IxVzf5eKrFbFXP/kYq74MVXYqs5f5GLHgcv28WK/Fsdiqxvgb/ ACMWPA7/AIjivA7k+LFdiy4F3+viydxxVy/5GKrOTck54q7n+xirv2eGKrcVWtx/YxVvlzxVc2QV ZyTFWuOKu/1MVXfB+xiyabivwYsXcuHwYq5Pt4q1xxVdy5riyW/D/Pk1a54sXYq7/ieKuxVbiyXM uLF3DIMlPFVT7GKrPtYq7j+3iq74cWLaZNVuLJb9rFi2zccVaxVtWxVzYq1iq3FkubFVv2MWK7FX Yqt5Yq7l/JirvjxVYzYqv5Jiq7FVLkv2MVWfCy88Vcv2eGKtfB9vFW8VcmLWpM38+SSqN3yKYLVX Fk0q4omt44pd9v7GKrsVWrirmxVT5YquxVT5ccVWb/yYqsyTBW5ccihZyxVpf9TFXNHirfHFVjYt jvh+xirpGxVbirSthVS9bCwXPkWbm+z8eKrOWLW7lirvhxVy4qpcsklcuRQp5JK7jkWKmzfyZJkt 54qvbIsXM2SZNK2RQ7lxxV//1vszx/kTLmLueFVqt8WFgiOWRQsX+TFWsklauKojl8ORQ3y7fsYq 7/L/AGMWxzYtbmxbHf6+Kr/8h/sYquXFVvw4qqYqt44qqfBiq7FVrLiqnyxVX44taz9jFsX8cVWR ty/bxVf6fD7GKuVv28Vd8WKr8Wt37XPFXcm+DFsVMWtr4lxVfyxbHKuKuZePwYqv5c8VaxVtm54q 1irfHFV3Lh9jFW1ZsVcvDFXL8OKu54q5V+HFV/2sVcq4q3i1tL8eLY1/kYq39rFVXFVKP4vjfFV6 f5eKu+DFXM2Krvs4q2rYq1yxZNr8eLFy4q1xXlzxVU4ZBk5mxVTxVUVeeKu+HlwxV3JvsYq0+LFt eXP/AC8WTXDFi2+LJbk1VWbFi1xxV3L9vIK77aYq5WbFWuOKu5Yqu/y0xZL+P8+TYu+DFVnx/sYq vT/IxV3H4cVc3LFV32sVdy/yMVWsv+Riq/jiruX7GKtc0xVbyxVd9rFW+P7D4qsVcVdx+LFV7Yqs ZsVX8efwYq1iq3/IxV3x4q7l/Jiq/jzxVy4q1irat8WKu48V+DFWsVdirfH4cVXviqxl/nxV3Hiu KubFWuS8ueKtr8GKqbf5f28VVG5ft4qsZsVXYq2uKtYq3xxV3w8cVWccVXYq3x/nxVr7WKtquKub jyxVzYq7jwxVv/iOKtL/ACfsYq77f28VWfF+3iq/7Xx/sYqsVW/2GKqy/H9jFVnH9tMVWfsYqvaP 4vgxVzNiqz7eKu48ueKubFXfsYquxVbxXhirmb9jFV2KttxXFXNirWKrV/kTFXN9jFV2KuxVayt+ 3irlk/4DFXL8OKqSr+xkFXYqv5YslPl2/bxYt4q7FWvixVevxYqo4qu5Yq03+Riyd9lsmxcrYqtx ZNccgq9Vb9vFXL/PirsVa54sW0xZOxV32fj4Yqs44qvxVz5Nisb/AC8Vcv8AkYq1iq39jFXL8OKr 1xVrFVvLFXceWKu44q5WVfgxVzLirlbFVn7OKuX7GKuVcVdx+HFVi/axVzL8XDFXf6mKuZcVdirs KqeBXYq2vL7GKu+Hli1tYWxb8eBV2KrfsYqo+n+3iqny/bxa1Tl+3i2KeLWqc8WxRb/h8VXsy4qv xVTX7eKuxVa2KrOP7GKr1xVYy/DwxV37WKu5viqz9rhi1ub/ACMWx2KrP9TFXNi1rG58cVd/xpiq mzNira/H8GKrFX9jJJW/5GKqvL4sihb9nJJU2bjkULP8vFsXYq7Cr//X+y2/8+XMV74ta1VySV6t iq9cVXMvH/UyKFv+vkktSZFC9fsYq7liruH7GLYuxVUVsVdwxVYvwfBiq/niqz4cVX88Vdiq9ZMV aZvixVUX7Hx4q7jirmwqvbArlb+fFWm+3iq1sVb49v28kwb+zkUKnLjirsVd8WLYrfHirmxVdiq1 cVdy44qv44q5sVc2KubFWsWtEYtimvL9jFXLyThirl/y8VcrfDiq9/t4q0uKtfH9jCq7l+xgVzcm xVZzxVf+zzTFXMq/t4q3iq71MVd9v9jFXfs83xV2LJeys+LFy4q7jirWKqmQZOb4cVU8VVG54q7F XKuKu5Lx+xirv2cVd8WKuj45Nit4YslyrixX8ueQZNft8MWLX+virbK2KrExVWkxVtmyarcVXMuK qfL/AGKYqrYqtblirl+xiq9fjX4MVaxVv4sVcy/F9jFVP4vt4q2uKu/kxVfx7ft4q7jwxVrFXYqt 5Yq7j/Piq9W+LFWsVW8kxV328VcvwLzxVe0fPFXMuKrOf7GKu/a4Yq7j/Jiq9VxVzfz4q7l8OKtY q77WKt8eeKuX+fFXcf58Vd9v7GKu5fDwxVZw/bxVf/qYq74sVU2bl8CYqqMvDFXM2KuZf28Va/Y4 Yq7FW1+P48VaxVU54qp4q77OKtq2Kqa/bxVU4/DwfFWvg/2eKtsy/Y/YxVzYq5VbFWv2OeKtry/b xVy4qsVeWKuZVTFXNirlxVeq4qsX7GKr/wBnFXf5afbxVey4qsZcVWcf50xVf3fFVnHFXfsYquxV vjwbFVGPFWlxVU4/yYqps3/B4q3kFdyb7GLJYzYqubjixa4t+3irlxVzYquxVd/l4qsZv58WS3jx ybF3+viruGKub4PsYq19n/XyCu+yuKtt8fx4smueLFvFk5lxV32vt4qs+ziq/FXYqtfJqtxYrVXj iq/kv2ExVT4viqp+ziruWKrG+xirvgxVYq8MVXtiq3FV3LFXccVU2bj/AKmKrf2sVX/Z/wAnFXN/ l4qsb/IxVzKuKu/yMVcmKu5ft4qos38mLWvVsWxzL+wmKrG/kxVc3HFrWri2NN9vFW1xVY38+KrH xa3N8fwYtjl5IuKu+FsWtSXJJXfa/byLNfi1qeKuxbFrYq5sKtcnwKt+LFWv8vFW2ZuP+RiqzFWm 4virbLiqnira/BirWLWt/YxV3LjiqHySV7fBirmb4cVbxVazcv2Mih3LivDFsWM2FXK2BXf6+LWu bi+Kv//Q+zLMuXMVnwfYyTBU/b4YqsTFXcuWKrmxVtftfHirlXFVy/yZFC/jxbFV64qt+D/Z4oVU xbVnHFWsVdiqp/l4qsVsVV8VWtiqtirbf6+KqDYqrqy4tbuOLY18f7eKrOXH7eKr+T4tba4tjvi4 8MVaxa1R8VdzxVyYtitiyWNyxYr2xVT5Yqr8ueKuVcVaxVtWbFVi/Diq7FXYqrKy4qpNirv8jFV7 NzxV3xYq6v8Al4qrfHirvjxVYzcMVX8sVU2xVtuP7eKub/LxV3Ln8GKr2ZsVXYq3yxVrjiydixdi rsgyVF/kxVr/AF8WKzFkqLwxVy/axVtsWLXDFk79nFVvL9vJquX4Pt4sVrNiyVP2+GQYtsvw4smm /wAjFivZVTFVn2cVaXFVX7bZNVnB8VX8v+DxVZy5/b+HFXfs4qv48vgfFXccVXsqs2KrOStiruWK rsVb48PgxVY0n8mKr/8AIxVyx4q7lz+xirWKuxV2KqXB8VXtybFXccVd8HLFV/Lnirm/kxVyt8OK ubFXL8GKu5Yq5cVcuKrE/wAjFV7Kr4q77a/HirWKtr8GKtYq3yxVpft4q7FW/hxVyriqxf58VXr8 GKtcWT4MVb/y/wBjFWsVW8vhxVy8sVXtirvhbFWsVb5fyYq7jx/ysVd/l4q1irf+virv8vFWsVbb l8eKubFXcv2ExVzNirTL8PDFW/8AUxVrFVrfz4q5l+3iq77OKrfjxVeq4qs/bxVy/wA+KruaYq23 +Xiqzjy+xiq7FW1/kxVTb7eKtt8OKuWTFVPl8PwYqqNiqn/xLFW+D5Bk19hvgxYr/wDLxVZy/nxV 3qYq5m+LFV6txbFVnLhirX+Riq79j48WTXHJsVvH+TFV/L4cVWKuKr+X7aZBk18H+wxYrOeKreWL JrFV/DFi3wxZLG5Yqv8AhbFVn2PsYqsyarsWLf8Ar4q5sVW8eGLJcvxLXFi7jirWKrft4q74ft4q 5W/bxV3H+TFV2KqTceXPFXKvD/XxV3Ll/l4q7ky9MVczcMVdxb7eKrPibFXcMVd9vFXM3/AYqpLk mC5l4/BkWbuWKuX+fFVFvt5JgvXIs2mbFk3iq3Fit5YqtZcWtzL+2MWxTxa2/hxVS5f8Bkkqn2/g yKFq/wAmFsXsuBXcsVUVbFW8VXcsVW4q18L/AOviqzFXPiqzjirlxVzN/Pi1uXFVi4qorkkrmblk UKb5JKo2RQp8WySXc8Va4/yYGbWBW+WLW5W/2GKubl/r4q//0fszlzS5WxVamSS5vs4qub7WBmuw sG5MizXqyt9jFrU+OKuZf28VVsVWqv8APiq9mxVrFsbXFV6rzxVy/axVYuKr/hxVzN8XwYqvVsVd 6mKrm+3irbfz4VWcu/7GBV6t8OFXM2Brdy/kxbF7f5GKub7XDFVrcskwVW+zwyLN3wc8VXK3HFWu P/C4sl6tiq77eLFf+ziqg2Kq6t8OLWs5J9jFsX7/AM+KtYq2vJMVcvwYqv4/t4qp4qqKq4q5VxV3 L4eD4q7/AC8VX8ua4qvZsVWKypiqxmXFVbin2MVXYqpfs4q5fb7GKr1+LFV3NMVWtiq7FXM3HFkt xV2Kr+WQVfwxV3Lliqniqoq4q7iuKuZsVdy44q5eL4qv2/nybFYzc8VXcsVbyCrm+LFXfHirvs/6 uKrFbFW/9f7GLJeuTYu4p9jFXM3xYq5WxVy/YxVyrirm+zwxVfwTFVnLFV2KuxVb+zwxV37GKuX4 cVcrfDirTcf92fbxVU5Yq7jiqxV44q5mxV328VcuKrsVbXliqz9nhiq/9nFXM38/28Vd/kYq74vs I+Ku5fyYq5eWKu9TFXM2KtYq3/qYqsXFVT/iOKtcePx/sYq7j+xiruXPFXKuKu44q7l/PiruPPFV itirl+HFXKuKr/t/Birv2sVdy/nxV3LFXfFiqmv28VVP9f7GKtNJyxVYy82xVeysmKrF+3iqvy+P FVn+virlxVYrLiruWKu/1MVdx4N8GKrsVb48MVWceWKuZuXx4q7l/Piq9ftcMVcqs/x4qsZcVX/5 eKrOOKr+XDFXf6+KuX4VpiqzjiruTLiruPw/BiqziyfGmKu+38GKr/t4qpsq/t5BV/8AsMVWfA+K uZeXwYq3y/YxZLvgxYqa4q3+1irm/kxVb/xDJq7iuKr+b4qsxVrIK3zxZO/b+3irmbFXPirkxV37 PDFXYq5fs4qsXFXM38mTYrf2cWS5cWLWKrV/nTFXK2Krvs4qt/YxVdiq1cVU+OKu5YqqMvw4qs5f 5GKuX2+xirS4q23HFrWK37f7GLY5fs4q5lxVf8P20+xiqz/LxVS+N8kwbyLNv/IxVytirlxVS/1M WS77GLF3J/sYqsb48VWf5eKuxVytirueKqeLW3y7/t4tizJMHf5eRQvbFsd+ziqxm44q7jyxVZxw qvZcCrcVU1ZcVd+1zxVT+ziqpiqxsVdxxa1is2Ku+x9vFVLsmSS238+RYqf7OSZKiquRQt54qtfJ JWM2KruWRZu44tbmb9h8VWceXwYq/wD/0vstyy5i7/LxVY3w4qvVvixVezfDi1rf9TJJVf8ALTIo dy4t/kYq1yxVtZMVb5fz5JK5fiyKHYoXLiq1vi+xilcsn7eLY22LWv5LyxbFi4qv/wBfFXfa+xir lbk2Kr2+18eKrG/yMVXfFyxVtff7eKq3Ln8GLWt45JLa/wAmRQt4/wA+Kr1X+TFXL8Xxvi2L/wBn hiqyPjiqryxVtlxVf8GKqeLJcuKqmLF2KuxV2KrcWTuOLFW/18VczYq5vtfYxVzfDiruP8+Ku5Li q/j2/YxVpV+LFV2KqbNy+DFVZl+HFVjcsVX8sVd9r4P2MVd9vFXcv2P28Vcv8n7eKu44quxVvjiq zFkrJkFWLiq9f+HxVofsYsW+eLJyrirsVdy/kxV2Ku4ZNi5fgbFVuLJUX48gxcv8+Kt4q18Lf6mK tty+Ph9jFk03HFiqfYyaubFVjccVVcVW8cVd9v7GKr2xVZyxVy/usVd6mKuX4sVczccVXYqtbkq4 q5sVd9j7eKu/1MVXYq3y+HFVnxPirv8AXxVzcm/ycVXJ9jFW/h44q7jirvstwxVrgmKqi/yYqp4q 3/l4q7liqzky4q7ly+DFV8n+Riqz4OWKr/2sVdx+LFWsVdira/yYq7liqz/LxVf/AK+Kub7XDFVn +zxVWxVRXFV/xYq1irfL4sVdy+LFVjLiruPxc8VX8vh/yMVdy+LFXccVX4qs/ZxVri+Ktr/l4qsT 9jFV7L+3iqz9vFXN9j4MVa4/DzfFVTlirmxVZ+z8GKuZfixVU/4lirXHFVnH7GKuVf58VXft8MVb b4MVd+ziruTfsYqsZsVcvxYqs4/z4qq4qpcefBMVVcVW8P28VU15cueQVeq/z4qt+38GLJc32v8A JxYu/wBTFW2X4uGLJrjxxYqa4qu+HFksZcmxd/l4q74+eKu4Yq1wyCt8MWTT4sVv+XiyX88VU8Vb 5YqvTFXJirWLFvJqs44qs/bxV3+piq/liruXf9vFXN8GKrFXFV2KrVbFVnLk2Kr+XH9jFXcsVWKu Ktfa+BMVVsVUW+xixmtxZO4/t4qu/wCJYqtZfixV2Kqbfz4tbsWxtcVdyxVZy+HFXLy+3irlxVeu KqWKqfx/bxVyYqs5Yq5vjxVrFrbZf2P28Wx3Lhi1tYq3xxbF7fDiqF5Yq22FWlwKtxVe3wYqsxVT xVUXj/q4qp4qtZeOLWuxVay/FiqnkktfA+KuX4PjxVzM37GKtceHwZFCiq4ti/4sKubA1tYtjsWt b/l4qub+fFX/0/ss0nDLmlZ/lpiq7Fsb+x8GFXf5eBraaTli2LmbJMGvj/bwM1RW44WC5W+LhkUO X+fFXJ9vFW+WSS5f58VXM37GRQ5VX7GKu5YqvVsWxrFW1xVfirmbFXLwxVd/l4q3yZemKtKzYq7/ AC8VVGbFV/8AkJirXL4uCYq3y4Ytblb7D4tjSfYxa1Rfs4q74VxbHcMVVuWKrFbFW1+1zxZKmLFb y+HFXccVXriruOKu44qsZv2MVVkxVzfZxVTxVUbhiq5f2+eKrcVX+pzxVfy44qs/a+PFWmxVv7f2 8Vcvx4qv44q5eOKu5ccVbVsWS/8A4jixU5PixVy4q7lxxVdiqpkGTvsYqs5fDiq/l/wGKuX/ACMV d9jFXLyfFXJiqz7WKq+TYtKuKrMVXMuQV3w4qqM37eLJT+wmLFvFV7ZNV2KqX7WKr/sYq1xfFW+P HFXf5GKub+T9vFV/x/YxVYrYq0vw/Birf7eKu+Fft4q5vhxVfx/b+1iqxW/bxV3L+TFV6tiqzlir S/bxVf8AZxVvl+xirWKtq37GKrGbjiq/jiq/4+eKrGX9jFWsVdirbfBiqz/LxVzYq5vtc0xVdiru T4q2vx4q1irf7WKu+HFWsVbXFXcfh+PFXcv2MVcuKuXFWsVW/wCWmKrsVb4/t4q77b4q7jiq/hiq iv2/gxV3qfDiq/8Ay/2MVcvwYqsX+fFV2KrVZcVXYq23wrwxVrFVv2MVdx44q7jiruH7GKr2/kxV Z9pueKr244q5m+HFWsVW0+H/ACMVdxTFXf8AEsVXYq2y/YxVZyT7GKu+18b4qs+HFV/2W4Yq77H2 MVc3w4q1xX/ZYq1iq1uXLhkFa44quWPniyWtixb+L7eKu5fz4qvT/IxVYzcsVdk2Tar8P8+LFY3P FXcv2MVdwyDJY2Kr8Vd+38eKu5fF8GKuxVY2Kr0xVZ8WKu/ZxVa3x5NVzLixWcsVc/8Al4qvVsVc 3+RiqzFk5uOLF3+X+xiruWKu/wBTFV2KuxVaq/z4qs5Kn2MVcy4qs/4niruP7eKrlX/g8VW/D+xi ruXw83xVTZW+w+LW77WLY7FXYqtXlirm/etirsWTmxYrGZW/18VWNIq/bxVcuKrW+ziqz/UTFWm/ kxa1vL+TFV3H+fFVP4Mklcq/DkWbuWKqbN+xiqovHCqxv8vAqxVxV3+virmbFVjYqv8AtNz/AG8V U8Vdi1rU/YxV3wYq5l5Yqo8sklW+xkUIf7eSS23L7eRQtZsWxYuKr5GxVrFVvD9vFVn7OFVvHi2F gr4Gb//U+yXJ8uaVTmmKrFZUwtjl5fYxVezN/sMDWv5Niqni2Nq38mKtt8f7eSYO48sVdirkxVdx xVy4qq8nyKG144qu4JirsVbVsWxrFW1bFWuCYqqK2KrF4v8AYxVfiq/7OKu4/wDDYqv9P9nFVP8A yMVVFk4YqvbFrWcn+xiq/wCwvx4qt45JKrkUOfFsdwxV32MVVlxV2LJ37GLFdirk+xirarirWKt/ tYq5v+Bxa16rzxbF6riqn9r/AFMVbXl+xiq/g+KrFbFV/qYVbwKubFVNW/kxVUb4sVcrLiq7FVv+ piq7FVrfyYqvVv2ExVzYqsX4cVX8cVX/ALWKrPhyDJfirv8AIxVYv86Yq7liq/7P28VWfaxVerYq 7nk2LuGKuTFV/Lniq3lkFXKrfYxZNcHxYu4pira/5eTVeq/FzxVYzYq7jwxVfyxVyx4qv44q7/Lx VZ9v7GKr2+L48Vdx+LFVF/t4qvX+TFXR/E2KrsVdiq39n4MVd8PHFV/xYq6TFVjKuKrsVW8cVX/F yxVY0fw4q1yfFVq/E3PFVZlxVYuKq3Hliqxm/nxVZ+xiq/f+fFVn2MVXYq3IuKuVcVcq8154q79r FVjYq7/UxVdirbMuKu44q1y5ft4q3x54q1xfFW+OKtYq23H7eKtYqsbj/Jiqp9lcVWLxbFXM2KuZ v23xV0f8+Kr2X4sVWMuKr+OKtP8AYxVa3xrzxVy4q7jiq/l/JiqmrclxVtl/k+3iq7FVvJVXFXep /Piq7FW/ixVZxxVzM7/6mKtcXxV3J8VVP9TFXcv58VWcf9hiruWKu5fYxVyt8OKuZf5MVWfa+39v FV6/6+KtMrZBVi8sVcrYq1xxVdx+HFku+H7GLFzfyYqp8sVWPk2S7Fiv+yvDFVjfFirT5BXfDirn xVvniyU8VVGXFWmXFisxZKmKu+3k2Kz9nFXKvPFVnJv2MVdiyX/6+LFyr8OKrGxV3w8cVWM3H4MV Xriq7FVjfF8GKrePPFVXFVrNirvjxVR5ft/t4q5WxV3H9j9jFXcf5Pt4q7j+3iqxsWtzfyYtjlVc VaxVTXFku+3ixdxxVZ+1iqxmwq7l/JgV3+Riqzkv7GKu/axa3Mq4tjvTxVzNxxa3cExbGsKqXL9v Aq9eLYta3FsW8cVWs2Ku/axVYrfDirlxa1/w4tixm44qs/y8Wtpm/wCDxVYzcsVaX4MklVZv28ih Dt8bZJKp9nIsVJm/YwtrT/YwK2vwYtaxcWx3HFXM2KrcKrG/1MLBvFX/1fsmvJsuaXfY+DFVvLi2 SSu+39jIoW8m/YySXK2Ktq3w5FCozYqvxbFP9j/IxVU5ft8+eKr/APLfFrUVbnkkquRYttxxS39j JJXK3P4MihfxxVrFVqsv7eKr+XxYtjuWKr1/y8VdiqxsVX88VVmbjiqxfs/5GKquKrfi4Yq5mxVe uKuXFrd+38eKr3xbHM2KuTFXYqqYqqYq7FVuLJdixdirsVbXFXcf2MVd8K4qv5ftvirv2v8ALxV2 KqmKqa8MVdiruOSYIjIs1PFVy/YxV3HFXccVWepiqriq3lirmxV2LJf8K4sXLiq343xZL/sYquVf S+DIK7FWsWK3/LxZLsWLfL+TFk5V+LFXcufx4qv5fYybFr/iOKrcVX/tZBkuVsWKm2KqnFMVW/Dk 1X+pw+DFVNcVVF/kxV3LFXK3xYq7jiq9v5MVWcvixVeuKu4/FzxVZyxV37eKu/18Vd9jFV/+pirm 5YqsZf8AIxV3qYq5WxVy4q7j8WKu44q5sVdx+Hhiq7FVvxN8D4q0328Vb/bxVytx/wBTFV37fPFW +OKu/wBf7eKu5fsYq5cVd+ziruTfsYq5m+HFXf6+KuVv+DxVzYq74cVWccVXq3/AYqvX/hMVWfDF irv9TFXccVdy+LFXfZXFXLxXFXfZ+BMVd8OKrGxVerfsYqs4t9hMVXtH8XwYq5lxVy4q7l+3iqxl xV32/t4quxVaq8cVd+3irvt/5OKr+OKrP8hMVdxb/ZYqvbFXLxxVZx4riqtiqiq4q5sVa/a+DFV+ KttirXNMVWt9jFVPjiqp8eKub4sVdxTFXDj/ALDFVNVyCu44snNx488WLuPPFV7NirlxVavwtXFk pcv+DyaqvH9jFisZsVX8kxVQkb+fIMlTkz4q7/iGKu+LFXN9rFVi4q1iqpx+PFXfYxVyrk2Km2LJ tcWKzFk5uWLFe3x4q1irf+pirWKqXxNirX/EsVVP9fFXKv8AwGKuZm/bxVzcVxVYn28Vd+zirpGX jirv2sVWNx+PFXN9nFXN/r4qt/ZyTBpvh+NMizd/r4q1iq3l/PhVzYFc38+KrPgTFW8VU8Vc+LW5 m4fAmFsc+BrWccVb/wCI4qtxbFqr8WKrGbn9vFV/7GKrsKrWXA1qOLYu5YqtxVyt+wcVdxV8VUW+ 1wTFV7f6+KtYta39jFVJlXJJcq4q3irX7HDFVnPFV3L4MihZy/nxbHcu37GKrG+P/UxV3HFXLhVZ x/bxVvFVuFg7FX//1vsf6n7GZDju5c8VaVsWbmbn9vIsVVVxSuxVT45JK9ZPixVczcvt/YyLN3w4 q5uOKq3L4cWtYy4q2v8AkZJK/liq5myKFLl/Pkkq+RQ7FW/9TFWvtYtjvtvi1t8sVX8uWLY7jzbF XLyTFV6yN+xirvs4qv8A+JYqtxVr9j4MWtWVv58Wxpm/YTFVv7XB8VXYtapybFscmLW7niq7li2O VWxVWxVauKu5Yqv44qsxZLsWKo3wt8eKqeKqjfH9vFra+H/Z4suNtlxZL1ZUxVZ8OKuVsVW/s5Jg u5Lx4ZFmrclbFXKvw4qp8sVVPgxV3LFVPjiqon+Xirl+LFXKvHFXcsVdxxVd9nFW/wBnFWvU4/Hi qpkGSxsVX/6n2MVWN/Jiq/hirl/nfFXJirl+1iq9Pt5Nis+z+xirueKqv2Mgqz9j48Vd9nFW2+L4 Mmrv2cVdx/bxVVxVviyYq5cVWcuX28VX/F9h8Vd+1iruOKu+HFWsVdirbfyYqsZuOKrsVWryxVdi rfLFVPk+Kt/bbFV6/Z54qs4tzxVfxxVRX7XwYqv/ANfFXfYXFVzKv7eKuxVv4VxVZ8T4q5ZGfm+K uXjz/wAvFV6/5eKu5Yq19rFVjfbxVU5fsYq5uLYq79rFXcuGKtfZxVd/xHFVuKt/5GKub4f9TFXc v5MVaxVb6n7WKr+X7eKu/wAvFXcsVd8f28VWNirv9TFV2Kt/s4qs5Jiq7FVv7GKrsVbXFVn7eKu+ 38GKtMv+yfFVT9n4MVc3xfHirmxVYq8PjxVe0i/sYq0rLyxVa32/jxVe2KrGxVfyxVZ/qYq0q/F8 GKt8f58VXYq2vL9vFVi4q5fhxVYq4q0sjLirmxVtvg+39vIMl32PjxYrF44qsxVdx+Lhiq7FXYqp cMmyXM2LFeq4q5v8jFVi88gycv8AweKtL/l4sW2XFk7j+3irlXFVi8sVd9rFV+KreLcsmrTYsVvw 4slzLixWcsVXYq5sWTsWK1v5MVXYqt+DFV2KrVk/kxVTbFV2KruOKrG+DFXf5CYqsb+fFXf6+Kuf FV/qYqhuWKr244q7/LxV3HFVn28KrsCu+ziqj/kYta3FXPirsWx3L9jFVNPsYtbbf5GLYs+w2Kr1 /wAvFXf5eLWo8uH2MWxvFVrYqt54q7FVi/5eKr1XFVit+xirmbFrdyxbGsWta/8AkYq5v9fFVPJJ dirfJXyKFJfhySXNJirTZFm7/Lxa1nLFsWMuKr+OFVH/AF8LB3HFVqtirnxVYv8AkYq//9f7HrJw b4MyHHbxVbzfFms54qq4sFRVxZtf6mRQ5/8ALxV32MWxf8P28KtYFb9T+TCreFg58VXr/PiqryTI oUlXJJVfsZFDv8jFXfY+DFV/+XirlxbHL8fx4q74uWKr3xV3FWXFXJiqpiq1m/4PFVRcVWNy/YxV evHFVrLkmC5VyLNyf5GLW6PFsVuX8mFVPl/Pga3YqqK37eLY5fg+xi1qmLYuVsVa5Piratiq9sVW f5GKrk+xiruL4qqc8WtTxbFTnirv9f7eKrmxVb9vFXMv7YxVf6f8mFV/28CuXFVn2cVXs3w4q77G Kr/9fFVn+X+xiq9mxVY3HjzxVdirfHFWsVVOeKuxV2KrP2+GQZL2/kxV2KuxVyYqvjbj8GKrF/y8 mxX8ef2MVWPiq/4n+DFWuX8+QVtlbFk3k2K7k37eKqf+RirlxVU+Fft4qv8A8vFVDjiqv8OKrFbF XL8XwJiq/wDyMVdy4rirm+P4MVWft4q5VbFXR/ZxVey4qs5N+xiq9V4NiqxVxVzNz+xiq9uWKrG+ zzxVfx54q5sVc2KrGZeWKrvtYq3+zirv9TFVnJnX4MVXrxxVY2Kr2Vvt4qpr9vFVRmxV3HFWsVdi rsVb5NyxV3HFVjYq77eKu5J9jFXckxV3+pirSrx+B8VbZV5Yqu5pira4qs+xiq9f8jFVn2PjxVer Yq5WXFVnFX/ysVc3w/5GKr1Xh/qYqs+FMVX8v5MVWNirv8vFXL9rniq/jiqirf8AC4quVv8Ag8VV P9fFVnHFV7L8WKrOXw4quxVvumKtYqt/y8Vd8TfbxVfyxVYzYqrYqhmbFV6t8P8AkYq7i3H4MVU/ 9TFVT/IxVzLxxVT9Nft5BV6riqmuKrlXFk19n/JxYu+ziq1Wyar+X7eKrGXFXJiqxV/YyDJXxVr4 sVWPirsVU8VVPsYq1wxYt4slnHFVmTVey4sXM2KtYq5ft4qp8sWS5vixYu+xirvgxVyt8WKqbYqq L8K4quxVS/axVf8A5eKrOXP7eKrPt4qv5cMVUePPFV74q7/UxVZyxV3H4sVaxVtlbFVn28VW8sWS 7j/wuLF3Lliqxvj+xirX+piq3Frd+zi2LGXmuKuZf28WtTXi/wDqYq2q8mxbF/xpiqxcVaX7eKtY q1+1irv2cVUeP8+Ku5YqvZsVU+T4ta1eSfbxbHL8P28Wte2KrGbjiqmq/bxVzfzviqmv2cklTxVW 54Gbvj+xgVR+w2Kr2bl8f7GFXLgVRbCq37fwYWC9sVUeXHFXMuKuVfhxV3L+fFX/0PsYvDMhx2sW bl+HFXKv7ZxVdyxVvkmKt8f5PsYsHceeKubItyorYq3y/byTBtv58ihv/IxbFq5JgrL8GRYrOXLJ MlTk37eRQ1y4ZJKqzfDw/byLNYrcG4YqrLi1rFb9jFV2Kt8uGKr8WxZ8WKr8VXccVbX48VbxVauK q2KqK4qrYq7Frbb/AC8WxzYta9MWx37WLW58Vc3874ti9uWKtf8AEsVVOTLirv8AIxVauLJV/Zxa WsWxtcVdyxV3+Ri1r0xbHPiruX/AYq7niruPD7GKuX4Pt4quVeWKuXFXNiruWKq2Krf2uD4q7jy+ D9jFXc/2MVdyxVdirsVW/bXFXYsnYquxYqit2fIMnYqs5fFiq7Fit/1MWS9mXFVy/wA+LFamTVbi yVsWLX2eeKrfh45BW+PxfHirceTVVxVR44qqL9jFVuKrmbFV32sVbXFXccVWL8WKub4eGKuaTFXK uKu+y3wYq5lxV32Pt4q7j/Jiq7FVv2MVc3wriq9V/nxVrFW5OOKrFVsVXcnxVbyxVy8f2MVcvwri ruKquKub4lxVf3fFVjYqv44qs+xiq/lzxVTX7eKr/s4q22KtYqt48cVcsf7eKr+PBsVdxxVZ8P28 VXt8GKqPLhiqsuKu/axVZy5fBiruOKuZsVd8GKuXliq7FVqriro1xV3LjirTN8Xx4qqKzf7PFVnw 8cVd8P7GKr2+DFVif5eKr+WKtep/w2KrfsLirmxVeuKqC4qr8cVd+1iqzl8OKu+L/Y4quxVb+xir TfbxVYrfFiqtiq37eKu5fDirv28VWKvDFV/x4q5vibIMlPj+3ixdy+HFXNxTFW8VabJqt54q5mxV dyxVbwyDJ3DFXL/r4qv5fsYqs4/t4qu+1ixW8MWSzl+xiqtixUMWSpx4fHirnybFYzLirWKrfjxV f3fFWsVdiq1sVdx/nxVdiq37eKub+TFVFMVXt7fbxVf+3iqxf58VczcMVWLzxVzN+3irmkxVd/qY qt/y+GKufFVFWxVey4q7/LfFVnHFXMv8mKrsVU8Kqf8AkYFc+LWpf5GSS2v8mRQ3/l4q5sVU2+3i 2KjL/PiqxVxVzft8MVU+OKqnxfYTFVNsVW4q5ftYq5mxVY2Kub/IxV3p/wDAYtazlxxVR45JLmxV zYqt/wBfFXPiq7IoUW+xi2L+X7eKrH/yMVd/xHCqxVxV3LFVqt8OFgs54q5mxVUxVR5fz4sFXjir /9H7Eq3P/UzIcddy+DFm2v8AkYsHYq7nira4s21kbFXce37GKuVsVaVv+DxVWblkWa+Nv5MKu5cv t4q19nAq1Wb9vJMFZMihaq5JKpiq1v8AhMihdx+H4MVcuKqjNxxVdirfH9jFsdyxVy4qv54qsX+f FVZmxVr/AFMVbVsVbxVrjz+DFV64VXcnwNbsVdiq39jC2L1bAruXDFrcvx/YxVf+ziq9WV8Wxyri rsUQX8cUrcVXLiq/liruOKu488Vc3wYta9fi+D7GLY79nFXKzNirsVX8fi+PFXM2KtNiqorf5GKr JOPb7GKr1bFXcfhxVzfad8Vd+xiq7FXYqt44qv5Yq5ftf5GKuVcVcq4q7/XxVv8A18WS79nhkFcv 2uGKu/1MVd9jFWsWK3/UxZL+eTYr1bFWv9TFVq/5eKuZcgyXty+xiq77DYsXft4qs45NW/ixVdyf FVsjYqv5Yq6TFXfZ+NMVc3xYq7j8PPFXceLYq74uGKu+LlirlbFXcVXFXLirvt4quxVbxxVy8vt4 q748Vab4fjxVvin2MVdJiruWKubliq9sVaxV2KrV/nxV3LFV2Ktt/Jiqz4f9jirlbl/r4q5v9fFX ccVXYqt5/wCXirl44qvXliqzjirlX9vFXL9jFV2KrePHFXf6mKr+TJiqxf5MVcn+XirmbFXft4q5 m+HFV7LirvsPirmbFVjYq7n+xiq9o/5/ixV3LFVnHjirm+HFWl+L48VaxVVb+TFXfFiqxlxVtvgb Fku5dv2MWKxlxVevFcVWN8WKubFXNxxV3L4sVWL/AD4qv/4liqz7OKr+OKtN8OQVZ+xwxVpcVVOX L7eKrOXw4q3irvgfJqsfFXN/Piq3/ieLJvIMXfHzxVteXLFk7l8PDFXNyX7eKtMzYsW+LcsWTv8A LxV2KtceOLFvhiyUcmrf7WKtcvixYu/YxVzL8PDFXScsVc2Kr2+PFVFmxVVxVay4qp/8SxVU/wAv FVjNirXLFW1bFXSL8OKrGXumKu4t+3irsVcf28Vdirm+HFrU8WxvliqxcVdyxVdirsVU8VU+TYq7 hi1u/wBfFsU+XxYtbfLFVn28VX/CzYtjv8jFVJm45Jgt45FmqL8WKrF/yMVcy4qsfFXc8VU1+3ir fw4tbWLY38KfBiqny4/H+3irbfyYtbSquKreSYqpfs/5eSS1xVOv28DNzK2BXLy/YxVzNiqzlirv hTFVir+3hVavwYWDatiwWc8VdzxVzLirsVWK2Kr1k54q/wD/0vsTHmQ47uWKr0xVyYq7FXYq0q/F /kYs3fs4qv5d/wBjFWlxVW5fyYGbuWBXL8f+viq/l+w+KtNyZsWtU5N+39jFsWK3PJMFReOKrFbF VVWyKFn+Xkkq3P8AbyKHc/2MVXs2KrI1xVWxbFjNiq//AC8Vdiq9fi+PFXK2Kt4q03HFV6tw+DFr X8eTfHirv2cVU1+3i2L1VWxVvkvHFrd+38GLYu4/FzT7GKt4q7niq5cVdyxVU44quxVRbFVT7eKr sVd9nFXYq3y+LFV3wRYta9cWxbyXFXfbxV328VX/ALOKquKqSriq/wDyHxVT5YqqcUxVYy4qv4ft 4q77GKrsVWq38/28VaZVbFW1+D7HwYqvZf8AgMVWYsl/7WLF37OQZL14Yq5eX7GKqeKqn/EMVd+1 /l4q7FVuTVdzxYr2XFVNWyCrlxVcqriya5MvTFivbFVnxceeTV3LFXcsVVOTft4quxV2KrW/nxVd J9nhiq1lxVfy54qo8v2MVVmbFVn2PsYqvVfh/wAvFVjLirmZf2MVcytirvtrirlbn8GKtMy/7PFW /wBvFVyr8XPFW+Pxc8Va+zirfL9vFVnLlirvsYq79jFXfHiq3FV37P8Ak4q5mxVyrx/18Vcv86Yq v/18VWcsVd8TfYxVc/2MVW8cVcuKuX7XDFXfCmKrsVW8lT7GKu5fDiq/9rFVnL/gMVc2Kr1b+fFW sVW8vhxV3HFXfBiruf7eKub+fFV2KrfsYqu+ziq3l8OKuZcVd/s8Vd6eKuVv28VcvxYq5vsYq0rf 8HirfL/gMVXq3LFVi4q7l8OKuXlirlX+TFXcf58Vc3Djirvt4qprx/bxVvIKv44slL/LxYrsVc3L Fkt5YsV3L4smqzhirsVc+Ku/y8gyafFiv44slv7P+XiruP2MVdirkxV2Ku+xirl+D7eKuVe74qt4 /wDB5NWl/nxYtYqt/wBfFV32sVWtiruWKrsVWty+xirn/wAvFViyLiq9sVd/r/bxVbiq5f5MVWcf 58VczcMVaVmxVtW54qs+JsVdJ9vFXcMVdy/YxVZJi1u44tjl+D7GKubFVjLiq7FXYqh/2sVdzxVz N/PiruTYqpfDyyTBy8cVXM2RZuXFXNiqj8H7eKr+X8mKqf8AqYqtZcVdiqxv8vFV/L+fFVHlxbFr Xq2LY19rFrdi2LZFxa3N9jFVvx5JKjzxVrl+xgZubimFg7l8OBm1gVbx5fBirl44qs5L9vCq1WXC wWviwdirmX9sYq7l+3iqnzTFXYq7FVv2MVf/0/sNz/YzIcdeq/DirlxVrFW1+DFVfFVPFXMvw/Bi q5WxZuX4MVd9v7eKrlwM164Fc2KrsVXLhVbirfJnxVtvhwsHf5eKqvwPkUL1xV3H4cVcvHj/AJGK r2XFXK37GKu5fDi2L+P/AAGKuZcVWL8eKq3JvsPi1tf8SxbHfb/2OKqn+QmKqbN+xiq5vhyTBcrY Ga/4cDWtVcklcq5FDWKtr/I+Kr/8vFsX8eeKt4quj+zwxV2LJzNixd/kYq5cVXtiruX+XirWKref 7GKqytyXFXNxVcVX8v2ExVY3x/bxVy/G2Kr1bFXcWXrirv2cVdy9LFXRtirX+piqtiq3i/28Vd9j 7eKrsVd9rFW+WKrG/nxV3wv8f7eKr1+D7eKu5cMVXpkGS1m4YsVuLJUxV2KtJixbXhiydk2K5VbF XccVbyCu9T+T7GLJdxxYrF/kxVf6jYq1k1W8sVVPgxVy4q5WxVczfDzxVb/l4qvXFVn+Xiq7FW1x V37fx4qs5L+x8WKu4/FiruK88VXriqxf58VXrirl/nxVZxxVzccVd/qYq5ufHFXcf8vFV6rzxVYu KukXFXccVd6fFsVcqrirl+1wxVe3JfsYq5f8jFVnJMVdx5/6+KruCYqtVcVXYqt5ccVd+zw+3irl ZfgxVzNw+N8Vd9hcVc3/AAmKuf8Ay8VakVWbFVT/AC8VWfbxVf8AC2KrPi4Yq7+fFXNx/YxV3HFX clbFXNiruXJsVXYqtVcVX8cVd8WKrP8ALfFV2KuxVb8eKrsVWtiq77OKtsuKrPsYq5uOKqfHFVRv s80xVzYq0zf8Hiq1uP2Mgya+L7GLFy/yYqv+xiqmuKtfYxZL+X2MmxbxVTVsVd8TYq7j/PkGTl+L FV3/ABHFVnw/sYsVvHFkvxVytirl/kxVZy/2GKr/APUxVTxVUybFYq4q7liqx/8AIxVeuKrGxV3H FV2KreWKu+DFXclXFXcfhxVT/wBTFXf5GKqjLiqxmX4HxVzNiqxvtcMVd9n7eKuVuz4qqYqpviqx ZMVaxVb6eKrsVcMks3ZFVvHFXf6mKrJGwq3gVD4tapirsWxy/wA+LW7l+3iqzl/Ji2ObFWsWt2LY tVm44taj8WLYv+D9vFVnPFXYqsXFrdv/AD4tjWLWp/sZJK74P2vt5FDmXFVPFDlbjilT5csklzNi rTZFmsVv28Vd/l4q5lwqt44WCxmxVZ8WKtpiwd9vFVit+xirlxVrFW1xV3qfDzxVYzcfjxV//9T7 DK3P7eZDjrsVb+LFXK3w/wCXiruWKu/1MVcrcsVX/wCXirWLN3FsVdzxVV/a+PFVrf5eKtf6+Bmr ccCrsVd9rFW+X7eFXK37eBW1XJMFbIoU1Zf28VVlXFXf5GKrsVdi2Oxa21+DFsdy/kxVemKuVn+w mKu5fFzTFV8jN/s8Va5Yq3x54qvVcVc3+piq/li1rF44qv8AUxVy4q7lzxVy/a54qvxbHcV5YqqY q0rYta/li2Ncl+3+1irf7P8AlYq7liq9pMVc3+XirmbFXcsVWr8f2MkwVV/kTIs3fbxVf+1iqzl8 GKu54qv+HFrVcWxbyb4MVdxxVfyXliqgq/sYqqM3H7eKu5JirvsYqv8A8jFWuOLJtl/kxYu5c/jx Vy/H9vFV6Yq77Xx5Bk1zxYrMWSorYq7FXfDirvhXJsXYqqYqsXIKu+LFku4/DwxYubliqxl+HFVR VXJq5Wb+fFV2Krfj+DFXcP2MVdy44qvZeWKrF+HFXfZ/YxV3JMVczNxxVe32ueKrPgxVe3JmxVy4 q1iq2RcVd/kJirmXFV7L/Piqz/hMVdy/2eKuVVX48VX/AORiqz9rgmKub/faYq71PixVytiq5vt4 q3+1irv2sVWcvhxVz/5eKr+PxYq1xfFW2/k/YxV3HFVir8OKr1XFXN9nniqz4UxVyrirv9fFV/Ln 9jFWlXkuKtriqzn+xiq//IxV3HFVn2FxV3HFXfBirk/YxVy8eXDFXcuOKrvtYq7FVvLFV3wfsYq5 V/b/AG8VW8lbFXf5b4qv5Yq7lirmbFVjfFiq5VXliq3liqzjzxVerYq7k37eKrPhxVVxVQ5ZBVTl iqzlwxVpl/bxVcy4smvixYu7Piqm3DJslVVxYuVsVWc8gyd9lsVc38+KuxV328VWty+xixXfYxZO fFXM2KuTFXN/r4q5W/2WTYrGX/YYq5sVWYsnf8SxYrv2/wDLxVv/AF8VWcuK4quxVS5cMVcq4q5f 8vFVi/G2Kr+X8mKuT7eKr3/yMVczYqo/C2KuTFXK37eKtR/YxVtWXFWl+D48VW8f2HxV3+Rirv8A LfFXfDiqxsVW4qqYqtZmxVZwfFVjN+3iqmv8+LWqfDi2KOSYLsihy/5GKtsq4tjl/wAjFVnHFVnL +fFWuOKt/H+3iqxMVcq4qs48MWtzcsWxZyxa3Niq/j3/AGMVWcv+DxVYvwfHiq3jwySVi/8AD4q7 FVPjkWa/lirWKqTLiq1v+J5Jg7j/AMLiqzFXPirfHliwWK38mKtYq3+zirXJ8VW/6+KuXFXNir// 1fsGq5kOOrcsVWceWKr1xV3LFVi8+OKq3+pirsVcvDFV6riqzFV3LFWlxZr2XAzWLhYKy5FmuxVv l6uKt8cKubFV3Hjga3KuKr/tYqt488klVyLF3L+fFK/l+3i2LG+LFV32cWtU+3iqzji2L8Vdx+DF VTFWk+3iqriql9nFV6s2Ku/y8VX8vh54q5cWtrFVRf8AIxVyt/weKuTFXf5GLYu5Yq5m/nxVWxVb 8eKrcVXfsYqvX4MVdyxVplXjira/A2KuXFV7f5GKub4sVd9n7eKuVcVd8P7eKr/g/bxVvFVytiqz 4sVbxVrlxbhiqriq3jiq7FVv7eKuVsVX/Diqzh+xiq9cVcrLirvs5BkrN/qYqpvixWq2LJerYqu4 /t4sVi/z4qqL9jJq0q/t4qs/yMgqp/r4snL8fwYq5W4Lirl+P7GKruPH/KTFitVW45NXRtiq5vi+ DFW/2MVcrfFirm+H7eKuZcVX/wCpiqz/AFMVcsf7b4q5/wDLxV3Ll/kYq5VxV3L4sVX8f5MVWcef 7GKrsVdiq2RcVX8sVc2KtYqpceeKr1/bxVcrfFwxVarLirviTFV/L9vFXMuKrF+H48VX/b+PFVjN iq/lxXhiqxlxVy4qv5fD/kYqsb7GKrsVW/F9vniq/j/kYq7j2/bxVYrccVXYq22KrPjxVy/AvDFX ft4q7kmKr1xVZ8eKrsVWMrPirfJMVX8vixVy4qsXFV7N8WKrFZvsYq0vw/t4q2uKr+PDFXcsVWcs VczM2KubjirlVVb4PsYqtxVqTFXN/kYqvbFVmQVb/r4q7lirfLFkv44sXMuKrPtYqtfJquVvhxVv 4sVUsWS7/I/YyCtcfjxYts2LJrFi2zYsljfH8GKr/tfHiruLL8GKu4YquVsWKHybJfyxYtYq7liy Wrixd9jFXMvLFV2KqXw4q5v5MVaVv58VdxxVtf8ALxVpWbFVT4f+CxVTVf2MVb/a+PFVPjzXFW1+ 1zxVe/8Al/YxVZx5fY+xirnxVyt8WKrFbFXMvxYqsVeOKruXxc8UTdilay4q5fsYq748VUW/yMVc y4tbsVc38+LYs/Zxa3ccVWcsWxy/6mKr+WKrFbin+RiqxWwqvbA1qPPFsdirnxV2KrPixa3fFyxb GsVb5YtaxsVUvtZJLS4qtZuf2/sYqu5fsZFCzli2LOX8mKr+XBsKuZvhwNazJJU2/wAjFgsZf9ji rsVdirsVWM2Kub+TFVjYq7lirv8AIxVby55Fk3yxQ//W+w328yHHd+z8GKu5csVcv2f5cVdz/bxV r7fx4s1Tk37GLB3LFXcvhxVerYq7l/Piq9m4Yqp/YxZr1kxVdH8eBm3iq5WxVy/yYFXcv28WttcV Xr8WKrf8jJJdiq7lxyLNtsk0qq8v28Dc79jA1u4ft4qvbFVjScfsYtisv+RirsVWLiq/ir4quXFX MvHFrVOOLY77H7GKu5Jiq7FXcf2MWtbyxVeuKuX7PwfbxbF7fz4tbueLY5fs4q5v8vFXJiqt8P8A ssVaVuOLJv8A1MWLuXHFV2Kt8cVcq4q7lzxVrgmKqmKuX/I+LFV6sv7eKrF+LFWv2PjxVvjxxVf+ 1irXw8cVW8MVVvi4Yqp8sVVFxVdirsVdirsVbZv5MVdy/YxVZiyVv2cWLl+HIMnK3Z8VaZcWKp6n PFks+HFXYqu5ZNi5cVbX4PsYqsTIMlZfs8MVbxYqX2ExVv4eOLJpW+HFiqMuTVrlw+BMVWKv7GKu bFVRW4/YxVzNirl+38GKrvtYqt4/Diq9v8vFWvs4qtZW44q6NsVd9hcVdxxVyf5eKu+3iruKYq5v hxV37GKr1bFXM2Ku5Yq5l/k/ZxVZ+3iruWKrsVW/6mKu9T9nFXccVX/tYqp8XxVv4nxVfy/4B8Vd +38GKrOWKrsVb/yMVWcsVdx/kxVf/qYqs5Yq5WxVe2Ku/wBfFVn7eKr+PDFXfY+DFVjYquxVb8Tf Biq5PsYqtZcVX8f5MVd8WKrOP+XiruX2MVX8VVfjxVYv2MVX8cVWM2KqbYqqN8TYq7j8WKrG9/sY qvVfixV37eKrMgq5cVWfaxVfx+LFVNsVVOXHFVuKuX7XPFkv5ZNioqv7ZxV2KrlxVb+1zyDJpv8A h8WLm+1wxV2Ktq2LJytiqz4cVXcVxYtt9rFk5mxV3PJsVHFk5l/nxYrsVdiq1cVX/DiqnyfFW/8A U+xirvh+3iruPH4MVdy+LhiruWKqfLFVRV/bxVZ/kfy4qs9Tnirh+xirvsYq1y4Lira/DirvixVp f58WPG3/AJeLJZxxVy4qsZVxVe3wYqs/YxV3HFXcsVWN8eKqbN/J9vFW+GKub/LxVrj8XwYqsxa2 3/y/t4q5vi+PFsdxxVSxVbyxVvlwxVpsVbZsVd8OKqPLFXMuKtYqtZsWtdiqm3w5JKxvb7eKuVcV a/y0wM12Fgo5Fm2q4tba4WxT5YFU1VuOSaWmbFm2vH/XxYLOGKuZueKuZv2ExVYzcPjxVY3JcVXY qt+x9vFWsiyU2+1wxVa+KHU/yMVf/9f7Aq2XNLuX7CYq5uX2P28Vb5fFkku5YsG1+NcVXr9jFVnL 4sVXr/Jiq/8AyMVaT7GKqnLn9vFXJirueKtM3ZMWatgZtq37GFpb5ZFk74v28LY7lgVf+zirl/kf 7OKr1+1zxa1i8ft4tit6nNfjxa1/7eKrP8tMVX8v5/t4q5f58Vdy+LFV2Kt8eeKr0xbHYqu5Yq39 rFXfaxV3qL/s8VXsy4q1yfFW+X8mKr1b/LxVZy+Lhiq7gmLWqYqp8f5MVVMWxZ/kYqrL8GKrOX/B 4qu44qrYqtVVxVdirsVbXFWsVWq38+Kq3PFXK2KuX/L+3irsVX8eX28VWc8VXxrirXLFW+LL9jFX fbTFXMyviq9cVdxxVzcVxVzfF9jFV2Ktry/bxVzYq1irat8OKrMWStixdyZ8gyd9psVdx/bxV3PF XM2Ku+xk2LsVc+Kr2bFWlXj8GQVvFVrYquxVczft/sYqtX48mq9sVU2xVev28VbbFXNJiq9cVWNi q/8AaxVYzYqv5fyYq1iq1m+LFV/7OKrP2MVXJ9jFVvFlxVzYquxV32sVdirbfCvDFVi8cVdy5fsY q1xfFV+KuxVay4q7l/weKu4t/ssVXYqtZcVXfH+3iruL4qtb+fFV/HniqxuKtiq9eOKrH/y8Vcq/ yYq0zfF8eKr8Vb5Yqs5fDiruPw4qvXliqxvixVy/aTFV7cv28VdxxVrFVrf6mKubFV7NxxVy/Hir WKrVb4vjxVfy/kxVT4r/ALLFVjN/Piqoqt/q4q5V+Hh9vFVnL+f7GKr1/wCHxVZx7fsYqt45BVRv hxVarfFiyaVcWK9cVWen+xirm/kxVrjirf7OKrf8jJqv+1irTMztiq39nFXfDkGTv2sVXq2KrMVU 8VVMVcmKu5ccVU+OTVvlixWs2LJpW/kxYrsVa+ziyabFi5fh+xirlb9jFXLiq9sVUeLcsVX8sVWL yxVytirX+pira/5eKu5cfjTFWv8AUxVazfDiq+TFVmKu5csVU2+JvgxVUX4cVU8VbbFXLirWKts3 L7GKrOWKubFXM37GKqa4qt54tbmXhiqxf5HxVpf5MVW5JK/lkUNYqtZcWx3HCruH7GBVjNirm/4H FVnDFXKuKrOOKtYqtZsVX/5eKrPsYta3jkkrWX4ciha0nL7GLYtVvhyTBpsizdxxVzfz4q1iqkrf 8HhVdw/bwtKjiruLccVdirv8jFVnLFVj/wCRiq7FVLl8WKtM3LFm0y/FwyKFNv58VVvU4NkmKgzL izf/0Pr8zcPt5c0rlbniq1m/k+xiq7l/PkmK9ftPiqzl8GKubniqtyxVyf5eKuXFV/LFXcueKuXl iq/FWsWbkxVUZuS8MWC5VxZrVX+fIs1bFVNckwVF/wAvIod9nFsXZJgu4ZFC5W+LFVrZJKsy8/jy KHfHiq9/sYqsX4G4Piq7FW+OLYvTFXYq7/IxVfyXjirX+viruOKrsVa5fsYqq4q2rYVWfYwKv5K3 TFrd6eKr+eLY7FXcl/YxVevLFXfZxVvFVy/Firm+BfjxVzYq7liq/wDyMVa+P9vFXYqqL8OKu+LF XLH/AMHirsVdzxV3+pirkxVev+RirvsJirXxcsVbVcVVcVWquKuVsVcv2MVcuKr2X+TFXceGKtYq 19rFku48MWLl4/YyDJcq4sW3xZO/y8Va4YsW2bFk1/xPFiqMuTVY+Ku/axVzLkGTuTccVXs37GKr Wb9jFi03+XiyXqq8sVX8smxU2xVyt8XN8VbVeGKquKrePw4q77K88VXt9rhirm+DFVjLirlXFXM3 HFXKv7eKr2xV3FvjxVZxZ/sYq5ft/Biq/liqz7C4qvX+fFWsVWquKr+P+wxVZyX9vFXLiq9cVUWb 4v8ALxVf+3iqzjwxVW44qsaT4cVX/Z+39jFVn+Rirm+xirmZsVa5cvsYqqceHx4qor/Jiq/4f28V czYqvXliruP8+KtYqt+3iq/lirm/nxV3Lh8GKrP8jFXR4qv5c/8AXxVZ9vFXMvHFV2KrV+xirmVv t4q748VdyxVyf5eKuZeK/BiqnyxVU/y8Vd9jFVL/AC8gq7FV3L9t8VW4quVcVW4q7FVmLJv/AC8W La/Biq34+eTVUxVpuPH/AC8Vc3xriqz9rIMnN9rFXYq74sVdx5Yq5W/YOKu4tirnxVTybFvl+xir mxVZ/qYquxV2Krf9TFV2KqX2/jxVf8eKuVsVU1xVvl/JireKruP+Xiqn/r4qqf5eKqLfDiq5W/bx Vav8+Kr1/kxVT+D7eKt8eWKr2bFUMqq+KrsVbZcVX0X+fFVjNiqxsVc2Ku5YqtxVTxV3L9vFVPFr b5Yq03+Xiqn/AJGSSiGX4uGBmsbAqj+1iq/jiq3FVNVxV3DFViriq/FVnLFVi/Fi1u4/yYquxVbk kqT/AG8VWcv58VXNyf7Hw5FC1W/kwtim3H9vFXcl/YxVyriq1vsYq7/iOFgtZmf4MWCz9nFXYqsZ WxVysuKubFVnH+TFVjfYxVb/AK+LN3PIoUlySWsVVsihYq4q/wD/0fr0vw/YzIcddGuLNcvH7GRZ tYqv4/DzyTS5eGKtrJkWSpirWSYqmKreH7eKr+OKu44q7jiq9eGKruOKrcVX+p8OKrsDc7lhYLvt 4Gbm+L7GBV7fZ+DFXepirat9vJMHK3Z8VXxrirXLFV32F4PkUNfFkkqv/Esih37GKreXHJJVE+xk WaovxYq7hirsVX/FirvU54q1yxVv9rFXK2Ku/axVeuFV/wAPHAqyNlxVd9rFrd9nFVT9nni2OVm/ YxV32/gH2MVdzxVr9j4MVV+SYquxVTxVb/l4qqcsVcuKqyrzxVRZv58VXLJi1qnw4q5mxbF3/EsV b49/28VWYqvZsVd9j7GKu+LFV/2FxV328VXP9jFVq4quxV2KuxVbiydiq5cVd/r4qu+H9vFVRvb7 eQYqGKquLJyYq74WxVy/8Jiq3l+w+TVdx5/Bixc3w4quXFV/7XPIKt/Y4YslvHFivxZLeX7GLFvj /Jk1VV+3iq1fh+PFVjNiq/kmKu5f8Niq/wD1/wBnFVn7PwYq5fsYq74V+3iruOKrsVb5cfsYq18H +zxVtl/nxVYqrxxV3L/gMVczYqvbFXftYqs5fD8eKu5ccVXfycMVWr/Jiq9f8vFVnwpiq9uP7GKt YqtX4fsYquxVvj/Pirl44q5cVWN/JirvgxV3H4eGKubFXKvLFXcfixVzfb+PFXf5eKukbguKr/2c VWN8OKrsVb5c8VWfDx4YquxVby4/YxVzYq5fg+B8Vdy/kxVys37eKu/YxV38j4q7l9jFV2KqTfF8 GKtK3HFW1ZeWKrvsZBVi4smuXw/Hixd/r4q7/IxVv7OKr+Pw4qt/18WTv2cVa+1ixdyyaqeLJc+L F2Ku+3kGTl/y8Vc+KrFxVfx/bxVZy/YxVfiqly/byat4sW2+JaYqs/2GKrsVWtirlVcVdyxVpWbl irf2Pt4q7lirlxVTVvhxVtWxVvFWvtpirn+3irm+DFWuWKt8v5PsYqs+Lj8GKu5fsPirueKuTFXf Ywqs/wAh8CrGbliq/wDyMVa+ziq1cVd/xLFXLiruWKqLcf2MVXNiqirfDwxVU54taxlxVrFsW/8A EsVXty+3irm+DFVithVT/wBfAq7FWl+DFVjfFirueKrF+DFXftYtaz4nxbHf8Rxa17SYtiH4qjZJ gqr/AD5FCxv5OeKttkkqa8MizU8VWs2Ku/1MVWtkmC1m4YsFzL+3izW8v2ExYLG+ziqxsVc2KuZl xVYrfFirmbh9jFVNlxZt8sihTZl5ZJK7j+xkUKfL+TFVRmV/sYqsZf2HxV//0vr62ZDjubFVHFmu /wAjFVTl+xzxYLueLNdy+H48ihT5fz4qqf8AEskltcWDa/5eKr+K/t4quxVvl+3irlxVevxYqv8A hxVzLirUfwYs2v8AUxVv7H2MVVVbAzW4FVft/BiqxsVVOXNskwVFb9vIoa+L7eSS3irStzxVzfC1 MVVWX9jIoXqy4tiz7GLWu+1i2Kitirv2cVdzxV3PFXYqqYq19nFXfDirlbFV8jYq7j9jFV/xYtbu OKr0xbHJiruXP48Va+1/qYqtb/LxVW5Ji1uX4/t4tjf+piyab48WK/4v28VcrfDirv8ALxVdirsV XK2SYKvw5FCzFsdx+PFXf8QxVeqt9j9jFV/+viqmq/FirfqNxxV3Lkvx4qv5fz4q7l8Px4qsZsVV cVWtiruWKuxZOZv5MWK/l/PirTYsnZBVRft/5GKrFX9vFV/xJ8eKuVvi/wAjFXf8QxVzfyft4q5W 5fbybF2KuVsVW4slX7P7GQVpf5ExYr1XjiqmuKqrfD9vFksX/XybFf8AFwxV3+RzxVzfYxVzK37G Kubliq//AFMVaxVtcVWfb+3irlxVzfDiruOKuf8Ay8Vcy4q5W+HFXeniq/4cVWcsVXYq7FVqf5eK r/h+2+KubFXKvJueKrGVcVdyVsVXt8Hx4qsVcVXtiruXPFVHl8OKr+PxYqvbin28VWK2KtL9vFVT /UxVZ9jFXfs/Biq/l8WKrFbFXfYxVe2KrOPw4quxVv8A1MVaxVv40xV3xYqs/a54quxVzScsVW8/ 28VU2xVUVV44qs9PFV/H4sVU/wDLxV3Lv+xkFa/y8VbVuHwYq77H28Vdx/YTFXNiydy+LnirXHFi qcf58VWNxxVzfYxVamTVc2Kt/s4qp8Mgrb4sl/L+fFVDFVRWxV3H+fFXPirsVW5NVvLFVvHFi5vh xV3x4q5sVdy/kTFXen/PirmxVy4qsbliq/8AyMVcvxYqs+JcVbxVTVsVX9kxVZy5NzxV2KuWPFXf sfyYqqYqpviruGLWp4tjfFuPPFXcv28VWP8A5eKu48lxV3HFXNirvsfHiqi38mKuVcVXLiq1V54t anx+LFWlySWuX/B5Fm5VxV3J/sYqs+x8b4qv/wBfFVBm4Yq3zxVz4q58Vdiqzli1uXFsUvt/bxal 0nFF/wAvFtd8P2MWtS5L9vJJczYquX48ihSZl+xkktMvL4EwM1/2MDWos2KrPhX7GLYt/ayTB3HF gt+PhirvhxVytwxV2KqeKrV44qvyLJC/Fkktt/Piwa/a54s13+RkUKfL9vFXMvFcVWL/AD5Jivb4 2xV//9P6+ZkOOt/bxVevHFVnHFV/+piqzi/28VXf5GLNVX4sih3DFXKuKruPDJMXLy+xiqriq3l/ Piq/l3/bxVy4qvfFVnLFV/PFV/L4cVaVvixZt4qqM2Bm5VwK5W9JsVXrirvUbj9vFW+PwZJg5MVV OWRQ03x5JLa8v28ihU+PFVq/DkkqmRQ7k+LY5eOLW3xxbHKrYqv54qvVsVd+ziq/jiruKfYxVysq /YxVdiqm2SYKq/yZFm1x/kxa1T/XxVy88Vd9luf7eKqfNMWxX4PireKuxVdy5YquxVSZcVXquKrs Vb/y8VX/AOpiqxm/YxVytwb/AF8VXr9nhiq9v8vFVi/t8cVXLiqon+Xiqzj+xiq9eX2MVU1/n54q uxVd8eKqa4qr8ea8MVWsuLJrl8PPFiv+HFVnxcsVXs37eKr0xVTxVUfIMln2sVXJixWYslTl8eKu /b+DFXfZ+DFWvsLzf4Mmxb4Yq7FVTFVqt+3kGTuXxYsWuWKq2KqXxfbxVys2TVU+JMVWL8LVxVe2 KrsVb5Yqs5csVcvxYquxVauKr+OKrPgxVy8fsYq5vixVyriq74eXwfbxVtsVWfz4quxVauKu4/sJ iq9l/bxVYzYqv44qsf8AyMVdx+Hg+Kr1b4sVdyxVY/8Al4quxV2Kt/5eKtYqs4viqouKqa8ePx4q qccVc3HFVjf77TFXMuKu5cF/y8Vd/qYq7/LfFXcV5c0xVzYq5v5MVdxTFV6t8OKrPsYq7jiqz7WK r1bFVjf5eKuZv5/sYq0v+RkFX8nxZO+DFitxVbxxVbiq/wCx9vFWmxV3+viq77Pxpiya+H7D4sW8 VWM2TVz4q7j+xiq3l/PiyXc8gq/7WKrPh/bxVrFi3zxZOxVS+zk1Xs2KqatixXrirvhxV3+WmKrG +L7GKr1X9jFVnD9vFXccVabjx+DFVvL9vFWuOKqn+viqz4sVWc8Vc+Kr+KYqs+3irsVd9n40xV3w tirkxV3Jv2MVWf5eKu5Yq5v58Vdx/bxVpPsYqt+H9vFXM2Kub4cVU/8AUxa2/wBrFsWMzNiruS4t bmbFVNv58VaZcklpW45Fm7lirv28VdyxV37GKrOXw4qq4qpKuKqLNirWKt8sVWM2LWv5fyPi2LP9 TFrWfaxbF+LUosyt9vFtWfab4MVb+xkmDuWBm0uBrWMuFsdyT7eBVLlkmlUZvixVY3x4qsxV37WK uZvhxVY3x4qsVcVW83yLJYvw4tjpGxa1jYqv9T+fFVLjkkttiwc2KqfJ8VX4q//U+vTcsyHHcrYq sZcVbxVcv2ueKuX4cVXK2LN3H9jFWlb4sihevx4qq8vi+D7GSYtK3L/UxVv/ACP28Vdy/bf9nFV6 tyXFV/8Ar4q7lirm5YqvTFXc8VaVsWbmbFVXjzwM16riruX8+BXft4qrfs4VW/D+3hYO5YGbkwsF /wALfbxV3qfD8eKrm5ZFDSq2Kq6tyxVYuKu5YquxVU4YtizliruXPFV6Yqv5cMVbxVd9hsVWfY+P FV/HFXR4q77GLWuxVvlzbFscy8ft4q1i1qmKuVsVdi2L+XDFV7Yq79vFV2KtrirWKtquKtP9jFXY qqKuKuTFXN8WKr+Xf9jFVmKrv+JYqqP/AJeKrGXniruX8mKr/wDXxVzK3L4MVXYq2q4q1ira4qsb FV7YqsXFVy4slTk2QVTxVX/1MVWcv58Vd+38eKu+3irvst/LirlbFXcvgybF2KrV+ziyVFxYu5ZB k3x+HFXKvDFXK37GKqmLFT5fz5NV6/YxVzNirpOOKu/18VWfZxVW/wBTFVjLyxV38iYq5WxV37eK r2XFVi/yYqv44qs48mxV37X+tirk/wAvFV6/H8eKrGZXXFV6r/PiqxmxV3LFXfYxVf8AH9jFWvj/ ANhiq1V/b54q1xXlwxVeq/tvira/zviqzn+3iq7FVvJMVdy44qv+39jFXccVa/Y4Yq2vLFVjcmxV y4q5uX2MVd8PHFV68sVWSL8WKrsVbX4PgxVY38mKr/2cVWM2KuX4sVWLy5fBiq79r48Vb/YxVY3x 4qvbIMln+virX7WLFfyTFVnL+TFVRVZ2/wAjFks+LFVTFitVsVW4q7FVq8v2MVaZsmq/g+Kqbfzv 9vFk0mKruX8mQVrlyxYrMWSpiruGKrGxVvJqp8sWLlxVd9rFVrYquxVvjiqz/LxVT5Yq38WKr2+H FXM2KrcVa5cf28VaZVxVysuKu44quxVTZsVd9lcVczYq7FVzYqo4q3/kJiruWKu+HFXLiqxmxVy/ 6+KrsVU8VU2bFrdxVMWx3DFXNzwqt/4jga2l9/sYtjWKtsrYqs4twxVZy+HFV/HFVuKqbNirsVdz xVzfyYqsbFVnLji1r2xbFF/t4tbXw8cVVsVQqZJK7j8eRQt+18aZJK77P28DNTwK0v8Ar5Jg3kWa jkmC+Th8eLBRVsVdwxVz4q7niqzliqirYqvZvhxVSb4ci3Ob7OLWsZsVa+2+Ktcsklv/AC0xYLFb FV2KrOT4qvxV/9X66JmQ47uGKuZcVXqq4q1yxVWxVbyTFXK320xVfy+L+TFXL/xDIslTjyxVZ8OK r8VX8eeKtLyyTFVxV2KrVbFV7YqvTFXYq7/IxV3Hh+xirsVVPiwNzm9vt4qq4FbWTFXN7fYxVtV/ 4DJMHcfgxVy/GuKqvL9jIocrfF8GKrfgTJJX8WbFV2KujXIoXt7fYxbHLxb/AFMVV8VU/sYq1x5r iqpGuKuXlirlX/gMVa5YqqLyxVy/z4quxVy8uPx4q2v+Xiqxm/4DFVZW7PirkxVz4ta/7OLY3irs VVMVdiq3liq9W+LFWsVdirfLh8GKr1k54q7/AC3xVzK2KuxVfy+xirv2sVdx54q5fh/bxVr/AIli rfL4eH7eKr1bFXfsYq5WbFVzYslq/wC/HxYu+HlzxV321xV3Ljiqt8WKreGLJpW/nyCr+K8cVc+K uxVpV/kxYt8vjxZNYsW8mrm/kxVdxxVb9lcVXLiratkGTlbjirTNixVGbliyU1ybFU/1MVcrcfjx VzcVxVZ8WKr1Zv2MVdyX9vFV6/CtMVczfsYq7/IxVZ/kfYxVeqrx4fbfFVnHFV2KrVbFXM3xYqv5 cGxVYn+RirvT/kxVy/D9vFXLirl+ymKr+OKubFWsVWyYqvZVxVZ+3iq/jxXFXcvt4q1irbf5GKrG xV3F/t4q7iq4q7liq9cVa+1irar+x+3iqzl/weKr1X9jFXNiqxsVXyYqsZsVXs3xYqsZsVcuKqfH 4fjxVUVsVU1+1/l4q7lireQVUxVS4txxVvl+3iya488WLS4qub7GLJauLFvliybxYtKvxfBirX+R irbZNW144qp/s5BXPireLJz4q7FWsWK1smrWKt8vixVr7OKuxVtl/bxVZyxVerYqsZsVW4qu5L+3 iruPw4q5lX7GKub4sVU2xVvsmKuVsVc3HFVnLliq5l+LFVvH4ub4q71PixVzL8OKu4Yqp/axV2Kt rx/YxVzYq7li1rPTxbHYslPlixdyxVbzwq7jxwK7FrWMvDFWuL4q38P/AAOLY5f5MVc2KrGbFXNi rvh4/wCXiqzl+3iqxv8AIxVzNirkxV3PFVnLni1u5Yti1WyTBc3LlkWazlybFrUWySW+Xw4qsxVz fuvjxVpvjyLN3HFVjNhVpvh+PAqkrfyZJguxVzKv7GLBZwxV3PFVi4q5WxVY3w4qtZv5MDc7lzxV vA1qf2MVcrMn2MVUv9TJJWcuWKts2LB3HFVnH9vFXcl/2GKtccVf/9b66K2ZDjrlxVamKr/tYq5m xVpm/bxVv4sVX/bXFXN8OKu5fFiq/wC39vIslRWb9jFVjfHiq9MVaZckxXr/AD4qqL8WRZNKvHJM V64q7jiq9W54q5W/bxVUxVT54qvxZqmKu5fsR5Fm5cVdyxV3LCq9W4/YwKv5ccWtdy4tiqn+1zyS URkWKzJIX8/28iydxT7GKq3PFsWf6/28VX88VdzxVy/ZxVT+ziqurfsJiqxf8vFVTCq7jgVy8cVc q4VX8u37GBrWKuKu4/yYti7FW2Vftpiq5W54q39n7eKuXhiq/lwxVf8Ab+PFV2KrV+LFXc/28VXY q23L7b4q5V/YxVpf5MWtU/1MWxzL3TFXf6+Ku+3iq/l9jFXcV/YxVyrirX/EsVXsv/B4qtVuX28V d/qJiq9cVd9j7eKr2xV37WKtYqt5cG+DFV68cVcuKrsgrfxYsli/5GKr+GKu4Yq5MVWfZXFV7Lir mbJsXfDirsVdiq/IKt5Yqub/ACMWS1W/nxYrsVaZvhyaqnx4qsb48VXrirlxVzf8Jirv+JYqv5Lx xV0nHFVi/B/qYqu+D/YYq2y4q1iq1lxVe2Ku/wAjFXMuKtL9vFVrMuKu5MuKuVsVdx44q79jFV/H FVnHFWmX/g8VVPixVZ6eKuZcVczft4q1y5/A+KttxXFXNx5cMVX8cVd+zirmb4vgxVZyxVzNiq9W /YxVZ8GKu+3iq9vjxVrFVv2MVXr/AD4qs4piqm2KqjfDirmVsVU2b+fFW2+D7GKtMuQVyfbxVrji qpyZcVU2xVd+1iyaX+TFi7jwxVpcVb5fyYqs54q3zyau/wAvFXN9rIMnJirkxVZy54qub4l4YsXY qt+ziydy/YybFazYsmuXHFiub7eKrcWS/lixc3wYqs/Z54q5V+L7GKu+1/q4q79nhirm44q5v58V WcWXriqxfixVcy/YxVTb7XDJMFuBmqLwwKub7XDFW+PH7GKqH2sVbZf5MWtf9jFVi4tixcVVnxVT xVY328Vb/wAtMVcsmKrPtYq1yxVbyZ8Wt3+Ri2LOKr0xVyt+xi1ubFXcm+x/Pi2NYVW/BgVZJi1q 3HFsWf8AEcVWftYqs/yMVdwxVysuKrGbjirX23xa12SSp4q5l4fYyKFJVySXKzNiqznirm4/7PFW v2cizbyTBT5ZFm7liqxf8jCqxcLBtuOKrePx4sFzYqpNirm+DFVjM2KrW5ZFk3i2KbLxXFXN9nFr cy4qpf6n28klbx/4DFg5WZcVc2KrcVdirX2sVd/r4q//1/riq5kOOvVvh/y8Vc32sVXr9n4PsYq7 4sVaXFV2KqmKqXL+TFVXFVrYq3izVl+HIocq4q5MVXt/l4q0q5Jirf5GKuXFWsVb/axVf+1iruXN sVd8WKrm/wCBxZruXw88DNrCwdiqoq/sZFm5cKrsDW7FsbVlxVvhkmC+PjiqvkUKS8sVd+1iqrir at/JirlZsWxemKuXk+KuTFXYq7niq9WVfsYq79j/AC8VVcVU8VXLyxVe3+Riqk2SYOXFVVmbIs1/ JUxVzL/weKqf2sWtUTFsXLiqpyxV2LJyr+xixdywqv48MCrGxV3/ABHFV/qM2KtcXxVUb7WKr1+D FVnx8MVXf6mKtt/kYq74cVX/AAYqptiqtiq3lyxVdirsVdirbK3+wxVytirmxVZiybVcVX4q0zZB V6r+xirmX9sYq7l8eKu+xirfLFi0+LJ3w5Ni5l+HFXYqtxZKq/YxYu+LjwyDJr4cWLm44q7liyXZ Ni7FWo2XFXfbb48Vd9nFXcef2MVdxZFxVe2KrsVW8f58Vd/xLFWm/wAv7eKqjN/Piqz4ePwYq7i3 PFXN8LYqv/afFXM2KrFbn8GKr2bFVn7PDFV6yYq7l+xiruPxYq743xVrFVqs2Ku5Yq7j8XDFV2Kt s38+KrGZXxV3qfyYqu+P9vFVLj6Xx4qu+L7GKt/YxV3xcsVXYqtXFXcv5MVXcnxVbx/nxVfy4Yqs bFXfHiq7mmKuxVav2MVUV+3/AJeQZOTFV7N8WKtNxxYu+x8GKuVcVd8OKqnJf28WSk2LFcseLJYz elirnybFb/xPFku55BXK2Kub4cVaTFisxZOxVv4P28Va45NXLirsWLvtYqt5YquVv28WS1V44sXK uKu4/wAmKu48v28VXYqtbFVNsVb/AMhMVdx54q7j8XNMVWfBwxVyrzxV3w/YfFWv2PjxVvniqmzL +xi1uwtjvs4GttcWx3L9jFXcsVWfBirmXliruWKrsVWtiq3FWvgfFVjLx+3i1rVZsklTxVfxyKHM vP7GLY5lxa1nHFsc2KrsVUpGxV32cVWYq58Vc32sVcmKqeKuxa1v7GKu5/t4qsX/AF8VWq3BcklY 3DFV/wAWKqX2sizWtirv2MVczfz4qsbCqzjhYObFWnxYO5Lirv2ueKrOX8mKtYqof6mLNv8Ab+DA zbVWwNa3l8eKu/axVT/y8kxdyxVY2Ku5YquxVTxVr7f28VczfDiqznir/9D64qq/sZkOO77D4qvZ v2Biq5cVW8mxV32VxVf/AK+Kr2b+TFVjfHireKqmKreOKtccWa/4cVbyKFZcVa5ZJi36n7eKqi8c iyW8sklvlx+xiwX/AOXirlxVe3xYqt5cPsYs28VXrJiqvgZodcLBEZFm0zZJguX48izbbCq3Arf+ XhVvnhYLlxVWX+TIoW8cklczZFDvt/YxVevL9vFscv8APirWKqn+virkxa16ti2NM38+KuZuWKqj K2Ku5Yq74Wb4MVX/AA8ueLW7lw+PFVi4tit8WLW5V54tjv8AieKu54tbl+NcWxezYq7lzxa16/z4 ti3FVX1MVdy/4bFWv2OeKtt8GKuZW/2GLWvfFXM3PFsdiruTccVXtHireKrmbFXcviTFVi/yYqv+ 3irvg5YqvVsVW/s4slzYsWlZeOKrfjZf8vFXfbXFV/LFV/PFXfbxV2KqeQZKzf5GLFZwxVvj8GLJ ytirl/nxVZ9nFVbj+3k2K3jiyaXnixX/AGsVbyDJY2LFU5fsc8VWK2Krft4sm2+1wxYt8vg4fsYq q4qpquTVerfDwxVTZeOKu5Yqr8uXDFXMv7eKqasrs+Kt8vixVzcmxV3H4sVX8fixVZ8XLFV2KrY/ 8nFVPjiqt9rFVvFPsYq7kv20xVdirf8AkJiqz4uPDFV2KrVXFV2KrW+D/UxVeuKrPt4q5vtfy4q5 sVXsrft/YxVTb7P+Viratirvt4qv7piqz7eKu+PFXNirv9fFXNybFXNirlxVZzfFV64q1y5ZBXMu KrOXw4qvVcVb+39h8WSz/UxVr0/hxYuj48cVb9NuWLJTxYr2yarXxVbiyXL9rIK0v8n7eLFtV5Ni yWM2Kr/9fFWsWLfDFk58mxWNxRfgxVrFVvHFV/7WKrOKYquxVbyxVy/FirvsYqsVef28VXq3Hhwx Vbiq7j/JirlxVR4riq/l/Jiqzk2KuTFXfs88Va+D7GKuZuGKtf8AEcKtcfi/yMCtYq7FW15YqsZc Vd9tsVdyxVdiqni1tM3DFsWYtbuGLY7j/JiqmvHFrabJJXNkULPi/YxbG+OSYLMizXNiq7FVLl8O KtMzYqpKuLWv+HFsU8Vb5Ytazi37eKtftfHireSSpKvH4MVb/wAjIoU+GSSuTAzd8HPFVn+W+KrO X7EeBrc3LFsWepzxV3H+TCq1W44WCxMVb5ccWCzl/JiruX7eKrG5Yq7lirWBuU1XAq0/t5Jgs4sm KuVf28Vb/ZxYKWKqmKqeKqf2vsYq5VxVerYqoMzPirfFfsYq/wD/0frj/kJmQ47WKt8u37GKr2b4 cVWcv5/t4q6NsVXrI32MVd8K4q7/AIniq/7OKr1/kxVytxxVd9rFW+WKuX+TFVTl8eRZKa/5eKq6 t+x+3iq6TJMVitiq9sVX/Y/1MVdy+HFXL/Jiq9WxV2KtYs3c8VRHLAzUuX7eFgqrgZuXAq/lzwq0 zN+3gV2Krl4/byTBdzyKFzYq3yV8Vcv2f8vFV/Lliq77OKtq2Kr+eLY5fs4q77eKu/4hirlZcVX/ AA/bfFXcueKt4qu5Ytblbli2LuT4qt/bxVWxa1nw4q0v+Xirf2v28Wxe+KqmKtNJirlbFXN/Jiq/ jiq37GLJcvHFiv44q5m54q7liqq2KrcVXryXFViYq77eKqzfFiruH7GKrP2OeKr/AI8VU/8ALxVW xVbyxVezYqtb48WTTfz4sXcvixVdzTFW1b4cVcrfDiqzFk39rFVVMgrm+LFXSfbxVTxV2Kr/ALGL FvFk58mxdx44q5lxV328VXp9vIMnN8XwYq7Fivb4PjTFkpcvi54sW25Yq7j/ACYquX7eKrvtN/kZ NVi/5GKr+OKu/wBfFXfs88VXtyxVYv2MVd8eKr+OKrI8VXriqxf9TFV32sVWs38+KuXFXNyxVc3w cMVW8f58VaX7P+TirbMv2ExVzNirTfbxVv8AbxVey4qsb7GKr2X9jFXb/wAmKu44qpYqq8u/7eKu VeHwYq79nFWuCYqt+38GKublirv9TFVnqYqv4ft4qo/FiqryfFW+OKrcgyWqq/YxYr+PP/XxVYzc MVX8cVW4qsjb4sWS74mXFivVsVUlb9vJqqYq19rFVnFuOQZLF/nxVfirsVc+KtYsW1jbFk5uXHFX Mvw/B9vFVvDJq0uLFZiydyxYrsVWqvHFV7csVWfHirlbFXKuKrsVdiqkytyxVqP7GKt8kxVSbhkm C5eSN8eRZuVcVdx/kxVT+ziq9e2LGa1VxZO5N9vFXK2KuXFXL8fx4qs5f8Birl/n/bxVdirsVdiq jyxVa+KuVcWtYzfFirX2sVbb4/sYtizJMGm+H48izX4qt5YqsX+TFWlX+fFXNiq1vs4qs/18Vcq8 cVXpi1qeLY3x+LFVjM2LW5vtc8VWZJi38L4s1Nmb7eRZrV/nyTBpuPFMizaxV3wf7PFVq4qs44VX riqxvi+DFVL/AF8LBUZcWCizYq5sVWcua/HirWBuaX+fFVjNga3KzccVdzxVSZsklze/28VWtiwW fZxVzNirl5f7DFVj4qsb4/t4qv8A9fFVP7OKqnLlir//0vrpmQ46jx+L/IxVeq4q7l8PDFVn+W+K q37WKqeKtriq9MVVMVa5viq9W/YfFXcsVdy5fbxV3L+fFXcvhxVUbIsl6qrYq5uPH4MVXcsVaZv5 8kxVP28VcvDjiq9fj+3iq9MVU8VVMVXccVWYs16quKr8DNcuKuZsCr1+D7GKuVf28VcuKr+XLCra /HhYNKyo3+RkWa/7K88WtarZJKqvLIoaZWfFW1xVev8APi2L+X8mKuxV3H4f5cVcvxriq9mxV3FM VXsv86Yqs5cMVbWTJMFVW+LAzU1+3gVUXjiq9MWtYv8AkYtjX7H+XiqpirvtLiq5sVVOH7eKrsVU 2xZLvs/6uLFzLirmxVc328VXLhVplwKv+LFXcvgxV3PFXPiq9VxV3L4cVXq3xYq5WxV3+RiruWKu XFV64q5sVWc/2MVX8sVa/wAvFk3y+Hg+LFrmmKu5PiqpwyDJZ9rFV7cMVWKy4qvZsVc+KtJixbfF k0vw4sVXJqp8v5MVX8vhxVzfD8eKtN/JkFcvL7GKt/Diyab41xYrcWTfJH+xixbX/IxVtWyar+XL FXf7DFXfY+DFXft4q77eKruaYqtb4fgxVzL8WKrsVdiq1cVXq2Kub4MVaxVay4q7jxxVe3L/AGGK rGxVfx4Yq7l/PirX2sVb44qs5Jiq9f8ALxVZ/kYqv5fsft4q79rFVnLlwxVevH7eKrPgxV3+virm Zf28VU2/kfFW15L8eKr2xVT5YqqLireQVR/18VXN7fbxZObl9vFV3+vixdy/YkxVRxVf8H7GKu+1 iq3nk1c3w4q74sVdy+DFV3H4uCZBVvX/ACsWTXJfsYsVv7WLJ32sVdxxVf8A6+KuxVyr3fFVkjYq 7lk2LTYslzcMVW4sXYq22KrGbjiqz9nFVzMyNiratyxV37GKqa4q5WbFXLiqpy5Yqh8kwXNyiyLN yyfz4qu44qt54q7lyxVZxxV3L9vFWsVbXFWsVdirsVWr/wAJiqxuP+zxa2lxbFrf5f2MVd+zirlZ sWt3PFsWN/O+Ku+z+3iruPDFrczcPgwtixmwKs/Y/wAvFVXFUNx+L48VVOP7GKukXliqzFVNuOLW 3y54tjuXDFraVeXx4qpN/Piq1f58klv/AFMihbyySVv7X+Riq7AzW/DhYLcih2KrWbFVi/yYWxb8 CYWCx8Vc0nD7eKt4sFjYqsVl/bxVT/ZyKV3HC2rMVdy/bwNaxcVW5JitXFVPliqorfFiq3FXYqp8 8VcvxYqp/ZxVtuP28Vdy/nxVrFX/0/rX6eZDjtK2LNr/AC8VVWbFg7jirvsLwTFV/LFWk+xirbYq vb4sVcq4qqYq1y+LFWlxV3HFW42+L/IxVW/y8Vd9rIsm1b9jFV7L8WKtN8C4q0q88kleuLBWxVYr Ys1+LBtfg+3iq/l/JirvhRcVc3xLzxVc0ipizc3x4qq8sDNTXArlxVU5YqqNhVpfjwKv/wAtPsYq 2rftpkmDl44q3iro/wB79vIs1RcWtfy4YtjWKt8vixVfiruP8+KuX+TFV/7HDFWlb9jFVRV5/wCv irmZm+x9vCruXw4FdkmC9l+HIs3csVd3fFrW8sklVVsizdy5Yq5MVd8WKr+XDFV/LFXMvxYq77eK rsWttcWxyrirWKtq37GLW1zTFsVExVZyxVWVv2HxVzfYxVzLiqriq3/LT7eKu/yMVWcHxVevLFXc sVXs2Ku5fsYq5eOKrGX+fFXYslb/AF8WLsgyWN8eKr1/y8Vd/lpirlXFXfYxVZyxVfzxV2KufFVq ZNVX4sWKzj/Pirl+HFXN/PkGTfH4fgxYrlXFktbFiu/a+DFksb9hMVVePJsWLfHJq77GKu4p9jFV i/Hiq/8AbxVYn28VXquKr/2sVWM3w4quxVvl8XDFWsVWt8a/Hiq7FVv+Riq9cVWepyXFXL/JiruP 8mKtcnxVfiq3j/Piq9cVd+ziqzliq7FVrfFirv28Va4viqoq8cVWM3LFXP8A5GKqf+piq/4vsYqs 44q5WbFW8gq5cVd9tcVUsWS9W4fbxVczLixaxZLFxYrsVabJqt4YqubFVuQZOxVzfyYqv+HFVnL9 vFXf5eKufFVnx/t4qv54q1ixb4YslvPJq1yxYu44q79rFWsVW/6+Ku/1MVcuKukbFV2KqeKrWb4s VXYqqYqo8cVW8ckwczZFm5vhxV328Vc3+viqnirXH+fJMFyrxyLN3w4qv5fsJ9jFVHj/AD/bxV32 8VU2xVU5Yqs+ziqxeT4qu44qtxa3cv28VaZeeLYsZm5YtbfH/IxbHN8GKrOX8+Kqf+XirfH4cVa5 Yq2zf5eKu5fsYqoryxVfiqzl8PPFXKyt9jFrcrcMVcrYtimzfF8eLWpcskltV4Yq5WxVYrYqub7W Bmp4FW/Birm+xiqz/Iwqt4/t4WDbfAvDFgsfFXc8VdiqzmmKtYqt5/t4q7jx+PFVJuPHIsncmTFV HJJW8sVb/bxYLcVab/IxVf8A8SxVZ+ziqxm7JiqxcVczYq71OGKubFXftYqs+3ir/9T61sy5kOO1 yxVdiqzjizXcvi4YsHL9r4MVVMWa7lzxYO+yuKu+Hjiq9MVcvw4q58VX/axVysr4qv8AsfYxVy/y YqvX4MVW8siyXYqqNy/bxVZy5rkkqqt8XDFg7l+xiq9m/wCDxV37eKu5Yqrc8Vd6i/sYq5W/YOKr lXFms4/sYqqYq3xwM2lwKqMzfsYqvXFXL9rniq+NmxV32fjwqt/1MLBe3x/bxVr/AC8VVlbIoc38 +Ku+PFV/LFsXq2KrP9TFV74q5MVX/s4qsX4W+DFVbj/wGKrcVVMVW/t4qv8A9fFVmSYOxVe2RQvX 4sLY5f8AL+3gV32fsYta9fj+DFsdy/n+3irfLFkuX+TFi7Fks+zixVeT4q7FW+PDFVvxfz5Jgqpk Wbv2cVXyYq1/l4quxVrl8WKr1+38eKu5f8Hiq7FXYqtXFV/HFWsVW/Y+DFV/LFWsVb4/FzxVbIvP FkiPUyCqP2cVX4q7FXJirWLFv4sWTkxVyt/Jiq/1G/YxVYrYq58mxXt8H28VWYqubFV/H4cgqi+K r1/nxVvFVvHFV32cmq/7GKqfLFV6t/wmLJv7XxpixWLyxVWb+TFVnLFXLirmxV32MVX/AB/YxVZ+ xirmbFV2KrWb9vFXM38mKrsVb5Yqs4/z4quxVazYq7jx+3iq74P2MVWr/wAJirv+I4qqf8RxVT5f 8HiruPxYq5sVdxxVZy5LwxVW482xVZ+1zxVdiqivx5BW/ixZNc3xYr5P58Vcn+Riqzj/AD4q3+x8 GLJr7WLFeyr/ACYqoM2TZK2LF2KqbNiq/j8OQZLOLYq18fPFi3x+L48WTuGKtc8WLeLJYv8AkYq7 jiruOKu/1Mmxc2Ku5Yqs48sVXccWTf7PwYsXcsVaxV2KreOKu/YxVZy54qvb7GKrFbFXftYq02Kq bc8kwXZFm7hirkxV2KrFxa3ccWxr7WKtszYq5mxVY2KrWxZNfFixbxa1NmxbHMuKuxa1Nv58VW5J Lbf5eKt5FDfHFVnLji2OZv5MKqf+XgVU/bxVRxV3PFViyYqvxVTxVvlirlbFrdyX9vFsQ68skwd9 rFVX7eRQs5cFxVSySXM2KqbZFmvXlhVZ/kYFXYqpcsKrW/kwsFr4sHYqs44q7liruWKrPUxVYrNi qz9rFW+Pw/HkWTueKqf7WSYrGbFV2KqeKuxVT/1/sYq77GKrFX+TFXLJiqxvixVr/IxZu44q2/8A l4sHcUxV/9X60N8WZDjuX7OKu+xiq9fgxVZiq9W/4DFXcueKr/gxVev+R9jFVnL+TFXf3X2MVXx/ Biqviq3lirfxYq3irsVW8sVVsVW8sVVOWRZN8lySVyq32/2sihfyZuuKro2yTFTXFV/wYs3csVVP +ExYO/ZxVfirueKtK3w4s1zYq7/LxVW5ZFm5ft4VXYFbXimSYOVcDNfy4fBirpP53wNa/kr/AB4t i/8AYxa12LYt/Yxa3cUxVesi4tjlxVrFVThirl+HFVTFWv2sVa/1MVXYVVMCrV+L7eKr+WKr1+1t +1iqkrc2yTBtpMihdzySVzL8WRZu4tirvtfYxVUxVcq4q79jFXNiq7FW+OKtYq7FVf8AZxa1n7WL Ys/yMVXR/YxVU9TnirX+Xira8uWKtLiqvyxVYq4qs5MvTFVZW/YxVZx/kxV3x4quxVtcVdxxVYv2 v8rFVb4/sYq7nkGTm+1iqnirfL4vgxVfwxVcy/D8GLFSZv58WS9MVaxYt/ZXFk5WxVf+0j5Ni5f8 vFVn28VaX4cgrb4sl/JMVXceWLFZ+zirmXFVT/jfFk74MmxWfZbFV7fa54q74uWKu5/t4qvb/ieK rOWKu+Hjirl5Yq74V+xiq/l/PiqxlxVf/qYqsf8Ay8VXquKrPhb/AF8VX/s4qsZuHDFV/L4cVWL8 Px4q6T7WKuZvixV37GKubFXcm4/HirXJ8VWquKu5fFiq/jiqz9rFV7N8WKrF/wAjFV3HIK7/AFMV U1xVvkmKu5Ysl/HFi5mbFVNcVbb4fsfbxV3+R+xiq1Mmq/7OKrOeKufIMljYqv8A9TFXfHwxVr4u XDFW/sYq5MVdy5Yq1ixbVsWTX2F+PJsVNmxZLuXPFi19nFXLiydixb44q1iq1l/bxVT44qqLiq7F VL4cVd9nFV/qYq7liqmuKrWXl/qYq7/iGKu+L9vFV6tiqHVskwXNkWbuWKtYq7FVrNirlbFVuKru XHFVPliq3hi1u+xiqxmxVrFW1X4cWx3xYq1Hy/bxVb8K/Hirmb9hMVd9vFVn2/jTFW8Vdiqnirkx VTxV2KrWbjiq7FrW/YxbFL/LTJMGmxVzYquxVbkULWbJJU+XLIs3ft4q77H28Ku+L7eKqPLCwWLy +3iq5lxYLOWKr2bFVPFVBsWa/lgZqLYFdxaX4/28VWNxwq3xwsG1XniwWLy+3iq3FVrYqt/y8Vdi qnirbccVWMzYq5cVWKzYqvbFXK3HFXNJir//1vrRwzIcdesfw4qsjjb7GKr1VvgxVrg+Kqnptirl jbFXei+Kr/Tb9jFXKrft/YxVesbP9vFXem+KuVW/bxVe0LJiruLfsYqv9NsVd6eKuWFsVXqrYqv9 N8Vd6PDFXem37GRZN+m3HFsdwxVWVWxa1lG/kxVfxbnhbHNG2KruLfY4YWlcvL9hOGLNv02XFgv4 t9jFVNVxZoji3PAzWrH/AMHhYLuPHIs1/ptxxV3psvwYq74sVd6b4tatyf8Ab+LFsUuGSYKvFm/Y yLNvjkmC7i37eRQ5Y/8AIxVri+KqnFkxbGsVVOGKuxVzK2Ku4Yq7FVZVb7eKqfHFVdlZMKrPi/bw KrNzxV3p/t4qs+LFXfFyxVrj8OLWqcWfFXM2LYvWNv28Vdx4YqvX7eFV/HAqxlxVdiqoytyxVZxx V3H4eeKuVfsYVVeOBW+P7eKrOGKr25N9jFXMzL8eKr+OKtKrcsVWcW/YxVUWPFXcfh+xiruOKuxZ L/ixYu44q708VdxxVT4viqpxxVeqt9jFVv7WLJdwxYu4ZBk7j8GKubnirm54q7FXfEuKu9NuWKtY sW+TYsncf5Mmxcy8MVXqvDFVrLiyb+LIMV6x4qp8cVb+LFXcfhxV3xNiqpIvxZNXNHiruOKubFXM uKu48vjxV3H4eeKrG5cvgxVfyxVzcvsJiqn/AJeKqnHFV/xccVWN/wAPirvt/Hiq/wCLFVnHFXcc Vdxbhirk/wAjFXcW+w+Ku9NsVdxxVzcsVdxxVpsgruOKuVcVWKuKu48MVb+JcWS7jixdx+H48VW/ F9vFkt44sVRVxV3D9vFXcfixVYvx/YxV3H4ueKuZmyatrH+3+xirn+3iqzj/AD4q5l7pkGTfFv2M WK3jyxVvi2LJ3+XiruGKu4tiqmy4sXYslRf8vJsVnLFVjcsVX8W+xiqzFku4vixb44q5lxVYvPji rXF8Vb44q5sVdx+LFVPjiqoytiruOKqfHFW+PBcVWceOKu4YqujVsVWfE2LW3xbFsU+L4q2vv9jF XMuKrGXFV/Fv2MVa9Nvt4qt+xiqn/r4qtZWxVzL/AD4qv4Piqx8Wt3p/DiruLYtjlVsVWccWtpuS Liq30+WLY5o/58Va+L7GKu4viqlxb9jFXcWxVzKyLirsVU+L4q7i+LW20f7eLYpem2SYO4ty4Yq0 ys2RQ5uT/bxVzQ4tixo2xV3pvi1rOLfYwtjvSOBViqzfYxVbxyTBYy4q7j+xiq1l4/bxYO4t9t0x VY3LFXNyX48VUuD4G53xYFWcWwq7i328CqPF8kwbZWxVv03xYLGjbjzxVYsbcvsYq1wfFVvFnxVf 6bfsYqsaNsVWNH/PirTRtizd6LcvsYq36b4sFjRtiq9Y2xVTZWXFm//ZCmVuZHN0cmVhbQplbmRv YmoKOCAwIG9iagoxNzEyMTIKZW5kb2JqCjEyIDAgb2JqCjw8IC9MZW5ndGggMTMgMCBSIC9OIDMg L0FsdGVybmF0ZSAvRGV2aWNlUkdCIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AZ2W d1RT2RaHz703vdASIiAl9Bp6CSDSO0gVBFGJSYBQAoaEJnZEBUYUESlWZFTAAUeHImNFFAuDgmLX CfIQUMbBUURF5d2MawnvrTXz3pr9x1nf2ee319ln733XugBQ/IIEwnRYAYA0oVgU7uvBXBITy8T3 AhgQAQ5YAcDhZmYER/hEAtT8vT2ZmahIxrP27i6AZLvbLL9QJnPW/3+RIjdDJAYACkXVNjx+Jhfl ApRTs8UZMv8EyvSVKTKGMTIWoQmirCLjxK9s9qfmK7vJmJcm5KEaWc4ZvDSejLtQ3pol4aOMBKFc mCXgZ6N8B2W9VEmaAOX3KNPT+JxMADAUmV/M5yahbIkyRRQZ7onyAgAIlMQ5vHIOi/k5aJ4AeKZn 5IoEiUliphHXmGnl6Mhm+vGzU/liMSuUw03hiHhMz/S0DI4wF4Cvb5ZFASVZbZloke2tHO3tWdbm aPm/2d8eflP9Pch6+1XxJuzPnkGMnlnfbOysL70WAPYkWpsds76VVQC0bQZA5eGsT+8gAPIFALTe nPMehmxeksTiDCcLi+zsbHMBn2suK+g3+5+Cb8q/hjn3mcvu+1Y7phc/gSNJFTNlReWmp6ZLRMzM DA6Xz2T99xD/48A5ac3Jwyycn8AX8YXoVVHolAmEiWi7hTyBWJAuZAqEf9Xhfxg2JwcZfp1rFGh1 XwB9hTlQuEkHyG89AEMjAyRuP3oCfetbEDEKyL68aK2Rr3OPMnr+5/ofC1yKbuFMQSJT5vYMj2Ry JaIsGaPfhGzBAhKQB3SgCjSBLjACLGANHIAzcAPeIACEgEgQA5YDLkgCaUAEskE+2AAKQTHYAXaD anAA1IF60AROgjZwBlwEV8ANcAsMgEdACobBSzAB3oFpCILwEBWiQaqQFqQPmULWEBtaCHlDQVA4 FAPFQ4mQEJJA+dAmqBgqg6qhQ1A99CN0GroIXYP6oAfQIDQG/QF9hBGYAtNhDdgAtoDZsDscCEfC y+BEeBWcBxfA2+FKuBY+DrfCF+Eb8AAshV/CkwhAyAgD0UZYCBvxREKQWCQBESFrkSKkAqlFmpAO pBu5jUiRceQDBoehYZgYFsYZ44dZjOFiVmHWYkow1ZhjmFZMF+Y2ZhAzgfmCpWLVsaZYJ6w/dgk2 EZuNLcRWYI9gW7CXsQPYYew7HA7HwBniHHB+uBhcMm41rgS3D9eMu4Drww3hJvF4vCreFO+CD8Fz 8GJ8Ib4Kfxx/Ht+PH8a/J5AJWgRrgg8hliAkbCRUEBoI5wj9hBHCNFGBqE90IoYQecRcYimxjthB vEkcJk6TFEmGJBdSJCmZtIFUSWoiXSY9Jr0hk8k6ZEdyGFlAXk+uJJ8gXyUPkj9QlCgmFE9KHEVC 2U45SrlAeUB5Q6VSDahu1FiqmLqdWk+9RH1KfS9HkzOX85fjya2Tq5FrleuXeyVPlNeXd5dfLp8n XyF/Sv6m/LgCUcFAwVOBo7BWoUbhtMI9hUlFmqKVYohimmKJYoPiNcVRJbySgZK3Ek+pQOmw0iWl IRpC06V50ri0TbQ62mXaMB1HN6T705PpxfQf6L30CWUlZVvlKOUc5Rrls8pSBsIwYPgzUhmljJOM u4yP8zTmuc/jz9s2r2le/7wplfkqbip8lSKVZpUBlY+qTFVv1RTVnaptqk/UMGomamFq2Wr71S6r jc+nz3eez51fNP/k/IfqsLqJerj6avXD6j3qkxqaGr4aGRpVGpc0xjUZmm6ayZrlmuc0x7RoWgu1 BFrlWue1XjCVme7MVGYls4s5oa2u7act0T6k3as9rWOos1hno06zzhNdki5bN0G3XLdTd0JPSy9Y L1+vUe+hPlGfrZ+kv0e/W3/KwNAg2mCLQZvBqKGKob9hnmGj4WMjqpGr0SqjWqM7xjhjtnGK8T7j WyawiZ1JkkmNyU1T2NTeVGC6z7TPDGvmaCY0qzW7x6Kw3FlZrEbWoDnDPMh8o3mb+SsLPYtYi50W 3RZfLO0sUy3rLB9ZKVkFWG206rD6w9rEmmtdY33HhmrjY7POpt3mta2pLd92v+19O5pdsN0Wu067 z/YO9iL7JvsxBz2HeIe9DvfYdHYou4R91RHr6OG4zvGM4wcneyex00mn351ZzinODc6jCwwX8BfU LRhy0XHhuBxykS5kLoxfeHCh1FXbleNa6/rMTdeN53bEbcTd2D3Z/bj7Kw9LD5FHi8eUp5PnGs8L XoiXr1eRV6+3kvdi72rvpz46Pok+jT4Tvna+q30v+GH9Av12+t3z1/Dn+tf7TwQ4BKwJ6AqkBEYE Vgc+CzIJEgV1BMPBAcG7gh8v0l8kXNQWAkL8Q3aFPAk1DF0V+nMYLiw0rCbsebhVeH54dwQtYkVE Q8S7SI/I0shHi40WSxZ3RslHxUXVR01Fe0WXRUuXWCxZs+RGjFqMIKY9Fh8bFXskdnKp99LdS4fj 7OIK4+4uM1yWs+zacrXlqcvPrpBfwVlxKh4bHx3fEP+JE8Kp5Uyu9F+5d+UE15O7h/uS58Yr543x Xfhl/JEEl4SyhNFEl8RdiWNJrkkVSeMCT0G14HWyX/KB5KmUkJSjKTOp0anNaYS0+LTTQiVhirAr XTM9J70vwzSjMEO6ymnV7lUTokDRkUwoc1lmu5iO/kz1SIwkmyWDWQuzarLeZ0dln8pRzBHm9OSa 5G7LHcnzyft+NWY1d3Vnvnb+hvzBNe5rDq2F1q5c27lOd13BuuH1vuuPbSBtSNnwy0bLjWUb326K 3tRRoFGwvmBos+/mxkK5QlHhvS3OWw5sxWwVbO3dZrOtatuXIl7R9WLL4oriTyXckuvfWX1X+d3M 9oTtvaX2pft34HYId9zd6brzWJliWV7Z0K7gXa3lzPKi8re7V+y+VmFbcWAPaY9kj7QyqLK9Sq9q R9Wn6qTqgRqPmua96nu37Z3ax9vXv99tf9MBjQPFBz4eFBy8f8j3UGutQW3FYdzhrMPP66Lqur9n f19/RO1I8ZHPR4VHpcfCj3XVO9TXN6g3lDbCjZLGseNxx2/94PVDexOr6VAzo7n4BDghOfHix/gf 754MPNl5in2q6Sf9n/a20FqKWqHW3NaJtqQ2aXtMe9/pgNOdHc4dLT+b/3z0jPaZmrPKZ0vPkc4V nJs5n3d+8kLGhfGLiReHOld0Prq05NKdrrCu3suBl69e8blyqdu9+/xVl6tnrjldO32dfb3thv2N 1h67npZf7H5p6bXvbb3pcLP9luOtjr4Ffef6Xfsv3va6feWO/50bA4sG+u4uvnv/Xtw96X3e/dEH qQ9eP8x6OP1o/WPs46InCk8qnqo/rf3V+Ndmqb307KDXYM+ziGePhrhDL/+V+a9PwwXPqc8rRrRG 6ketR8+M+YzderH0xfDLjJfT44W/Kf6295XRq59+d/u9Z2LJxPBr0euZP0reqL45+tb2bedk6OTT d2nvpqeK3qu+P/aB/aH7Y/THkensT/hPlZ+NP3d8CfzyeCZtZubf94Tz+wplbmRzdHJlYW0KZW5k b2JqCjEzIDAgb2JqCjI2MTIKZW5kb2JqCjkgMCBvYmoKWyAvSUNDQmFzZWQgMTIgMCBSIF0KZW5k b2JqCjE1IDAgb2JqCjw8IC9MZW5ndGggMTYgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4AaVW227TQBB936+Yx7VEnfiSJuGRthJFCApY4gHxEMwWDHbd2m1RP4jf4luY9e6Zje0U hFBVeTMez+XMmZm9oTd0Q0v+S5ZpTuvjDXWG3tMVLS5MV5rr27tdTV3FSoOC1bRK9lk2tDhvEjpt 2cjipE9U2dMyztJ8madrf9pkrDrIku2K+pIWb029u63uzUlbt13VmNuuKr2HwWzCnjZ0vGZzDT0r aJ0OYv8o2GlRsA4Vl/SB9GlER8s4Jd0+x4ki9siS6ipI1CB5DcG1VzEdS9I83pLeedGtf7Yd7Lwy kP2IKFnFidKt/S5fkv7utfuIPlLxgs6KAdDEZ8IwrLapRYoTybJ4mzvowlGNEtI/Iyq+Ta0c57Ta bL2VPInzwbocvAU1g2Se3CUAQEbIEdlXTU+RAwsqLXQ+A5nyDmYaIxhDHdrut9JfoWvwBuB37acB z5x0bRq87fEaIZX+Q0ZdnEH2WP0P1cKimGUORSXgyWFUByYWsjWIp24jSrnkD6OkHVYIfo54g88Z V0dLAY/fHIxzQ3m28eQPRNmnzyjWw5xJlis2s+J0FVNPspTDyASney6BCu7TijL8yvUaUrn3KeGT kH7VSpqSeNmKj2BqTiDRb4Wt8NcCzFHfTugqfStsmfYvD4tZ/z6NaMNzSmn2dagqFs9s/dcmlLlU 7nwbIWSgWTFoPESY9LOGGKLiKBLS0HbIKl33T1yAZAMchtmJf1745xkaDQrw3HniumopXfVV6KQw JL94OzNHiCVUF1FJgX6VcBrqCXvBg9krW5A6PaX3/T5agRTDVIgsB2G0cpuBK+CAAg74XVbI6AFR Q6WGjueO0kKiacA0CnioSGf6tg7lFSJ6q0qqGkAqH7isW7t/9tMfrIUGMmKp90KlETGeB7gzsyh9 UDJV3NaLI3UIa95bKf//YW+RwG0XsZtBarL9eOKmqR1BdvtJneQwssAj6B0IfIc5AwrhaXpUblq4 Fi8CtE7CdEdNa3wEQWdwkpnDjN7GKzsgoCwcl6hsH4y7NOw4+cxfFcajRqBWfJ3yVwS+TCV8R/pH qKdXBDueknTtt4ZALIcp1gWwfomDoO8SV7o3/f6gAB4NMJPOgECqNFqQtgeHqTqQGrooF6z20q21 OTyAGafMNr9dZ/+1FdNHh/j4LsaMvPATJEw+O71HiZQyQ5CSJ4PSgV54JTQ7Qt5hqkAHmym0P/tU k40h7DJ8hRriOcIBCPcGNxj4ch44Li75+M5b4hobwuFiClvpzW/15YHVCmVuZHN0cmVhbQplbmRv YmoKMTYgMCBvYmoKOTQ5CmVuZG9iagoxNCAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMg MCBSIC9SZXNvdXJjZXMgMTcgMCBSIC9Db250ZW50cyAxNSAwIFIgL01lZGlhQm94ClswIDAgMTAy NCA3NjhdID4+CmVuZG9iagoxNyAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgL0ltYWdl QiAvSW1hZ2VDIC9JbWFnZUkgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDkgMCBSCj4+IC9Gb250IDw8 IC9UVDEgMTAgMCBSID4+IC9YT2JqZWN0IDw8IC9JbTEgNyAwIFIgPj4gPj4KZW5kb2JqCjIwIDAg b2JqCjw8IC9MZW5ndGggMjEgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AY1U zXKbQAy+71PoCIfg/cPgo2snU/eQNgkzPXR6cOkmpcUhASeZPFBfq89SASsZu6T2cECj1X6SPn2r R7iCR5D4KaktJNMUagef4R4mn1ydu4ft07qEusCgLqCNbIPaf76ByWqjYFkhyGTRKJE3ICOjrbQ6 8VZqMLTzqVkMTQ6Ta1eut8WzW1RlVRcbt62L3GfoYBUYM4WptQITvMsg0Z3b/zJMmmUKFGS38AWC 1dkyhDMZaQggxEz4Lxq0vkL2Ac6zrj01iouXpJQasnyQQk1nUWpmbYN9Js2ZLj+GECcQZANwgbQQ uIZYTltSsGYTI4rtTgbmXu3B7xCyn4clJgpRjO/cmghpxI+NPQTsfn5/2Pzak7Dlv+hIcZsH9vQ0 EV0UWZEj/0GgBOaziODOYziKZfKr93SJjqqarKasQlBxpCB46X0i+O6RdifcysQffesuWQjKKv/l fQRZUNU4azE2ayTS2tiPg/lj45DIvhwROGKpLVlLCF43jgvDnGOpjAZj7f8mL/bSvTl5Y/WxggXp /obofiKD6Xom3lyNZ6lseSe6Cm7mLuyFQYxeE87FwnOd6Dh9s2PNtQ4EvjNP7BhXxckdz0ky3F+V k0DH2ttXeR8peEkwD85LErWJMahSFNwrkUK4/DaoBnT09C2JtkueCF3+U9L1bhDaRjNcTpyY3hIh de9lTF8oZZWqYzx1e0rgTmAdDJ7NXtbRHAZSGsVuioM9dspAldKQpMcKZQnP2z3db+xbYpE8xByv It44q3OKzULRL/4LuvVCa6biV1HSxCjGsXx2D5tGkFc8naagi4732D9FDeTHpIqrvy4bhsgKZW5k c3RyZWFtCmVuZG9iagoyMSAwIG9iago2MjcKZW5kb2JqCjE5IDAgb2JqCjw8IC9UeXBlIC9QYWdl IC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAyMiAwIFIgL0NvbnRlbnRzIDIwIDAgUiAvTWVkaWFC b3gKWzAgMCAxMDI0IDc2OF0gPj4KZW5kb2JqCjIyIDAgb2JqCjw8IC9Qcm9jU2V0IFsgL1BERiAv VGV4dCAvSW1hZ2VCIC9JbWFnZUMgL0ltYWdlSSBdIC9Db2xvclNwYWNlIDw8IC9DczEgOSAwIFIK Pj4gL0ZvbnQgPDwgL1RUMiAyMyAwIFIgL1RUMSAxMCAwIFIgPj4gL1hPYmplY3QgPDwgL0ltMSA3 IDAgUiA+PiA+PgplbmRvYmoKMjYgMCBvYmoKPDwgL0xlbmd0aCAyNyAwIFIgL0ZpbHRlciAvRmxh dGVEZWNvZGUgPj4Kc3RyZWFtCngBjVbNUtswEL7rKfYozzSJJf8lp04LnQ69tLSe4VB6SI0AUweD HcrwQH3PrmTt2sZOhuEQIa9Xu9/Pyo9wDo8Q4p8KdQxZuobGwAXcw+qbaQrzsH/aVtCUGOQCbKQN sr/FDlZnOwWnNSZZnbRKFC2Ey0jHYawzv1pHGOr21CaBtoDVd1Nt9+Vfc1JXdVPuzL4pC3+CS6tA JRrSNBR4wMccMu22/U+Oh+Y5xkB+DT9Bfg1gES41yIcAz8Ffc0874HfOA9GFPNET0+79s7Lm8Jbi rwPYLBOQdYM7KsTqQV74+M+B+AX5F/iUO+CUrzjSkKwdIlhwFC8zC6bFaLgelS7/BSK/e50nCyHJ Moss5ok14uay9KtRDmz/A7LlShOSWrrlLqmhsm0HrdNuVTIK5sq3R7lKRoWiKaLB7DpebkBu/TsI VwcvFbBoTEnhi6tAOFpqLmtRM1XTZJTDYe9e/OuP6Y4TsuLcqwDmuLAYauKiR65feQwFSagx1Erb q4G2fqMEkmUMsvJA940zRtQjYTVFry36pilqJDPXate8kAyVPXIiQI/2+/nuUTGxjjoFiaH6huuR ilCJMKvE+BiKYpQDlXhKMqgNO4nYPN6Qdyfh8kzQM76UhiLo/5o2nh1JyloWvR6HIP+MBI0POBm9 Q0n62nYHIM0iiHTkp9EQxuF6BMc8pEopTGSVKd7o7jP2FlX9EgBmkKZ9F8AaJ5OQ9IRD2erWXRiD sEx7taPNae4N0HHsjpi56+3ZT5bezDfe88ZupZvlGuQLnWdzdIbiLbSYK4UNxlwZHEzd+LATatbs EWiS+2jYznDTGf4wN/qY3mFIsEC9T7nhsuuOJE8RMEXPrDUCcu/bm4SWTCcBR6/gKcrN35dXrArZ z50bD+kkL9dooe1gn7gVbdWBPiGGXundxJxRMexJLxZhraisZKkRimQw7JM5bq1fVKoP34aTGXS2 4CmEOQ9NTiqkqHd0E219x1RbORj7B6YCDto08bUNxTZYj+ubFx7eVqkf18cufL6sftCYZfhqNnxF /FCHbb2bwI4XUcduiV9rXgIkFyaPcOCNgfq6y77uQoaX1eznUn9bOY9PaeE+yuKWPtSoroHOLmV7 GYyoOP8PokgyIQplbmRzdHJlYW0KZW5kb2JqCjI3IDAgb2JqCjg0NgplbmRvYmoKMjUgMCBvYmoK PDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDI4IDAgUiAvQ29udGVudHMg MjYgMCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzY4XSA+PgplbmRvYmoKMjggMCBvYmoKPDwgL1By b2NTZXQgWyAvUERGIC9UZXh0IC9JbWFnZUIgL0ltYWdlQyAvSW1hZ2VJIF0gL0NvbG9yU3BhY2Ug PDwgL0NzMSA5IDAgUgo+PiAvRm9udCA8PCAvVFQxIDEwIDAgUiA+PiAvWE9iamVjdCA8PCAvSW0x IDcgMCBSID4+ID4+CmVuZG9iagozIDAgb2JqCjw8IC9UeXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAg MCAxMDI0IDc2OF0gL0NvdW50IDQgL0tpZHMgWyAyIDAgUiAxNCAwIFIgMTkgMCBSCjI1IDAgUiBd ID4+CmVuZG9iagozMCAwIG9iago8PCAvVHlwZSAvQ2F0YWxvZyAvUGFnZXMgMyAwIFIgPj4KZW5k b2JqCjI0IDAgb2JqClsgMTkgMCBSIC9YWVogMCA3NjggMCBdCmVuZG9iagoyOSAwIG9iagpbIDI1 IDAgUiAvWFlaIDAgNzY4IDAgXQplbmRvYmoKMTEgMCBvYmoKWyAyIDAgUiAvWFlaIDAgNzY4IDAg XQplbmRvYmoKMTggMCBvYmoKWyAxNCAwIFIgL1hZWiAwIDc2OCAwIF0KZW5kb2JqCjEwIDAgb2Jq Cjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL1NOSlRDWCtHaWxs U2Fucy1MaWdodCAvRm9udERlc2NyaXB0b3IKMzEgMCBSIC9FbmNvZGluZyAvTWFjUm9tYW5FbmNv ZGluZyAvRmlyc3RDaGFyIDMyIC9MYXN0Q2hhciAyMjIgL1dpZHRocyBbIDI3OAowIDAgMCAwIDAg MCAwIDMzMyAzMzMgMCAwIDE3NyAzMTMgMTc3IDI4MSA1MDAgNTAwIDUwMCA1MDAgMCA1MDAgMCA1 MDAgNTAwCjAgMTc3IDAgMCAwIDAgMjgxIDgwMCA2NjcgMCA2NzcgNzQwIDQ5MCA0MzggNzE5IDcx OSAyMDggMCAwIDQ2OSAwIDc3MSA4MjMKNTEwIDgyMyA1NzMgNDY5IDU3MyAwIDAgMTAzMSAwIDAg MCAwIDAgMCAwIDAgMCA0MjcgNTEwIDQxNyA1MTAgNDc5IDI0MCA0MjcKNDkwIDE4OCAxODggNDI3 IDE4OCA3NzEgNDkwIDU0MiA1MTAgMCAzMzMgMzU0IDMwMiA0OTAgNDI3IDcwOCAwIDQxNyAwIDAg MAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwCjAgMCAwIDUwMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgNDc5IF0gPj4KZW5kb2JqCjMxIDAgb2JqCjw8IC9U eXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL1NOSlRDWCtHaWxsU2Fucy1MaWdodCAvRmxh Z3MgMzIgL0ZvbnRCQm94ClstNTMxIC0zNjggMTM1MSAxMTE1XSAvSXRhbGljQW5nbGUgMCAvQXNj ZW50IDg5OCAvRGVzY2VudCAtMjM4IC9DYXBIZWlnaHQKNjg3IC9TdGVtViA1MyAvWEhlaWdodCA0 NTQgL1N0ZW1IIDQ0IC9BdmdXaWR0aCA1MTcgL01heFdpZHRoIDEzNzUgL0ZvbnRGaWxlMgozMiAw IFIgPj4KZW5kb2JqCjMyIDAgb2JqCjw8IC9MZW5ndGggMzMgMCBSIC9MZW5ndGgxIDE0ODk2IC9G aWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AcV7CXxU1dn3OXebe2e9s2cyJJlhCAgDTMgQ hkA0UyCRRSWyNUGC2YgBUQgQFDQGjDESoBgxgJQqRVTEbUCBxAVRURT3tvata9u3Sksl1M9XUYG5 +f7nzrDYr+3X7/d73983mTNnvec853me82znZtmSpnnETFYRnsRrb6heTPSP/V5C6Kba5csCqbo4 A/X76xdfd0OqLn1DiPLEdQtX1Kfqzl2E5B5umFddl6qTs8hHNaAhVacjkQ9ouGHZzam6uhP5VwsX 1ab7nUNRX3lD9c3p9cknqAdurL5hXmr8GBn5JYsXLV2WqhcuRL5t8ZJ56fG0nBD+dKrvol+KchGZ TQzkRiSOqCRCfkoId1p5ggiE4g/bImT1c+8sv9ZW9C31s2UIeWz0e3r+wYIBw8+8lLQZ35V70SDr 41kPnjFEtAxCTOTMS2fOGN8936M/h5+ibnJlmD6LVV4hU8P0RXKYLCW1pIRESQDdM8MvklfJfDLr Ry2vkeoftZAXyUvkNjw286LHXibryTK0xM9P9App/PFjz5IjWHhGuJscCpQ0z8+Y0E3Go1IYjt9K VgZWcmRF3gqOLAksyVvCVzXSQOPvG7l4XVkdl1cXr1tc11cnLK6l8dpVtRypjdeW1d5dKwSqy6qr qldVJ6rFQNWhKo5cm3dt1bV8vHJxJReozEPGkznqnMCcqjlC4BqKb9VPaFX87vihOF9cWJdTOLYu p7vv0NMvZGWN0nNfZiq3qSyP172gWEbZnrM9HzkQ6S4+UNw99cDUbpn0kOe4vp6+ZzlWynku8pyg kB4qV7SV5WzuGpwztevarkVd/B0zIzkzN0ZynmrJz+ncOClnY0tZTntbXc7qlrqc1rZNOW0tRTnN LZsYAPGMlvETR2Xf7Mm6ydNvucff5Mlc5vEt9Sz2YLV4RtbCRR5vv4WLvP6Fi3zX3+jxX39jy5LM BS7W2ZdVP9/l7lc/3+2vn++b1+Dyz2toa8y8b/zp4GakjUidSOuR1iKtQWpHakNqRVqN1ILUjJR/ 3xw5Z3OlnNOFtBHlTqT1P5Vz1iKtQWovl3PakFqRVqPegtSMVFst59Qg5VdeI+fMQSqfJef8FKl6 ppxThZR/DX5mITlGum1RtznfrYxwS3luPuImw91Dh9mGhK2XDLYNHGQdkGvrH7IGgrbsHKu/X5Yl w5dpcXu8FofTZbGpdrPZYjUrRpNZMshmXhDNJO6mnNk/Vs6xjZFz+EI5h4yWc8qiNOGYQqbMGJdw UuTTxyWi4SlA17REfnhKQi67pnwPpT+rQGuCu6ubkhkJ4a5uDplj/Oxryrupj3W3+VEt3yPQbrqq bf16//lSRUU4K1E3ZXp5YnFWRSKfFe7OqiDhf/WhYb2fhlN5GIX05x89d6EXgxIZbI1xqeF7FLaD umnpqt64LByeu3Tu0qXLUGCfpSjqX/w0oYjKUkKaRCYGmkQXy/RP30WfLXyq/UQf60r9stJgjf1e NPDfLI4jC8hV5CdcGQTdvdy93NWklZvPYaqUMGOT/tPPHFJPniH7yFRyKfmOltNf0Xa6kpvOPc6d 5e6jb9F/BsJ/0Q2QgRc+VdzlPBvbhCYmmllqIOWkBjlLf/9hamI2UhVSGdL/y6cN0u3cZwfZgXUa SAv+ZuGvgdvBDSFkCCYvI3VYeiFhIDm0wdAPW4hDbCIOQuKFo2OjCkZG80fkRYYPGxoeMviSQQNz B4T6BwM52Vn9/Jm+DK/H7XI67KrNajGbjIpskESB5ygZShMZ4FSfIewPBoMVw9L1zB/XE3yu+nUw QRw/GuT/8aA9/f6unvV39ezz9asSxJUoDY2fwCbeQ0qPJYgzQV0JwlahziuxUhqSkroFoZL5Cd/4 uqoqPDEhpAYSpV9F0qDoAO8xGceHxs8zDhtK9hhNKJpQwtjFe2jpZVQvcKUlY/ZwRLYMG5pw4ODm lrC0IBFfW4VCaAK2jh7nhR5I1nUXdxE8lhpEMEwv0YQ0PmHQ1w3MT8SrE2RtYM/QQx3rulVSUxU2 14XqqueUJ/hqIHUP4XNLGmaghpWRqhoCCQHr6j9+tARKGgIdqLNhVfgNTcBT/7Adzcr48vbgIV3E tJck7OHE5Xjy8pWf+/mOkoz5AVbt6GgPJLZfXX5xb5CNqaioyBg2NNBREsJCE4YNLVkwDpjOiDB0 C7n4TqoLldTNrw4kVtUsAG7wrV7HEB/sUBOlp4AmylDHUl3VAgbvAowVkAU61s7T97NOh59hlJY0 gHjV/7dRHR0lbNHqOgYKZh6fiM/QMzJjNkNZoATonVCRbkoPQI+g91RNqAA92GpTppWPR29JqHoC +JTx8vmWqnQLGkrOdQYYnJMS8apEoDaQINPKQ3h4NPuZN5p01I5mvI5p6LChU8ouPJUQc9VQoONb kqBVod4TDOILLdXpFilX/ZawztJQaVVHR2koUNpR1VHd3beqJhRQQx17pkzpWFxShVXLyhMU7c+u 9SdK11Uk1KoGOgb0YVxSOq282B+0Yx+patm5KgHbgfnA5tgOsIDvpHQGWpAZ5cHA+ASZWV7hByLL WXkGyqmcMRuYezT4II02hqN5bLNYiJXTxWCQcfDa7jipGTY0mFh1dXmqHiA1/r0kHgmDHlWs59C5 HvdM1rPqXM/5x6tCIM4zukXpTsgDz39tqsdZ0jAmQT3/onteqj/hHF/O+zl2KFDi/DwrGcOQBkUJ bxjlS8IdIMt7oYQaTojlh/xFFQHVDinBqDc9NOXq2eWBko7zXJBqObdpKOGLWB9C4Z9yvz/YYQ85 AoWRimEwP4dO6SZKWcoe6KZ9bd0TSFYPUQh/7Vx0jxkaCJTMnwA2QWXsUDQMCaJUNDRQmiJuqCLQ EeiYVNcRKA00VNcBBj0HH87rqIiAkNPLcZgZORPxCv/54ryKijGY51I2Dx7B8I4KzLAgPQNyvSmS xKDLhk4Blw8sK4ckWDUB7DChAoQGOx0C3x3CQahgGyk+DykgZuZ1CuY4YC4egv6fpGYBmlZhioqO DjYnatxAUL+jw9+BnegtoSAMonRDN9HHQEB003hZOeuKh4KM/UpCwVAQcFRMwNzjQJ5zhwtWPUOp fDFKyQSgVE6jdMJ5QPFkCcCboKO09L8JpZf/Oyid+G+hdNJ5SH+E0smAeRJD6ZTzKI37E+Q8SkM4 aH+HUPJPMXwe5fF/gPJVKZSv+gcov+JHKL/yX6P8qvMbAdRTAf5VOsrL/ptQfvW/g/Jp/xbKp5+H 9EconwGYpzOUz/z/iPJZF6Ec5htzvLlC+O27yU4kK11AlnKryVV6XkwkgZBxcOffRH4F0lqkGUhj kZamx0Sl+r6z4iwiiwtInXiC7OBPkJ38arJdfInUI+2gu8l2HrkUJtulTaRBcKXzTRj7EpkrbCKy XNyn8QvIZPS18DA3kc/gPyDT6AniRXsu5myhq8kGurrvCOorWBnz3cLahdT41YB/NfcBmcEt6PuQ tWMcEXfDOp1FzNiDhPl82HIqNkEQmZHoXagHEAv4kcWNNg4xG/YRiEgkxDdkyFIjQhLsKUIsxIpf G1LqoxI7s32Jk7iIm3iIl2ToKxGSiVY/6UeySDbJwUpB/YH+qcd+9BsiA0guGUgGkUvIYFjZYTKU DCPDEVXJIyNIPsZGyUhSQEaRGBmNGmj2P/IZ8z8y67+adGy6sz/pT6aR2+F27CdHyQkKHqQHuQlw O97hb+d38CeFvaJVXCYeFE9LQ6R10vPSr6SvDZcYthr+IM+V31LqlbuU08bbjR+Z8kzrzMQ82ZJv WWl53PJX60TrEuvrNpftdtsxNVtNqJp9ov0uB+eY7Vjp+E+sDucDUScQGlQ3EH/cZKACJSKvCERW P3sbXxKJvh15e0Re0B605+KHYvDpVSI5w3KCAjhopzaY2ya2g0sGxX2SnwjSuIlkF+nGAMEIfuAw fasSSeZHGis/J8XFI/KoxNlVhzdE7Crlth56571D12mL6Aax/SnNoJ3Wzmhigt7L9eP60XswvxXz S/r8A+MZOJh+8oj0rcSJklvKlQokQZLOT1+kT+8cBS+LGxRl01sPvYfZaae2SBucoGeoiL8fEtrC 5LHk5xpzKSlZ2qeS7+EAyqRf3CLwvJyQHAJw8pQc6VU/fYsU90YZCmJul6FgVEGo4Pu2cPjItv3z JhYthNdIITPu56JUAw4tz9CN2GwkQiJJ7NIdLOCimp9qVVX6OliNrcMT234+wTnJU3ykF7Ozqdms R44wJxQY7jvJDcJ+eeDTTSjHzeSJi+cJ7ySgDkd5PuKNRrDTdnF4uL35MFaK0hB9Y65WXCW2n76O neJxfSf5gzrOvGRe/KpS8yTHLHOFQ3jY/Khjv7nHIZi7SiUqOR1dk7CiUMHPUipss9xCj22/+wfb KbeAeI670DbKLSg2ye3lMxTB1so/73O3Ks9lqKd6Va23sbGykhRX9uJbWQkY8oFuLtQflCXOfEYA vezgyPOUS77w2llqe2zbwZ5f3PvyC2K71q49rB3UbqXNNEZbac3pN2gVtVKZXqs9op3UvtQeI5S+ iY1E4V3zJDNu4xw8T9vyuMUcF+coB1YC6hgr2UN2LtogNp1ei6E6/q4ACV7B3h2kJl4CRpYDcp4s PCQfko/a3pP/IH8lS1Oss60LrN/LwkfqX1VO7jI59HCr2sULimJprZIWS3dLvAoMSZB9pkg0Yo+y JRnawceVxb3YMamklY3OglHRfI9bpUF3kNhHDgz1l+b8/LHHTiY1ruPsGq79mbbydcL6W1qO79Ke Th6o4hbRttWJiTqca0GjRYCzP3koHlYyu3D+zDF/XFZifr+Nd8QttpjD4eqyOQkJArC/eqk3w2KN mbv7voo7bWpMkcxUzs5wZ8ayWbvU3feXp20Oln8V7y8bY4TYlYDJGlP8fpLdKkneVtW8yMwpBI+Z zXZsam7lXLanpL0wEg1jhyz8hLZwGITFNlkK2x2FaO8tHJGX3qpLMrgFu0sK9R9U4InmI+gx0FCg Z6H+W1Y+fuD47bdS23ePPXnv3Q93PvPio1sPHlizSXijbvZrW298fKBwjfZdz+9KqsbvbNvwKF/z wOJFm3VczAAuQERIi+vi45skmuke7Cp08RmerrgIiURF0eSzWtUuk5Pr8vEVzgXO/fJr8m9l0dks 07hFjVGaJ9OITGW+xSf7rJFoNNILimFPai9208sOMdsKIyK4prESp9Ouk85FLtpJqL/Bzns1R2Hs fU3TXt7x5Cudm15+57HKWrGpWitVvnztZU2bc1Pj4U07e7K5dSl+GwvY3wbsIhkR9/Fg3AqOd3Ec QjtOvkvkKQ8ByAkMokhhIQMl2m7FwRXZyVXoIBos4N9Orp7N/SQpgY1XDBRJNSbmIZdO8pCJ0K45 0Ipf9JDBjPCejJhNBvVtKkgcUj39Yl5GcAWFLBWdImpPo5/l8VyMMZJQl5exlpexltcrDgZLZXV9 D6QKAdWbwRjqBHtiIHvCjAaHC7XvM6nMGuxgqe9clFORzw7MHMgZWch7gK9frN5IjSSOAnFltspy oJWYVXOemTe7WjkzN7DVEenVqcBYrNceDedXhlN/4DJdcPSmWauQ8R37gDADC0amqGJAtAw8hrrT lWYznC2qnzC33kInHPik675P9r7zxcO7jrf+vHHJpm2Lb9zKjXji1hW7H29u2cn9x60vbv7s4y2v 3nzrZ7v+/PmDn9Pnltx//02LfvHA2eRNu55aecuTTwLPHC5RIJcRyWM6sF/caoD45xK8TUCVSegi FVoF/IMDADHN0vdtbW38liNHkpEjR/B8FEL7JOiUCVtndDzLas1OZDkyMzM6ecGNY+e3WEx3qGo2 DKKnsoGSCHbNmBFIwbxR/ZRh7lhq21bO7fIasOvLOBwssCNbMBqZOGHJzwqeHDgod2rutqGzi2t/ 8mWb8MoDudtbJz74fX24eFzWNdWRxWfWFpUtXnhWAFTYV99Z7VlpAeAaSeJkb3z+VCO9JDY6OlIk g5hOGURcgwYxC4AfNEgZzg0qcLnCMAfG3jFiRHZBV1jqGjAgHM52bM4wb84mFcosW4drjX/N8C7b fS5Dj7LPxo0erVzWvGg4HT5csbnucLvHKXcEg+Nsd/gZsSOMtr3swFWyEtMUvXpbkdqr6n3RSBGG 2aNRykZ59TMhNquHUfVC2EC4RnnJ7YrmkwKVBANQLvh1RiUhlC6zllD/gpGxQSk2IdF8b5TmO3S0 AYse4abm3eYRN1Obtlt7Vntcm0yfgZY5cLy+Uav5QbtFy6G/ppvpHHqXtmffClnY2n3va3T4b96d I2hXbfuic9Hu/7hHMJ79dKR3GJ30PXXRRu0y7ZdQW9Po6BffpJ/Q1bSJntEqtbe0P2vNi7MHCT1f 7f+WLnsp6aS3HLplu7brxY59On8hZi5eJbaAnYxkZXwCLysKZxREUSEKx62mxEUpMSiiuFoyuCTJ wAuysDFuNEoKMQgcFcGNROYFetAgGgVBORiATgLmMn1JbyG+JKO4qKiouCgKLGYyZk1bBe3DM5hx YFCLilhioibEB/mQwnNvcG2NnyZnfdrItdHJ2q+1D8SW06vpn7QsseXsQe6e5I0AG1ZBXd9JcSz4 x02Wxad28weU161HXIKpUzHTtA6x0k6JfKUbeJ0uQem0OmdJ1K4aTTFRKpHusm+xH5NERZSo/IOd msdR6pWar6PUfsCjapW96jvq51BAcyEU9AMWBa9gY7pSYgaFe2Ca1Pm5bulcURymfaOd1XaAkvbP qeX777SXtJ/SvXToCdGxvF27X/sO/Q9vWNxK76MjYBdtY3vhYFsTsQ0yWobHMj6eb99IedNGg0Ox uoXJ1lnCCuudwiZhv9BjPSYct54SzJIwShhj5a3NQrfT2CLvc6RtnhSkOK5BnQsHU6c9VQruoMfp UtquNWvbNGEh7aA2Oh/FL8QmbaX2pva+1iT6zxTTK6mTWugMht+dEPJPAiYTKYmHxY02gQpxqy0m MFktxO2OGKgNe5I3bDQ6BGUcfDLe0GLaZ1a/SRZBsH4OWwRiCWSH5KyEeGIaDVaInvj7k0u45mQr d//ZU2LT7OT71yTfmI212Lrbse4ilBVSEM9m60aEYoEXBJktJjtEkWIdhZqUfUb1c3tUTRbBVICx pR/ki9YJ2flFyV9wg5IfLmRL9M5OTsOslNSDb64C3/hIXVw1iVPENs9WUbBstFodGaS771R8qALj pJNSvjNDUC1Kp8Ppcy+XuB73cff3bt5ikSg1t6j7/VKz+0AmLE18CyOwUZgUSeYXMrOkV7dLAAzk xAU+idmDBUH7BV6Jgj2+07bjjId/94j2Ib33ux+057Qr6WN0/CeiunK9th3d32m/nEVXzE4eX063 0ZE0n27GHhi/5Oi0GR73ChsVRTLJPCc5jFwL3W9RxBYJdDiVLFK1JLQDjt+toEMGQw7s0SBSFL9i zg1n5yxcyO9k1im3KblAbErewrWlaUDNmJ/5AoTnHHDamTpIG7TUDIymDVodFv4ljBWZdqIbBQfh ed5AW4R9kvoNOzGMNmxlRnxq5Z4++0c8/UWK3Cl6i8w4Vsil8SAnGwyreQ7+BMfLBo4THYqB52Ts ymTgW0SQ/FQynyV9VxDNhRe8DHuI7Q4CW1w7+8zHC+cIIQal8OqZsWLTmbHCqzhnDX0npQhob0Is 4OZ47GHuUeFR+WGj4CE+iTkhfzb/xSE5Ov8CsARz55+ZC2JzebywZhyu2CQbhVWjxNzMIEEj8q/2 o73UTVkxbkGfrZnv9rmblQMZKcaASQHuTxsU8ER0jrhIQ9CLyvxkOoo+pV2tHcWBnE6foIVwBq/T 7oPDeVrrotfDL7lW+432gXYt/SUN06H0l6ffpPMoD6d4nvZzSJ2k9nPskZ2f48CnEZZZaTwibzSb qdFhgkiZKcyQ6oXlwtvWT60nIEZkSfAInNr8BxxtwW1WWoz7XIxrQLPK3kZdloBtQDtnED4EzB1w DgRKypjeTld/+mXvF9q3CxdS4an9ex8Wm1577ImjyaWiP/nWve2rtzC51qB9rOOb2Yg3x39qcMmZ Ja7JmW0uscu1NXOf69nMD1wfZX7h+mum7HZlZua6hmQKTqcdh89mc3X6eI+yhr9TEXhnZqciHJeO mbkx3oIsDkEeXvI2m7uDWc3SgQBD9Vkc/0LmBDGpU9nL9oBzCB9wRJ5oGJA7IKWgid1FRJhrsdzA Ob2Nhq9XaBu1r7XfavfSR4H0sXS3dkDb/79enVCSvB7obdQ2gwRJ9DZsWT/smJ/upCYI7/u1edp7 p7U5eTujH9D5fRhYr23uI30acxlSMl14BXSww/JqiU9bamg1bDR8ZYDd5uY5o8m0WlZcsqzIJrvR Llk3rnLd7eJcLtgXmUz6y0berigVXkavO4UPvce9pwSDJFBvsyD0c6ot9n3+NKlAKRht0LTYOMhV 2VuoFtlxLmDEM4MFJ6+xMkVA0eOFkh0O3mF0TPlGoR20/o8ntVMlTbSo5ZuVd7W+sHDhX/Y8d3Cv 2PTKw1/XBJ/RsmjLoWuTNSDrpxtaV9+NvVEyF7b/DThHQfJ2PCPTH+lX3I8f7C/0r/N3yXuN4mHD bwwcZOmJeBCeny8zM71X0el2erJ5+OwBTlYyfYIt4GDmutENq97h6rQ5KKuW4iEmfgP8LAkYkOZ7 heXmFVl3mtdkbTLfl3VKMkhmJYuTMxUfC4R4W/LMx8ynYNmbQw6H1BzIysvisg70V081pgxZZuHb vYV6QADFMDNrIaC9hZWNDEtWHUskXFnZyIR1f5h1HiGb6vb9eR9ywHCqm/58dH/rbY/W0cvuqT+x +8nuN7tufWyB9vza6hMPPyhGbrr+vsarb7+5bMuKX362sqXrl00VG269Yv2irR8ynMHOEtaDHwwk K24VHCJTZ5RyLaJogAIDs0J7FDEJCzEJIV0grE9+c0PyG+iu01+I/tkM731a39fyOMxhJg/Gf4pX Vc4xkZmJTWLGWxZmCR7ealFyiSJiUIKQFqYiLkgMZpOJow6johgQRoIlp5iMZoMsIWgj8KLIy7LR CNkRifoi0YyIT9dpOFT4gp3wq5tyKkw4FQoFP0Dgj425tE2XznSTjkYV/UtDQlALZyXfXUTfoR8E Ydq+uyj5Tqaw/sw8sfXMCqGdpdPN7NxMBm/N5XcjNjuQbIubVgbbEBS4xGRjjuQ78UmKLXbU9mro I9sHoa8yRJJBPZ6BHi6ny2r1yNksVJjbJffrQpjMCUHS5VEVk8802MR/0f9Uf8gNq5TdVpVJMzNN TsZpFldGzOns3xoxTTVxJpwdxhiQfsmiIvw24kjBAdJ9ArTm5zNXoLcRMrwRIr2SmX39B6bN+wG5 BSPhDqXCLXb4BYPsAxkjRfP5uS1j+2dKnRsa7qYeyr11++Zt65t3ePp1vfBDw1W3bZ9WNaxkyV3V m56wND3fNK/mlqbkK5EGmmPYuCSON/yAjxbg44hOcy+p6iF832fxYm+/2GHpN9I3Ei9ILmPAyFt4 T5eoUsJCEEYnlWSPfEzmp9ivsV/vvsX9uP15u+RslZ/38dY20gPdxEyDXgqOZ1IDFgveC4GYIOEY LIOUpwfnhbcDfBZACfVvqdnY88wx7c/H75uyZPHe48+s2RkVxyUf2HTmtWPal1x38tfhLxIP/kqX DbMArw/0c5P6+IgF1nmuo7aPbILJJjg50oVjbe56wERNJqXLiviDS/VIAyWuwb7CftT+kV1AdOhE 3GG1xuw+WGEmE33eK7Xan/Po9i3CPeEUxDgtujEO2ccOTPrQQq4zksAzdQDt8h3Xb33ppR3Lb+9Y fvSHM69czzffMOa3jz35dkF9hJL3PqRO4JbFdbYAt1ZYg7XxUL1xufELLy96cz04KDZetTgyukRE IU0qIR73EJnTdb/TzXT/f8ZdkFOyC3BabHBVnvW7W+XnMhmk0KFF0PtALjOB4UTm5+Ngg2sgeAsA ISkYydxBH3cecH5L7W33HNb+iyqvt3TecdcD73zy0CpmvUycTd1H36bqZM59Zhg3bdavdz7yGeCe Brg3AMdOwL0+Hv6r5xuRW+54SNgrvKb+VhU9Yo4v4uPpZpvrTjunmCQ7NIvJ22VXETM59LTXF2N5 fLhiicmyBJZRrPPdK6xvWH/nFo9bqbsVFz8KRNbzfhedxdfDFmu1sp0lK/Pz1bON+REErXRjFwTR 7W6ErVL7q6TBFNfrlMA+QQmPGESwVeI3JMP8J5ueeuT+w0e0s1/tf+xEcjQ3Y+TfGh+iJzMytv52 zaKV1PXBUar87TZqWQ9WAgBeHIBd0DMuMi2e3+N4y/6h/bhdMDkUS5dktcEx5bucdIydSkabsc3E 4mvbKaUWC+Jsi8FkkUpEoiOVkUqVeZ46xAgbFqXErG6Z97e7o+4Q5C2iGLp853bVjv/93r01u3f3 3DlJrJoT0v60pOxsNz+xbPMDPYCJJ7naYH4W4jEh3AGNpkPjj4B7PNxh61H16MgPLMdHfmWSBjvo VC/d6X9owO4hvNHnsfjsngG+IQMHDB5iGDuyydJquXPAmiHiVrnL8py0P+9d6dW830sGy+aCYAEt GOCQDeP6bR4QV+2xAXGzNTZgQChvs89BHX66ecjmkFpqm+hebvutTdg6qGvY1uju6MMxcZSQZxiT XRi4MjouJnn7DSNkUGtAKBOqhFXC3QL0QCDGTpbJbo9FXeyn1cY4QHE4YjbbGGNrJqtlmdVYZuaw QKzV5o64R7t5t7twWKsayAtwgecK1W9SsRI9bBJmhn24N6xLSwhJaIiUemXGF6RkOPzNsSjEJTAP IYM/sAdTryHYkVaeKdjz8bPcAoSTYgUp/cqn5Q1jIicrBwNuFz/r/ZbaNZ+PmULb7/ro5Zd+Rc1d 3Suaj75QMK+z87r6dT9btuFR7WNtL7+lbNmqpXdeOnZk/0vyPKsWNG9oX/RMWAhVVRcIAx6p7zyQ PNw5b96GdXUN9yRzasp27MYdJHisBUSF6wM7bRqTrifiSoYvZsq3OVmM8nfxfrItlmkeYmbKgzN3 CaqiOoxthmedxNamAmv7ZDmm9sABD+sylfklEKfFTEtABMDM0sUpOExlwduQ/Y/C0ue3PVtz+umV NfC3Wve+/lTybc5ML3s1eQuAwNneAKi+RpHF+y7DzQJngLJ2GGxU5MQ2yMdD+wcMisXhmnT3vcjc ENb0tGyJSUB6YzgVDyxmliDsdhYRxJpf19bWik27dmmhsw3gXK7vCN4OPKmvYYGPMMCQrWbGpDLV F5MuUUwxjrPwymbZb7HhUkPgLIoitFnSq1hA9WiE2QAQbpBt+jr6TvW14CQMuowW2E/W1t7T4pl/ TXpV7onDM7g7N/Nnsb8VwPcz+toKuTM+Df78MuVuJaHwRAkoVcoqBXauKLbLcBZEQTYoCEW1M1NZ lGAsizJabEAN5xAxUIhLZewqBFfGCDvJMm3jeowIQOSnLkQQhohGGUWKfYATsSeZRZ0Q2T5fgPZY AvMYOFK4kEI/ruF6NYUraU8+T8+mfFwtpE2BDfwnug+8coE2o+NGuMWEtrLrHoabaCym5yCOnoMy eg4Zy4EyoE3KgU7RIzW3zn+3wJd/ErI8h0zGq0EwcS5RzDGLJ9vBSf1cgj2zSxbUHJu5zfKCR3K3 eV7Ipllttmya3RNQT8FQYbuFnw1qQK5582GZMc5zuhnfec/xHlPhEuM+VmD5p8Lifb+edfvBDYma 25bMvG18beuN25tq+C07nvn007ceTb7JGbseq29MrufM9z0EzgTTXDgrgNVOZu/zG8NGDsz3ztPw gXFU3nlaNsdgv/9nvJ/HH7PikAqq3cZOiwuSTGmT/9mRQbQdFMKhQYAdnNSYgt3jBph/d2YOLAeI 2/e+vif5bvrI6IBxhNkcGuBifv0d8czBKq0n8yV2m5jAbeJr5jccssfsQ6SS+eke+OkSc+TNXeyG kag21WzRvfn4MBRy+cEK57N53Nxs20w3x64cOVvrG/xxqEF2w0iU15RjCq9fNCJKiEghJFwjc/Gh 6wE+E3WNuG50s5sbpul1OZbW9Fz4dWrSvn39dah6y+s/f+/9rdvef5/frZ18+y3tb9T+1tvUcXbn hzsf/OSjh3bCa2DyYDX0zUHsjdkojftM/TOCDMufxb0ofOmlqsnRpTgtfhu12jK6cCnIKGDN9Mfc GcxOSV+9ndqHc41wP1MCeNc9Jj3vpyp4qgcBLBgrqsZkeWoPEF5pgxD2IBgJPJTayyAQxHvBJPzT 2o7DlNNOHWpbV1PTvPqht3730HJ+y8hS7eu3j2rHS5KnxEX3JNeXvPforo913lmNzZzV9zE6HiDm gHm3yCPEaaNxI3P3oMotsLJUo9Rm6LGlfNvmSAYLqcHuY6EnxNIMQCMPMKLuKAwL7mzh0tKOX9TU CA/9YjZ/6Zz52vfJg/yWrynegsFr97in3oT1csjhfZa4bI1l4ZjGXShkZJvNMdmXkdGuwHxTZLgC J+JWHFiexXp8GU5XTGGMMhBBzknKJF+FUuE7pogZik8WrNlkM4zYzdmqutlud262Ok1saD/oDL+K H32QyU89bczIDapSm+pn4sFmi+k5VvZDHER7I+o7CF724tbPiwsm3dMA/7CrKOaYMmLo13BWdg3H 5Ot5KzetOS94pqk7KW7FusXTl5TQwqonV61d8+BtM2+4XDtS+cStjfycBXNnj4tMvfn2sus3zqia Mbs07+pbV0yevxH+5IfAUZ3wBt6NmR7PM+XDrbAWKSq7muVdfBdnM5qMsFGcVHDZ+alOauSNQpv9 986/OTk4V/BaK1VGnca0PmDlYqaAotA9gDkV8mM+kG4NDizQrawYwt6cpoXnTqyqrrxm5fffjxfe 0N4tS356x/RhcyMNc7hNZR/PYnoZZ3oBzreLTI2bTvM/qByXDQBxHQilrDpjUj40s9FpIw5EFWGl 20mb61mPqY2Ztkwpyz1uKGUcUBYCBWgQkClMVgYLQlbK7u7g7DDoRjGvh5eFeHvDvS/XrFtc1T6h Zsucqw4luDHJ11fdU76Qu/Nsg87DJA2TBHyFmafdfsHTbk+FLUWKVyckScANHcdTSYR0F8/51Gk/ ujgKHOFK5Mfe83l/mV+gNV2qza2js+kV/Jazs/jdZ3/gDefWF3cDJ2byVLzazNY3mV0mk5kzGY3p 9RWEynV9KSsiogLtkohbG1HmTbyEezUR4VmzGSEAyWAzw/E3mhBdEw3wAniTCe9WUSzD+/kwQri8 xCIBlQgFVPoQ3Waa/v8MBugbwc+/EwvADU86HCDu1pZGtC+0Pw3TbqqiY2hgFM2gcbZX7sukm9+d dHAnWdL3bIb8g9iHNdQcv5yHwyuJBs7A9s4ZcI9twH8p8PouEQAXeWCecn5gSxQF22iBsl0bCJP2 hEiLoKvZIIG9oVKphznCUdA+CtcAm2BEwS6jsA5SVkLqjmpEnkEukosAvh7L4GuSZXX0Jxquiq6i l/JbTndya7hjyVu5OwAuwJLoS9xp/hnoIvt+RYFAlvCWEoI77FDQ9O2xBO6j0r319feyxD173caN 19VvxMs5kPc+UKAUPo8bpdv24UUkt/5OBTP19HcrvFCzxVZqtXdZzQKVNvvcBluG4LAyMWSH5qWS rc1q9batyjiUwWUwmWfGjVcGdfFtCt5PYsII2BAi4WgUFgNkKzMieiMRXQ0XMecIwokJIOZZX+Qa BZwhpsSyKAtP0T8erNm169HtdIij1n74lsVcqBbmt+4nLek5rGmJDduWpGxNhhT8j089/u3mH32K 0MgDV2a8t5d6X+/c23oZiJv6EQXqD09rwN+9gRfR37278ObdGDIB/1ZYSi4nE8kkMplMIVeQK/Ev QlPxPzFX4+216fjvwVn4P8hyUoH/k5lD2skhHRiKt3AYy4M3gG8y/arJM8aXhy+fv3Dh9Ooblw67 Yv51DcvI/wbfRUFcCmVuZHN0cmVhbQplbmRvYmoKMzMgMCBvYmoKMTA0MTQKZW5kb2JqCjIzIDAg b2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFzZUZvbnQgL0tSSEtRRCtH aWxsU2Fucy1Cb2xkIC9Gb250RGVzY3JpcHRvcgozNCAwIFIgL0VuY29kaW5nIC9NYWNSb21hbkVu Y29kaW5nIC9GaXJzdENoYXIgNzggL0xhc3RDaGFyIDg0IC9XaWR0aHMgWyA5MDUKODUxIDAgMCAw IDAgNzY4IF0gPj4KZW5kb2JqCjM0IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9u dE5hbWUgL0tSSEtRRCtHaWxsU2Fucy1Cb2xkIC9GbGFncyAzMiAvRm9udEJCb3gKWy01NzQgLTQx MSAxNzk3IDExMzFdIC9JdGFsaWNBbmdsZSAwIC9Bc2NlbnQgOTIzIC9EZXNjZW50IC0yMzUgL0Nh cEhlaWdodAo2ODIgL1N0ZW1WIDIwNCAvWEhlaWdodCA1MDEgL1N0ZW1IIDE2MiAvQXZnV2lkdGgg NjMyIC9NYXhXaWR0aCAxODgzIC9Gb250RmlsZTIKMzUgMCBSID4+CmVuZG9iagozNSAwIG9iago8 PCAvTGVuZ3RoIDM2IDAgUiAvTGVuZ3RoMSAyNjQwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0 cmVhbQp4Aa1Wa2wUVRT+zsydfbmUdi19LdgZpluhu+u2FDX4oJu6i2INFoqw64sW2to2baktEqqi Nb7ioqLRECTEB/EtklE3ZMUfFNFooo0x0RijhvhDjUaIMWoMdKee2dmuRerjh3d359zzuGe+893Z e2bL8C1d8GIMMqKbBjqGkBuu61nUbtq6RbV1qR2g/u6hmwZsXf4QEHfc1D/abeuuRyx/T1dHp61j kuUFPWywdVrKsqZnYMs2W3ddxbK4f/OmvN91D+uegY5t+fvjS9bVwY6BLjves4jloqHNI1ts3W3l Dw0Nd+XjKcH3d9i+GVfiuUAfnDmbxHU6wJkkxp6zWH7+nXhF2r9h7iW/kt+VM78e/mHMmnzaV7Pw VO/kwaJ2t5fj3FZsbrB0bjSrgbnFp3qzjxa1Fzz5AIgMzgnSISh4CWqQDuMV+FGJUsyFh2Nqg4ex H3XQUMW2acurUE+LwWG8cEbQi1iCxRxYiqJ8opdQk0v0Z+qXWZ95MxzCASYiEMzgeTW+vbcilkFp MB1d16DUp0MRESxKLxJzipQ0Fj03pqTvvPV2MZoeGRXDI2ll+OYhkR5aPyjWpdcruB3pOd6zPO60 y+lwOd5YiXo8lJGn7l1Qhq11VRVNQXvYk6oKMOEuBroS63E1qs0G88QUcFL2ij5lu7JbOkoGHaBO up6upTXUSqvoKopRMzXRpXQxXUiNFKEgLaZzKUDVtID8VE4+KqYi8pKHXCTRSfyO3/ALfsZPOIEf 8T2+wzf4GsfwFb7A5/gMH+MjTOAojjALGRxEGq/DYPafx7PYi8fwKB7CDjyAbmxEpWuX407lqNgr 7hadIiKqhV9UCp8w5UpZyL9Iu6Wd0gNSg/QZvce4X6ZnaR89TU/SLnqMdtD9dDdtp9voZhqgHq5q I7VzZevylV1JV3BtTbQsV9d0VVY9RVyLRCasWn7mGiz0H+MDRpvGPjyNPYxyB6NDHfnwDVNzLd/W Rz28/z6zAT75JHxKH85Ozy3izUl73Lw5aUXIEhkIvUZyoFldofZ0dBpyICfbEnpEz/oj+vFk+bLy S1QD1yQMuc6vJQ26rPg0QzhU4itfFg6xNRw6Eg4Z8a0G6csNFBv0iQG9mbVmY+VWQ1I5zWXLDSp+ ZwVP9BinYmlQO9v15jYj0KVvs9dPr5pegn9eosZ7YuFQMMyVKIHmpuP/DjlXclP23wPPoCXJnIRD TdYvGw7N6rbYOMNRoHMmmbPGHWfas8nTOeY/Y6glA3dr4jWih5MZmro3E8OCN/nEkTfcGM5gXkhV 471MaTsrZSE21Gk8K2cg1p6uSehJNaWmVnam8siEvdHs6EolI7wDbYlevq5NaEY06S9Mu5LJizhP hZWHl3B4KskZ+vhRsTKwzJkiWQ6qDLWohlzbmlidMMZifiMaS/o1TY0b460JYzzGD0+So6oKSBmx ddDYmP2MuaqO/fPtLG2cg1MkUykrJ2tSrWaMp1L+FFeSs+hahpA3ZJCLkQPxDEVbE5Yrqmt+Lj2u a7rGOJIxzr0g1NKWiDMSzUJyzhmUIjaD0uoCUI5VGV51jlLtf6J04X+hVP9PlNYUkJ5GaYAx11iU 1hYojfoNFCjVNWPsL4TibxkuUB6dhfIxm/KxWSg/dwblVqtFo/NSHHB8hLWOAFbw+UT5zmh1Xu4G WMW9mLgBTw85P1FxJR7nw9lqzo2APMHNXObY8qjbSQKK7BaITBR/NcHXyERDfWOJVhLQSrRGec/k t9KebLeDT88xhdcTtzo4dvJ56EZNtMLtdTq8wi2Rm2gIzjkOGpaUOZKzrgFNkSb+1i8m4mQaXxw7 zQezDeZGGpEm6BlZTE4qfVmGwZjWTp1wjCrbUYxq6FE/qGw+lfm8Xu98n3CfJTkHUeIZrHR5conr gvVUKgldrZHOX+qr0ZaIMp+y9DxJX+iYV1rWuGQ5OUbfMJ80zSlz76v7qYtonMJvd5rrzrvhvsSL 40deGNm3Vjr4tnlo/H1acegtir83fNTM7lx114bz33nqqXeve8YijSx+lWNcpxP+6Nm2Scxzet1O 2T1EsscZ5BIZCddmfZRjpjA3mEJ5QlSe+k5U0mqrrtyY6ubmN9vgDUUDv29cmHMSfPnddPDbB1rW XNGyOha8vLe/v61jcCTcvLmf3/7+ABKoa0wKZW5kc3RyZWFtCmVuZG9iagozNiAwIG9iagoxNjE3 CmVuZG9iagozNyAwIG9iagooSUVURjEwNCkKZW5kb2JqCjM4IDAgb2JqCihNYWMgT1MgWCAxMC4x My42IFF1YXJ0eiBQREZDb250ZXh0KQplbmRvYmoKMzkgMCBvYmoKKEtleW5vdGUpCmVuZG9iago0 MCAwIG9iagooRDoyMDE5MDMxNDE2MzcwNFowMCcwMCcpCmVuZG9iagoxIDAgb2JqCjw8IC9UaXRs ZSAzNyAwIFIgL1Byb2R1Y2VyIDM4IDAgUiAvQ3JlYXRvciAzOSAwIFIgL0NyZWF0aW9uRGF0ZSA0 MCAwIFIgL01vZERhdGUKNDAgMCBSID4+CmVuZG9iagp4cmVmCjAgNDEKMDAwMDAwMDAwMCA2NTUz NSBmIAowMDAwMTkyNDE2IDAwMDAwIG4gCjAwMDAwMDAzNjAgMDAwMDAgbiAKMDAwMDE3ODMxNiAw MDAwMCBuIAowMDAwMDAwMDIyIDAwMDAwIG4gCjAwMDAwMDAzNDEgMDAwMDAgbiAKMDAwMDAwMDQ2 NSAwMDAwMCBuIAowMDAwMDAwNjEzIDAwMDAwIG4gCjAwMDAxNzIwMjkgMDAwMDAgbiAKMDAwMDE3 NDc4NyAwMDAwMCBuIAowMDAwMTc4NjMwIDAwMDAwIG4gCjAwMDAxNzg1NTEgMDAwMDAgbiAKMDAw MDE3MjA1MSAwMDAwMCBuIAowMDAwMTc0NzY2IDAwMDAwIG4gCjAwMDAxNzU4NjggMDAwMDAgbiAK MDAwMDE3NDgyMyAwMDAwMCBuIAowMDAwMTc1ODQ4IDAwMDAwIG4gCjAwMDAxNzU5NzYgMDAwMDAg biAKMDAwMDE3ODU5MCAwMDAwMCBuIAowMDAwMTc2ODQ4IDAwMDAwIG4gCjAwMDAxNzYxMjUgMDAw MDAgbiAKMDAwMDE3NjgyOCAwMDAwMCBuIAowMDAwMTc2OTU2IDAwMDAwIG4gCjAwMDAxOTAwOTAg MDAwMDAgbiAKMDAwMDE3ODQ3MSAwMDAwMCBuIAowMDAwMTc4MDU5IDAwMDAwIG4gCjAwMDAxNzcx MTcgMDAwMDAgbiAKMDAwMDE3ODAzOSAwMDAwMCBuIAowMDAwMTc4MTY3IDAwMDAwIG4gCjAwMDAx Nzg1MTEgMDAwMDAgbiAKMDAwMDE3ODQyMSAwMDAwMCBuIAowMDAwMTc5MzA4IDAwMDAwIG4gCjAw MDAxNzk1NjMgMDAwMDAgbiAKMDAwMDE5MDA2OCAwMDAwMCBuIAowMDAwMTkwMjg1IDAwMDAwIG4g CjAwMDAxOTA1NDEgMDAwMDAgbiAKMDAwMDE5MjI0OCAwMDAwMCBuIAowMDAwMTkyMjY5IDAwMDAw IG4gCjAwMDAxOTIyOTUgMDAwMDAgbiAKMDAwMDE5MjM0OCAwMDAwMCBuIAowMDAwMTkyMzc0IDAw MDAwIG4gCnRyYWlsZXIKPDwgL1NpemUgNDEgL1Jvb3QgMzAgMCBSIC9JbmZvIDEgMCBSIC9JRCBb IDw1OTdmMTYwZjgyYzQ2YWI2ZDdhYjM0MzEwZjc4ODY4ZT4KPDU5N2YxNjBmODJjNDZhYjZkN2Fi MzQzMTBmNzg4NjhlPiBdID4+CnN0YXJ0eHJlZgoxOTI1MjEKJSVFT0YK --Apple-Mail=_BC5154A1-BDB6-4B66-B6D3-4AB4909AF40C Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii --Apple-Mail=_BC5154A1-BDB6-4B66-B6D3-4AB4909AF40C-- From nobody Thu Mar 14 09:48:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 33171130E9B for ; Thu, 14 Mar 2019 09:48:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vL5nOkPWwcAU for ; Thu, 14 Mar 2019 09:48:07 -0700 (PDT) Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0544D130E86 for ; Thu, 14 Mar 2019 09:48:07 -0700 (PDT) Received: by mail-lj1-x231.google.com with SMTP id v3so5436864ljk.9 for ; Thu, 14 Mar 2019 09:48:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fhNH5N1TsDNHpsV3+dqzhwxfA2xSAITKzOD1SNZD/Cc=; b=y92hD3mnB6AuF00mc5tMKbAdi747ujQGDqKJunjhZBauGQqzXeWkXF5ABs8T6drIO4 fjjF8/EVmyb6KeAB6VQ1xBmebFlSA6BBGZHGjlNw2jxKGfWgVYwg9weliadinrDHvrWT D01EKck2MJzP4m4IoixUEQG24X2mKMsN70C/PoS0lsWquSk3y/UTDBGkh04iSRmW0/lx C0URcPe6TbnR0/++qafTU3ToKnUKBLy5RNOc3nbu0pHNGm5jhiX5rgzJrkeS7fGCysNG 1b36uM7WQK/j0P2kVYnGUwhBo27SAjM7wCncCtMN07RSCX4hfVWTMuV3kPvdlAj2r2mQ 8Uhw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fhNH5N1TsDNHpsV3+dqzhwxfA2xSAITKzOD1SNZD/Cc=; b=mdaqoayzPMBiDoV+zhYtuV79A3z6TAW6HyVebOYZnAMpHViPGDU/VcmLFULVn9PbbJ N9m4LSlTGFHqXbwYuf6YWTGP6N4Kfu7e4YIuNbWbTqyp8uWCSFEVuX3sTuKBWauPcO4b xjxkgtr+VbPRN3Yib7y6Dlg7GY0MBQDp88u2AIsQ8p7v6q8FfKojIec+Qb3bw9mbAZf7 yvrmCtJKrd5VzUByWzF5D0SvSe3czG5VOWctTkC4sp8WfH/cD7tPEncTVV8QhWynZ8HS +q85vgHSmVlgLQFCIaCATvhlTechYSIxBc28UWNPaP7V6+3x8cpBUE7jLrJdiNRmDAYl mF9Q== X-Gm-Message-State: APjAAAXSIemPO9Q2XHjQcfUSAb5fHj5Yt/DklmuwCtzpFhB4xXVku/hM oSR357QdGAgNWaVsj32Bs3WWtaVFWcrxM5Vbv8d4d+Pt X-Google-Smtp-Source: APXvYqzD+bH9Ui358lIu4sGoDRLC1JbdMNQzqbkSDZ8IX889ibBJ///XXQk4COMTlXud5GgwVU878MxDH3YmXZdAT2s= X-Received: by 2002:a2e:965a:: with SMTP id z26mr24083140ljh.59.1552582085129; Thu, 14 Mar 2019 09:48:05 -0700 (PDT) MIME-Version: 1.0 References: <23689.7924.461871.555714@gro.dd.org> <8EB4385E-69A7-49BF-B4D1-EEA1F42BF81F@rfc1035.com> In-Reply-To: <8EB4385E-69A7-49BF-B4D1-EEA1F42BF81F@rfc1035.com> From: Eric Rescorla Date: Thu, 14 Mar 2019 09:47:24 -0700 Message-ID: To: Jim Reid Cc: DoH WG Content-Type: multipart/alternative; boundary="000000000000ab600f058410af66" Archived-At: Subject: Re: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 16:48:09 -0000 --000000000000ab600f058410af66 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Mar 14, 2019 at 8:46 AM Jim Reid wrote: > > > > On 14 Mar 2019, at 15:36, Eric Rescorla wrote: > > > > Given the extraordinary amount of discussion there has already been > on-list, it's hard to imagine how we could possibly resolve these in 10 > minutes each. > > True. That=E2=80=99s why I suggested having focused discussions about the= m on the > list. The discussions to date have gone off at a tangent (or two). > > Here=E2=80=99s what I suggested earlier today: > > I think the questions to resolve at the WG are: > > 1) Are the issues identified in > draft-livingood-doh-implementation-risks-issues valid/reasonable and does > the WG want to work on them? > 2) Are the issues identified in draft-reid-doh-operator valid/reasonable > and does the WG want to work on them? > > And if the answers to q1 or q2 are no, the followup question would be: > what, if anything, needs to be done to the draft(s) to make them > WG compatible? > > > I hope the WG can concentrate on these questions in the run-up to Prague. > That seems.... optimistic... but in any case, that still calls into question why we need 20 min of presentation time followed by effectively no time for discussion. -Ekr --000000000000ab600f058410af66 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Mar 14, 2019 at 8:46 AM Jim R= eid <jim@rfc1035.com> wrote:


> On 14 Mar 2019, at 15:36, Eric Rescorla <ekr@rtfm.com> wrote:
>
> Given the extraordinary amount of discussion there has already been on= -list, it's hard to imagine how we could possibly resolve these in 10 m= inutes each.

True. That=E2=80=99s why I suggested having focused discussions about them = on the list. The discussions to date have gone off at a tangent (or two).
Here=E2=80=99s what I suggested earlier today:

I think the questions to resolve at the WG are:

1) Are the issues identified in draft-livingood-doh-implementation-risks-is= sues valid/reasonable and does the WG want to work on them?
2) Are the issues identified in draft-reid-doh-operator valid/reasonable an= d does the WG want to work on them?

And if the answers to q1 or q2 are no, the followup question would be:
=C2=A0 =C2=A0 =C2=A0 =C2=A0 what, if anything, needs to be done to the draf= t(s) to make them WG compatible?


I hope the WG can concentrate on these questions in the run-up to Prague.

That seems.... optimistic... but in any = case, that still calls into question why we need 20 min of presentation tim= e followed by effectively no time for discussion.

= -Ekr

--000000000000ab600f058410af66-- From nobody Thu Mar 14 10:51:17 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DC50D1274D0 for ; Thu, 14 Mar 2019 10:51:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iFibyY9ufiOw for ; Thu, 14 Mar 2019 10:51:01 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53DA8130EEA for ; Thu, 14 Mar 2019 10:50:57 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id u6so3781831vso.10 for ; Thu, 14 Mar 2019 10:50:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=m3SYk4wKl+h3WmdMDap+i8XwvvrmCU50bpH/LPbNU5Q=; b=F2clig0lUm8QKg8baPjbbEWlTT4PrG5FZNpPtUJ8Et5h/sVG9IPydpO4HNWsRSsdtp xkYkYG5eIIXNGVyopqfFciMSFNm7qyTULtHdf9MxKr+JsdoiJv+hzzSc2/GaARX/tJrb XlBiPxpATbRZ0s6Br2B7g/EDgnRy0pnLIMegsAx9ALPkYdOm5TlLqJ9mvjkXQ/4s8MkT m92Co++VIBWNgj/IsXZ/6PESKvpK62+ykvcm9i/zJutkBfW6WNQvN3Crona7QtXoRMBJ 8b96Os8tvj/fLss6BW692YHw8GdNFpuHenQBsvjhYkJ8TvuTAK5hmYR/IcZSd6L0gZIE DPJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=m3SYk4wKl+h3WmdMDap+i8XwvvrmCU50bpH/LPbNU5Q=; b=LOZEoJR3MzCGtNgJOtRY7v3k96nl8zLxRxMHcyULCAmeRX0qs6aAtZ4taVi0ushvE6 rgClfpmwgmFLZqvR3FKZBVkq7YFmk4xGANNsWif6LfkBZpMXALCmSk8bW9AuBFmkc/6U C4YeA/YPqnIv8YPjM0Ni90pQfpuVB3OJQjfak3RW/sNYzaL7ostWe6DvijuOXC7mr8W0 Z7rXyETmSqHN3MG+Pq3n1nQjQ1HksidC6RxkK1Jkii14dd/xUp4GWscvdjz7N/6z9mEV Z9+oYcKwjsZ9XgnX6S9/2jwHTvHptMRhjJjuPBR7ckLB7uR3N8s0wBukFUpU0KXyZUXq bOUg== X-Gm-Message-State: APjAAAW7mY0+zR0Lz9wqpYRnxcMtVFPZwmubuuMbH/iUY/Sowkg9Tl3/ h2bWs9iSiVf6U4rP6kHWfHJtAeb28KH3gAse+JwMMw== X-Google-Smtp-Source: APXvYqyGe3H+EZaf97GikRSSMzyCp01stcsHy3bM3ykRXWdhoGMBNbmlSTp3HgFOL4Erdpnqtth+FEswk04asIH9FT0= X-Received: by 2002:a67:ebcd:: with SMTP id y13mr4977870vso.152.1552585855991; Thu, 14 Mar 2019 10:50:55 -0700 (PDT) MIME-Version: 1.0 References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> <4425132.CsHbCTgi9Z@linux-9daj> In-Reply-To: <4425132.CsHbCTgi9Z@linux-9daj> From: "Vinicius Fortuna [vee-NEE-see.oos]" Date: Thu, 14 Mar 2019 13:50:44 -0400 Message-ID: To: Paul Vixie Cc: Ted Lemon , dns-privacy@ietf.org, dnsop@ietf.org, doh@ietf.org, Vittorio Bertola , hrpc@irtf.org Content-Type: multipart/alternative; boundary="0000000000006e760205841190d0" Archived-At: Subject: Re: [Doh] [hrpc] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 17:51:03 -0000 --0000000000006e760205841190d0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Paul, I'm trying to understand your scenario. If you ran your own DoH server in your network (doing RDNS or whatnot), and the DoH server is distributed to clients via DHCP + a protocol upgrade mechanism, would that address the concerns you are listing? Vinicius Fortuna On Thu, Mar 14, 2019 at 1:33 AM Paul Vixie wrote: > On Thursday, 14 March 2019 00:48:53 UTC Ted Lemon wrote: > > On Mar 12, 2019, at 2:52 PM, Paul Vixie wrote: > > > please do not relegate discussions about the loss of operator control > over > > > the RDNS control plane > > > > Although it=E2=80=99s certainly true that DNS is used as a control plan= e by many > > operators, there is no standard =E2=80=9CRDNS control plane.=E2=80=9D = ... > > i don't think lack of standardization is the same as not existing. device= s > which honour the dhcp-assigned rdns service, work as expected, and as > intended. devices who ignore that setting and seek their own rdns by thei= r > own > internal configuration, will often not work at all. > > because many of us amend our locally visible dns namespace with things > like > .corp or .home or .local, it's even more vital that devices respect the > rdns > assignment i make. the dns content i want to be visible on my network, > have to > be visible on my network. > > because many of us won't allow pirate or malware or otherwise undesired > DNS > lookups to succeed, either because we don't like the name, or we don't > like > the result of the query, or we don't like some name server that would be > involved in resolving it. the dns content i don't want to be visible on m= y > network, have to not be visible on my network. > > from the days before dhcp when we typed these numbers in by hand, until > now, > it has always been the expectation that rdns was part-and-parcel of local > network service. no different in that regard from dhcp or arp, neither of > which is standardized under the heading, "control plane", yet, are. > > so i think i'm not going to follow you down this terminological rabbit > hole. > the reason that internet creations of yours will work better on my networ= k > if > you treat the rdns as part of my control plane is, because it's my networ= k > and > that's how i operate it. you're not welcome to bypass it, nor answer dhcp > requests when you're not my dhcp server, nor answer arp requests when you > aren't the device i assigned that address to. > > you can call that tautological if you wish. but it's the life my networks > lead. external DoH providers are explicitly not welcome to provide servic= e > to > malware or intruders who get into my network -- because rdns is part of m= y > control plane, and like arp and dhcp, i control it and i monitor it, for > $reasons. > > > The problem with the discussion we=E2=80=99ve been having about DoH and= how it > > affects your =E2=80=9CRDNS control plane=E2=80=9D is that we=E2=80=99re= talking past each other, > > not that the discussion should be had elsewhere. It=E2=80=99s fine fo= r there to > > be a discussion, but if there is going to be a discussion, participants > > need to engage constructively, and not just fling slogans at each other= . > > i think i've flung considerably more than slogans, and, it's been > exhausting. > > vixie > > > _______________________________________________ > hrpc mailing list > hrpc@irtf.org > https://www.irtf.org/mailman/listinfo/hrpc > --0000000000006e760205841190d0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Paul, I'm trying to understand your scenario.

=
If you ran your own DoH server in your network (doing RDNS or wh= atnot), and the DoH server is distributed to clients via DHCP=C2=A0+ a prot= ocol upgrade mechanism, would that address the concerns you are listing?

Vinicius Fortuna

On Thu, Mar 14, 2019 at 1:33 A= M Paul Vixie <paul@redbarn.org&g= t; wrote:
On Thu= rsday, 14 March 2019 00:48:53 UTC Ted Lemon wrote:
> On Mar 12, 2019, at 2:52 PM, Paul Vixie <paul@redbarn.org> wrote:
> > please do not relegate discussions about the loss of operator con= trol over
> > the RDNS control plane
>
> Although it=E2=80=99s certainly true that DNS is used as a control pla= ne by many
> operators, there is no standard =E2=80=9CRDNS control plane.=E2=80=9D= =C2=A0 =C2=A0...

i don't think lack of standardization is the same as not existing. devi= ces
which honour the dhcp-assigned rdns service, work as expected, and as
intended. devices who ignore that setting and seek their own rdns by their = own
internal configuration, will often not work at all.

because many of us amend our locally visible dns namespace with things like=
.corp or .home or .local, it's even more vital that devices respect the= rdns
assignment i make. the dns content i want to be visible on my network, have= to
be visible on my network.

because many of us won't allow pirate or malware or otherwise undesired= DNS
lookups to succeed, either because we don't like the name, or we don= 9;t like
the result of the query, or we don't like some name server that would b= e
involved in resolving it. the dns content i don't want to be visible on= my
network, have to not be visible on my network.

from the days before dhcp when we typed these numbers in by hand, until now= ,
it has always been the expectation that rdns was part-and-parcel of local <= br> network service. no different in that regard from dhcp or arp, neither of <= br> which is standardized under the heading, "control plane", yet, ar= e.

so i think i'm not going to follow you down this terminological rabbit = hole.
the reason that internet creations of yours will work better on my network = if
you treat the rdns as part of my control plane is, because it's my netw= ork and
that's how i operate it. you're not welcome to bypass it, nor answe= r dhcp
requests when you're not my dhcp server, nor answer arp requests when y= ou
aren't the device i assigned that address to.

you can call that tautological if you wish. but it's the life my networ= ks
lead. external DoH providers are explicitly not welcome to provide service = to
malware or intruders who get into my network -- because rdns is part of my =
control plane, and like arp and dhcp, i control it and i monitor it, for $reasons.

> The problem with the discussion we=E2=80=99ve been having about DoH an= d how it
> affects your =E2=80=9CRDNS control plane=E2=80=9D is that we=E2=80=99r= e talking past each other,
> not that the discussion should be had elsewhere.=C2=A0 =C2=A0It=E2=80= =99s fine for there to
> be a discussion, but if there is going to be a discussion, participant= s
> need to engage constructively, and not just fling slogans at each othe= r.

i think i've flung considerably more than slogans, and, it's been e= xhausting.

vixie


_______________________________________________
hrpc mailing list
hrpc@irtf.org
https://www.irtf.org/mailman/listinfo/hrpc
--0000000000006e760205841190d0-- From nobody Thu Mar 14 11:07:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67312129A4B for ; Thu, 14 Mar 2019 11:07:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tYGV0jAWWbAF for ; Thu, 14 Mar 2019 11:07:28 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C2331277E5 for ; Thu, 14 Mar 2019 11:07:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1552586847; x=2416500447; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=aCr/0ZRp7b+Z2gek2bHTmZ/Y1s/G54niqXdAaDoXHI0=; b=clxnF2qsCgru0dDTGkIrQlDzDzIz3UOU40ete9FkNmYN40uBT8gxQyIxLimAs3Yh E1QBLWA9peaxYBogOnQkSBAxEVKqnbj0Aqtgj+sxBiFgDMOBW12GqIuz++VGfLHd iDNQav09yTtQxdt4MkFROtqJaKlTcsEyFB0+odbqlPsps2UyvTztLsQux5fzjtoC msF9za4bmQvlsgB1XcgX0QA9vZvvv9AzQom53WGc1zCWCKEo8sNNReVrgaNSZOGt AQDmRTzQ5/CeM6qyzrNu2QNpFNsVXK+selkEwG12kaPhquw8TEnVzlg60qR4a9k7 ngX9Lek5SfJDKFFJDbpO4WSiYzuGyPyQWC6AqJyrJ2N5SIChl7JO6Fsgys5r8S9y hwvEzAS5wY6wR4h80VSUEnLaqSIVBO20BYpv5ZeEmxj5wTZPdKJdLALKUn5cN7av 61ODs0IhTOU+Tjd4A9dNGdE8H1/+i+WXhYP07lhKkpFjN0nK5jEniz8/h6KjfoKf +K1U6bpxvsRFUsP2IBCafJuIZplYuymq+eBHGrtg8gclTA8+n3z2LkRYBYH2OpNZ D5+bxjPOEk5IMRJK1PUNGuiAAdCDGP4lJp7w5i2gVOEQHxLsveVQ82Ex25LdjPp6 lcd/V9cGhNkkOXOwSCMJLqLyaQtApuc/illJqnMkTG4=; X-AuditID: 60729ed4-2cdff700000044dc-f6-5c8a98577529 Received: from COPDCEXC36.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id E9.0B.17628.7589A8C5; Thu, 14 Mar 2019 12:07:19 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC36.cable.comcast.com (147.191.125.135) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 14 Mar 2019 14:07:18 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Thu, 14 Mar 2019 14:07:18 -0400 From: "Livingood, Jason" To: Eric Rescorla , Jim Reid CC: DoH WG Thread-Topic: [Doh] Working Group Session Agenda @ Prague Thread-Index: AQHU2a/mL99+lzZI90238LivsUQz+6YKYH4AgAESHQCAABSMAIAAAsCAgAAQ+gD//9NDgA== Date: Thu, 14 Mar 2019 18:07:18 +0000 Message-ID: References: <23689.7924.461871.555714@gro.dd.org> <8EB4385E-69A7-49BF-B4D1-EEA1F42BF81F@rfc1035.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [68.87.29.9] Content-Type: multipart/alternative; boundary="_000_CF331E2741BC47238F62057C9ADA96A9cablecomcastcom_" MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprEKsWRmVeSWpSXmKPExsWSUDRnsm74jK4Yg+ZTShbX7l5ks1jx+hy7 xblnCQ7MHkuW/GTyOH31FbPH5MdtzAHMUeE2RanFpUm5mSUKxalFZZnJqbZKyYnFSnZcChgA qDQnNbE41TG5JDM/r1gfQ42NPswwu4TwjPOd/awFBzwqDj64yNLAuNeti5GTQ0LARGLuzoPM XYxcHEICu5gknmw+xAThtDBJfGjazQjhnGaUmHXzAytIC5uAmcTdhVeYQWwRARuJa88aWUBs ZgFJiUfHD7F3MXJwCAtYSBx5HABRYinx9NQbJgg7TOLt3ClgNouAqsSryZPYQGxeAReJmwv+ gY0REnjMJPF4PRvIGE6BQImLJ1VAwowCYhLfT61hgtgkLnHryXwmiAcEJJbsOc8MYYtKvHz8 D+xKUQF9iY2bjrJBxOUklv28wwzRmy5xvfEsI8RaQYmTM5+wQNSISxw+soN1AqP4LCQrZiFp mYWkZRbQdcwCmhLrd+lDlChKTOl+yA5ha0i0zpkLZVtJbJ/yiQ1ZzQJGjlWMfJZmeoaGJnqG phZ6RoZGmxjBKWXelR2Ml6d7HGIU4GBU4uHlm9QVI8SaWFZcmXuIUYKDWUmEd08gUIg3JbGy KrUoP76oNCe1+BCjNAeLkjivz/eOGCGB9MSS1OzU1ILUIpgsEwenVANjN9eyTNc55VP1D7yO i5lopfLZJPr7BRYTeb8y9X4D2W/e4We9NH1Vjt/dfDvEeW3C7S3TJvC2SPX5vBM/bST6VMDX Z0f+zGz17GfvwjbJPqwusX6REeb8sNx88qyjIbOlXH9P97kz/+z13LUTl5z6khnb8EEuqt7o 3Yvb0x7VGeRz//40n226EktxRqKhFnNRcSIAMIP3jiUDAAA= Archived-At: Subject: Re: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 18:07:30 -0000 --_000_CF331E2741BC47238F62057C9ADA96A9cablecomcastcom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 WWVhaCwgaXTigJlzIGEgdGlnaHQgdGltZWxpbmUgZm9yIHN1cmUuIEkga25vdyBmb3IgbXkgc2xp ZGVzIChJIGp1c3QgZGlkIGEgMXN0IGRyYWZ0KSBJ4oCZZCB0YWxrIGZvciAyIOKAkyAzIG1pbnMg YW5kIHRoZSByZXN0IGNhbiBiZSBRJkEuIEkgY291bGQgZW52aXNpb24gYSBzY2VuYXJpbyB3aGVy ZSBKaW0gYW5kIEkgZG8gb3VyIHNsaWRlcyBiYWNrLXRvLWJhY2ssIGFsbG93aW5nIGZvciAxMC0x NSBtaW5zIG9mIGRpc2N1c3Npb24gb24gdGhlIHR3by4NCg0KRnJvbTogRG9oIDxkb2gtYm91bmNl c0BpZXRmLm9yZz4gb24gYmVoYWxmIG9mIEVyaWMgUmVzY29ybGEgPGVrckBydGZtLmNvbT4NCkRh dGU6IFRodXJzZGF5LCBNYXJjaCAxNCwgMjAxOSBhdCAxMjo0OCBQTQ0KVG86IEppbSBSZWlkIDxq aW1AcmZjMTAzNS5jb20+DQpDYzogRG9IIFdHIDxkb2hAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTog W0RvaF0gV29ya2luZyBHcm91cCBTZXNzaW9uIEFnZW5kYSBAIFByYWd1ZQ0KDQoNCg0KT24gVGh1 LCBNYXIgMTQsIDIwMTkgYXQgODo0NiBBTSBKaW0gUmVpZCA8amltQHJmYzEwMzUuY29tPG1haWx0 bzpqaW1AcmZjMTAzNS5jb20+PiB3cm90ZToNCg0KDQo+IE9uIDE0IE1hciAyMDE5LCBhdCAxNToz NiwgRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPG1haWx0bzpla3JAcnRmbS4uY29tPj4gd3Jv dGU6DQo+DQo+IEdpdmVuIHRoZSBleHRyYW9yZGluYXJ5IGFtb3VudCBvZiBkaXNjdXNzaW9uIHRo ZXJlIGhhcyBhbHJlYWR5IGJlZW4gb24tbGlzdCwgaXQncyBoYXJkIHRvIGltYWdpbmUgaG93IHdl IGNvdWxkIHBvc3NpYmx5IHJlc29sdmUgdGhlc2UgaW4gMTAgbWludXRlcyBlYWNoLg0KDQpUcnVl LiBUaGF04oCZcyB3aHkgSSBzdWdnZXN0ZWQgaGF2aW5nIGZvY3VzZWQgZGlzY3Vzc2lvbnMgYWJv dXQgdGhlbSBvbiB0aGUgbGlzdC4gVGhlIGRpc2N1c3Npb25zIHRvIGRhdGUgaGF2ZSBnb25lIG9m ZiBhdCBhIHRhbmdlbnQgKG9yIHR3bykuDQoNCkhlcmXigJlzIHdoYXQgSSBzdWdnZXN0ZWQgZWFy bGllciB0b2RheToNCg0KSSB0aGluayB0aGUgcXVlc3Rpb25zIHRvIHJlc29sdmUgYXQgdGhlIFdH IGFyZToNCg0KMSkgQXJlIHRoZSBpc3N1ZXMgaWRlbnRpZmllZCBpbiBkcmFmdC1saXZpbmdvb2Qt ZG9oLWltcGxlbWVudGF0aW9uLXJpc2tzLWlzc3VlcyB2YWxpZC9yZWFzb25hYmxlIGFuZCBkb2Vz IHRoZSBXRyB3YW50IHRvIHdvcmsgb24gdGhlbT8NCjIpIEFyZSB0aGUgaXNzdWVzIGlkZW50aWZp ZWQgaW4gZHJhZnQtcmVpZC1kb2gtb3BlcmF0b3IgdmFsaWQvcmVhc29uYWJsZSBhbmQgZG9lcyB0 aGUgV0cgd2FudCB0byB3b3JrIG9uIHRoZW0/DQoNCkFuZCBpZiB0aGUgYW5zd2VycyB0byBxMSBv ciBxMiBhcmUgbm8sIHRoZSBmb2xsb3d1cCBxdWVzdGlvbiB3b3VsZCBiZToNCiAgICAgICAgd2hh dCwgaWYgYW55dGhpbmcsIG5lZWRzIHRvIGJlIGRvbmUgdG8gdGhlIGRyYWZ0KHMpIHRvIG1ha2Ug dGhlbSBXRyBjb21wYXRpYmxlPw0KDQoNCkkgaG9wZSB0aGUgV0cgY2FuIGNvbmNlbnRyYXRlIG9u IHRoZXNlIHF1ZXN0aW9ucyBpbiB0aGUgcnVuLXVwIHRvIFByYWd1ZS4NCg0KVGhhdCBzZWVtcy4u Li4gb3B0aW1pc3RpYy4uLiBidXQgaW4gYW55IGNhc2UsIHRoYXQgc3RpbGwgY2FsbHMgaW50byBx dWVzdGlvbiB3aHkgd2UgbmVlZCAyMCBtaW4gb2YgcHJlc2VudGF0aW9uIHRpbWUgZm9sbG93ZWQg YnkgZWZmZWN0aXZlbHkgbm8gdGltZSBmb3IgZGlzY3Vzc2lvbi4NCg0KLUVrcg0KDQo= --_000_CF331E2741BC47238F62057C9ADA96A9cablecomcastcom_ Content-Type: text/html; charset="utf-8" Content-ID: <7310744BA2D4D244AF989C98E670F36D@comcast.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJUaW1lcyBO ZXcgUm9tYW4gXChCb2R5IENTXCkiOw0KCXBhbm9zZS0xOjIgMTEgNiA0IDIgMiAyIDIgMiA0O30N Ci8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYu TXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5r LCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1 ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBl cmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0K CXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWww LCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdp bi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCgltc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZh bWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5 bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBl OmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJ e3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBpbiAxLjBpbiAxLjBpbjt9DQpk aXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5bGU+DQo8L2hl YWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2 IGNsYXNzPSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZToxNC4wcHQiPlllYWgsIGl04oCZcyBhIHRpZ2h0IHRpbWVsaW5lIGZvciBzdXJl LiBJIGtub3cgZm9yIG15IHNsaWRlcyAoSSBqdXN0IGRpZCBhIDE8c3VwPnN0PC9zdXA+IGRyYWZ0 KSBJ4oCZZCB0YWxrIGZvciAyIOKAkyAzIG1pbnMgYW5kIHRoZSByZXN0IGNhbiBiZSBRJmFtcDtB LiBJIGNvdWxkIGVudmlzaW9uIGEgc2NlbmFyaW8gd2hlcmUgSmltIGFuZCBJIGRvIG91ciBzbGlk ZXMgYmFjay10by1iYWNrLA0KIGFsbG93aW5nIGZvciAxMC0xNSBtaW5zIG9mIGRpc2N1c3Npb24g b24gdGhlIHR3by4gPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxNC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwv cD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBw dDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0O2NvbG9yOmJsYWNrIj5Eb2ggJmx0O2RvaC1i b3VuY2VzQGlldGYub3JnJmd0OyBvbiBiZWhhbGYgb2YgRXJpYyBSZXNjb3JsYSAmbHQ7ZWtyQHJ0 Zm0uY29tJmd0Ozxicj4NCjxiPkRhdGU6IDwvYj5UaHVyc2RheSwgTWFyY2ggMTQsIDIwMTkgYXQg MTI6NDggUE08YnI+DQo8Yj5UbzogPC9iPkppbSBSZWlkICZsdDtqaW1AcmZjMTAzNS5jb20mZ3Q7 PGJyPg0KPGI+Q2M6IDwvYj5Eb0ggV0cgJmx0O2RvaEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJq ZWN0OiA8L2I+UmU6IFtEb2hdIFdvcmtpbmcgR3JvdXAgU2Vzc2lvbiBBZ2VuZGEgQCBQcmFndWU8 bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPk9uIFRodSwgTWFyIDE0LCAyMDE5IGF0IDg6NDYgQU0gSmltIFJlaWQgJmx0OzxhIGhy ZWY9Im1haWx0bzpqaW1AcmZjMTAzNS5jb20iPmppbUByZmMxMDM1LmNvbTwvYT4mZ3Q7IHdyb3Rl OjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7 Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0 O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PGJyPg0KPGJyPg0KJmd0OyBPbiAxNCBNYXIgMjAxOSwgYXQgMTU6MzYsIEVyaWMgUmVzY29y bGEgJmx0OzxhIGhyZWY9Im1haWx0bzpla3JAcnRmbS4uY29tIiB0YXJnZXQ9Il9ibGFuayI+ZWty QHJ0Zm0uY29tPC9hPiZndDsgd3JvdGU6PGJyPg0KJmd0OyA8YnI+DQomZ3Q7IEdpdmVuIHRoZSBl eHRyYW9yZGluYXJ5IGFtb3VudCBvZiBkaXNjdXNzaW9uIHRoZXJlIGhhcyBhbHJlYWR5IGJlZW4g b24tbGlzdCwgaXQncyBoYXJkIHRvIGltYWdpbmUgaG93IHdlIGNvdWxkIHBvc3NpYmx5IHJlc29s dmUgdGhlc2UgaW4gMTAgbWludXRlcyBlYWNoLjxicj4NCjxicj4NClRydWUuIFRoYXTigJlzIHdo eSBJIHN1Z2dlc3RlZCBoYXZpbmcgZm9jdXNlZCBkaXNjdXNzaW9ucyBhYm91dCB0aGVtIG9uIHRo ZSBsaXN0LiBUaGUgZGlzY3Vzc2lvbnMgdG8gZGF0ZSBoYXZlIGdvbmUgb2ZmIGF0IGEgdGFuZ2Vu dCAob3IgdHdvKS48YnI+DQo8YnI+DQpIZXJl4oCZcyB3aGF0IEkgc3VnZ2VzdGVkIGVhcmxpZXIg dG9kYXk6PGJyPg0KPGJyPg0KSSB0aGluayB0aGUgcXVlc3Rpb25zIHRvIHJlc29sdmUgYXQgdGhl IFdHIGFyZTo8YnI+DQo8YnI+DQoxKSBBcmUgdGhlIGlzc3VlcyBpZGVudGlmaWVkIGluIGRyYWZ0 LWxpdmluZ29vZC1kb2gtaW1wbGVtZW50YXRpb24tcmlza3MtaXNzdWVzIHZhbGlkL3JlYXNvbmFi bGUgYW5kIGRvZXMgdGhlIFdHIHdhbnQgdG8gd29yayBvbiB0aGVtPzxicj4NCjIpIEFyZSB0aGUg aXNzdWVzIGlkZW50aWZpZWQgaW4gZHJhZnQtcmVpZC1kb2gtb3BlcmF0b3IgdmFsaWQvcmVhc29u YWJsZSBhbmQgZG9lcyB0aGUgV0cgd2FudCB0byB3b3JrIG9uIHRoZW0/PGJyPg0KPGJyPg0KQW5k IGlmIHRoZSBhbnN3ZXJzIHRvIHExIG9yIHEyIGFyZSBubywgdGhlIGZvbGxvd3VwIHF1ZXN0aW9u IHdvdWxkIGJlOjxicj4NCiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB3aGF0LCBpZiBhbnl0 aGluZywgbmVlZHMgdG8gYmUgZG9uZSB0byB0aGUgZHJhZnQocykgdG8gbWFrZSB0aGVtIFdHIGNv bXBhdGlibGU/DQo8YnI+DQo8YnI+DQo8YnI+DQpJIGhvcGUgdGhlIFdHIGNhbiBjb25jZW50cmF0 ZSBvbiB0aGVzZSBxdWVzdGlvbnMgaW4gdGhlIHJ1bi11cCB0byBQcmFndWUuPG86cD48L286cD48 L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5UaGF0IHNl ZW1zLi4uLiBvcHRpbWlzdGljLi4uIGJ1dCBpbiBhbnkgY2FzZSwgdGhhdCBzdGlsbCBjYWxscyBp bnRvIHF1ZXN0aW9uIHdoeSB3ZSBuZWVkIDIwIG1pbiBvZiBwcmVzZW50YXRpb24gdGltZSBmb2xs b3dlZCBieSBlZmZlY3RpdmVseSBubyB0aW1lIGZvciBkaXNjdXNzaW9uLjxvOnA+PC9vOnA+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tRWtyPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_CF331E2741BC47238F62057C9ADA96A9cablecomcastcom_-- From nobody Thu Mar 14 12:18:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5F44130DC0; Thu, 14 Mar 2019 12:18:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=verisign.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CXoDs1hZqTCD; Thu, 14 Mar 2019 12:18:16 -0700 (PDT) Received: from mail6.verisign.com (mail6.verisign.com [69.58.187.32]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9452B12DF72; Thu, 14 Mar 2019 12:18:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=verisign.com; l=7001; q=dns/txt; s=VRSN; t=1552591095; h=from:to:subject:date:message-id:mime-version; bh=POeX1bcpfsfWFVsO//z7n3Jxv0XQGDaA0N6w9/EPvVg=; b=BLwZfjGul19JKNqg2fsMPqLjvQS9unjrbJltcxKP+u2xsPvJC6NOwnDn hc+RxLe+/zI/Tz7QR457nKxXxtIi3quChpHAEj1oJ1ogYrvBgw8RRFo5s 2VPsomgN7LHSkSmkhPc5BV/dMxe944ooYtsw+KClSxhK3WJLlRfzNKseT Wit1bE+WJ0kZNVHyr2RAIcqhWah7YU3n7U6O7VJ+zzGeasmiG78k0HWOm 3MN/2AZLqt+0DMG0iI8rEww/5tuUUrmh5FcM+KaesSSPD5QiHYir80F6o 1tYDnp+kk7vA66tbp7vyf9xC0P25uwiw9ShSH8dYjsekC+n+qm+swNLpH w==; X-IronPort-AV: E=Sophos;i="5.58,479,1544504400"; d="scan'208,217";a="7163827" IronPort-PHdr: =?us-ascii?q?9a23=3AzRqJJRNoVON6cA3Ry/Ml6mtUPXoX/o7sNwtQ0K?= =?us-ascii?q?IMzox0I//5rarrMEGX3/hxlliBBdydt6sczbKP+4nbGkU4qa6bt34DdJEeHz?= =?us-ascii?q?Qksu4x2zIaPcieFEfgJ+TrZSFpVO5LVVti4m3peRMNQJW2aFLduGC94iAPER?= =?us-ascii?q?vjKwV1Ov71GonPhMiryuy+4ZLebxhUiDanfb9+MQi9oBnMuMURnYZsMLs6xA?= =?us-ascii?q?HTontPdeRWxGdoKkyWkh3h+Mq+/4Nt/jpJtf45+MFOTav1f6IjTbxFFzsmKH?= =?us-ascii?q?w65NfqtRbYUwSC4GYXX3gMnRpJBwjF6wz6Xov0vyDnuOdxxDWWMMvrRr0yRD?= =?us-ascii?q?+s7bpkSAXwhSkHKTA37X3XhMJzgq1VoRKuuxNwzpXOb42JMfpzZL/RcMkYSG?= =?us-ascii?q?dHQ81fVzZBAoS5b4YXAeYPP/hXr4/gqFQQtxu+Hg6sBOX3xjRVg3H5x7c60+?= =?us-ascii?q?AvHQrb2wEuGtAAv2rSrNroKqgSS/u1zK7OzTjYcfNZxy396InTchAgrvGMW6?= =?us-ascii?q?h8ftbWyUkqDg7IiEibp4/9Pz6Ny+gBr3KX4/diWO+hkWIrtgF8rza1ysojjo?= =?us-ascii?q?TFnp8Zxkze+Slkwos5Oce0RFN0bNOnCpdcqiKXO5N4Qsw8QGxkpCM3x7gEtJ?= =?us-ascii?q?GnYCQF0pEqywPDZPObdoWF4g/sW/ifITp9gH9qZa+wiAi0/EO90OPzTNO030?= =?us-ascii?q?xPriddl9nMsW0C2ALL58icT/t94l+h2TGS1wDP8u1EIV47la7cK5M537M+io?= =?us-ascii?q?IdvVnDESHul0v5jbOaels+9ui29+vnZa/mpoeGO4Bulw7yKLoumtakAeQ+KA?= =?us-ascii?q?QBQ2+b+eGk2L3i+032XqlKg+UrnqXFqpzWOMYWq6CjDwNI0osu5QyzAjii3d?= =?us-ascii?q?gAmHkINlNFeBaJj4jzPFHOJej1A/K9jVuyljdk2u7JPqf6ApXKKHjOi6nhcq?= =?us-ascii?q?hn605d0wozzN9f55ROBr4dJ/LzX1f9tMbEAR8hLwy03+HnBc1g2YMYQmKDG7?= =?us-ascii?q?eZMLnTsV+W/O0gP+mNaZQUuDnjN/gl6eTijXgjmV8SZaOpx4cYaGikHvR6JE?= =?us-ascii?q?WUeWfjgtABEWoRvwoxUvDqiFOYXT5UfXayUPF02jZuQo6gFsLbXIGzibeQ9C?= =?us-ascii?q?a2ApMQYXpJQBjYHXHzMp2eWukFYzO6I8J9nHoDT7f3D8dr2RaunA7317QhKf?= =?us-ascii?q?DbsGVMuZXj/Nl4++OVkgs9o29aFcOYhiutQmd4k3kTQDlylIN2u0g3ggOg8a?= =?us-ascii?q?V+j/FCDttVz+1ESAYhNJHaied9DoahCUr6Yt6VRQP+EZ2dCjYrQ4dpzg=3D?= =?us-ascii?q?=3D?= X-IPAS-Result: =?us-ascii?q?A2GOCACXqIpc/zGZrQpkH4F4gQ6BWRGBNIQBkxCGFZRWF?= =?us-ascii?q?IFnDAEThHKEXDQJDQEBAwEBAQgBAwIBAQKBEYI6IoMZaAFKAgQwJwQBJoMOA?= =?us-ascii?q?YERrjWBL4VGhG2BL4EKh1qEIT6BOB+HESaDIDGCJgOMUoQMHpNEAwYCi1WHY?= =?us-ascii?q?ZNMin+SaAIEAgQFAhWBR4IPcHoBgkKCFReOHpAagR8BAQ?= Received: from BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) by BRN1WNEX02.vcorp.ad.vrsn.com (10.173.153.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.1713.5; Thu, 14 Mar 2019 15:18:13 -0400 Received: from BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde]) by BRN1WNEX02.vcorp.ad.vrsn.com ([fe80::7c0a:1cc:5def:9dde%4]) with mapi id 15.01.1713.004; Thu, 14 Mar 2019 15:18:13 -0400 From: "Henderson, Karl" To: "dns-privacy@ietf.org" , "doh@ietf.org" Thread-Topic: Authoritative DoT or DoH Thread-Index: AQHU2pqrpJ4BZOcvCk2kB7Aw5+rcZw== Date: Thu, 14 Mar 2019 19:18:13 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.7.190210 x-originating-ip: [10.170.148.18] Content-Type: multipart/alternative; boundary="_000_C8284F2DF46A484EA14599C0D8ADBC58verisigncom_" MIME-Version: 1.0 Archived-At: Subject: [Doh] Authoritative DoT or DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 19:18:18 -0000 --_000_C8284F2DF46A484EA14599C0D8ADBC58verisigncom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SW4gdGhlIGxhc3QgY291cGxlIG9mIGRheXMgdGhlcmUgaGFzIGJlZW4gYSBsb3Qgb2YgYWN0aXZp dHkgY29uY2VybmluZyBETlMgb3ZlciBIVFRQUyAoRG9IKSAtIEhvZmZtYW4gYW5kIEFsaWJhYmEg cHJlc2VudGF0aW9ucyBhdCBJQ0FOTiBhbmQgSUVURiBkcmFmdHM6IGRyYWZ0LXJlaWQtZG9oLW9w ZXJhdG9yL2RyYWZ0LWxpdmluZ29vZC1kb2gtaW1wbGVtZW50YXRpb24tcmlza3MtaXNzdWVzL2Ry YWZ0LWJldG9sYS1iY3AtZG9oLWNsaWVudHMuDQoNClRoZXNlIGRpc2N1c3Npb25zIGhhdmUgZm9j dXNlZCBvbiBEb0ggZm9yIGNsaWVudCAodHlwaWNhbGx5IHdlYiBicm93c2VyKSBjb21tdW5pY2F0 aW9uIHdpdGggcmVjdXJzaXZlIHJlc29sdmVycywgYW5kIGl0cyBjb21wYXJpc29ucyB3aXRoIERv VCBmb3IgdGhpcyBwdXJwb3NlLg0KDQpJcyB0aGVyZSBhbnkgY29tcGVsbGluZyByZWFzb24gYXQg dGhpcyBwb2ludCB0byBiZSBjb25zaWRlcmluZyBEb0ggZm9yIHJlY3Vyc2l2ZSByZXNvbHZlci10 by1hdXRob3JpdGF0aXZlIG5hbWUgc2VydmVyIGNvbW11bmljYXRpb25zPw0KDQpBcyBJIG5vdGVk IGF0IHRoZSBEUFJJVkUgaW50ZXJpbSBtZWV0aW5nLCB0aGUgd29ya2luZyBncm91cCBuZWVkcyBl bXBpcmljYWwgc3R1ZGllcyBsb29raW5nIGF0IHBlcmZvcm1hbmNlIGFuZCBhdHRhY2sgdmVjdG9y cyBmb3IgYXV0aG9yaXRhdGl2ZSBETlMgZW5jcnlwdGlvbi4NCg0KVW5sZXNzIHRoZXJlIGFyZSBj b21wZWxsaW5nIHJlYXNvbnMgdG8gY29uc2lkZXIgQXV0aG9yaXRhdGl2ZSBEb0gsIEkgcHJvcG9z ZSB0aGUgd29ya2luZyBncm91cCBmb2N1cyBpdHMgYXV0aG9yaXRhdGl2ZSBETlMgZW5jcnlwdGlv biBhc3Nlc3NtZW50cyBhcm91bmQgQXV0aG9yaXRhdGl2ZSBEb1QuDQoNCkluIHN1cHBvcnQsIEkg YW0gd2lsbGluZyB0byBjby1hdXRob3IgYW4gQXV0aG9yaXRhdGl2ZSBEb1Qgb3BlcmF0aW9uYWwg Y29uc2lkZXJhdGlvbiBkcmFmdCBpbiBvcmRlciB0byBvdXRsaW5lIHRoZSBvcGVyYXRpb25hbCBj aGFsbGVuZ2VzIHRoZSBjb21tdW5pdHkgbmVlZHMgdG8gYWRkcmVzcyAtIHNpbWlsYXIgdG8gdGhl IGRyYWZ0LXJlaWQtZG9oLW9wZXJhdG9yIGRyYWZ0IGJldHdlZW4gY2xpZW50IGFuZCByZWN1cnNp dmUuDQoNCg== --_000_C8284F2DF46A484EA14599C0D8ADBC58verisigncom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYzQzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9 DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpz cGFuLkVtYWlsU3R5bGUxNw0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1jb21wb3NlOw0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bh bi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UNCgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVk LXNwYWNlO30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0K CXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4waW47fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9o ZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0RjcyIj4N CjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+SW4gdGhlIGxhc3QgY291cGxlIG9m IGRheXMgdGhlcmUgaGFzIGJlZW4gYSBsb3Qgb2YgYWN0aXZpdHkgY29uY2VybmluZyBETlMgb3Zl ciBIVFRQUyAoRG9IKSAtIEhvZmZtYW4gYW5kIEFsaWJhYmEgcHJlc2VudGF0aW9ucyBhdCBJQ0FO TiBhbmQmbmJzcDtJRVRGIGRyYWZ0czombmJzcDtkcmFmdC1yZWlkLWRvaC1vcGVyYXRvci9kcmFm dC1saXZpbmdvb2QtZG9oLWltcGxlbWVudGF0aW9uLXJpc2tzLWlzc3Vlcy9kcmFmdC1iZXRvbGEt YmNwLWRvaC1jbGllbnRzLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+VGhlc2UgZGlzY3Vzc2lvbnMgaGF2ZSBmb2N1c2Vk IG9uIERvSCBmb3IgY2xpZW50ICh0eXBpY2FsbHkgd2ViIGJyb3dzZXIpJm5ic3A7Y29tbXVuaWNh dGlvbiB3aXRoIHJlY3Vyc2l2ZSByZXNvbHZlcnMsIGFuZCBpdHMgY29tcGFyaXNvbnMgd2l0aCBE b1QgZm9yJm5ic3A7dGhpcyBwdXJwb3NlLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+SXMgdGhlcmUgYW55IGNvbXBlbGxp bmcgcmVhc29uIGF0IHRoaXMgcG9pbnQgdG8gYmUgY29uc2lkZXJpbmcgRG9IIGZvciZuYnNwO3Jl Y3Vyc2l2ZSByZXNvbHZlci10by1hdXRob3JpdGF0aXZlIG5hbWUgc2VydmVyIGNvbW11bmljYXRp b25zPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBw dDtjb2xvcjpibGFjayI+QXMgSSBub3RlZCBhdCB0aGUgRFBSSVZFIGludGVyaW0gbWVldGluZywg dGhlIHdvcmtpbmcgZ3JvdXAgbmVlZHMgZW1waXJpY2FsIHN0dWRpZXMgbG9va2luZyBhdCBwZXJm b3JtYW5jZSBhbmQgYXR0YWNrIHZlY3RvcnMgZm9yJm5ic3A7YXV0aG9yaXRhdGl2ZSBETlMgZW5j cnlwdGlvbi48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox MS4wcHQ7Y29sb3I6YmxhY2siPlVubGVzcyB0aGVyZSBhcmUgY29tcGVsbGluZyByZWFzb25zIHRv IGNvbnNpZGVyIEF1dGhvcml0YXRpdmUgRG9ILCBJJm5ic3A7cHJvcG9zZSB0aGUgd29ya2luZyBn cm91cCBmb2N1cyBpdHMgYXV0aG9yaXRhdGl2ZSBETlMgZW5jcnlwdGlvbiZuYnNwO2Fzc2Vzc21l bnRzIGFyb3VuZCBBdXRob3JpdGF0aXZlIERvVC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdDtjb2xvcjpibGFj ayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Y29sb3I6YmxhY2siPkluIHN1cHBvcnQsIEkgYW0g d2lsbGluZyB0byBjby1hdXRob3IgYW4gQXV0aG9yaXRhdGl2ZSBEb1Qgb3BlcmF0aW9uYWwmbmJz cDtjb25zaWRlcmF0aW9uIGRyYWZ0IGluIG9yZGVyIHRvIG91dGxpbmUgdGhlIG9wZXJhdGlvbmFs IGNoYWxsZW5nZXMgdGhlJm5ic3A7Y29tbXVuaXR5IG5lZWRzIHRvIGFkZHJlc3MgLSBzaW1pbGFy IHRvIHRoZSBkcmFmdC1yZWlkLWRvaC1vcGVyYXRvciZuYnNwO2RyYWZ0DQogYmV0d2VlbiBjbGll bnQgYW5kIHJlY3Vyc2l2ZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_C8284F2DF46A484EA14599C0D8ADBC58verisigncom_-- From nobody Thu Mar 14 12:51:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B828B13117F; Thu, 14 Mar 2019 12:50:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FJPTXsOm9PVN; Thu, 14 Mar 2019 12:50:49 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5524C1310F7; Thu, 14 Mar 2019 12:50:49 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 09571892C6; Thu, 14 Mar 2019 19:50:49 +0000 (UTC) From: Paul Vixie To: dnsop@ietf.org, hrpc@irtf.org Cc: doh@ietf.org Date: Thu, 14 Mar 2019 19:50:46 +0000 Message-ID: <5105495.cfdlLhXNj9@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <4425132.CsHbCTgi9Z@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 19:50:51 -0000 i've removed "dns-privacy@ietf.org" from the CC headers, at the WG chair's request. note, the main topic of this message is DNS privacy's implications. On Thursday, 14 March 2019 17:50:44 UTC Vinicius Fortuna [vee-NEE-see.oos] wrote: > Paul, I'm trying to understand your scenario. > > If you ran your own DoH server in your network (doing RDNS or whatnot), and > the DoH server is distributed to clients via DHCP + a protocol upgrade > mechanism, would that address the concerns you are listing? > > Vinicius Fortuna no. the new risk intended by DoH comes from its expected ubiquity. two of its design assumptions are wrong. one wrong assumption is that all users and apps operating inside my network deserve rdns service from third parties that is invisible to me (as network operator) and which is therefore subject to neither my surveillance nor my control. it turns out that some users are intruders and some apps are malware, and i do not want them to have the capability of invisible third party rdns. the second wrong assumption is that all on-path interferers have ill intent and do not deserve to surveil or control their network's rdns. as a parent, my interest in monitoring and control of the control plane used by my family, including rdns, is not a matter to be litigated against IETF consensus. the same thing happens at a larger scale in my corporate network. so, no DoH service i can add would have any impact on the intended risks of DoH. i may offer it anyway, for clients who can't use DoT. but for my actual purposes both a user of networks and an operator of networks, DoT is both sufficient and better. my costs to mitigate the risks intended by DoH will in some cases be cheap, like enumerating the so-called "public DNS" providers who offer it, and blocking them at my IP firewall. DoH risk mitigation costs will be much higher for me when DoH is offered by an IP that i have other business with, for example if i need access to a google API or service, and the same IP also offers DoH. there, i'll have to run a tls proxy, and break any client who tries to use outbound TCP/443 directly. many people here have mistakenly asserted that i had that risk anyway, and that this mitigation cost should already be on my ledger. this is mistaken for two reasons, both of which owe to security economics. first, because some of my networks have an outbound TCP/443 whitelist which may have included IP addresses i previously thought i could trust not to offer invisible third party rdns to intruders or malware (or children) on my network. second, because some of my networks only close the barn door after badness has passed through -- that is, the IP blacklist is amended after a detection event, since whitelisting wasn't feasible. defense that only works in the future is still quite a bit better than defense that will not work in the future. DoH, by intending to be invisible inside flows i already accept, will raise my defense costs, forever. so, the costs of proxying TCP/443 to well known IP addresses was not already on my ledger, but must be now, and will have far-reaching effects. not all agents (users and apps) inside my network are friendly and trusted, nor can they be expected to use DoH only when MDM tells them it is ok. not all network operators who monitor or control their rdns are unfriendly or untrustworthy. DoH is intended to be, and is, a security economics disaster for edge network operators. vixie From nobody Thu Mar 14 13:10:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4690E128AFB; Thu, 14 Mar 2019 13:10:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i8ScIuC2_70P; Thu, 14 Mar 2019 13:10:03 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08F541277DE; Thu, 14 Mar 2019 13:10:02 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id A3AAF6A295; Thu, 14 Mar 2019 21:10:00 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552594200; bh=TU6jR6sYGs+YPGAnuVElGELx5Y9CgvkPn+gsYi9fMD0=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=hQQPkhOX906qGmOqgsKxWt9ywvRsN+Pc7sonvcApEqkYKrtw3Uke87q7adJ6SO8ZI y/9aUywrUQUd9ep1od0j/S7lq/DCiUBhfUCmlAWhmKuJTM/iVeedRETGhTCFTbBMg4 WYpj5VfXjsTLztsmY6bYfpRVx9sENA1InWN40RYDdTeVjVIvHZCQPTO6DsTVEy68xk VRr93xhjF7tu9CuTEEggNnguCbuguWSY3Va96ou72EmqZl/7K8PHfiieJ9bfUmu9Ls kPQpsKVQdSQulpcGMDTE1oTEgT1hjtnKKr6SLzJGKrmzwS5cITkA6BQZnWkBDJqEgu CIIgR2wB00lYw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 94F423C06E9; Thu, 14 Mar 2019 21:10:00 +0100 (CET) Date: Thu, 14 Mar 2019 21:10:00 +0100 (CET) From: Vittorio Bertola To: Stephen Farrell Cc: doh@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <2135705037.762.1552594200563@appsuite.open-xchange.com> In-Reply-To: <6a6b463c-0e67-c0cd-ca12-ea3dd298c401@cs.tcd.ie> References: <20190311170218.o5hitvysuefhjjxk@nic.fr> <1829067625.16839.1552327024048@appsuite.open-xchange.com> <20190312090142.s32hdimbozsrbovt@nic.fr> <2044747.4WdMZHU4Qz@linux-9daj> <897EAAF7-0EF8-484A-B785-E4C46FCFA87F@fl1ger.de> <6a6b463c-0e67-c0cd-ca12-ea3dd298c401@cs.tcd.ie> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [hrpc] [DNSOP] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 14 Mar 2019 20:10:06 -0000 > Il 14 marzo 2019 alle 15.53 Stephen Farrell ha scritto: > > Hiya, > On 14/03/2019 14:41, Ralf Weber wrote: > > the DoH protocol caused some application providers to experiment with > > switching resolution per default away from OS and the local network provider > > I wasn't aware that some application provider was doing this > as their default (assuming that's what "per default" means). > Can you provide details? > > I am aware of what FF/CF have done but I don't believe that > was on by default. What caused all this fuss is that they did not turn it on by default, but they publicly said they "would like" to do it in the future, here (at the end, "what is the status"): https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/ and also here, more or less at half the text, they say "Firefox does not *yet* use DoH by default" (asterisks are mine): https://blog.nightly.mozilla.org/2018/06/01/improving-dns-privacy-in-firefox/ Mozilla also had several calls with concerned parties in which they were asked to clarify, and they confirmed that while they are considering all the feedback, this is still in their plans for the future. So we are not all having hallucinations here :-) and even if Mozilla decided to announce that their plans are changed and that idea is now off the table, which has not happened yet, now everyone is aware that this could be done by any application at any time in the future; so, speaking from a policy perspective, it would be nice to agree (if possible) that that is a bad idea, at least if certain conditions are not met, and record that consensus somewhere. It would not prevent anyone from doing something else if they want, but that's true of any standard; but it would at least provide some guidance for well behaved application makers. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Thu Mar 14 19:22:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DC1A127817 for ; Thu, 14 Mar 2019 19:22:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=A5UTJbCC; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=jrGuyMq/ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K-Lh1WO8tjqT for ; Thu, 14 Mar 2019 19:22:06 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F41631277D9 for ; Thu, 14 Mar 2019 19:22:05 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 213EE21EFE for ; Thu, 14 Mar 2019 22:22:05 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Thu, 14 Mar 2019 22:22:05 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm1; bh=ddX1x x8vX1aONmGgEKVeg5Bia0UjvOPB6omFfdQG8fg=; b=A5UTJbCCrv/NJ8/W15lv/ szv3yLN/hS8qonHXc2Iciy4VgfVuNNJWgjWFCzrJVnZHZ5L5sEeBW7NgVEgOBuPq 5ul/3QL86PNfxNjP8ww7VLxHCfsYyaQ1vGYApzjA4dY+Lw1Nd0ADxsUGHdJ0fH9L 38eM2KA3FzMghK1kymiZr87ZDvmXdRHVigjYJFbnD7f+I1cM5/InC/T409Dg1PoB 4TnSDspf/XhgdpIdBWqDdxkcR/ZNcAxhWXqvTaU4oV2CNN+Us10DZjZmXGF31TpE PsTQYYMLnXcLMiDhKr5KNPhmOIDpSpohGdqkjsXbUyvhFywW4IRa8wOL2slpNI1I g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=ddX1xx8vX1aONmGgEKVeg5Bia0UjvOPB6omFfdQG8 fg=; b=jrGuyMq/wOGAFNAtIrKY8ytPeuQZ7JvpxwKnDs2/xxUKNGPY0WLIxPZF8 o5aC/xWmE5pvFM75JKMBy3WbAm2Kvk1o5Ig/2qP0dRzjjQQBw5l2oXXyb+V0kQdz 5wTnDsMrzUpyoF567fjNeFQHPI1diU/amR0Rez82yhSF8wG2SDRUvr24Gj2CEKRk 82a/5hegD8HuRJlmewJu5GQLGUb4MlLayXX3b0lC4EinQRCvA4nPnDe+32TObOO3 hEbkIbIM/BI/+5moOQJ29hPpaN2tPEmQD7Lx2/YMndxEyxTZ6aIZcXJTFavCy0Wp D8sK+3V2gR8WxoX7wI4k7P8g43qMg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrheeggddulecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehloh ifvghnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 831877C1B7; Thu, 14 Mar 2019 22:22:04 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> In-Reply-To: References: Date: Thu, 14 Mar 2019 22:19:59 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [Doh] =?utf-8?q?Captive_portals_=28was_Re=3A__suggested_slides_f?= =?utf-8?q?or_IETF_104_on_draft-reid-doh-operator=29?= X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 02:22:08 -0000 Thanks for sharing the slides Jim, (As an aside, the parallels between your summary of the draft and draft-= mm-wg-effect-encrypt are striking.) There are lots of *things* on your list, but maybe it would help to look= at a few in more detail to see what they teach us. I happen to chair a= working group that is tasked with improving the captive portal situatio= n, so I thought I'd start there because it's first on your list too. The first thing I observe is that the story could be different depending= on where the remote resolver is configured. In particular, whether you= consider the configuration of an remote, encrypted resolver to be syste= m-wide or per-application. Captive portal detection is typically done at a system level, and so the= system-wide configuration would seem to be most relevant to this partic= ular issue. That is, unless the network manages to successfully evade t= he various captive portal detection mechanisms in the hopes that they ca= n somehow present information in the browser, which I'll get back to. As I've learned, operating systems typically use very different network = configuration during the captive portal detection phase, and most won't = be applying encrypted DNS policies until they have first validated the n= etwork is "usable". So I would expect that even if the operating system= is configured to use an encrypted DNS service other than the one the ne= twork provides, it would still use the network-provided service while it= is bootstrapping. For instance, I understand that Android uses the net= work resolver to discover the IP address of its DoT/DoH resolver (Ben ca= n probably clarify/correct me here). If the network decides to evade captive portal detection, then it is pla= ying roulette. Most applications now use authenticated connections to s= ervices, and so do many websites. A DNS redirection is no more effectiv= e in these circumstances than a port 80 interception[1]. The applicatio= n detects the "attack" and throws up errors. That can lead to the opera= ting system concluding that the network is broken if applications report= these errors. If you are lucky and it is a web browser that first make= s a connection and that connection is to a site without HSTS, then the n= etwork gets a chance to show a web page. I shouldn't need to quote stat= s on app vs. browser usage and proportion of HTTPS on the web to make it= clear that this playing this game has increasingly bad prospects. If this is a per-application configuration, then only those applications= that are configured to use remote, encrypted resolvers are affected. T= hey fail to get the modified DNS results, but all the other problems sti= ll exist. That makes me conclude that captive portals aren't any worse off as a re= sult of operating systems or applications choosing to configure their ow= n encrypted resolver service. Given that using DNS for captive portals = is worse than alternative methods[1], I'd suggest that we not concern ou= rselves with this particular problem. Cheers, Martin [1] Spoofing DNS results for captive portals poisons the cache, which ma= kes DNS rewriting a bad choice for this use case. This is - in part - w= hy most captive portals intercept TCP on port 80 and spoof an HTTP 302 i= nstead. And if you consider DNSSEC-validating endpoints, that would be = another reason not to spoof DNS... if those existed in any significant n= umbers. On Fri, Mar 15, 2019, at 03:39, Jim Reid wrote: > Here=E2=80=99s what I plan to present at the WG. Please comment on the= list if=20 > you have questions or suggestions. From nobody Thu Mar 14 19:27:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2A5312782C for ; Thu, 14 Mar 2019 19:27:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=MaPu2j5l; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Cm1q97C3 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X-_MDFM-y5PI for ; Thu, 14 Mar 2019 19:27:40 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E6CD11277D9 for ; Thu, 14 Mar 2019 19:27:39 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id E1C0721EAD for ; Thu, 14 Mar 2019 22:27:38 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Thu, 14 Mar 2019 22:27:38 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=7brwWLCCtn3em6Vt5Vt0MvnW9DtgNAX hypLAYzmurr4=; b=MaPu2j5ltUCBoSxtLE2XJy9i7xm435Zm4Xnoaa1a1RoVruC vWOg2TRYy3jsm7wRjAjefk3Ro2ZeXSHfzPRTJRdbiumQ7w4westp6KjpeArP2pxz cHP11Z8eF7xtNKSbYl9lmr2a1edgLWcHt1fblsQzPPz+mzPjysSPu6rFf2xz6PCA 5Mfikb4+hsdhWxIwpEClIUxmssXn+S1O+DyACcNRiTcaJij3QycPZtK/VlrwAhHj g2+m2WPD0YbcDpZNOSVRCN+sZRGJ6GrtG9rPtMqyUxhLUFbZaHc5KqHnMYP2yNVi Gd722ddYjqCGHxfn9+iDLOIl+3NB9CUA6ksBQFw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=7brwWL CCtn3em6Vt5Vt0MvnW9DtgNAXhypLAYzmurr4=; b=Cm1q97C3fin9CIc8SheTHr v5Qeol2RMxO1gwVQt55cG3+A4bJNzmFOy4sEvXm5DMCe4fvw6YwvR/ljs3f//G9H xq5jxsFAeIUyn14lRSkCTZGH9aO/yeCplqapbJHyo1c+zLLJz0ztbraSmR/u1m82 VhMYBeM7o2sJH16qJ/jenPbvyWRejQjaejTmIOjWNil34UXCbNgsnM0WPE4JkpSQ fomfyBTcbCJlxyE/vgzhQ0RyNpeFJQemcEPYaWUIMFRn8O2NuhmA4Yu5MYGGMUU2 4YUmLaSQ4CKwO6keYcFVlZN/iuWRBqh0rtBeT/O5JOv8qgPXDHjiLog5wIbYswGg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrheeggddvtdcutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehivghtfhdrohhrghenucfrrghrrg hmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhushht vghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 5D7A27C5FB; Thu, 14 Mar 2019 22:27:38 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com> In-Reply-To: References: Date: Thu, 14 Mar 2019 22:27:39 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] Authoritative DoT or DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 02:27:42 -0000 There is far less reason to use DoH for connections to authoritative servers. DoT seems far more appropriate (than both DoH and the unencrypted variants). I expect there to be a lot of discussion about DoS (not DNS over SCTP, sadly) and load management in any such document. I don't see much of the stuff that has generated so much heat lately to be relevant in the authoritative context. On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote: > > In the last couple of days there has been a lot of activity concerning > DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN and > IETF drafts: > draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issues/draft-betola-bcp-doh-clients. > > > These discussions have focused on DoH for client (typically web > browser) communication with recursive resolvers, and its comparisons > with DoT for this purpose. > > > Is there any compelling reason at this point to be considering DoH for > recursive resolver-to-authoritative name server communications? > > > As I noted at the DPRIVE interim meeting, the working group needs > empirical studies looking at performance and attack vectors for > authoritative DNS encryption. > > > Unless there are compelling reasons to consider Authoritative DoH, I > propose the working group focus its authoritative DNS encryption > assessments around Authoritative DoT. > > > In support, I am willing to co-author an Authoritative DoT operational > consideration draft in order to outline the operational challenges the > community needs to address - similar to the draft-reid-doh-operator > draft between client and recursive. > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > From nobody Thu Mar 14 20:01:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 97977130F29 for ; Thu, 14 Mar 2019 20:01:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MyV0DX5HUnjA for ; Thu, 14 Mar 2019 20:01:08 -0700 (PDT) Received: from mail-ua1-x931.google.com (mail-ua1-x931.google.com [IPv6:2607:f8b0:4864:20::931]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 70FA8129524 for ; Thu, 14 Mar 2019 20:01:08 -0700 (PDT) Received: by mail-ua1-x931.google.com with SMTP id s15so2653646uap.6 for ; Thu, 14 Mar 2019 20:01:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vAv0/eT35i5P1OlsMgsGv6Y55BBKlSyzNZRDzlppXy0=; b=iZiQPIsKc/YgSpyddPucsE3LvJCxP0AdBXijVRaUR6vz82KlsFBlhc6BGeXrnCGNMt izqUjr3rPuVwhukqq+uXE8sE+rgMYVnCyll0L5n79qdB3ZQy7j13U659XYky2LRjnW5F RNCReL+cPtOAHUFBF3iJDaKpfZ/QC3LGYmwiutlfTxkd1zjupx1T7Q60KFOwB0cTrQaD v8B3yd8A/b28QCtB+gxR12frsJA0TvRqfyuxQEHpukTwFw3UnvbMMzmGutDyPAcWYtz4 NGTgg4M/6nHPE9iUVeTzjKkaPCVtHp4X606APoIkb4FahIWWQfW7Uz/dn5QoAnrnTeet BuRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vAv0/eT35i5P1OlsMgsGv6Y55BBKlSyzNZRDzlppXy0=; b=pe6HPSWtzgJrs7zvAJeKPiDuzOddsG9FVslZSOhErRH/Uv3DYehEMOYvyyxHhvJyDJ BxFw+hntnvi6X8PIUpTydBXziF6S+MVTshaoZpnOkQwMWRcTvHeFfceyWA9rxQWUjCk4 iqAT7BzhYJd4DHGAMJQ7uMmcAumDUMPlz1zT7cBFrra+OQ21gvFs5Efqs8l8BS5pv/jW 5OYa8EyVo3OoksZ6Yqv6hKZe2S00sZiPbThlwpuwW5QO3vGFDdGJnJNPU7o3rZvsAC1b DeMhCSkkhd48TdjVxxXmYBs/kEUYerqf75ofVrzQAu+7afCcUeQ5rkREWuq4VhLiixNN mn3g== X-Gm-Message-State: APjAAAVs/nHhL195u0PRkg9HcaSsjiankZAnrOBKczhvmDi/2PylBCRU Sc5sTv5Hl2bWx6CCPXxIJlUVw1FSGmcV97aHP10ROwN3fio= X-Google-Smtp-Source: APXvYqwQt62JFkLCDuQr+Q2qMR7V9nMExyY4DjnBOoVIENVUo+6FceOpqz95V0iFhkO+CMszZ+nMpvlEJr/0ED1fYUc= X-Received: by 2002:ab0:6819:: with SMTP id z25mr7685160uar.0.1552618867189; Thu, 14 Mar 2019 20:01:07 -0700 (PDT) MIME-Version: 1.0 References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> In-Reply-To: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> From: Ben Schwartz Date: Thu, 14 Mar 2019 23:00:56 -0400 Message-ID: To: Martin Thomson Cc: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000138e350584194088" Archived-At: Subject: Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 03:01:12 -0000 --000000000000138e350584194088 Content-Type: multipart/alternative; boundary="0000000000000d519005841940fe" --0000000000000d519005841940fe Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Mar 14, 2019 at 10:22 PM Martin Thomson wrote: > Thanks for sharing the slides Jim, > > (As an aside, the parallels between your summary of the draft and > draft-mm-wg-effect-encrypt are striking.) > > There are lots of *things* on your list, but maybe it would help to look > at a few in more detail to see what they teach us. I happen to chair a > working group that is tasked with improving the captive portal situation, > so I thought I'd start there because it's first on your list too. > > The first thing I observe is that the story could be different depending > on where the remote resolver is configured. In particular, whether you > consider the configuration of an remote, encrypted resolver to be > system-wide or per-application. > > Captive portal detection is typically done at a system level, and so the > system-wide configuration would seem to be most relevant to this particul= ar > issue. That is, unless the network manages to successfully evade the > various captive portal detection mechanisms in the hopes that they can > somehow present information in the browser, which I'll get back to. > > As I've learned, operating systems typically use very different network > configuration during the captive portal detection phase, and most won't b= e > applying encrypted DNS policies until they have first validated the netwo= rk > is "usable". So I would expect that even if the operating system is > configured to use an encrypted DNS service other than the one the network > provides, it would still use the network-provided service while it is > bootstrapping. For instance, I understand that Android uses the network > resolver to discover the IP address of its DoT/DoH resolver (Ben can > probably clarify/correct me here). > Yes, if the user has specified a DoT resolver, Android resolves that name through the network's default DNS server. Specifically, Android simulates a parallel version of the network configuration that is used for captive portal login and DoT bootstrap, but is not accessible to normal apps. This version may be used even after login succeeds, in order to handle "captive portal snapback" (e.g. session expiration). The Chrome team has also been prioritizing correct functioning with captive portals on all supported platforms. I don't foresee DoH implementation causing any significant regression. > If the network decides to evade captive portal detection, then it is > playing roulette. Most applications now use authenticated connections to > services, and so do many websites. A DNS redirection is no more effectiv= e > in these circumstances than a port 80 interception[1]. The application > detects the "attack" and throws up errors. That can lead to the operatin= g > system concluding that the network is broken if applications report these > errors. If you are lucky and it is a web browser that first makes a > connection and that connection is to a site without HSTS, then the networ= k > gets a chance to show a web page. I shouldn't need to quote stats on app > vs. browser usage and proportion of HTTPS on the web to make it clear tha= t > this playing this game has increasingly bad prospects. > > If this is a per-application configuration, then only those applications > that are configured to use remote, encrypted resolvers are affected. The= y > fail to get the modified DNS results, but all the other problems still > exist. > > That makes me conclude that captive portals aren't any worse off as a > result of operating systems or applications choosing to configure their o= wn > encrypted resolver service. Given that using DNS for captive portals is > worse than alternative methods[1], I'd suggest that we not concern > ourselves with this particular problem. > > Cheers, > Martin > > [1] Spoofing DNS results for captive portals poisons the cache, which > makes DNS rewriting a bad choice for this use case. This is - in part - > why most captive portals intercept TCP on port 80 and spoof an HTTP 302 > instead. And if you consider DNSSEC-validating endpoints, that would be > another reason not to spoof DNS... if those existed in any significant > numbers. > > > On Fri, Mar 15, 2019, at 03:39, Jim Reid wrote: > > Here=E2=80=99s what I plan to present at the WG. Please comment on the = list if > > you have questions or suggestions. > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000000d519005841940fe Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Mar 14, 2019 at 10:22 PM Mart= in Thomson <mt@lowentropy.net&g= t; wrote:
Thanks= for sharing the slides Jim,

(As an aside, the parallels between your summary of the draft and draft-mm-= wg-effect-encrypt are striking.)

There are lots of *things* on your list, but maybe it would help to look at= a few in more detail to see what they teach us.=C2=A0 I happen to chair a = working group that is tasked with improving the captive portal situation, s= o I thought I'd start there because it's first on your list too.
The first thing I observe is that the story could be different depending on= where the remote resolver is configured.=C2=A0 In particular, whether you = consider the configuration of an remote, encrypted resolver to be system-wi= de or per-application.

Captive portal detection is typically done at a system level, and so the sy= stem-wide configuration would seem to be most relevant to this particular i= ssue.=C2=A0 That is, unless the network manages to successfully evade the v= arious captive portal detection mechanisms in the hopes that they can someh= ow present information in the browser, which I'll get back to.

As I've learned, operating systems typically use very different network= configuration during the captive portal detection phase, and most won'= t be applying encrypted DNS policies until they have first validated the ne= twork is "usable".=C2=A0 So I would expect that even if the opera= ting system is configured to use an encrypted DNS service other than the on= e the network provides, it would still use the network-provided service whi= le it is bootstrapping.=C2=A0 For instance, I understand that Android uses = the network resolver to discover the IP address of its DoT/DoH resolver (Be= n can probably clarify/correct me here).

Yes, if the user has specified a DoT resolver, Android resolves that name= through the network's default DNS server.=C2=A0 Specifically, Android = simulates a parallel version of the network configuration that is used for = captive portal login and DoT bootstrap, but is not accessible to normal app= s.=C2=A0 This version may be used even after login succeeds, in order to ha= ndle "captive portal snapback" (e.g. session expiration).

The Chrome team has also been prioritizing correct functi= oning with captive portals on all supported platforms.=C2=A0 I don't fo= resee DoH implementation causing any significant regression.
=C2= =A0
If the network decides to evade captive portal detection, then it is playin= g roulette.=C2=A0 Most applications now use authenticated connections to se= rvices, and so do many websites.=C2=A0 A DNS redirection is no more effecti= ve in these circumstances than a port 80 interception[1].=C2=A0 The applica= tion detects the "attack" and throws up errors.=C2=A0 That can le= ad to the operating system concluding that the network is broken if applica= tions report these errors.=C2=A0 If you are lucky and it is a web browser t= hat first makes a connection and that connection is to a site without HSTS,= then the network gets a chance to show a web page.=C2=A0 I shouldn't n= eed to quote stats on app vs. browser usage and proportion of HTTPS on the = web to make it clear that this playing this game has increasingly bad prosp= ects.

If this is a per-application configuration, then only those applications th= at are configured to use remote, encrypted resolvers are affected.=C2=A0 Th= ey fail to get the modified DNS results, but all the other problems still e= xist.

That makes me conclude that captive portals aren't any worse off as a r= esult of operating systems or applications choosing to configure their own = encrypted resolver service.=C2=A0 Given that using DNS for captive portals = is worse than alternative methods[1], I'd suggest that we not concern o= urselves with this particular problem.

Cheers,
Martin

[1] Spoofing DNS results for captive portals poisons the cache, which makes= DNS rewriting a bad choice for this use case.=C2=A0 This is - in part - wh= y most captive portals intercept TCP on port 80 and spoof an HTTP 302 inste= ad.=C2=A0 And if you consider DNSSEC-validating endpoints, that would be an= other reason not to spoof DNS... if those existed in any significant number= s.


On Fri, Mar 15, 2019, at 03:39, Jim Reid wrote:
> Here=E2=80=99s what I plan to present at the WG. Please comment on the= list if
> you have questions or suggestions.

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--0000000000000d519005841940fe-- --000000000000138e350584194088 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCdzhNe4+8DRkEXGVrk5Jjf 8aX8fAWYlfr/nGaefbLIyTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMTUwMzAxMDdaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEACKE3j3xJsKUPHb77kRvwpSpIvJcPuambBml2G8Uc kxG/NigG5jaQVJ1InMLReHh1AMwqj4LpHvmCgTjLUiaBI/OrySJJc9vd8D8Fcddgd4sQUTi8H5Sv xqc2g5SRtOn90nIYHO15pPgr6akcWxINyfyvZ+r0+LBKud6J/oVV9BvqKLx6/fQAZbd6X+K+JNVB vEyPTWSObeQ4Zlz11xwCtW95x4By7zVRpxDNKXsAQeLgkDEbdMCrFKSN+LRDdKcWwhcp3Wrqw8VP ktJ2Ly0hXGgadNYfvPuEfAxo/BHr/kE+ZKuH2U9+FBTw5kM19NSgssQUwFqMCdveJljrTcZxnQ== --000000000000138e350584194088-- From nobody Thu Mar 14 20:23:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5A9F5129A87 for ; Thu, 14 Mar 2019 20:23:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.498 X-Spam-Level: X-Spam-Status: No, score=-9.498 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=loon.co Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MbtjVZfJgw17 for ; Thu, 14 Mar 2019 20:23:43 -0700 (PDT) Received: from mail-it1-x129.google.com (mail-it1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A32D51310D4 for ; Thu, 14 Mar 2019 20:23:43 -0700 (PDT) Received: by mail-it1-x129.google.com with SMTP id l15so8700880iti.4 for ; Thu, 14 Mar 2019 20:23:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=loon.co; s=google; h=mime-version:references:in-reply-to:reply-to:from:date:message-id :subject:to:cc; bh=E23ROFRVKAzQ14jXwIID9jIfZtXIaEXW+Wsn/3L6Q30=; b=GWZIJ2SbET+s49O1M0nA2etzJiRli8JY6578Jsknl4DZTPfQahPQ7vlw8sRcp01AA3 tx6y6TktBnxNJvQYtKqESlNuG0yD1Wb0ifCxAao6pO/1+B1+XbsOrnDOXv7ycSCx2VCV 3JfQGWkb+ozohl4fqUuRMc6TPWvMZmsTca6v0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:reply-to :from:date:message-id:subject:to:cc; bh=E23ROFRVKAzQ14jXwIID9jIfZtXIaEXW+Wsn/3L6Q30=; b=ezkdTzdIGv6lBCih1PQVok+K3C8H/pNrZjyOfyYMQk6DKL31h0N2J/XlT/8BGhP0zk cDmJtg+bG73SedXWflyHGz01K69gwwCgeNKCH+MpfGt35Kouq3bItrP8rLwTso3erfhP qGc9GpEn0L7WbdINKl0F2lM1SiUTtI5w2w7dJucMSTlM2cNL7GrnG0JFIGPLfhC+Ps/b TZYQjJgC4y75Daooy2ud4aB0ev025TigYXihG/DMNsknqPgS+UqU6noi0+qXmiW3soeP 243w77SDcqojB2FsbBCEY3qUsKx+ZB/6Ynp/JiFQ6Qg6QiCtSU8s0Iadddwm1+5zjCUs SCpw== X-Gm-Message-State: APjAAAUbdSJRepEhVVA5MLWPmgTAB3sNDcm3Vdwa5A0LNMpqiu2qp7X8 KYMmuVIxyzw2msj7K89TOu6GPNCZmTgGLujIhVKyyQEzI6U= X-Google-Smtp-Source: APXvYqwiX9FZlW6kqkhmVAdG3g+IV+wx4DXDzn98czAcQzc4uMHXDcjA69fcD/cqFh2KUwqoBXso5M9aZoDIQHt/Jhs= X-Received: by 2002:a24:cc89:: with SMTP id x131mr537272itf.121.1552620222585; Thu, 14 Mar 2019 20:23:42 -0700 (PDT) MIME-Version: 1.0 References: <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com> In-Reply-To: <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com> Reply-To: ek@loon.co From: Erik Kline Date: Thu, 14 Mar 2019 20:23:31 -0700 Message-ID: To: Martin Thomson Cc: doh@ietf.org Content-Type: multipart/alternative; boundary="000000000000d71fd705841990a6" Archived-At: Subject: Re: [Doh] Authoritative DoT or DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 03:23:46 -0000 --000000000000d71fd705841990a6 Content-Type: text/plain; charset="UTF-8" And on account of the load management issues I would expect some folks to prefer to try out DoQ (DNS over QUIC), does actually bring things back around to DoH. On Thu, 14 Mar 2019 at 19:27, Martin Thomson wrote: > There is far less reason to use DoH for connections to authoritative > servers. DoT seems far more appropriate (than both DoH and the unencrypted > variants). > > I expect there to be a lot of discussion about DoS (not DNS over SCTP, > sadly) and load management in any such document. I don't see much of the > stuff that has generated so much heat lately to be relevant in the > authoritative context. > > On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote: > > > > In the last couple of days there has been a lot of activity concerning > > DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN and > > IETF drafts: > > > draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issues/draft-betola-bcp-doh-clients. > > > > > > These discussions have focused on DoH for client (typically web > > browser) communication with recursive resolvers, and its comparisons > > with DoT for this purpose. > > > > > > Is there any compelling reason at this point to be considering DoH for > > recursive resolver-to-authoritative name server communications? > > > > > > As I noted at the DPRIVE interim meeting, the working group needs > > empirical studies looking at performance and attack vectors for > > authoritative DNS encryption. > > > > > > Unless there are compelling reasons to consider Authoritative DoH, I > > propose the working group focus its authoritative DNS encryption > > assessments around Authoritative DoT. > > > > > > In support, I am willing to co-author an Authoritative DoT operational > > consideration draft in order to outline the operational challenges the > > community needs to address - similar to the draft-reid-doh-operator > > draft between client and recursive. > > > > > > _______________________________________________ > > Doh mailing list > > Doh@ietf.org > > https://www.ietf.org/mailman/listinfo/doh > > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000d71fd705841990a6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
And on account of the load management issues I would expec= t some folks to prefer to try out DoQ (DNS over QUIC), does actually bring = things back around to DoH.

On Thu, 14 Mar 2019 at 19:27, Martin Thomson <= mt@lowentropy.net> wrote:
There is far less rea= son to use DoH for connections to authoritative servers.=C2=A0 DoT seems fa= r more appropriate (than both DoH and the unencrypted variants).

I expect there to be a lot of discussion about DoS (not DNS over SCTP, sadl= y) and load management in any such document.=C2=A0 I don't see much of = the stuff that has generated so much heat lately to be relevant in the auth= oritative context.

On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote:
>=C2=A0
> In the last couple of days there has been a lot of activity concerning=
> DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN and =
> IETF drafts:
> draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issue= s/draft-betola-bcp-doh-clients.
>
>
> These discussions have focused on DoH for client (typically web
> browser) communication with recursive resolvers, and its comparisons <= br> > with DoT for this purpose.
>
>
> Is there any compelling reason at this point to be considering DoH for=
> recursive resolver-to-authoritative name server communications?
>
>
> As I noted at the DPRIVE interim meeting, the working group needs
> empirical studies looking at performance and attack vectors for
> authoritative DNS encryption.
>
>
> Unless there are compelling reasons to consider Authoritative DoH, I <= br> > propose the working group focus its authoritative DNS encryption
> assessments around Authoritative DoT.
>
>
> In support, I am willing to co-author an Authoritative DoT operational=
> consideration draft in order to outline the operational challenges the=
> community needs to address - similar to the draft-reid-doh-operator > draft between client and recursive.
>
>
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000d71fd705841990a6-- From nobody Fri Mar 15 00:39:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C65E6131236 for ; Fri, 15 Mar 2019 00:39:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dv8IkqnPAuBM for ; Fri, 15 Mar 2019 00:39:32 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44B71131223 for ; Fri, 15 Mar 2019 00:39:32 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 3B3C0242109D; Fri, 15 Mar 2019 07:39:29 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> Date: Fri, 15 Mar 2019 07:39:28 +0000 Cc: doh@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> To: Martin Thomson X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 07:39:39 -0000 > On 15 Mar 2019, at 02:19, Martin Thomson wrote: >=20 > Thanks for sharing the slides Jim, >=20 > (As an aside, the parallels between your summary of the draft and = draft-mm-wg-effect-encrypt are striking.) I wasn=E2=80=99t aware of that draft Martin. Thanks for the tip. > ... details snipped ... > That makes me conclude that captive portals aren't any worse off as a = result of operating systems or applications choosing to configure their = own encrypted resolver service. Thanks. That=E2=80=99s good to know. Though I think we need more = experience and use cases of what actually happens when DoH clients and = captive portals bump into each other. Somewhat off at a tangent: I run a validating resolver on my laptop and = generally use that in preference to whatever DNS service is provided on = some guest network. This sometimes mean I bypass that network=E2=80=99s = captive portal and end up in a (self-inflicted) world of pain. If = widespread use of DoT makes that sort of thing happen for large numbers = of unsuspecting users... Suppose a DoH client has already bootstrapped itself and knows the = address of its chosen DoH server. The device moves to a new net that has = a captive portal. Will the device try to speak DoH to that server=E2=80=99= s address directly instead of doing the captive portal dance? Likewise, = what happens what a DoH client is configured to only use DoH and = therefore never interacts with the network=E2=80=99s or captive = portal=E2=80=99s por 53 resolver?= From nobody Fri Mar 15 00:45:09 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDC2F1311EC; Fri, 15 Mar 2019 00:45:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vqk57Aig3RGO; Fri, 15 Mar 2019 00:45:02 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1DC0C1311EA; Fri, 15 Mar 2019 00:45:02 -0700 (PDT) Received: from linux-9daj.localnet (vixp1.redbarn.org [24.104.150.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 2D229892C6; Fri, 15 Mar 2019 07:45:01 +0000 (UTC) From: Paul Vixie To: Ted Hardie Cc: dnsop , DoH WG Date: Fri, 15 Mar 2019 07:44:59 +0000 Message-ID: <1900056.F7IrilhNgi@linux-9daj> Organization: Vixie Freehold In-Reply-To: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 07:45:06 -0000 On Tuesday, 12 March 2019 20:52:27 UTC Ted Hardie wrote: > Paul, > > Since it is apparent our disagreement is at a more fundamental level, I > will make only two further comments. ted, your comments were of such a nature that i had to sleep on them more than once before i felt i could re-engage. i apologize for the delay. let's continue. > The first is that you recently chided someone for using the word "rant", > saying that it would "diminish and disrespect" someone's words. In the > note below you use terms like "warfare" to characterize the work of the > authors; that is both inflammatory and disrespectful. The authors worked > on a chartered working group item throughout the IETF process. You > disagree with the security trade-offs made in the chartering and execution > of that work, and discussion of that disagreement will hopefully be > fruitful. But if you want their respect of your opinion, according them > the respect due theirs will go a long way; they did not make these choices > arbitrarily. i did not intend the term "warfare" to be taken colloquially. i meant it in the literal sense. all war is economic -- the fighting will continue until one party cannot afford to continue. not all war is violent. we do not have a word like "trade" as in "trade war" to describe what's happening here, and we need one, so that i can use that term to describe as accurately as possible what i think is happening. DoH's stated goals include "prevent on-path interference in DNS operations." i am an on-path interferer, and "i aim to misbehave"[1]. DoH is, in that sense, targeted at me. i think it was wrong to do so, not morally wrong, but wrong on its own terms, to falsely equate all on-path interferers. parental controls and corporate security are forms of on-path interference in DNS operations which have a valid and moral place in our digital society. DoH could have distinguished between edge network operators who interfere for reasons our users and their apps are either cooperative with or unwelcome entirely. they did not. they lumped us all together. the method of DoH with respect to preventing on-path interference with DNS operations is to make it too expensive, obviously, because it (deliberately) hides recursive DNS transactions in flows which have been, until now, unaffective of DNS operations. i wish the DoH well in their walk with the GFW, but i predict that the CCCP has effectively infinite resources and resolve, and that it is _not possible_ to exceed their expense budget to the point where they say, "ok, that's the end, everybody in china who wants free and open DNS access can get it, we just can't deal with this DoH thing." however, for non-nation-state actors, such as myself, it's going to be really quite costly to prevent intruders and bots and other malware from moving their DNS operations out of our sight and out of our control. our costs will increase. this increase was deliberate. it would be dishonest not to call that economic warfare by the DoH authors. if this comes as a surprise to them, then so much the worse for all of us, i think. > My second comment is to point out that the IETF has been heading this way > for about five years now. The IAB formalized its early support of this > approach in November of 2014 with this text: > > > The IAB urges protocol designers to design for confidential operation by > > default. We strongly encourage developers to include encryption in their > > implementations, and to make them encrypted by default. We similarly > > encourage network and service operators to deploy encryption where it is > > not yet deployed, and we urge firewall policy administrators to permit > > encrypted traffic. > > > > We believe that each of these changes will help restore the trust users > > must > > have in the Internet. We acknowledge that this will take time and > > trouble, > > though we believe recent successes in content delivery networks, > > messaging, > > and Internet application deployments demonstrate the feasibility of this > > migration. We also acknowledge that many network operations activities > > today, from traffic management and intrusion detection to spam prevention > > and policy enforcement, assume access to cleartext payload. For many of > > these activities there are no solutions yet, but the IAB will work with > > those affected to foster development of new approaches for these > > activities > > which allow us to move to an Internet where traffic is confidential by > > default. i remember this text. DoH is not what i expected as "will work with those affected". the problem of surveillance is differentiated between home and corporate networks on the one hand, and public networks on the other. one perfectly valid approach to the goal set out by the IAB above would have been to say, all network operators who care about DNS privacy, should run their own recursive DNS servers, and, those servers should prefer DoT where available when communicating upstream. that answer was not politically acceptable by other interpreters (that is, not me) of the IAB text. rather, the IAB text was taken as license to change the way DNS resolution would be done for all users. that was overreach, and was a consensus i could not join, and has created more losers than winners, and i view it as either naivety about real internet security issues, or as an abuse of power, depending on who knew how much at what time. > By that point, the IETF working groups were already in formation. Moving > the DNS toward encryption has been going on since DPRIVE and has been > accompanied by the rise of transports like QUIC which are encrypted by > default. You have been working around that, rather than developing new > practices. I invite you instead to consider how you can accomplish what > you need to in an Internet where all traffic is confidential. when you talk about "the Internet" which originally meant simply a "network of networks", you could mean something technical, in which case my network is one of those networks (of which there is a network), and we would likely agree that for networks i build and fund, the traffic will be what i accept, not what is imposed on me. both the payloads, and the form of those payloads. no enterprise or home network operator is going to accept the IETF's mandate as to which traffic must be encrypted on our networks, for example. on the other hand you could mean what christian huitema seems to mean, which is an Internet that is viral, and anything that connects to that viral agency has to accept all of the payloads and formats decreed by the community. i do not expect this view to sway the CCCP, as i wrote above. in any case it does not sway me, either as a home network operator or an enterprise network operator. simply put, i will not have these views imposed on me. not in the form of DoH now, and not in the form of spam back in the 1990's. not ever. > Enterprises > are currently doing that via managed software and environments, and that > approach seems to be well in-line with your practices below. Using > resolution systems for this will not accomplish what you need now, nor will > it do so going forward; it is time for a different approach, rather than > seeking to return to cleartext. i am not asking for cleartext per se, though on my own networks, which i build and fund, i ought to be able to ask for that and get it, and if you insist otherwise, it will be as effective as the IETF's one-time insistence that the end to end principle forbade firewalls, and later, the IETF's insistence that the end to end principle forbade NAT. the consensus you're seeing appears to be in a non-representative bubble. using resolution systems for surveillance and control of edge networks is the world the IETF finds itself in. they can decide to provide other approaches, and they would find me a ready participant. they cannot however simply decide that my approach is wrong or outdated, and say that those days are over. until there is another way to achieve what the internet security industry achieves by watching and controlling DNS operations, those operations will continue, and they will be non-optional on many edge networks. the IETF consensus is not, to borrow a term from christian huitema, "king". what i'm asking for, though, is not clear text. rather, i'm refusing to allow outside answers to naming questions, for the same reasons i would refuse to allow outside answers to ARP questions. the internet only exists by cooperation -- of which interoperability is only one example. when the wide area services, the intermediate networks, the edge networks, the apps, and the users all agree on what should happen, then it happens. otherwise, not so. to want any other system is to be willing to forcibly impose communications on others, which is NOT "the Internet way" and cannot become so, because it would rely on cooperation which can be withheld. (as in my case, with DoH.) > The situation that moved this community to that stance was well-laid out in > IETF 88. We must acknowledge that not all devices which are on-path are > controlled by entities known to the user or network operator and not all of > them are acting in the interests of those parties. Protecting against that > threat requires us to change our ways. Please help, rather than working > around the effort. i don't think you realize what you're asking. the bad guys didn't attend IETF 88. we have a world wide digital civilization to run here, and we will continue doing that, even if it means "working around" disruptions like DoH. if someone from the IETF community wants to work on protecting DNS from the bad guys without also giving the bad guys greater powers that the good guys are nowhere near ready to cope with, my e-mail address is paul@redbarn.org. > regards, > > Ted Hardie > (wearing no hats) i am paul vixie, "concerned internet citizen." thank you for your thoughts. i hope that you will also read michael sinatra's response to this same message. he does not nec'ily speak for me, but he does seem to be making sense here. [1] https://www.youtube.com/watch?v=1VR3Av9qfZc From nobody Fri Mar 15 00:46:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6AC911311EC for ; Fri, 15 Mar 2019 00:46:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o4fV5I4xQo7F for ; Fri, 15 Mar 2019 00:46:45 -0700 (PDT) Received: from shaun.rfc1035.com (shaun.rfc1035.com [93.186.33.42]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDCEC1311EA for ; Fri, 15 Mar 2019 00:46:44 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id 46E16242109D; Fri, 15 Mar 2019 07:46:43 +0000 (UTC) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> Date: Fri, 15 Mar 2019 07:46:42 +0000 Cc: doh@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> To: Martin Thomson X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 07:46:46 -0000 > On 15 Mar 2019, at 07:39, Jim Reid wrote: >=20 > If widespread use of DoT makes that sort of thing happen for large = numbers of unsuspecting users... Whoops! s/DoT/DoH/ From nobody Fri Mar 15 01:12:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 873061311E6 for ; Fri, 15 Mar 2019 01:12:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8NSwxnlOL6lQ for ; Fri, 15 Mar 2019 01:11:58 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E6101311DC for ; Fri, 15 Mar 2019 01:11:58 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x2F8Brd1001512 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 09:11:53 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x2F8BqxY001502; Fri, 15 Mar 2019 09:11:52 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Fri, 15 Mar 2019 09:11:52 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Jim Reid cc: Martin Thomson , doh@ietf.org In-Reply-To: <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> Message-ID: References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="1129329158-732140084-1552637513=:5797" Archived-At: Subject: Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 08:12:01 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1129329158-732140084-1552637513=:5797 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT On Fri, 15 Mar 2019, Jim Reid wrote: > Suppose a DoH client has already bootstrapped itself and knows the address > of its chosen DoH server. The device moves to a new net that has a captive > portal. Will the device try to speak DoH to that server’s address directly > instead of doing the captive portal dance? Then we enter application specific territory. A hypothetical browser might for example first verify that it is "captive portal-less" before it activates DoH, and it might also feature a config entry that skips that waiting period (a wait that is annoying when you restart your browser and have N tabs you'd like to reload at once etc). Yes, validating local resolvers (and others) have the same problem. Captive portals in general are a world of pain. > Likewise, what happens what a DoH client is configured to only use DoH and > therefore never interacts with the network’s or captive portal’s por 53 > resolver? A browser set to *only* use DoH and never "native" will effectively be locked out from the network when it finds itself in a captive portal. (There's at least one Firefox bug on this.) Which proves that all pieces work as intended! In those cases, some users have been known to fire up a *separate* browser to resolve the captive situation as then the DoH-using browser can come back to the living. -- / daniel.haxx.se --1129329158-732140084-1552637513=:5797-- From nobody Fri Mar 15 01:50:04 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A7F61311EC; Fri, 15 Mar 2019 01:49:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2yoafV22cvy1; Fri, 15 Mar 2019 01:49:51 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00073.outbound.protection.outlook.com [40.107.0.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56F761311FD; Fri, 15 Mar 2019 01:49:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=q2MK3cJYrYJcScS6SB5zPoJQJ/YMdvA5Dzqod+fWyTg=; b=MOMGMra0wei19MybfbOpIs/BgqkFN4e7Fz9XXIQL5aEO6zG8ApTXrt9pYipGu3zn+i0PzcwGF70OUDR6txlDpQVIkvSMkD5VoRMtdstaXHvlG99vr8Ytm3HxgSVTGCT/uHPIAGIHdql0o/ZFu4HPXFG69pEKBS9IyDO7tlB2K7o= Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com (10.167.132.7) by AM4PR0601MB2196.eurprd06.prod.outlook.com (10.167.132.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.14; Fri, 15 Mar 2019 08:49:48 +0000 Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c]) by AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c%7]) with mapi id 15.20.1709.011; Fri, 15 Mar 2019 08:49:48 +0000 From: "Winfield, Alister" To: Paul Vixie , Ted Hardie CC: dnsop , DoH WG Thread-Topic: [EXTERNAL] Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator Thread-Index: AQHU2RWz4x417yc18UCnZL38/f7OWaYMU8+AgAARlYA= Date: Fri, 15 Mar 2019 08:49:48 +0000 Message-ID: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: <1900056.F7IrilhNgi@linux-9daj> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e20a:2d00:fdf8:995:b7f8:f9bf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 3267adb5-266d-4f06-319f-08d6a9232e28 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:AM4PR0601MB2196; x-ms-traffictypediagnostic: AM4PR0601MB2196: x-microsoft-antispam-prvs: x-forefront-prvs: 09778E995A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(136003)(396003)(376002)(39860400002)(346002)(199004)(189003)(83716004)(14444005)(71190400001)(71200400001)(110136005)(54906003)(58126008)(68736007)(305945005)(5660300002)(74482002)(93886005)(53936002)(6246003)(316002)(5024004)(7736002)(256004)(8676002)(82746002)(446003)(6486002)(99286004)(46003)(4326008)(6512007)(86362001)(476003)(72206003)(2616005)(11346002)(97736004)(486006)(102836004)(6436002)(229853002)(36756003)(105586002)(6116002)(14454004)(8936002)(33656002)(81166006)(2906002)(25786009)(186003)(6506007)(81156014)(478600001)(76176011)(106356001); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0601MB2196; H:AM4PR0601MB2180.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: eqAEAhgmTlYPs/IGagekodGg51V6E/ff6m40HDUYXQNqI8rxFCmzbOzcgpaNIyVNKrFp2cXCqzv6i/bhKzVx9gEgAytcD6i+zxWufq3f9/O+ZVZJOICnW5p2+fllKxqEIYk6uPuMK95wiV4+veAvD5dKw3FOuvJQlLfu1egXzePfCtu89ZmQOYcE9CmgSvdCbr3NH35dyeomPH0BVZgNM+IDHlquXpjnMc4ptTuSKG0mf0Xr+SYIPC5/An99WSFxMwtDZy0Un+RyxdjZnq9Zm9k8x+ZU3JojpT1vag/80C1um3M124oJV2W09XQJWGq2iQH1LE90lYMv6aJqbIjRHxNWBTrtb2FRzSBCSmDJLOXt/XVpJ/LHRcnBx0H0r4eL+YpIJsFrfv3kpNZCL9mClZOTGVnoHYm82GWukjC3HLQ= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 3267adb5-266d-4f06-319f-08d6a9232e28 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2019 08:49:48.1718 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0601MB2196 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 08:49:55 -0000 DQoNCu+7v09uIDE1LzAzLzIwMTksIDA3OjQ1LCAiRG9oIG9uIGJlaGFsZiBvZiBQYXVsIFZpeGll IiA8ZG9oLWJvdW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIHBhdWxAcmVkYmFybi5vcmc+IHdy b3RlOg0KDQogICAgRG9IJ3Mgc3RhdGVkIGdvYWxzIGluY2x1ZGUgInByZXZlbnQgb24tcGF0aCBp bnRlcmZlcmVuY2UgaW4gRE5TIG9wZXJhdGlvbnMuIiBpDQogICAgYW0gYW4gb24tcGF0aCBpbnRl cmZlcmVyLCBhbmQgImkgYWltIHRvIG1pc2JlaGF2ZSJbMV0uIERvSCBpcywgaW4gdGhhdCBzZW5z ZSwNCiAgICB0YXJnZXRlZCBhdCBtZS4gaSB0aGluayBpdCB3YXMgd3JvbmcgdG8gZG8gc28sIG5v dCBtb3JhbGx5IHdyb25nLCBidXQgd3Jvbmcgb24NCiAgICBpdHMgb3duIHRlcm1zLCB0byBmYWxz ZWx5IGVxdWF0ZSBhbGwgb24tcGF0aCBpbnRlcmZlcmVycy4gcGFyZW50YWwgY29udHJvbHMNCiAg ICBhbmQgY29ycG9yYXRlIHNlY3VyaXR5IGFyZSBmb3JtcyBvZiBvbi1wYXRoIGludGVyZmVyZW5j ZSBpbiBETlMgb3BlcmF0aW9ucw0KICAgIHdoaWNoIGhhdmUgYSB2YWxpZCBhbmQgbW9yYWwgcGxh Y2UgaW4gb3VyIGRpZ2l0YWwgc29jaWV0eS4gRG9IIGNvdWxkIGhhdmUNCiAgICBkaXN0aW5ndWlz aGVkIGJldHdlZW4gZWRnZSBuZXR3b3JrIG9wZXJhdG9ycyB3aG8gaW50ZXJmZXJlIGZvciByZWFz b25zIG91cg0KICAgIHVzZXJzIGFuZCB0aGVpciBhcHBzIGFyZSBlaXRoZXIgY29vcGVyYXRpdmUg d2l0aCBvciB1bndlbGNvbWUgZW50aXJlbHkuIHRoZXkNCiAgICBkaWQgbm90LiB0aGV5IGx1bXBl ZCB1cyBhbGwgdG9nZXRoZXIuDQoNCiAgICBJIG1pZ2h0IGFsc28gbm90ZSB0aGF0IHRoZSBvdXRj b21lIG9mIGJsb2NraW5nIHN1Y2ggJ2ludGVyZmVyZW5jZScgd2lsbCBsaWtlbHkgaW5jcmVhc2Ug dGhlIGNoYW5jZSBvZiBzdWNjZXNzZnVsIGRhdGEgZXhmaWx0cmF0aW9uIGJ5IHRoZSAndW53ZWxj b21lJy4gVGh1cyBpbiBmYWN0IHRoaXMgInByaXZhY3kiIHByb3RvY29sIG1heSBvbmUgZGF5IGJl IHNob3duIHRvIHJlZHVjZSBvdmVyYWxsIHByaXZhY3kgYW5kIHNlY3VyaXR5IGZvciB0aGUgbWFq b3JpdHkgb2YgdXNlcnMgZHVlIHRvIHlldCBtb3JlIGRhdGEgbGVha3MuDQoNCg0KQWxpc3RlciBX aW5maWVsZA0KDQpJbmZvcm1hdGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1ZGluZyBhbnkgYXR0YWNo bWVudHMgbWF5IGJlIHByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCBhbmQgaXMgaW50ZW5kZWQgZXhj bHVzaXZlbHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSB2aWV3cyBleHByZXNzZWQgbWF5IG5vdCBi ZSBvZmZpY2lhbCBwb2xpY3ksIGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mgb2YgdGhlIG9yaWdpbmF0 b3IuIElmIHlvdSBoYXZlIHJlY2VpdmVkIGl0IGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBz ZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0ZW0uIFlv dSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNtaXQsIHVz ZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3ZSByZXNl cnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0aHJvdWdo IG91ciBpbnRlcm5hbCBhbmQgZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJr cyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcg YW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQoNClNreSBVSyBMaW1pdGVkIChSZWdpc3RyYXRp b24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJhdGlv biBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdpc3Ry YXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiA5 NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGltaXRl ZCAoUmVnaXN0cmF0aW9uIE5vLiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlv bmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2Fs ZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNs ZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0K From nobody Fri Mar 15 02:09:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1579F13120B for ; Fri, 15 Mar 2019 02:09:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a3NYBx_Jm-nT for ; Fri, 15 Mar 2019 02:08:59 -0700 (PDT) Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01on0628.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe1e::628]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB7721310CD for ; Fri, 15 Mar 2019 02:08:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=BeBeSYnrR/0e6yulwfNm+eR0ORJODekzRXSuqm/GFDc=; b=V1cP4PyXsAr4oO0H5n9JDsUfNmOqVOdgn/WGEY8xfX37jyxMKzbcNT2UcNt4StRMqhROvdsw7lPqw7Xc54agKyd7j9p6qKqr9xw0MnAj07wr1kbcxFOF/vlHWYCt1OUp51lilsxBKKRVq/EYrI/C6UjGafo5NvXHl4Z+Solnwvs= Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com (10.167.132.7) by AM4PR0601MB2129.eurprd06.prod.outlook.com (10.167.123.142) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.14; Fri, 15 Mar 2019 09:08:55 +0000 Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c]) by AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c%7]) with mapi id 15.20.1709.011; Fri, 15 Mar 2019 09:08:55 +0000 From: "Winfield, Alister" To: Daniel Stenberg CC: DoH WG Thread-Topic: [EXTERNAL] Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) Thread-Index: AQHU2wJlkaNvcWjTr0qOlfUR8kO7NaYMV3kAgAAPaQA= Date: Fri, 15 Mar 2019 09:08:55 +0000 Message-ID: References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e20a:2d00:fdf8:995:b7f8:f9bf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 254628e3-ff9d-4903-beef-08d6a925d9ed x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:AM4PR0601MB2129; x-ms-traffictypediagnostic: AM4PR0601MB2129: x-microsoft-antispam-prvs: x-forefront-prvs: 09778E995A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(136003)(396003)(39860400002)(366004)(199004)(189003)(5024004)(8676002)(14444005)(256004)(81156014)(25786009)(186003)(81166006)(7736002)(71190400001)(71200400001)(14454004)(46003)(8936002)(83716004)(305945005)(4326008)(74482002)(5660300002)(2616005)(102836004)(6246003)(11346002)(99286004)(486006)(446003)(72206003)(76176011)(66574012)(6506007)(86362001)(478600001)(53936002)(476003)(6512007)(6436002)(6486002)(93886005)(58126008)(33656002)(2906002)(316002)(68736007)(106356001)(105586002)(36756003)(82746002)(97736004)(6116002)(6916009)(229853002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0601MB2129; H:AM4PR0601MB2180.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: npAta4mScJPU7YTSxlfBc1IjXdBx+bovqWGQ1x1CDXFy3bUFiFZBIJNCdKvcHh/n60MJeW62QTQ6X8raBaVpd4hC5qUjZQjlLNadP9wJXtHVGqk4qzLpnAu9AGo4IKYXf43HDvKTOAFbwVeACt72OKn6FrzpzTHiwJ86nj1bvgeYYQ55NqA+ZSDkC0fD8O7ZsE6qF2Kj2dFe4m5a/lraJjvQZlHn7ht/LNanATb8wR4tMcRn6gO9ifxK6go9k/Ml0lbOJwtYUNlUElzj5/oIsSpcdtB+tAi+DnIjI2ZQfGp+N2+TBatXmI14MLQdW9wi71A6160OjNmYrM3WjaLwvXaCJh4VXEjU/guxDsc2cAksCmOK+oyvX6/d1GeJbx14fRSuECDcIh+eKPOmCqONeV7SEg5tD68yJicdn4EtjdU= Content-Type: text/plain; charset="utf-8" Content-ID: <5A4185E9221C0D428AE417F65888F12F@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 254628e3-ff9d-4903-beef-08d6a925d9ed X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2019 09:08:55.3133 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0601MB2129 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 09:09:01 -0000 DQogICAgSW4gdGhvc2UgY2FzZXMsIHNvbWUgdXNlcnMgaGF2ZSBiZWVuIGtub3duIHRvIGZpcmUg dXAgYSAqc2VwYXJhdGUqIGJyb3dzZXIgdG8NCiAgICByZXNvbHZlIHRoZSBjYXB0aXZlIHNpdHVh dGlvbiBhcyB0aGVuIHRoZSBEb0gtdXNpbmcgYnJvd3NlciBjYW4gY29tZSBiYWNrIHRvDQogICAg dGhlIGxpdmluZy4NCg0KDQpUaGlzIGlzIG9idmlvdXNseSBhIHRlY2huaWNhbCB1c2VyLiBTb21l d2hhdCBub3J0aCBvZiwgSSBndWVzcywgNzAlIG9mIG5vcm1hbCB1c2VycyB3b3VsZCBlaXRoZXIg Z2l2ZSB1cCBvciBhc3N1bWUgdGhhdCB0aGVpciBsb2NhbCBzZXJ2aWNlIHByb3ZpZGVyIGNhbiBz b3J0IG91dCB0aGUgcHJvYmxlbS4gQW55IHN1Y2ggc3VwcG9ydCBhZ2VudCBtYXkgd2VsbCBmaW5k IGl0IG5lYXIgaW1wb3NzaWJsZSB0byBoZWxwLCB3aGljaCBjbGllbnQsIGlzIHRoYXQgdXNpbmcg RG9ILCBpcyB0aGUgT1MgdXNpbmcgRG9ILCAuLi4gLiBGcm9tIHBlcnNvbmFsIGV4cGVyaWVuY2Ug RE5TIGNhbiBiZSBvbmUgb2YgdGhlIGhhcmRlc3QgdGhpbmdzIHRvIGRpYWdub3NlIHdoZW4gaXQg aXMgbm90IHdvcmtpbmcgcmlnaHQsIGVuZC11c2VycyBqdXN0IGRvbid0IHVuZGVyc3RhbmQgdGhl IGNvbmNlcHRzLg0KDQpBbHdheXMgcmVtZW1iZXIgbW9zdCB1c2VycyBoYXZlbid0IGEgY2x1ZSBh Ym91dCBETlMgbW9zdCB3b3VsZG4ndCBldmVuIGtub3cgdGhhdCBETlMgaXMgYSB0aGluZyB0byBr bm93IGFib3V0LiBXaGF0ZXZlciB0aGUgZGVmYXVsdCBiZWhhdmlvdXIgaXMgaXQgYmV0dGVyIGp1 c3Qgd29yayBmb3IgPjk5JSBvZiB1c2UtY2FzZXMuDQoNCkFsaXN0ZXIgV2luZmllbGQNCg0KSW5m b3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBw cml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0 aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9s aWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2 ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVy biBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCBy ZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2Ug aXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQg dG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50ZXJuYWwg YW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBTS1kgbWFya3MgYXJlIHRyYWRlbWFy a3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlvbmFsIEFHIGFuZCBhcmUgdXNlZCB1 bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkx KSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUp LCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQw MTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRp cmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlv biBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29tcGFuaWVzIG1lbnRpb25lZCBpbiB0aGlzIHBh cmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVzIGFuZCBzaGFyZSB0 aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBHcmFudCBXYXksIElzbGV3b3J0aCwgTWlkZGxl c2V4IFRXNyA1UUQNCg== From nobody Fri Mar 15 02:30:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BAD96127887 for ; Fri, 15 Mar 2019 02:30:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FsMcbj0njPJr for ; Fri, 15 Mar 2019 02:30:52 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 20DC61277DB for ; Fri, 15 Mar 2019 02:30:51 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x2F9UlA2007491 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 10:30:47 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x2F9UkjI007479; Fri, 15 Mar 2019 10:30:46 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Fri, 15 Mar 2019 10:30:46 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: "Winfield, Alister" cc: DoH WG In-Reply-To: Message-ID: References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 09:30:55 -0000 On Fri, 15 Mar 2019, Winfield, Alister wrote: > In those cases, some users have been known to fire up a *separate* > browser to resolve the captive situation as then the DoH-using browser > can come back to the living. > > This is obviously a technical user. Somewhat north of, I guess, 70% of > normal users would either give up or assume that their local service > provider can sort out the problem. Which is why I don't think users who *might* end up in a captive portal should have DoH-without-fallback enabled unless they know perfectly well what they're doing and can get themselves out of it. A DoH-without-fallback config has several other quirks as well with local host names etc that I doubt a lot of users will experience that without having asked for it themselves. -- / daniel.haxx.se From nobody Fri Mar 15 03:12:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D5D112762F for ; Fri, 15 Mar 2019 03:12:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MbWb6sBy6tBT for ; Fri, 15 Mar 2019 03:12:39 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D81D1200D7 for ; Fri, 15 Mar 2019 03:12:38 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id B311CBE64; Fri, 15 Mar 2019 10:12:35 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lLu8mmhUSvHJ; Fri, 15 Mar 2019 10:12:34 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 2A57DBE2F; Fri, 15 Mar 2019 10:12:34 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1552644754; bh=rkfHUukmoj/WTsYtFAx4xvbbJ250t+EILmwvuuS9CNE=; h=Subject:To:References:From:Date:In-Reply-To:From; b=ueJBnc+C27l5ZXuchGKw21KnhuhC5eOl4mxWJrWPuNosTBI1ZOhTVy50Oc8hxSS71 88a/6DHWr0q2WyIDCcMGXEmDf4SIwzoR0Cn0XeWhqRwSuzQxtC5tv3eY8McfHdVD98 l3YuNKjGu1oI4iUB1zaQccDD+Co8SdTLso+ASa2M= To: Martin Thomson , doh@ietf.org References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <066b95a1-3c53-591f-7885-041dc98c4f7a@cs.tcd.ie> Date: Fri, 15 Mar 2019 10:12:33 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="vJZLgz12bwfXOoEF8zCBe7sUCejP2EudQ" Archived-At: Subject: Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 10:12:42 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --vJZLgz12bwfXOoEF8zCBe7sUCejP2EudQ Content-Type: multipart/mixed; boundary="QWxG4Bwcu3AcFYC283fhCA1VElCIvJh6I"; protected-headers="v1" From: Stephen Farrell To: Martin Thomson , doh@ietf.org Message-ID: <066b95a1-3c53-591f-7885-041dc98c4f7a@cs.tcd.ie> Subject: Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> In-Reply-To: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> --QWxG4Bwcu3AcFYC283fhCA1VElCIvJh6I Content-Type: multipart/mixed; boundary="------------A8B0061675CF1D0EDE45E99C" Content-Language: en-GB This is a multi-part message in MIME format. --------------A8B0061675CF1D0EDE45E99C Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 15/03/2019 02:19, Martin Thomson wrote: > That makes me conclude that captive portals aren't any worse off as a > result of operating systems or applications choosing to configure > their own encrypted resolver service. Given that using DNS for > captive portals is worse than alternative methods[1], I'd suggest > that we not concern ourselves with this particular problem. I think Martin's argument here is convincing. I'd also note that as a user of stubby (DoT as the system resolver with my configured choices of recursive), I've also experienced problems with captive portals that rely on intercepting DNS, e.g the free wifi in my local airport does that. The version of stubby I have installed doesn't have captive portal detection, not sure if that's likely to be available soon but it'd be a minor improvement. So basically any encrypted DNS not using the DHCP DNS as recursive (and possibly also cleartext DNS not using the DHCP DNS as recursive?) will have an issue, and it's not a DoH-specific issue. S. --------------A8B0061675CF1D0EDE45E99C Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------A8B0061675CF1D0EDE45E99C-- --QWxG4Bwcu3AcFYC283fhCA1VElCIvJh6I-- --vJZLgz12bwfXOoEF8zCBe7sUCejP2EudQ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyLepEACgkQWrL68XsX K+peqg/+KIc/EHKE6Lai1aI/M4rU67aW6J9VX+Qmecd8+dmxh4m9DjUAXIzu7fmt XM42WMWlGHydIRmuXTL16IpVbeaF2kB9fL6aITgLg1CggvFJ99NQCFehaDdrHy1X EUuixMU8S5MuueJghqkfHota4oRpJW03ORxdtfA+L8tI5Kr83S+foVu6LTk+tmKM Gi+o99xOlKlmpSD4X+nye26GT87I5VswHZIaWeCnsg1SZ1/1Yj3F2MtO6M9nkeTv K9ydacPUwAY4rDcfCj254gf5+OBvCN3uLVYJKcaLibdROnf2bSGagSW+d8RuRxUI Opoi2n8uCxT2XrwPQyvNdpXmrvHs+/P4VYtbUI2bigqA68hYKbj3hcGbG+rK2+ZL A8jORrHHgYXqaeVvqPMfeSXtBvOo2DgKKeuVC0b+1PvpehMtBKKyRuryfPOv+JfY kA9QTrhWFOYfNQ6AKUFZm3pZdBGjrcUni9rsK1JVLx7SBYIkQ82r+yUG5tfiJPTH gMYq7O+got9IWajxTeb6mgSUIdhD+R5BsSwH9cnUFHtWGD8Q2AAT7qPx7uGF6n2I i3opcrvCU13SYlMzt2YRU1Yg5z9o6HT9/qL9qznq/rwwQ4TKj0W3UNNJ5Hni8fPk J6sHpbopP/XCAt7/EQVmb6ABgV/7HGLao2ZsLhq6xUuebvHWNPU= =U/e2 -----END PGP SIGNATURE----- --vJZLgz12bwfXOoEF8zCBe7sUCejP2EudQ-- From nobody Fri Mar 15 04:04:40 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6A9E5130DD8 for ; Fri, 15 Mar 2019 04:04:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=n3h3sF+2; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=R1NCEDkI Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2FULKDgSi8Ob for ; Fri, 15 Mar 2019 04:04:36 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DD261286CD for ; Fri, 15 Mar 2019 04:04:36 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id AA05522221; Fri, 15 Mar 2019 07:04:35 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Fri, 15 Mar 2019 07:04:35 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :cc:subject:content-type; s=fm1; bh=6JTzpAw1Pr6FA7SktTSdtecCImSR 8MetTWTeXtsPwgI=; b=n3h3sF+2yR0Nx7LwZdv1OkjAxmQiDltjHiY+U7k+j8Ph mZApIK9+Xo+XZ22ZMPegOKEp0EkdkZKeaJUGvXhCRGVP7Uxvyzd7a0iB2ZUFY1j4 TNTqGmcnHAoTPXVXjJ9QzgtFy3YshfFllyb50J4NsQin7PWTVz0GIeb40x+LeUUt vFBaEue+0x8URMHOx5+yzO7msVOGz7Buf7O0/zUfWd+gSoN2GcCzJapYGlyqbYDH aCGxASmx8lwCiqkn+9NuRmUUjxk1e6yUb4BTcEtqBYXUz5udTdDZ3vV8LnXCV8Ks DgFOQIMJYqelmo6mRAUuHGlZw8bvGMFol9HxRgqq1Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=6JTzpA w1Pr6FA7SktTSdtecCImSR8MetTWTeXtsPwgI=; b=R1NCEDkIzmb7rpMTfksOo3 UpnMe32QBvHININcPfKndpmv7vCty8I5f6iHwUTBIwJwkR+Hakzbxpg/cogKqQk6 5o6mAI18jcTUR68afUADw8W+fM1GZ+AjItt3NMYKyHsrXNkm/+zYbf6SffoZIDUM 4QMY6VfUBsqK8LCn3Xg6NEosYWuVlxz7B3NEEcupwpsKod6atXgo9pVuWPmt5Zbc 5kQBSWzYU0tY6NWLb8qYJkHlOSjV6UiNM8o4IGs3/dLP9BlrtSWkL4NUbAndUAvc 6cQ11gMWgyr6ib+ttanh4KR+OMwpvU4B70442q4+1vi3kC+EGexVVnWoyOWlaKIg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrheehgddvfecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefofgggkfgjfhffhffvufgtsehttdertderredtnecuhfhrohhmpedfofgrrhht ihhnucfvhhhomhhsohhnfdcuoehmtheslhhofigvnhhtrhhophihrdhnvghtqeenucffoh hmrghinhepihgvthhfrdhorhhgnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhho figvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id A531F7C32E; Fri, 15 Mar 2019 07:04:34 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <2f18ea6a-89e7-418b-82cf-70a8af70e8c1@www.fastmail.com> In-Reply-To: References: <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com> Date: Fri, 15 Mar 2019 07:04:36 -0400 From: "Martin Thomson" To: "Erik Kline" Cc: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] Authoritative DoT or DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 11:04:40 -0000 DNS over QUIC (either directly, or as DoH with HTTP/3) will likely exacerbate load problems. QUIC isn't great about its CPU usage at the current time. That comes with some advantages, like sharing an encryption context for multiple requests without the head of line blocking inherent in HTTP/2, but it's unlikely to be a total slam dunk. On Fri, Mar 15, 2019, at 14:23, Erik Kline wrote: > And on account of the load management issues I would expect some folks > to prefer to try out DoQ (DNS over QUIC), does actually bring things > back around to DoH. > > On Thu, 14 Mar 2019 at 19:27, Martin Thomson wrote: > > There is far less reason to use DoH for connections to authoritative servers. DoT seems far more appropriate (than both DoH and the unencrypted variants). > > > > I expect there to be a lot of discussion about DoS (not DNS over SCTP, sadly) and load management in any such document. I don't see much of the stuff that has generated so much heat lately to be relevant in the authoritative context. > > > > On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote: > > > > > > In the last couple of days there has been a lot of activity concerning > > > DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN and > > > IETF drafts: > > > draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issues/draft-betola-bcp-doh-clients. > > > > > > > > > These discussions have focused on DoH for client (typically web > > > browser) communication with recursive resolvers, and its comparisons > > > with DoT for this purpose. > > > > > > > > > Is there any compelling reason at this point to be considering DoH for > > > recursive resolver-to-authoritative name server communications? > > > > > > > > > As I noted at the DPRIVE interim meeting, the working group needs > > > empirical studies looking at performance and attack vectors for > > > authoritative DNS encryption. > > > > > > > > > Unless there are compelling reasons to consider Authoritative DoH, I > > > propose the working group focus its authoritative DNS encryption > > > assessments around Authoritative DoT. > > > > > > > > > In support, I am willing to co-author an Authoritative DoT operational > > > consideration draft in order to outline the operational challenges the > > > community needs to address - similar to the draft-reid-doh-operator > > > draft between client and recursive. > > > > > > > > > _______________________________________________ > > > Doh mailing list > > > Doh@ietf.org > > > https://www.ietf.org/mailman/listinfo/doh > > > > > > > _______________________________________________ > > Doh mailing list > > Doh@ietf.org > > https://www.ietf.org/mailman/listinfo/doh From nobody Fri Mar 15 04:26:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9C3E127918 for ; Fri, 15 Mar 2019 04:26:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=m0RtsXQt; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=y2z8RMZy Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IkDNyPvRtPWM for ; Fri, 15 Mar 2019 04:26:10 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3385B131227 for ; Fri, 15 Mar 2019 04:26:10 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id E8E5121F93; Fri, 15 Mar 2019 07:26:08 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Fri, 15 Mar 2019 07:26:08 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :cc:subject:content-type; s=fm1; bh=Ve3mjbcmOvS/cVcNQxF0fcq6JWU2 Yb9m9UD97tRDNHI=; b=m0RtsXQtdSrMwbZ0tg8E1JdWl3BnUlbeHnQ9nUZWxR+k xhypaa29lFN5WrL8h5k3w9e4dtN7Tc2DYGO3ME1xv6N5fASQIYFoOd1ipCFhnxTD vDAsbEsKB294pfnqyZaDdy4BiZLfRyXonnwjtPgSJHw03lXWmZxYUCpiXzkLtJ8I 8o0ZOxkzia05kepw+6T7MxTf5bEcQwjZBVmHwDFnPk3UkyLdKutWJ0ZGTvKHYEQd rDyens1gTW9/sNA2nX8/OKRClOZg1w/IazaTC/+kYpC1Gira0VrdGFtawIcNF/bt kJyElx7lR4BAFSA+zNCNGWHAFWYA5VuTcVqPBHWq8A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=Ve3mjb cmOvS/cVcNQxF0fcq6JWU2Yb9m9UD97tRDNHI=; b=y2z8RMZywA0RDgVnvbQTey 8JSGhpw1P2u+UPyMo9r8hWtSa4V5EcpgSQicSAy9Tm0Je+SdWnQc3pCUrgmijl3c /MFcQC1m/GyF/2FgAdk74hkm7IAHzq9+cNip3txkhE85e+GGwNRSc2MwbYSohDBY YIV8u0/LlS4yl1akLCFCfge+8YMYJmAsTC9vu/VKk3xWM+hb/R4ZF4qOyG5vMxbW ueWhSzooIklWGm1qGpy042Z+zFrEOxQjGtoiJOe0uQDGo1Ks95S6zrrWHAolCKRk 50i2ZKFDHwIvDt8BxsUyRPTICi+QyDaxt/F1HX2ukvurVuu5FIlbKCwyO91CF81A == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrheehgddvkecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreerjeenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 34F157C32E; Fri, 15 Mar 2019 07:26:08 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <0c060e21-c1a4-4768-9fad-27ac85da391f@www.fastmail.com> In-Reply-To: <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> Date: Fri, 15 Mar 2019 07:26:10 -0400 From: "Martin Thomson" To: "Jim Reid" Cc: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] =?utf-8?q?Captive_portals_=28was_Re=3A__suggested_slides_f?= =?utf-8?q?or_IETF_104_on_draft-reid-doh-operator=29?= X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 11:26:12 -0000 On Fri, Mar 15, 2019, at 18:39, Jim Reid wrote: > Suppose a DoH client has already bootstrapped itself and knows the > address of its chosen DoH server. The device moves to a new net that > has a captive portal. If the OS catches the captive portal, everything works nicely once the captive portal is dealt with. If the captive portal manages to evade detection... The app might blithely continue. If the resolver is now blocked by the captive portal (remember, we already have an IP address) then name resolution fails the next time it is needed. The app that Daniel talks about is more sophisticated. It attempts to detect the new network and then tries to restart its bootstrapping process. This is highly unreliable both in detecting the move and in detecting the captive portal (after all the OS missed it too). So the sophisticated app often ends up looking like the dumb one. But this isn't that unique. It's not just name resolution that fails in this case. We're back that the "you connected to a broken network" mess I described in my original mail. The only real take-away then is that evading captive portal detection produces a terrible user experience. From nobody Fri Mar 15 05:22:33 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 828BA131221; Fri, 15 Mar 2019 05:22:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5yAosNDUZuCE; Fri, 15 Mar 2019 05:22:23 -0700 (PDT) Received: from mail-wm1-x32d.google.com (mail-wm1-x32d.google.com [IPv6:2a00:1450:4864:20::32d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08714130E62; Fri, 15 Mar 2019 05:22:23 -0700 (PDT) Received: by mail-wm1-x32d.google.com with SMTP id e16so5910664wme.1; Fri, 15 Mar 2019 05:22:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:cc:references:from:to:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding:content-language; bh=eYa7evyZJ7LyoIONTGCJ3o68XWbaFYDNCu2Fo6fzzDo=; b=RN0KcJnCpWglS1n/divHFfj67k2sqiGYoC0cH2AvHEVA/f9U0PigD7MTZp3ThyA59I ezWNHIo/r0EN8OY/ukSzy62y6sW5ac4Waw/hYCRDwd3CjYAPNp9pRTDgU/fgkIzRojNJ JClUejeIN+PggRB3A9RqCylg8A9pG/vtsXuiA11Ggv0KOpB1oHJPyUCK/jXGw5dPOx9T aw7lFabrqA+JqhhV06SLJRIylDoM2p/Cfifs+bthOOwdY7WTiNVY2tGbfI59/IXOCilU DaCOmjH+Ee899c+jI1U5uyVAVqh/e9F/i3nDX70OJpHsulxLmOsmLoaajUcbjrhdTfJA G0ZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:cc:references:from:to:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding :content-language; bh=eYa7evyZJ7LyoIONTGCJ3o68XWbaFYDNCu2Fo6fzzDo=; b=fgjtvnGZBb0vj/4ryf86wFdhAamC9qNgJ8cwz4meyyay2b7H8nXT5+Ak6Y3b+ZBG1J JbENZA2pzXNbIxNy41thwLeBLC94QrRlTfGAlXVnFQWt7SjnNugEodIsQG1lh5lJHw2r PT+k4w0E2UiS5O09CHfgPHDLYYQdVkB8mho4bWpr2nQgHOU+iBIhRJJuP/3gM0vHr6xv UnGhBddAPlOXeaSCv5LLaKVvD791Y8XZuKIezp3JKJVuK4M/VNCXFuWt2skeH7CqhALY vNTaYn37cn/k1Cel9Nj8yPCg8CsqUpXnYYh4PITqhPAak+f2aBtmmGBgtAylxbaMAfzI nMfg== X-Gm-Message-State: APjAAAVMHI+jtE2ozEZezlW6lt42liNTtGnX2Q/3sHFmAITJ/PrOHowf vvlZSjLoxHSKf6QV2ebVJ5RTdYNf X-Google-Smtp-Source: APXvYqxOxIkQ7SSLB6+I/FHcqsKlHmXdEKkDe6L11OFIl4cZwidcSBiRpeEX/MI2SY7v9ZXzFaHBfA== X-Received: by 2002:a7b:c5c3:: with SMTP id n3mr2058477wmk.82.1552652541184; Fri, 15 Mar 2019 05:22:21 -0700 (PDT) Received: from ROADKILL.local ([132.185.158.35]) by smtp.gmail.com with ESMTPSA id v20sm7536402wmj.2.2019.03.15.05.22.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 15 Mar 2019 05:22:20 -0700 (PDT) Cc: captive-portals@ietf.org References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> <0c060e21-c1a4-4768-9fad-27ac85da391f@www.fastmail.com> From: Thomas Peterson To: doh@ietf.org Message-ID: Date: Fri, 15 Mar 2019 12:22:19 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <0c060e21-c1a4-4768-9fad-27ac85da391f@www.fastmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-GB Archived-At: Subject: Re: [Doh] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 12:22:25 -0000 (to those exclusively on the captive-portals list, this email follows on a discussion around a presentation discussing implications of DNS over HTTP in networks where captive portals are present) On 15/03/2019 11:26, Martin Thomson wrote: > If the OS catches the captive portal, everything works nicely once the captive portal is dealt with. If the captive portal manages to evade detection... As there are numerous folk from browser and OS vendors within this mailing list who implement capture portal detection, would there benefit in authoring an informational document covering capture portal detection methods in the absence of a network's DHCP service not implementing RFC 7710? Such a document may help describe common methods to inform implementers and minimise detection evading capture portals. It may be better placed in the capport WG instead of doh. Regards From nobody Fri Mar 15 06:13:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB36E131236 for ; Fri, 15 Mar 2019 06:13:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3oxlREO2a-wU for ; Fri, 15 Mar 2019 06:13:10 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB9AE131234 for ; Fri, 15 Mar 2019 06:13:09 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id w26so2853274vsk.13 for ; Fri, 15 Mar 2019 06:13:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=DQw1K+ldNr+hwhiOx4Wn+3ebb2dQfepZmD5PWbpmk3w=; b=u2SUFpJrIm9FCv9QiwHJd3vPrlVSE6DMoSZYsjFfd7KGZTHNYnI/E8st6WbeNR7wnq EhfToXYuT7qW1pyKGcg4XgZxKPHe27vThjq+hJQIYJjbtsuAlp+QqaZlO/UyVu0I4wpO X+/cLe5tvKlZYq5H6Zors02bIT49i5WkAojxakYJJ6hfl0/DIG7JxpCH/SSDSoS2tYcj ks4CbHZsa9WmopNcPXP3lLQwXdQHaBJwY7TeaIbrFq4PVXvMvuSIREC+AARsYK6ejx3+ WBJNUfs+Z3CnajZAf7QOCqeOJa3ili4HwyIFfrImxVMA57bDxVhnJBl9P6ejWYuFEIMq TVEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=DQw1K+ldNr+hwhiOx4Wn+3ebb2dQfepZmD5PWbpmk3w=; b=XHGy4XQUMgcD7A3eK6djQP8xh2U6jkRNtYyv9PEn+y0nWd6b3L+vBmZl1QUtzSl/4x dZ9xIXQrU/WOnfxNoTKEmo+Yqe34CkWH11IdEPKpfP9af56TlbJQ/0UfLgqZQtKtEqqi Xp/VOOJhZWPFVj8wUO+EWRMb7EU6PrEokO2ytJmeUgDBGgpIaaoOFGCiODB13Gr7YiPz 50BTTv4b+3cyOz3phIty9icpCNqnsGBKwDl28YC260/m5R8NSzP49yw7s+vixFgcipeJ U1Bv0V43w9L2cDu6PHDQ9S+feqfzDds3Tn51PzDhLXJiap7wC3njjGa4vjpxxKGqXl9L 0gig== X-Gm-Message-State: APjAAAVayxvWsm51B+x07Bl/M/LNbmgl8RLOGBTX8KHe/SrGWfHozg0H lzWsBFD61eIlDfLSdhtt7IOl7qNUJ/Z2FqBQsWoyAkGZRe4= X-Google-Smtp-Source: APXvYqx9I6/oN64eJDjX6ihQJC6GggogQn4NhNyhB6SGn3zIbNs/wCISjtI72SZQ48SNSlfenVlE/gaSdhK3gcmaroI= X-Received: by 2002:a67:ee86:: with SMTP id n6mr1822766vsp.92.1552655588559; Fri, 15 Mar 2019 06:13:08 -0700 (PDT) MIME-Version: 1.0 From: Ben Schwartz Date: Fri, 15 Mar 2019 09:12:56 -0400 Message-ID: To: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000d770fb058421cc8f" Archived-At: Subject: [Doh] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 13:13:12 -0000 --000000000000d770fb058421cc8f Content-Type: multipart/alternative; boundary="000000000000d0f1f7058421cc34" --000000000000d0f1f7058421cc34 Content-Type: text/plain; charset="UTF-8" I'd like to thank the working group participants for the extensive discussion of our most recent drafts. However, I would appreciate more review of the Resolver-Associated DOH draft, which has the largest time segment allocated for the upcoming meeting. This draft contains several components that have been controversial in the past: 1. IP-address certificates 2. A new .well-known endpoint 3. JSON 4. Recursive resolvers synthesizing responses as if they were authoritative for certain names 5. Machine-readable content in a TXT record Also, the draft does not enable the use of DoH if (1) an application relies on POSIX-like DNS APIs to bootstrap AND (2) the resolver is only reachable on a non-public IP address (e.g. RFC 1918). This is a side effect of the requirement that the DoH server provide a valid certificate for its name, chained to a root that is already trusted by the client. This draft does not alter that requirement. If any of these technical elements are of concern to you, please comment now, so that the meeting can be as productive as possible. --Ben --000000000000d0f1f7058421cc34 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'd like to thank the working group participants for t= he extensive discussion of our most recent drafts.=C2=A0 However, I would a= ppreciate more review of the Resolver-Associated DOH draft, which has the l= argest time segment allocated for the upcoming meeting.=C2=A0 This draft co= ntains several components that have been controversial in the past:
1. IP-address certificates
2. A new .well-known endpo= int
3. JSON
4. Recursive resolvers synthesizing respons= es as if they were authoritative for certain names
5. Machine-rea= dable content in a TXT record

Also, the draft does= not enable the use of DoH if (1) an application relies on POSIX-like DNS A= PIs to bootstrap AND (2) the resolver is only reachable on a non-public IP = address (e.g. RFC 1918).=C2=A0 This is a side effect of the requirement tha= t the DoH server provide a valid certificate for its name, chained to a roo= t that is already trusted by the client.=C2=A0 This draft does not alter th= at requirement.

If any of these technical elements= are of concern to you, please comment now, so that the meeting can be as p= roductive as possible.

--Ben
--000000000000d0f1f7058421cc34-- --000000000000d770fb058421cc8f Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCA3gjMU/gjDpBgU05HdjVWn ZGaMNZm9az5NYwd4qfoLPzAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMTUxMzEzMDlaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAol9ke++tFir0MdRlX/ovgy8LPRzJpQiLoDBt+b6W roUx4ZBqTpKZ7mJts3BloR54XnzwuhRYjbxdSs5X6b6fQMtVXgdfZsJeup3YYxck6wrDceHcMKr2 VAbTdtUS5ODyRUg7cDErvcHiQISPfvjr3griqJx9m4ldW7fvHAvvVw1oQekNA++YiWJtKTc43ysv MGm57htB3dGeZ60WJacvnfIqF2JulYsYFxIM7cnISztcvxsGt4yFjfSSbaVgf3oaB0DmZo79njHE CvOYY7OhPshtFVdg0WKubUgLGTNaXZafBT9wwjb5u2u64vrVElkw4887Gd1ovckaS7JLPa1zHw== --000000000000d770fb058421cc8f-- From nobody Fri Mar 15 06:41:41 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6E2C131252 for ; Fri, 15 Mar 2019 06:41:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zgvcHV04CGHW for ; Fri, 15 Mar 2019 06:41:38 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40086.outbound.protection.outlook.com [40.107.4.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4B61131255 for ; Fri, 15 Mar 2019 06:41:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2ZC/4qLXHl+T++jsOVfAlhYdt7znU4PKK2cUTI9XuzQ=; b=lvRBU5cgaEad6id32L4EbzMcscUnnE6vlKjeGVigDPAmbyroLGZBlbBqExd89VkjQv5wk7G5FTwZsQ5DQ4iGkkD4PsTfP42PMLudC6/VIzm1Sw/T3ROE0Mf7soNTdz3LCN9xFUQ9et/LvAnhSB/ydDRp646i2DsaX/22LwfqMS8= Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com (10.167.132.7) by AM4PR0601MB2114.eurprd06.prod.outlook.com (10.167.123.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.14; Fri, 15 Mar 2019 13:41:35 +0000 Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c]) by AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c%7]) with mapi id 15.20.1709.011; Fri, 15 Mar 2019 13:41:34 +0000 From: "Winfield, Alister" To: Ben Schwartz , DoH WG Thread-Topic: [EXTERNAL] [Doh] Reviewing Resolver-Associated DOH Thread-Index: AQHU2zDgdC+hW+Sxh0WNA4zTYA6Ad6YMsq0A Date: Fri, 15 Mar 2019 13:41:34 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e20a:2d00:95a4:4072:f8fe:2d75] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 0cd65c23-2a69-4742-73e0-08d6a94bf0f5 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:AM4PR0601MB2114; x-ms-traffictypediagnostic: AM4PR0601MB2114: x-microsoft-antispam-prvs: x-forefront-prvs: 09778E995A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(346002)(366004)(376002)(136003)(39860400002)(396003)(199004)(189003)(186003)(106356001)(71200400001)(71190400001)(6486002)(6436002)(478600001)(83716004)(36756003)(229853002)(72206003)(86362001)(6116002)(82746002)(74482002)(2906002)(14444005)(5024004)(81166006)(8676002)(256004)(33656002)(81156014)(25786009)(46003)(68736007)(11346002)(446003)(6506007)(14454004)(6246003)(316002)(53936002)(5660300002)(97736004)(76176011)(2616005)(110136005)(7736002)(58126008)(6512007)(102836004)(6306002)(486006)(99286004)(476003)(54896002)(105586002)(8936002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0601MB2114; H:AM4PR0601MB2180.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: JcB5HprkkBdrlHLEYEcsE9oAj5ETAnifjrp5ElHjts8ZwzBVAbyfmvsRwMt9beU7PG7clM3ffgaQ+iex0uTpo0EwduNf8FKUDpTbDLXgE9CFOmz6vVqdGlNftv1UMa1iROIgmxUpJeuhPnc2clqJ3MnsV691YUPUu+oJ0Ic63LSSlALNLLCQuDvMi4s+mF+kFElRRRUSVTrvsS9PEr8eFJXFzNJbOLx4qfgLMC4z9SHqJ1tXnKfKwiwLaxdRc8lvZqKcEN3354T7yLHlXLSkWPw9x+ly+jMR4CL6dIN6sl+d1VVBQbPAP86Wu6AZgHyefaHQ5NTQys1md5V3Eo2l2dxHrKzlj5+tAvo1pF1hXUs9VVf9KzZdwDY2r7AP7acQjcALuYsHAzwY5AJWdR3KVabz+ekWv+B2QhV+3NgmuM8= Content-Type: multipart/alternative; boundary="_000_ED16E0D8BBCB4316A116BA8513F523A3skyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 0cd65c23-2a69-4742-73e0-08d6a94bf0f5 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2019 13:41:34.8682 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0601MB2114 Archived-At: Subject: Re: [Doh] [EXTERNAL] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 13:41:41 -0000 --_000_ED16E0D8BBCB4316A116BA8513F523A3skyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCg0KICAxLiAgSVAtYWRkcmVzcyBjZXJ0aWZpY2F0ZXMNCg0KQmFkICEgRXNwZWNpYWxseSBp ZiB0aGUgbGVzcyBlbmxpZ2h0ZW5lZCB0aGluayB0byB0cnkgdG8gY3JlYXRlIGEgY2VydGlmaWNh dGUgZm9yIGEgcHJpdmF0ZSBJUC4gVmVyeSBiYWQgaWRlYS4NCg0KDQogIDEuICBBIG5ldyAud2Vs bC1rbm93biBlbmRwb2ludA0KDQpNYXliZSBzb21lb25lIGNhbiBzdWdnZXN0IGEgYmV0dGVyIGxv Y2F0aW9uIHRoYXQgZG9lc27igJl0IGJyZWFrIHRoaW5ncy4NCg0KNC4gUmVjdXJzaXZlIHJlc29s dmVycyBzeW50aGVzaXppbmcgcmVzcG9uc2VzIGFzIGlmIHRoZXkgd2VyZSBhdXRob3JpdGF0aXZl IGZvciBjZXJ0YWluIG5hbWVzDQo1LiBNYWNoaW5lLXJlYWRhYmxlIGNvbnRlbnQgaW4gYSBUWFQg cmVjb3JkDQoNCkFsc28sIHRoZSBkcmFmdCBkb2VzIG5vdCBlbmFibGUgdGhlIHVzZSBvZiBEb0gg aWYgKDEpIGFuIGFwcGxpY2F0aW9uIHJlbGllcyBvbiBQT1NJWC1saWtlIEROUyBBUElzIHRvIGJv b3RzdHJhcCBBTkQgKDIpIHRoZSByZXNvbHZlciBpcyBvbmx5IHJlYWNoYWJsZSBvbiBhIG5vbi1w dWJsaWMgSVAgYWRkcmVzcyAoZS5nLiBSRkMgMTkxOCkuICBUaGlzIGlzIGEgc2lkZSBlZmZlY3Qg b2YgdGhlIHJlcXVpcmVtZW50IHRoYXQgdGhlIERvSCBzZXJ2ZXIgcHJvdmlkZSBhIHZhbGlkIGNl cnRpZmljYXRlIGZvciBpdHMgbmFtZSwgY2hhaW5lZCB0byBhIHJvb3QgdGhhdCBpcyBhbHJlYWR5 IHRydXN0ZWQgYnkgdGhlIGNsaWVudC4gIFRoaXMgZHJhZnQgZG9lcyBub3QgYWx0ZXIgdGhhdCBy ZXF1aXJlbWVudC4NCg0KSWYgYW55IG9mIHRoZXNlIHRlY2huaWNhbCBlbGVtZW50cyBhcmUgb2Yg Y29uY2VybiB0byB5b3UsIHBsZWFzZSBjb21tZW50IG5vdywgc28gdGhhdCB0aGUgbWVldGluZyBj YW4gYmUgYXMgcHJvZHVjdGl2ZSBhcyBwb3NzaWJsZS4NCg0KLS1CZW4NCkluZm9ybWF0aW9uIGlu IHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwg Y29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFkZHJlc3Nl ZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwgYnV0IHRo ZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQg aXQgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBieSByZXR1cm4gZS1tYWlsIGFu ZCBkZWxldGUgaXQgZnJvbSB5b3VyIHN5c3RlbS4gWW91IHNob3VsZCBub3QgcmVwcm9kdWNlLCBk aXN0cmlidXRlLCBzdG9yZSwgcmV0cmFuc21pdCwgdXNlIG9yIGRpc2Nsb3NlIGl0cyBjb250ZW50 cyB0byBhbnlvbmUuIFBsZWFzZSBub3RlIHdlIHJlc2VydmUgdGhlIHJpZ2h0IHRvIG1vbml0b3Ig YWxsIGUtbWFpbCBjb21tdW5pY2F0aW9uIHRocm91Z2ggb3VyIGludGVybmFsIGFuZCBleHRlcm5h bCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtzIG9mIFNreSBM aW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5kZXIgbGljZW5j ZS4NCg0KU2t5IFVLIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjkwNjk5MSksIFNreS1Jbi1I b21lIFNlcnZpY2UgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMDY3MDc1KSwgU2t5IFN1YnNj cmliZXJzIFNlcnZpY2VzIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjM0MDE1MCkgYW5kIFNr eSBDUCBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDk1MTMyNTkpIGFyZSBkaXJlY3Qgb3IgaW5k aXJlY3Qgc3Vic2lkaWFyaWVzIG9mIFNreSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIyNDc3 MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJl IGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVn aXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNleCBUVzcgNVFE DQo= --_000_ED16E0D8BBCB4316A116BA8513F523A3skyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <84B1F4B812CFF044B46DC3B980D9F82C@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNYWxndW4g R290aGljIjsNCglwYW5vc2UtMToyIDExIDUgMyAyIDAgMCAyIDAgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQ7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIg MiAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiXEBNYWxndW4gR290aGljIjt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywg c3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYz QzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlw ZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7 DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1z b0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0 eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1ib3R0 b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpw Lm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1u YW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0No cERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBw dDt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2lu OjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1s aXN0LWlkOjIwOTg4NjkzNzg7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVt cGxhdGUtaWRzOi05NDQ4MzY3NjQgOTQ3Mjk0MTY4IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAz IDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1O30NCkBsaXN0IGww OmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6NTQuMHB0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2Vy Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246 bGVmdDsNCgltYXJnaW4tbGVmdDo5MC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlz dCBsMDpsZXZlbDMNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN CgltYXJnaW4tbGVmdDoxMjYuMHB0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDps ZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjE2Mi4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9 DQpAbGlzdCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCW1hcmdpbi1sZWZ0OjE5OC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlz dCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN CgltYXJnaW4tbGVmdDoyMzQuMHB0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpAbGlzdCBsMDps ZXZlbDcNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3Np dGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0OjI3MC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9 DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCW1hcmdpbi1sZWZ0OjMwNi4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlz dCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsN CgltYXJnaW4tbGVmdDozNDIuMHB0Ow0KCXRleHQtaW5kZW50Oi05LjBwdDt9DQpvbA0KCXttYXJn aW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxlPg0K PC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9IiMwNTYzQzEiIHZsaW5rPSIjOTU0Rjcy Ij4NCjxkaXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFy Z2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6LXdlYmtpdC1zdGFuZGFy ZDtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2 Pg0KPG9sIHN0eWxlPSJtYXJnaW4tdG9wOjBjbSIgc3RhcnQ9IjEiIHR5cGU9IjEiPg0KPGxpIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0iY29sb3I6YmxhY2s7bWFyZ2luLWxlZnQ6MTgu MHB0O21zby1saXN0OmwwIGxldmVsMSBsZm8xIj4NCjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTot d2Via2l0LXN0YW5kYXJkIj5JUC1hZGRyZXNzIGNlcnRpZmljYXRlczxvOnA+PC9vOnA+PC9zcGFu PjwvbGk+PC9vbD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LWZhbWls eTotd2Via2l0LXN0YW5kYXJkIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6NTQuMHB0Ij5CYWQgISBFc3BlY2lhbGx5 IGlmIHRoZSBsZXNzIGVubGlnaHRlbmVkIHRoaW5rIHRvIHRyeSB0byBjcmVhdGUgYSBjZXJ0aWZp Y2F0ZSBmb3IgYSBwcml2YXRlIElQLiBWZXJ5IGJhZCBpZGVhLjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjU0LjBwdCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGNtIiBzdGFy dD0iMiIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJjb2xv cjpibGFjazttYXJnaW4tbGVmdDoxOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KPHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQiPkEgbmV3IC53ZWxsLWtub3du IGVuZHBvaW50PG86cD48L286cD48L3NwYW4+PC9saT48L29sPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQiPjxvOnA+Jm5ic3A7 PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVm dDo1NC4wcHQiPk1heWJlIHNvbWVvbmUgY2FuIHN1Z2dlc3QgYSBiZXR0ZXIgbG9jYXRpb24gdGhh dCBkb2VzbuKAmXQgYnJlYWsgdGhpbmdzLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6LXdlYmtpdC1zdGFuZGFyZDtjb2xvcjpibGFjayI+NC4gUmVjdXJz aXZlIHJlc29sdmVycyBzeW50aGVzaXppbmcgcmVzcG9uc2VzIGFzIGlmIHRoZXkgd2VyZSBhdXRo b3JpdGF0aXZlIGZvciBjZXJ0YWluIG5hbWVzPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+ PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQ7Y29sb3I6YmxhY2siPjUu IE1hY2hpbmUtcmVhZGFibGUgY29udGVudCBpbiBhIFRYVCByZWNvcmQ8bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6LXdlYmtpdC1zdGFuZGFyZDtj b2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5 bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQ7Y29sb3I6YmxhY2siPkFsc28sIHRoZSBk cmFmdCBkb2VzIG5vdCBlbmFibGUgdGhlIHVzZSBvZiBEb0ggaWYgKDEpIGFuIGFwcGxpY2F0aW9u IHJlbGllcyBvbiBQT1NJWC1saWtlIEROUyBBUElzIHRvIGJvb3RzdHJhcCBBTkQgKDIpIHRoZSBy ZXNvbHZlciBpcyBvbmx5IHJlYWNoYWJsZSBvbg0KIGEgbm9uLXB1YmxpYyBJUCBhZGRyZXNzIChl LmcuIFJGQyAxOTE4KS4mbmJzcDsgVGhpcyBpcyBhIHNpZGUgZWZmZWN0IG9mIHRoZSByZXF1aXJl bWVudCB0aGF0IHRoZSBEb0ggc2VydmVyIHByb3ZpZGUgYSB2YWxpZCBjZXJ0aWZpY2F0ZSBmb3Ig aXRzIG5hbWUsIGNoYWluZWQgdG8gYSByb290IHRoYXQgaXMgYWxyZWFkeSB0cnVzdGVkIGJ5IHRo ZSBjbGllbnQuJm5ic3A7IFRoaXMgZHJhZnQgZG9lcyBub3QgYWx0ZXIgdGhhdCByZXF1aXJlbWVu dC48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6 LXdlYmtpdC1zdGFuZGFyZDtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9w Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0 OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQ7Y29sb3I6 YmxhY2siPklmIGFueSBvZiB0aGVzZSB0ZWNobmljYWwgZWxlbWVudHMgYXJlIG9mIGNvbmNlcm4g dG8geW91LCBwbGVhc2UgY29tbWVudCBub3csIHNvIHRoYXQgdGhlIG1lZXRpbmcgY2FuIGJlIGFz IHByb2R1Y3RpdmUgYXMgcG9zc2libGUuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQ7Y29sb3I6YmxhY2siPjxvOnA+ Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4wcHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTot d2Via2l0LXN0YW5kYXJkO2NvbG9yOmJsYWNrIj4tLUJlbjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4N CjwvZGl2Pg0KPC9kaXY+DQpJbmZvcm1hdGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1ZGluZyBhbnkg YXR0YWNobWVudHMgbWF5IGJlIHByaXZpbGVnZWQsIGNvbmZpZGVudGlhbCBhbmQgaXMgaW50ZW5k ZWQgZXhjbHVzaXZlbHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSB2aWV3cyBleHByZXNzZWQgbWF5 IG5vdCBiZSBvZmZpY2lhbCBwb2xpY3ksIGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mgb2YgdGhlIG9y aWdpbmF0b3IuIElmIHlvdSBoYXZlIHJlY2VpdmVkIGl0IGluIGVycm9yLCBwbGVhc2UNCiBub3Rp ZnkgdGhlIHNlbmRlciBieSByZXR1cm4gZS1tYWlsIGFuZCBkZWxldGUgaXQgZnJvbSB5b3VyIHN5 c3RlbS4gWW91IHNob3VsZCBub3QgcmVwcm9kdWNlLCBkaXN0cmlidXRlLCBzdG9yZSwgcmV0cmFu c21pdCwgdXNlIG9yIGRpc2Nsb3NlIGl0cyBjb250ZW50cyB0byBhbnlvbmUuIFBsZWFzZSBub3Rl IHdlIHJlc2VydmUgdGhlIHJpZ2h0IHRvIG1vbml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9u IHRocm91Z2ggb3VyIGludGVybmFsIGFuZA0KIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRo ZSBTS1kgbWFya3MgYXJlIHRyYWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5h dGlvbmFsIEFHIGFuZCBhcmUgdXNlZCB1bmRlciBsaWNlbmNlLg0KPGJyPg0KPGJyPg0KU2t5IFVL IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjkwNjk5MSksIFNreS1Jbi1Ib21lIFNlcnZpY2Ug TGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMDY3MDc1KSwgU2t5IFN1YnNjcmliZXJzIFNlcnZp Y2VzIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjM0MDE1MCkgYW5kIFNreSBDUCBMaW1pdGVk IChSZWdpc3RyYXRpb24gTm8uIDk1MTMyNTkpIGFyZSBkaXJlY3Qgb3IgaW5kaXJlY3Qgc3Vic2lk aWFyaWVzIG9mIFNreSBMaW1pdGVkIChSZWdpc3RyYXRpb24NCiBOby4gMjI0NzczNSkuIEFsbCBv ZiB0aGUgY29tcGFuaWVzIG1lbnRpb25lZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3Jh dGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVzIGFuZCBzaGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9m ZmljZSBhdCBHcmFudCBXYXksIElzbGV3b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQNCjwvYm9keT4N CjwvaHRtbD4NCg== --_000_ED16E0D8BBCB4316A116BA8513F523A3skyuk_-- From nobody Fri Mar 15 06:51:29 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9C5E130DC4 for ; Fri, 15 Mar 2019 06:51:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QbuvTxtr6SOC for ; Fri, 15 Mar 2019 06:51:24 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150049.outbound.protection.outlook.com [40.107.15.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 382AF129441 for ; Fri, 15 Mar 2019 06:51:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=ruCWg7JeWqUbZxZZrp0uWg/9ib5XmV5Pl4lE9LcmdRQ=; b=PE4yTcTErJ41qowwUKVw8ZW/m+qWyEbbj6g3ytWNQJj0gS3XjiGhmcju+G5sGN4RHWe/kzGz4oWt7/LUvhaszkHM7lrkPpdHAE0M7bX4r2NX3MbyULZkFm8CGJ+lLta0yCV7M8E25HCRyorMIl2V2V5CMZWgoFdJoD7vYafYQZE= Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com (10.167.132.7) by AM4PR0601MB2225.eurprd06.prod.outlook.com (10.167.132.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.14; Fri, 15 Mar 2019 13:51:20 +0000 Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c]) by AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c%7]) with mapi id 15.20.1709.011; Fri, 15 Mar 2019 13:51:20 +0000 From: "Winfield, Alister" To: Ben Schwartz , DoH WG Thread-Topic: [EXTERNAL] [Doh] Reviewing Resolver-Associated DOH Thread-Index: AQHU2zDgdC+hW+Sxh0WNA4zTYA6Ad6YMsq0AgAACugA= Date: Fri, 15 Mar 2019 13:51:20 +0000 Message-ID: <82AF02E3-7AE7-4C44-A4EF-FB3C051A8A76@sky.uk> References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e20a:2d00:95a4:4072:f8fe:2d75] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2bd43656-9681-4326-b82f-08d6a94d4e1b x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:AM4PR0601MB2225; x-ms-traffictypediagnostic: AM4PR0601MB2225: x-microsoft-antispam-prvs: x-forefront-prvs: 09778E995A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(376002)(346002)(39860400002)(136003)(189003)(199004)(110136005)(478600001)(97736004)(8676002)(72206003)(14454004)(71200400001)(81166006)(81156014)(6436002)(256004)(71190400001)(33656002)(46003)(14444005)(36756003)(6486002)(83716004)(5024004)(53936002)(2906002)(316002)(11346002)(2616005)(446003)(476003)(45080400002)(8936002)(5660300002)(105586002)(7736002)(6246003)(58126008)(486006)(68736007)(6512007)(6306002)(54896002)(25786009)(106356001)(74482002)(102836004)(229853002)(6116002)(82746002)(86362001)(6506007)(76176011)(99286004)(186003); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0601MB2225; H:AM4PR0601MB2180.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: XG1MXFTjMbLCVSyyj1VyMz0Mpx5vKhToWCWGIoI7sAS8edxGgl8YmDKvlfzE9+cGiTxuAWa/wl1572KOM/iQU714kBDdxT5hTKSeF6TKalVlFjQi0xfF76vIr6LCGiTa8LXoeO74BV9QBX/yu7f3pUQnlpBvgUMC116Ghu9ZLPzu/eUa9meeuxxvG4l5cEE/2nG2aP52Rpnzt4mxA9iUAkJ02rb36NJE+AbyHvPd9Dk6nOyAJYOnIq8mHEHDp9DkTapVqADMqfITkFs6dtGUfd/+HpFqsBD9O+MoHWWd3nO0Wzt+052HDROAaDyuncKWvn0VrusjVPmcXDbVih3pc5BipPEovTojBNeDSmt5D6MYkTF+HZgqoTUJVVED0PbR3TeoWarZ63K7FiFY2XgMS00Wv0QekIW8IHIp3rWDFwA= Content-Type: multipart/alternative; boundary="_000_82AF02E37AE74C44A4EFFB3C051A8A76skyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 2bd43656-9681-4326-b82f-08d6a94d4e1b X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2019 13:51:20.6068 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0601MB2225 Archived-At: Subject: Re: [Doh] [EXTERNAL] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 13:51:27 -0000 --_000_82AF02E37AE74C44A4EFFB3C051A8A76skyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Q29udGludWluZyAoc2lnaCBvdXRsb29rIHNob3J0Y3V0cyBzdGluaykuDQoNCg0KNS4gTWFjaGlu ZS1yZWFkYWJsZSBjb250ZW50IGluIGEgVFhUIHJlY29yZA0KDQogSSBoYXRlIGl0IG92ZXJsb2Fk aW5nIFRYVC4gVFhUIHVzYWdlIGlzIGFscmVhZHkgZnVsbCBvZiBob3Jyb3JzLCBJIGtub3cgd2hl biBsb29raW5nIGZvciDigJhxdWlja+KAmSBzb2x1dGlvbnMgaXTigJlzIHRoZXJlIGl0cyBlYXN5 IGFuZCBpdHMgbGlrZWx5IHRvIHdvcmsuIFRoYXTigJlzIG5vdCBob3cgcHJvdG9jb2wgZGV2ZWxv cG1lbnRzIHNob3VsZCBiZSwgaXMgaXQgdGhlIOKAmHJpZ2h04oCZIG9wdGlvbiA/IElmIHRoZXJl IGlzbuKAmXQgYSBiZXR0ZXIgYW5zd2VyIHRoZW4gZmluZSBUWFQgaXQgaXMuDQoNCkluZm9ybWF0 aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmls ZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFk ZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwg YnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVj ZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBieSByZXR1cm4gZS1t YWlsIGFuZCBkZWxldGUgaXQgZnJvbSB5b3VyIHN5c3RlbS4gWW91IHNob3VsZCBub3QgcmVwcm9k dWNlLCBkaXN0cmlidXRlLCBzdG9yZSwgcmV0cmFuc21pdCwgdXNlIG9yIGRpc2Nsb3NlIGl0cyBj b250ZW50cyB0byBhbnlvbmUuIFBsZWFzZSBub3RlIHdlIHJlc2VydmUgdGhlIHJpZ2h0IHRvIG1v bml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9uIHRocm91Z2ggb3VyIGludGVybmFsIGFuZCBl eHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtzIG9m IFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5kZXIg bGljZW5jZS4NCg0KU2t5IFVLIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjkwNjk5MSksIFNr eS1Jbi1Ib21lIFNlcnZpY2UgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMDY3MDc1KSwgU2t5 IFN1YnNjcmliZXJzIFNlcnZpY2VzIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjM0MDE1MCkg YW5kIFNreSBDUCBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDk1MTMyNTkpIGFyZSBkaXJlY3Qg b3IgaW5kaXJlY3Qgc3Vic2lkaWFyaWVzIG9mIFNreSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8u IDIyNDc3MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJhZ3Jh cGggYXJlIGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhlIHNh bWUgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNleCBU VzcgNVFEDQo= --_000_82AF02E37AE74C44A4EFFB3C051A8A76skyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <1C38D563BA429B4C8752D0D1BE071035@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNYWxndW4g R290aGljIjsNCglwYW5vc2UtMToyIDExIDUgMyAyIDAgMCAyIDAgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQ7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIg MiAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiXEBNYWxndW4gR290aGljIjt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywg c3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYz QzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlw ZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7 DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1z b0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdyYXBoDQoJe21zby1zdHlsZS1wcmlvcml0 eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1hcmdpbi1ib3R0 b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpw Lm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1u YW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6 MGNtOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNw YW4uRW1haWxTdHlsZTE5DQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsOw0KCWZvbnQtZmFtaWx5 OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5FbWFpbFN0 eWxlMjANCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1pbHk6IkNh bGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0K CXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30NCkBwYWdl IFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJnaW46NzIuMHB0IDcy LjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlv bjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNvLWxpc3QtaWQ6NjUx MjU1Mjk0Ow0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxNjI5MTQwMjQyO30NCkBsaXN0IGwwOmxl dmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6MzYuMHB0 Ow0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0 O30NCkBsaXN0IGwxDQoJe21zby1saXN0LWlkOjE3Njg2NDcxMDk7DQoJbXNvLWxpc3QtdGVtcGxh dGUtaWRzOi0yMzgzODI3MTg7fQ0KQGxpc3QgbDINCgl7bXNvLWxpc3QtaWQ6MjA5ODg2OTM3ODsN Cgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10ZW1wbGF0ZS1pZHM6LTk0NDgzNjc2 NCA5NDcyOTQxNjggNjc2OTg3MTMgNjc2OTg3MTUgNjc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTUg Njc2OTg3MDMgNjc2OTg3MTMgNjc2OTg3MTU7fQ0KQGxpc3QgbDI6bGV2ZWwxDQoJe21zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgltYXJn aW4tbGVmdDo1NC4wcHQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDt9DQpAbGlzdCBsMjpsZXZlbDIN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1z dG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCW1hcmdpbi1sZWZ0 OjkwLjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVsMw0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1sZWZ0OjEyNi4w cHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwyOmxldmVsNA0KCXttc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2lu LWxlZnQ6MTYyLjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVsNQ0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6 MTk4LjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVsNg0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1sZWZ0OjIzNC4w cHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCkBsaXN0IGwyOmxldmVsNw0KCXttc28tbGV2ZWwt dGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2lu LWxlZnQ6MjcwLjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVsOA0K CXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBoYS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJbWFyZ2luLWxlZnQ6 MzA2LjBwdDsNCgl0ZXh0LWluZGVudDotMTguMHB0O30NCkBsaXN0IGwyOmxldmVsOQ0KCXttc28t bGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCW1hcmdpbi1sZWZ0OjM0Mi4w cHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVs DQoJe21hcmdpbi1ib3R0b206MGNtO30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5n PSJFTi1HQiIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29y ZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0Ij5Db250aW51aW5nIChzaWdoIG91dGxvb2sgc2hvcnRjdXRzIHN0aW5rKS48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwv cD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDo3Mi4w cHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTotd2Via2l0LXN0YW5kYXJkO2NvbG9yOmJsYWNr Ij41LiBNYWNoaW5lLXJlYWRhYmxlIGNvbnRlbnQgaW4gYSBUWFQgcmVjb3JkPC9zcGFuPjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1h cmdpbi1sZWZ0OjcyLjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRh cmQ7Y29sb3I6YmxhY2siPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDo3Mi4wcHQiPjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTotd2Via2l0LXN0YW5kYXJkO2NvbG9yOmJsYWNrIj4mbmJzcDs8 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQiPkkgaGF0ZSBp dCBvdmVybG9hZGluZyBUWFQuIFRYVCB1c2FnZSBpcyBhbHJlYWR5IGZ1bGwgb2YgaG9ycm9ycywg SSBrbm93IHdoZW4gbG9va2luZyBmb3Ig4oCYcXVpY2vigJkgc29sdXRpb25zDQogaXTigJlzIHRo ZXJlIGl0cyBlYXN5IGFuZCBpdHMgbGlrZWx5IHRvIHdvcmsuIFRoYXTigJlzIG5vdCBob3cgcHJv dG9jb2wgZGV2ZWxvcG1lbnRzIHNob3VsZCBiZSwgaXMgaXQgdGhlIOKAmHJpZ2h04oCZIG9wdGlv biA/IElmIHRoZXJlIGlzbuKAmXQgYSBiZXR0ZXIgYW5zd2VyIHRoZW4gZmluZSBUWFQgaXQgaXMu PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNs dWRpbmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5k IGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhw cmVzc2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdz IG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxl YXNlDQogbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZy b20geW91ciBzeXN0ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3Rv cmUsIHJldHJhbnNtaXQsIHVzZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQ bGVhc2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29t bXVuaWNhdGlvbiB0aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQNCiBleHRlcm5hbCBuZXR3b3Jrcy4g U0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtzIG9mIFNreSBMaW1pdGVkIGFuZCBT a3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5kZXIgbGljZW5jZS4NCjxicj4NCjxi cj4NClNreSBVSyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9t ZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3Jp YmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kg Q1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGly ZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGltaXRlZCAoUmVnaXN0cmF0aW9uDQogTm8uIDIyNDc3 MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJl IGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVn aXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNleCBUVzcgNVFE DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_82AF02E37AE74C44A4EFFB3C051A8A76skyuk_-- From nobody Fri Mar 15 06:51:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 181CB131260 for ; Fri, 15 Mar 2019 06:51:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2AEz5y_cl6a7 for ; Fri, 15 Mar 2019 06:51:27 -0700 (PDT) Received: from mail-it1-x12e.google.com (mail-it1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97758129441 for ; Fri, 15 Mar 2019 06:51:27 -0700 (PDT) Received: by mail-it1-x12e.google.com with SMTP id w18so10212725itj.4 for ; Fri, 15 Mar 2019 06:51:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=MjziIo4D2XRD4hJDjPxzcxNiT73NFLIiZz836YOMb8Y=; b=PITShWtgvI5KEl/1OTTi1n6VJyHuK+dOBPMAQ5NpdAg2/6wfG/POkeuQhNwJ9LgbgZ c2eBQCj4AXgGpFfUu9ET1eEGmP+Kmt1AAjPYoAZHij6K2BFusbeaexvJJOIowdywHXuL oxE2ysSoxEnnuMzeT6b0zPVg+45/H7T9tBSqI/vqJGkVVsfzOISitvsjCZgVlkNbGhvl PZWqEqjsDy93y+rTUx5u7Qn7xcM4sxPArjtmNCGcbVH6Xo2xd4i4NGagBToloyYoeQbx k0M79zZ3gbyH7Jw1AzqUst2Bczjpo/8TzP9WbW7LeTn0J9Qo8jYuxWhm3hFan/vhjjKM ZAfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=MjziIo4D2XRD4hJDjPxzcxNiT73NFLIiZz836YOMb8Y=; b=NbCOI35DxtpRliIF510j/gAs17lcwXHhX4qbfALNdlvVWj3zmuZ6JnuSn4j4z25Gbv 4l8tXeSU83tnrA+95PXs43tF9XaJJuRNZaZjJ+hNXCK2uTemMd6zJN+bPianaXQGgHdI 7/8nmcWNHdFBURgeN/v45vPKYJ+uREzkKuTUHWgOSBCWqYJ/IpRKb9F6jN7hdV8MuIIt SeHpb2Yc8HiH8M65Br+u3NC+E8W4c0fH90o12jRpsRY0jiSACTihJ0b+rOKcbfoiEtMf pQNFi+SJ1o+93o/Cj0Tv5nGCNb/hlI+yBeIqtFLaQ+Ty8TqwSosuhggzZW0u97fKb85X 8h5A== X-Gm-Message-State: APjAAAWA+eH6PVTbYriZG3EDd8qPmFTDh5tRx83v2lEDXzU2I5Q0f5Rz eaMjMSmCpJmurXZnfkIJdEfB8dIoj2XLgX6aOwo= X-Google-Smtp-Source: APXvYqykw/B4a6qii7VfOg3hQKx8aqpE5aI4faw9AchEcuNisKrDCTCV6vhpmlm0z1vi1DJp0dMWJFRS7OErXTC6mCQ= X-Received: by 2002:a05:660c:646:: with SMTP id y6mr1560137itk.91.1552657886805; Fri, 15 Mar 2019 06:51:26 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Loganaden Velvindron Date: Fri, 15 Mar 2019 17:51:15 +0400 Message-ID: To: "Winfield, Alister" Cc: Ben Schwartz , DoH WG Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [EXTERNAL] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 13:51:35 -0000 On Fri, Mar 15, 2019 at 5:41 PM Winfield, Alister wrote: > > > > > > IP-address certificates > > > > Bad ! Especially if the less enlightened think to try to create a certifi= cate for a private IP. Very bad idea. > > > > A new .well-known endpoint > > > > Maybe someone can suggest a better location that doesn=E2=80=99t break th= ings. > Can you elaborate more ? > > > 4. Recursive resolvers synthesizing responses as if they were authoritati= ve for certain names > > 5. Machine-readable content in a TXT record > > > > Also, the draft does not enable the use of DoH if (1) an application reli= es on POSIX-like DNS APIs to bootstrap AND (2) the resolver is only reachab= le on a non-public IP address (e.g. RFC 1918). This is a side effect of th= e requirement that the DoH server provide a valid certificate for its name,= chained to a root that is already trusted by the client. This draft does = not alter that requirement. > > > > If any of these technical elements are of concern to you, please comment = now, so that the meeting can be as productive as possible. > > > > --Ben > > Information in this email including any attachments may be privileged, co= nfidential and is intended exclusively for the addressee. The views express= ed may not be official policy, but the personal views of the originator. If= you have received it in error, please notify the sender by return e-mail a= nd delete it from your system. You should not reproduce, distribute, store,= retransmit, use or disclose its contents to anyone. Please note we reserve= the right to monitor all e-mail communication through our internal and ext= ernal networks. SKY and the SKY marks are trademarks of Sky Limited and Sky= International AG and are used under licence. > > Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (R= egistration No. 2067075), Sky Subscribers Services Limited (Registration No= . 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indi= rect subsidiaries of Sky Limited (Registration No. 2247735). All of the com= panies mentioned in this paragraph are incorporated in England and Wales an= d share the same registered office at Grant Way, Isleworth, Middlesex TW7 5= QD > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Fri Mar 15 06:55:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AEC8B12D4E9 for ; Fri, 15 Mar 2019 06:55:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4WWClt1RjG3n for ; Fri, 15 Mar 2019 06:55:21 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-am5eur02on0626.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe07::626]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6806A129AA0 for ; Fri, 15 Mar 2019 06:55:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MG2QgLgy4ahWy7mmBRIYP8M0sFm8xLnzbDNNoxJFfkk=; b=qQ6nsmR7k0cRX30Hl/7WFKiIH4b0dMUMRQRuFTS3/Y87h7vwKuTmy5mwB3ZCJn1ecVc7BDynW2zGOosa24+LmFYEpUs1NA/ViCtdjpcx2Wl2u/yGPCzuEMgO3hZLskAKabHt+uFxp5BOgKDM0zsgIsFgOpoNfA++GHQU8/zIwYQ= Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com (10.167.132.7) by AM4PR0601MB2212.eurprd06.prod.outlook.com (10.167.132.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.14; Fri, 15 Mar 2019 13:55:18 +0000 Received: from AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c]) by AM4PR0601MB2180.eurprd06.prod.outlook.com ([fe80::ed97:fec5:56f0:586c%7]) with mapi id 15.20.1709.011; Fri, 15 Mar 2019 13:55:18 +0000 From: "Winfield, Alister" To: Loganaden Velvindron CC: DoH WG Thread-Topic: [Doh] [EXTERNAL] Reviewing Resolver-Associated DOH Thread-Index: AQHU2zY4sZA+EqUK1kWIKZR4ajDFSKYMtnkA Date: Fri, 15 Mar 2019 13:55:17 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.16.1.190220 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e20a:2d00:95a4:4072:f8fe:2d75] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ca36448f-3ba6-4d8f-4523-08d6a94ddc03 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:AM4PR0601MB2212; x-ms-traffictypediagnostic: AM4PR0601MB2212: x-microsoft-antispam-prvs: x-forefront-prvs: 09778E995A x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(346002)(376002)(136003)(366004)(39860400002)(189003)(199004)(4326008)(72206003)(76176011)(36756003)(14454004)(2906002)(53936002)(68736007)(11346002)(478600001)(446003)(81166006)(71200400001)(81156014)(102836004)(186003)(6506007)(25786009)(6246003)(6512007)(6116002)(99286004)(71190400001)(83716004)(8676002)(97736004)(106356001)(74482002)(6436002)(7736002)(229853002)(2616005)(105586002)(46003)(86362001)(33656002)(486006)(256004)(14444005)(1411001)(5024004)(58126008)(5660300002)(6916009)(305945005)(316002)(8936002)(82746002)(476003)(6486002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM4PR0601MB2212; H:AM4PR0601MB2180.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: VoaMN1DynhK8HLB1fr1P5R7SzT1fVQ47KrdGwJ5yqXzMGYGrdxmXyqNOvfvvOtQehrx1zebSMiZogFjd3Fwf4s+nsdrWKTXk4zdg6jbJiJ4KGtGmqLrcy4QzQo8DMDvwBtNNxO+HoA6WboQyeBlaL43BpYNPMnY6GQefMeWso9yCdewD9CAg7o4iWGiOq9AQijy7pdmPnpjyUsLkfCl9uhrZ2JrhFtJvsM/0dC9tTAi06JGxMoMr5dHTsNuNLXhg+okI3vXHAyQjKM5bjnTkXsKiWyg9L20b+YB/D8fSch9MHzeYU/eva66xxvOPE1OF3JuNdWZ6lAj40wRRO/D0QcBirjS5N7bJBL4iQcHd/1k91pULSZ82UlEW1Kbi8/Ue9JjSNXnfsjCuTjaCYVHZUQGm7gM0ptiFBHCmjAORdOY= Content-Type: text/plain; charset="utf-8" Content-ID: <71B8341548A39747AD5902B2D559D258@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: ca36448f-3ba6-4d8f-4523-08d6a94ddc03 X-MS-Exchange-CrossTenant-originalarrivaltime: 15 Mar 2019 13:55:18.6990 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM4PR0601MB2212 Archived-At: Subject: Re: [Doh] [EXTERNAL] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 13:55:24 -0000 DQogICAgPiBBIG5ldyAud2VsbC1rbm93biBlbmRwb2ludA0KICAgID4NCiAgICA+DQogICAgPg0K ICAgID4gTWF5YmUgc29tZW9uZSBjYW4gc3VnZ2VzdCBhIGJldHRlciBsb2NhdGlvbiB0aGF0IGRv ZXNu4oCZdCBicmVhayB0aGluZ3MuDQogICAgPg0KDQoNCiAgIEkgY2FuJ3QgZGVjaWRlIG9uIGFu eXdoZXJlIHRoYXTigJlzIG5vdCBmdWxsIG9mIGhvcnJvcnMuLi4gVGhhdCBpcyBJJ20gcmVsdWN0 YW50bHkgZmFsbGluZyBiYWNrIHRvd2FyZHMgdGhlIC53ZWxsLWtub3duIGVuZHBvaW50IGJ1dCBl dmVyeSB0aW1lIEkgc2VlIGEgdGhpbmcgbGlrZSBpdCBzb21laG93IEkgc3VzcGVjdCB0aGVyZSBp cyBhIHByb2JsZW0gdGhlcmUgd2FpdGluZyB0byBiZSBmb3VuZCBsYXRlci4NCg0KDQpJbmZvcm1h dGlvbiBpbiB0aGlzIGVtYWlsIGluY2x1ZGluZyBhbnkgYXR0YWNobWVudHMgbWF5IGJlIHByaXZp bGVnZWQsIGNvbmZpZGVudGlhbCBhbmQgaXMgaW50ZW5kZWQgZXhjbHVzaXZlbHkgZm9yIHRoZSBh ZGRyZXNzZWUuIFRoZSB2aWV3cyBleHByZXNzZWQgbWF5IG5vdCBiZSBvZmZpY2lhbCBwb2xpY3ks IGJ1dCB0aGUgcGVyc29uYWwgdmlld3Mgb2YgdGhlIG9yaWdpbmF0b3IuIElmIHlvdSBoYXZlIHJl Y2VpdmVkIGl0IGluIGVycm9yLCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUt bWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJv ZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNtaXQsIHVzZSBvciBkaXNjbG9zZSBpdHMg Y29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0byBt b25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQg ZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBv ZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVy IGxpY2VuY2UuDQoNClNreSBVSyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDI5MDY5OTEpLCBT a3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjA2NzA3NSksIFNr eSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIzNDAxNTAp IGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0 IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5v LiAyMjQ3NzM1KS4gQWxsIG9mIHRoZSBjb21wYW5pZXMgbWVudGlvbmVkIGluIHRoaXMgcGFyYWdy YXBoIGFyZSBpbmNvcnBvcmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBz YW1lIHJlZ2lzdGVyZWQgb2ZmaWNlIGF0IEdyYW50IFdheSwgSXNsZXdvcnRoLCBNaWRkbGVzZXgg VFc3IDVRRA0K From nobody Fri Mar 15 07:56:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A9893130DDA for ; Fri, 15 Mar 2019 07:56:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2c3lJRWxRcBM for ; Fri, 15 Mar 2019 07:56:48 -0700 (PDT) Received: from mail-wm1-x343.google.com (mail-wm1-x343.google.com [IPv6:2a00:1450:4864:20::343]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5433131265 for ; Fri, 15 Mar 2019 07:56:47 -0700 (PDT) Received: by mail-wm1-x343.google.com with SMTP id e16so6418959wme.1 for ; Fri, 15 Mar 2019 07:56:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=G5OvWzQfLgNdEdvzUaBYbTzTV2wRqWeDOU4ff8Qdxdw=; b=J0l/aoc9xHDiab+HCQb9gwMF0MuUR97mSXNJjX0NA69NLHIvyjnG8syVpbSQv2kb/W UtpYNz63qoakIMlxehJbC3DJeY4Samn1aIbrGVc9Dvodi0DDxlm99WcTdgGGHhg6D/W3 C6XslA2NrroY22rvzVpmSUHveYQE+LilLPWbIBLN1w2hj7b+CspLX0VHSxL3OSvi4DOC dO6GfuqtBT/WmMGerLOAMXHBfW7Kc8lFjHT8xMzKgSYCOYRhVQ3reifquC25Z4xoWKQa H726bGv8VQ3GNN3/Z2i6D385Sqagbtv7YuQeN/z9j1L+DVWii0MVLWWMEmaIOY3aTGZw XWpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=G5OvWzQfLgNdEdvzUaBYbTzTV2wRqWeDOU4ff8Qdxdw=; b=oLGBtbYVum0W8vLENFJnpk0d76mDch57dLieizQyYHPFqpDGO0pnB6F6zSgk7U3inH /KmDyYrUROS6lKWE4M3/J8F320udjn1V2hPnt2O3JczLaVOi56YwesFoYA2PydmnUMBG uTMs4GFT0GWMNsIfz4WZ1CW5Bxm/K3YoPIgep8sZnBJqrvhW3tOzzCWVERCMgeXkUjnw L+d4GHEu+mQ8fvMEax76LoGrgV2QX/fByOalNA5ju8ZGPvmro8gzJ0L+PAEb02HO2AB2 cEH5UkBq/Kxlaad1HNMNLtp0br/aJVLgZUSUvNPw3nVs8aWpEAPpBXSmGATEQ+LlbLec zK8w== X-Gm-Message-State: APjAAAUmByjSz51C9m6gCeGAMBnQgjEZ4L4+0bn9QLz8A8FXkGIvkYcq /59U+ziBvd0IUuSflu9QryTIg95xVasuvLP2g1ml2g== X-Google-Smtp-Source: APXvYqxdygYXIqzAB7lCo2q4bzwC+WYlF8PmL5JigX6nYcdXC6vYcT+cAU+dBMpZ/iwMv3V7EKFxlj8JzFdTP0Jhw9s= X-Received: by 2002:a1c:9c0e:: with SMTP id f14mr2553012wme.78.1552661806127; Fri, 15 Mar 2019 07:56:46 -0700 (PDT) MIME-Version: 1.0 References: <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com> <2f18ea6a-89e7-418b-82cf-70a8af70e8c1@www.fastmail.com> In-Reply-To: <2f18ea6a-89e7-418b-82cf-70a8af70e8c1@www.fastmail.com> From: Ian Swett Date: Fri, 15 Mar 2019 10:56:33 -0400 Message-ID: To: Martin Thomson Cc: Erik Kline , doh@ietf.org Content-Type: multipart/alternative; boundary="00000000000069b6f60584233fd7" Archived-At: Subject: Re: [Doh] Authoritative DoT or DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 14:56:51 -0000 --00000000000069b6f60584233fd7 Content-Type: text/plain; charset="UTF-8" For a DNS or DoH heavy workload, I'd expect QUIC CPU usage to be very comparable to DoT or DoH over HTTP/2, but obviously crypto isn't free, so it would be more expensive than plain DNS. QUIC CPU really suffers when sending(and to a lesser extent receiving) huge payloads. On Fri, Mar 15, 2019 at 7:04 AM Martin Thomson wrote: > DNS over QUIC (either directly, or as DoH with HTTP/3) will likely > exacerbate load problems. QUIC isn't great about its CPU usage at the > current time. That comes with some advantages, like sharing an encryption > context for multiple requests without the head of line blocking inherent in > HTTP/2, but it's unlikely to be a total slam dunk. > > On Fri, Mar 15, 2019, at 14:23, Erik Kline wrote: > > And on account of the load management issues I would expect some folks > > to prefer to try out DoQ (DNS over QUIC), does actually bring things > > back around to DoH. > > > > On Thu, 14 Mar 2019 at 19:27, Martin Thomson wrote: > > > There is far less reason to use DoH for connections to authoritative > servers. DoT seems far more appropriate (than both DoH and the unencrypted > variants). > > > > > > I expect there to be a lot of discussion about DoS (not DNS over > SCTP, sadly) and load management in any such document. I don't see much of > the stuff that has generated so much heat lately to be relevant in the > authoritative context. > > > > > > On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote: > > > > > > > > In the last couple of days there has been a lot of activity > concerning > > > > DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN > and > > > > IETF drafts: > > > > > draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issues/draft-betola-bcp-doh-clients. > > > > > > > > > > > > These discussions have focused on DoH for client (typically web > > > > browser) communication with recursive resolvers, and its > comparisons > > > > with DoT for this purpose. > > > > > > > > > > > > Is there any compelling reason at this point to be considering DoH > for > > > > recursive resolver-to-authoritative name server communications? > > > > > > > > > > > > As I noted at the DPRIVE interim meeting, the working group needs > > > > empirical studies looking at performance and attack vectors for > > > > authoritative DNS encryption. > > > > > > > > > > > > Unless there are compelling reasons to consider Authoritative DoH, > I > > > > propose the working group focus its authoritative DNS encryption > > > > assessments around Authoritative DoT. > > > > > > > > > > > > In support, I am willing to co-author an Authoritative DoT > operational > > > > consideration draft in order to outline the operational challenges > the > > > > community needs to address - similar to the draft-reid-doh-operator > > > > draft between client and recursive. > > > > > > > > > > > > _______________________________________________ > > > > Doh mailing list > > > > Doh@ietf.org > > > > https://www.ietf.org/mailman/listinfo/doh > > > > > > > > > > _______________________________________________ > > > Doh mailing list > > > Doh@ietf.org > > > https://www.ietf.org/mailman/listinfo/doh > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000069b6f60584233fd7 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
For a DNS or DoH heavy workload, I'd expect QUIC CPU u= sage to be very comparable to DoT or DoH over HTTP/2, but obviously crypto = isn't free, so it would be more expensive than plain DNS.

QUIC CPU really suffers when sending(and to a lesser extent receiving= ) huge payloads.

On Fri, Mar 15, 2019 at 7:04 AM Martin Thomson <mt@lowentropy.net> wrote:
DNS over QUIC (either d= irectly, or as DoH with HTTP/3) will likely exacerbate load problems.=C2=A0= QUIC isn't great about its CPU usage at the current time.=C2=A0 That c= omes with some advantages, like sharing an encryption context for multiple = requests without the head of line blocking inherent in HTTP/2, but it's= unlikely to be a total slam dunk.

On Fri, Mar 15, 2019, at 14:23, Erik Kline wrote:
> And on account of the load management issues I would expect some folks=
> to prefer to try out DoQ (DNS over QUIC), does actually bring things <= br> > back around to DoH.
>
> On Thu, 14 Mar 2019 at 19:27, Martin Thomson <mt@lowentropy.net> wrote:
> > There is far less reason to use DoH for connections to authoritat= ive servers. DoT seems far more appropriate (than both DoH and the unencryp= ted variants).
> >
> >=C2=A0 I expect there to be a lot of discussion about DoS (not DNS= over SCTP, sadly) and load management in any such document. I don't se= e much of the stuff that has generated so much heat lately to be relevant i= n the authoritative context.
> >
> >=C2=A0 On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote:
> >=C2=A0 >
> >=C2=A0 > In the last couple of days there has been a lot of act= ivity concerning
> >=C2=A0 > DNS over HTTPS (DoH) - Hoffman and Alibaba presentatio= ns at ICANN and
> >=C2=A0 > IETF drafts:
> >=C2=A0 > draft-reid-doh-operator/draft-livingood-doh-implementa= tion-risks-issues/draft-betola-bcp-doh-clients.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > These discussions have focused on DoH for client (typi= cally web
> >=C2=A0 > browser) communication with recursive resolvers, and i= ts comparisons
> >=C2=A0 > with DoT for this purpose.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > Is there any compelling reason at this point to be con= sidering DoH for
> >=C2=A0 > recursive resolver-to-authoritative name server commun= ications?
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > As I noted at the DPRIVE interim meeting, the working = group needs
> >=C2=A0 > empirical studies looking at performance and attack ve= ctors for
> >=C2=A0 > authoritative DNS encryption.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > Unless there are compelling reasons to consider Author= itative DoH, I
> >=C2=A0 > propose the working group focus its authoritative DNS = encryption
> >=C2=A0 > assessments around Authoritative DoT.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > In support, I am willing to co-author an Authoritative= DoT operational
> >=C2=A0 > consideration draft in order to outline the operationa= l challenges the
> >=C2=A0 > community needs to address - similar to the draft-reid= -doh-operator
> >=C2=A0 > draft between client and recursive.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > _______________________________________________
> >=C2=A0 > Doh mailing list
> >=C2=A0 > Doh@= ietf.org
> >=C2=A0 > https://www.ietf.org/mailman/listinfo/= doh
> >=C2=A0 >
> >
> >=C2=A0 _______________________________________________
> >=C2=A0 Doh mailing list
> > Doh@ietf.org
> > https://www.ietf.org/mailman/listinfo/doh

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000069b6f60584233fd7-- From nobody Fri Mar 15 09:06:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B2F81129BBF for ; Fri, 15 Mar 2019 09:06:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lYVSKWc3Ehlg for ; Fri, 15 Mar 2019 09:06:40 -0700 (PDT) Received: from mail-io1-xd42.google.com (mail-io1-xd42.google.com [IPv6:2607:f8b0:4864:20::d42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FCCC1279E6 for ; Fri, 15 Mar 2019 09:06:40 -0700 (PDT) Received: by mail-io1-xd42.google.com with SMTP id v4so7659572ioj.5 for ; Fri, 15 Mar 2019 09:06:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tUTggQc4ce5olrwKcikdCigAWq6EfOkPXww8MgECOB4=; b=eaHwjovMG7aF/mIGY5Y3ITTdU4jOqIgT0ge60PqWmb7rKJPYkScOEHabDwFIF1YjpD fEY33EtRGpmzmU4fgcpzOsCP3mBRJBKha+uoVmUmUKbEA1jqM3BqcokuqFR8FP1aypTz DZxnnxnF2RepuF4YokxfmVseDP0vR07Pp2mO0hhvYdBWy3wagKb6nj+1Vf/7xDM+HkRD N+s6YLm+KRqq2xfxiE1qwR9pNCZ/n2Csza6KlUbRg/QI2Gdeinbj5hDbQqhLqLg+qK1V G/vuiPniCzMK47WZ5rtZJeFU/lvtfBePglazx8m+np6atMAYp6gqIIE0VeDcz+MdIs1m ZobA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tUTggQc4ce5olrwKcikdCigAWq6EfOkPXww8MgECOB4=; b=UJgZhhY9YKDV5urc2gxKu6zovld/dkFVJvcv9pq1rlrhwxY0Bmn4/E6OVnov/aXTUY 20tIuy3vuI4DbZ66kKE04Iahk+kjqaiT2t4F13rCCD6wo/h5N2x7jWVg0Ccak/W6qsTK oPdjYBRDWZ3TUyNxgGUX5AYUkey4tXAHoq8P4cuRTbVio7UFlqo9VNNNznyW7ELrEcey pqGCZX1vL0yHegBNfQENTbuS/jwd4+jq+VGp6gtp3qPSPKE8/vws2VzCL4g9tlbeIoAh DLh3Zg1hCVFjenxBAdpJm97c8mtI0JB0fDYVA/rDJWBvTApeeUeeN2V935hjcAa6psmO sU4w== X-Gm-Message-State: APjAAAU9lbk0r5B0TUSgi/Yrw2bfSLzdTdksvRon/nqmpk6a9iq3rK8e 0X2ryKRdYuUhLGbfve4Qeq0mv0xeF9YkRg3ZiK4= X-Google-Smtp-Source: APXvYqwfj/2V8SGWLMvtg3HN2Aunw9vuY2mf1RoSVdOi5mtdsvbTKpR5LTsaho3V4UO38J1lxEdzM6TKneL7fhks9rc= X-Received: by 2002:a5e:9b0e:: with SMTP id j14mr2807596iok.35.1552665999393; Fri, 15 Mar 2019 09:06:39 -0700 (PDT) MIME-Version: 1.0 References: <73eb005a-da34-41cb-a05d-1cb8268060d2@www.fastmail.com> <2f18ea6a-89e7-418b-82cf-70a8af70e8c1@www.fastmail.com> In-Reply-To: From: Ted Hardie Date: Fri, 15 Mar 2019 09:06:13 -0700 Message-ID: To: Ian Swett Cc: Martin Thomson , DoH WG , Erik Kline Content-Type: multipart/alternative; boundary="00000000000059493705842439d4" Archived-At: Subject: Re: [Doh] Authoritative DoT or DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:06:44 -0000 --00000000000059493705842439d4 Content-Type: text/plain; charset="UTF-8" Speaking about DNS over QUIC, not DNS over HTTP over QUIC, a comment in-line On Fri, Mar 15, 2019 at 7:56 AM Ian Swett wrote: > For a DNS or DoH heavy workload, I'd expect QUIC CPU usage to be very > comparable to DoT or DoH over HTTP/2, but obviously crypto isn't free, so > it would be more expensive than plain DNS. > > For the client-to-recursive-resolver case, the big advantage is that the traffic bursts of queries can work well with both the multiplexing of QUIC and with 0-RTT. You can have a burst of queries each resolved on an independent stream without head of line blocking, then either a low-effort quiescent connection or 0-RTT resumption. For an authoritative server of a large flat zone (like a TLD), you could get a similar advantage by having the recursive resolvers talk to anycast instances which would be able to multiplex parallel queries or use 0-RTT to lower the latency of using the encrypted transport. For authoritative servers with deep hierarchies or low utilization, DNS over TLS seems a better fit, since they are less likely to need the multiplexing (and will get 0-RTT with TLS 1.3). regards, Ted > QUIC CPU really suffers when sending(and to a lesser extent receiving) > huge payloads. > > On Fri, Mar 15, 2019 at 7:04 AM Martin Thomson wrote: > >> DNS over QUIC (either directly, or as DoH with HTTP/3) will likely >> exacerbate load problems. QUIC isn't great about its CPU usage at the >> current time. That comes with some advantages, like sharing an encryption >> context for multiple requests without the head of line blocking inherent in >> HTTP/2, but it's unlikely to be a total slam dunk. >> >> On Fri, Mar 15, 2019, at 14:23, Erik Kline wrote: >> > And on account of the load management issues I would expect some folks >> > to prefer to try out DoQ (DNS over QUIC), does actually bring things >> > back around to DoH. >> > >> > On Thu, 14 Mar 2019 at 19:27, Martin Thomson wrote: >> > > There is far less reason to use DoH for connections to authoritative >> servers. DoT seems far more appropriate (than both DoH and the unencrypted >> variants). >> > > >> > > I expect there to be a lot of discussion about DoS (not DNS over >> SCTP, sadly) and load management in any such document. I don't see much of >> the stuff that has generated so much heat lately to be relevant in the >> authoritative context. >> > > >> > > On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote: >> > > > >> > > > In the last couple of days there has been a lot of activity >> concerning >> > > > DNS over HTTPS (DoH) - Hoffman and Alibaba presentations at ICANN >> and >> > > > IETF drafts: >> > > > >> draft-reid-doh-operator/draft-livingood-doh-implementation-risks-issues/draft-betola-bcp-doh-clients. >> > > > >> > > > >> > > > These discussions have focused on DoH for client (typically web >> > > > browser) communication with recursive resolvers, and its >> comparisons >> > > > with DoT for this purpose. >> > > > >> > > > >> > > > Is there any compelling reason at this point to be considering DoH >> for >> > > > recursive resolver-to-authoritative name server communications? >> > > > >> > > > >> > > > As I noted at the DPRIVE interim meeting, the working group needs >> > > > empirical studies looking at performance and attack vectors for >> > > > authoritative DNS encryption. >> > > > >> > > > >> > > > Unless there are compelling reasons to consider Authoritative DoH, >> I >> > > > propose the working group focus its authoritative DNS encryption >> > > > assessments around Authoritative DoT. >> > > > >> > > > >> > > > In support, I am willing to co-author an Authoritative DoT >> operational >> > > > consideration draft in order to outline the operational challenges >> the >> > > > community needs to address - similar to the >> draft-reid-doh-operator >> > > > draft between client and recursive. >> > > > >> > > > >> > > > _______________________________________________ >> > > > Doh mailing list >> > > > Doh@ietf.org >> > > > https://www.ietf.org/mailman/listinfo/doh >> > > > >> > > >> > > _______________________________________________ >> > > Doh mailing list >> > > Doh@ietf.org >> > > https://www.ietf.org/mailman/listinfo/doh >> >> _______________________________________________ >> Doh mailing list >> Doh@ietf.org >> https://www.ietf.org/mailman/listinfo/doh >> > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000059493705842439d4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Speaking about DNS over QUIC, not DNS over HTTP over = QUIC, a comment in-line

On Fri, Mar 15, 2019 at 7:56 AM Ian Swett <ia= nswett=3D40google.com@dmarc.= ietf.org> wrote:
For a DNS or DoH heavy workload, I'd expect QU= IC CPU usage to be very comparable to DoT or DoH over HTTP/2, but obviously= crypto isn't free, so it would be more expensive than plain DNS.
<= br>

For the client-to-recursive= -resolver case, the big advantage is that the traffic bursts of queries can= work well with both the multiplexing of QUIC and with 0-RTT.=C2=A0 You can= have a burst of queries each resolved on an independent stream without hea= d of line blocking, then either a low-effort quiescent connection or 0-RTT = resumption.=C2=A0 For an authoritative server of a large flat zone (like a = TLD), you could get a similar advantage by having the recursive resolvers t= alk to anycast instances which would be able to multiplex parallel queries = or use 0-RTT to lower the latency of using the encrypted transport.=C2=A0 F= or authoritative servers with deep hierarchies or low utilization, DNS over= TLS seems a better fit, since they are less likely to need the multiplexin= g (and will get 0-RTT with TLS 1.3).

regards,

Ted
=C2=A0
QUIC CPU really = suffers when sending(and to a lesser extent receiving) huge payloads.
=

= On Fri, Mar 15, 2019 at 7:04 AM Martin Thomson <mt@lowentropy.net> wrote:
DNS over QUIC (either direc= tly, or as DoH with HTTP/3) will likely exacerbate load problems.=C2=A0 QUI= C isn't great about its CPU usage at the current time.=C2=A0 That comes= with some advantages, like sharing an encryption context for multiple requ= ests without the head of line blocking inherent in HTTP/2, but it's unl= ikely to be a total slam dunk.

On Fri, Mar 15, 2019, at 14:23, Erik Kline wrote:
> And on account of the load management issues I would expect some folks=
> to prefer to try out DoQ (DNS over QUIC), does actually bring things <= br> > back around to DoH.
>
> On Thu, 14 Mar 2019 at 19:27, Martin Thomson <mt@lowentropy.net> wrote:
> > There is far less reason to use DoH for connections to authoritat= ive servers. DoT seems far more appropriate (than both DoH and the unencryp= ted variants).
> >
> >=C2=A0 I expect there to be a lot of discussion about DoS (not DNS= over SCTP, sadly) and load management in any such document. I don't se= e much of the stuff that has generated so much heat lately to be relevant i= n the authoritative context.
> >
> >=C2=A0 On Fri, Mar 15, 2019, at 06:18, Henderson, Karl wrote:
> >=C2=A0 >
> >=C2=A0 > In the last couple of days there has been a lot of act= ivity concerning
> >=C2=A0 > DNS over HTTPS (DoH) - Hoffman and Alibaba presentatio= ns at ICANN and
> >=C2=A0 > IETF drafts:
> >=C2=A0 > draft-reid-doh-operator/draft-livingood-doh-implementa= tion-risks-issues/draft-betola-bcp-doh-clients.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > These discussions have focused on DoH for client (typi= cally web
> >=C2=A0 > browser) communication with recursive resolvers, and i= ts comparisons
> >=C2=A0 > with DoT for this purpose.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > Is there any compelling reason at this point to be con= sidering DoH for
> >=C2=A0 > recursive resolver-to-authoritative name server commun= ications?
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > As I noted at the DPRIVE interim meeting, the working = group needs
> >=C2=A0 > empirical studies looking at performance and attack ve= ctors for
> >=C2=A0 > authoritative DNS encryption.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > Unless there are compelling reasons to consider Author= itative DoH, I
> >=C2=A0 > propose the working group focus its authoritative DNS = encryption
> >=C2=A0 > assessments around Authoritative DoT.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > In support, I am willing to co-author an Authoritative= DoT operational
> >=C2=A0 > consideration draft in order to outline the operationa= l challenges the
> >=C2=A0 > community needs to address - similar to the draft-reid= -doh-operator
> >=C2=A0 > draft between client and recursive.
> >=C2=A0 >
> >=C2=A0 >
> >=C2=A0 > _______________________________________________
> >=C2=A0 > Doh mailing list
> >=C2=A0 > Doh@= ietf.org
> >=C2=A0 > https://www.ietf.org/mailman/listinfo/= doh
> >=C2=A0 >
> >
> >=C2=A0 _______________________________________________
> >=C2=A0 Doh mailing list
> > Doh@ietf.org
> > https://www.ietf.org/mailman/listinfo/doh

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000059493705842439d4-- From nobody Fri Mar 15 09:22:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B8002127133 for ; Fri, 15 Mar 2019 09:21:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5z4IxVdaHDqP for ; Fri, 15 Mar 2019 09:21:57 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54532129284 for ; Fri, 15 Mar 2019 09:21:57 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Fri, 15 Mar 2019 09:21:55 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Fri, 15 Mar 2019 09:21:55 -0700 From: Paul Hoffman To: DoH WG Thread-Topic: IP address certificates Thread-Index: AQHU20s053m571RCmE2FnR+Zj5DstQ== Date: Fri, 15 Mar 2019 16:21:55 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="utf-8" Content-ID: <7ED5796D5E4FED40B1B15DD51DFA7F13@pexch112.icann.org> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Doh] IP address certificates X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:22:00 -0000 Rm9yIGNsYXJpdHk6IGluIGRyYWZ0LWlldGYtZG9oLXJlc29sdmVyLWFzc29jaWF0ZWQtZG9oLCBJ UCBhZGRyZXNzIGNlcnRpZmljYXRlcyBhcmUgb25seSB1c2VkIHdoZW4gZ2V0dGluZyB0aGUgRG9I IHNlcnZlcnMgdXNpbmcgSFRUUFMuIFRoZSBmb3JtYXQgZm9yIHRoYXQgcXVlcnkgaXM6DQogICBo dHRwczovL0lQQUREUkVTU0dPRVNIRVJFLy53ZWxsLWtub3duL2RvaC1zZXJ2ZXJzLWFzc29jaWF0 ZWQvDQoNCg0KT24gTWFyIDE1LCAyMDE5LCBhdCA2OjQxIEFNLCBXaW5maWVsZCwgQWxpc3RlciA8 QWxpc3Rlci5XaW5maWVsZD00MHNreS51a0BkbWFyYy5pZXRmLm9yZz4gd3JvdGU6DQo+IAnigKIg SVAtYWRkcmVzcyBjZXJ0aWZpY2F0ZXMNCj4gIA0KPiBCYWQgISBFc3BlY2lhbGx5IGlmIHRoZSBs ZXNzIGVubGlnaHRlbmVkIHRoaW5rIHRvIHRyeSB0byBjcmVhdGUgYSBjZXJ0aWZpY2F0ZSBmb3Ig YSBwcml2YXRlIElQLiBWZXJ5IGJhZCBpZGVhLg0KDQpDYW4geW91IHNheSB3aHkgdGhleSBhcmUg YmFkPyBUaGV5IGFyZSBub3QgY29tbW9uLCBidXQgdGhleSBhcmUgY2VydGFpbmx5IGF2YWlsYWJs ZSBhbmQgaGF2ZSBwcm92ZW4gdXNlZnVsIGluIHNvbWUgZW52aXJvbm1lbnRzIGZvciBhIGxvbmcg dGltZS4NCg0KLS1QYXVsIEhvZmZtYW4NCg0KDQoNCg== From nobody Fri Mar 15 09:27:30 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F6D8130E3F for ; Fri, 15 Mar 2019 09:27:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id au2nCIYS1qMX for ; Fri, 15 Mar 2019 09:27:26 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3F3C81279E6 for ; Fri, 15 Mar 2019 09:27:26 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Fri, 15 Mar 2019 09:27:24 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Fri, 15 Mar 2019 09:27:24 -0700 From: Paul Hoffman To: Ben Schwartz CC: DoH WG Thread-Topic: Use of TXT records Thread-Index: AQHU20v4KBZkOuZdVUmKLPdN7Ma4/Q== Date: Fri, 15 Mar 2019 16:27:23 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Doh] Use of TXT records X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:27:28 -0000 On Mar 15, 2019, at 6:12 AM, Ben Schwartz wrote: > 5. Machine-readable content in a TXT record This is the first I had heard that people objected to using a TXT record, b= ut I might have missed that part of the discussion. Given that this query i= s for a newly-created SUDN that is only used for looking up DoH information= , there is no chance that the TXT record would be in use for anything else. Having said that, it would be quite easy for this document to create a new = RRtype for this particular query. (I would not want to re-use the URI RRtyp= e because it would take more effort to explain the priority and weight, as = well as dealing with the common error of people not put the URI in quotatio= ns marks as is required for the URI RRtype.) --Paul Hoffman= From nobody Fri Mar 15 09:52:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1346E129284 for ; Fri, 15 Mar 2019 09:52:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rw2vSx8-xKqP for ; Fri, 15 Mar 2019 09:52:48 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C5189130E7D for ; Fri, 15 Mar 2019 09:52:43 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id h132so5793532vsd.5 for ; Fri, 15 Mar 2019 09:52:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=wgC9mvufDn55+3AIBsJB2MFXH8iG3CGNe07q9VUObQQ=; b=MseLO6DHbeWTBWWmkyX3889HaGpy/SPeLhmnOZvntN8MixZnAFo852AgHgn0VFXwnB UW/vr10n7b/Ov6bQFSSF4h/9N+m4Pv65wdQswTBICRRXrqGtO/yqIK3N5BOCrrg/nM53 4iGZ4MPybG7UiQO5C/ooAQWkvAnngvNiV61b28b978RS2sumMiojuwFSKigfOcn7TJs7 Ao5FKfxo05hWK+RQcyMaCsv32nH0vpqBB+B8P53ieiOQTgOd4CN/647L8/D2T1pwO+bZ Ina2ucKICOTGOyhZBKxN/gWuDY44kRsc/Pcw+bwEH8RLk3cCVA3FngpLCSSPI4nt7dAD R3HQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=wgC9mvufDn55+3AIBsJB2MFXH8iG3CGNe07q9VUObQQ=; b=PfKcfOAnD9rgT5OIQRR5doNk4XOkckv4DViTgI8bnpydlLizjy6frYBhQ3uNI6ptFm KwgWSd5LR3AMiRbDTHfRCyPSwhnf3lHVR5kGGfyj7zZqXRYXuFuRUUz0dBNc6nlCau9m 2UlXCQsazMS680lUlMMPEj3GzScDMwyRpB3mz5S3zLGOcATig1RhKSRrVe+jjeJt+AmJ 18NhAZ3NnfJgPw26K7ss2I3nM/dztkwsF1jy/EB9DwGWck00EMv/sVxyx9pec9D95fBY NWlBLGW7tshCHjwop73+iaFjfmLtw0Laf1sTHmlN4/+D5JtQI/NWcGMYMzXolGwI/tD9 L7iQ== X-Gm-Message-State: APjAAAUbQKD8kgo2ewFHQAdkCu8TcXG+SY8t8OywFojrkK6gSyaN/YZh SR/kXsy79sTY/RE5jWLVeAG0RbOkIgQAUCaBV0fKN31fb5I= X-Google-Smtp-Source: APXvYqyeU1UT0deG04Nc2f/Awl9grVX1Dqy6Vuk4XM6LLCQh0hRm+Wt5oOXLafGLTqCIlh5tPQpBDItFZ/GTGckOJbI= X-Received: by 2002:a67:f64f:: with SMTP id u15mr2528885vso.1.1552668762575; Fri, 15 Mar 2019 09:52:42 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ben Schwartz Date: Fri, 15 Mar 2019 12:52:30 -0400 Message-ID: To: Paul Hoffman Cc: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000012c063058424de8e" Archived-At: Subject: Re: [Doh] Use of TXT records X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:52:51 -0000 --00000000000012c063058424de8e Content-Type: multipart/alternative; boundary="0000000000000c857a058424de9a" --0000000000000c857a058424de9a Content-Type: text/plain; charset="UTF-8" To be clear, I'm not objecting to this choice. I'm merely noting that use of TXT has been a point of controversy in other discussions at the IETF. Some groups have decided to proceed with TXT, some have preferred to use different or new RRTYPEs, and some have not yet decided. I would like the working group to consider this question soon so it doesn't delay consensus later. On Fri, Mar 15, 2019 at 12:27 PM Paul Hoffman wrote: > On Mar 15, 2019, at 6:12 AM, Ben Schwartz > wrote: > > 5. Machine-readable content in a TXT record > > This is the first I had heard that people objected to using a TXT record, > but I might have missed that part of the discussion. Given that this query > is for a newly-created SUDN that is only used for looking up DoH > information, there is no chance that the TXT record would be in use for > anything else. > > Having said that, it would be quite easy for this document to create a new > RRtype for this particular query. (I would not want to re-use the URI > RRtype because it would take more effort to explain the priority and > weight, as well as dealing with the common error of people not put the URI > in quotations marks as is required for the URI RRtype.) > > --Paul Hoffman --0000000000000c857a058424de9a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
To be clear, I'm not objecting to this choice.=C2=A0 I= 'm merely noting that use of TXT has been a point of controversy in oth= er discussions at the IETF.=C2=A0 Some groups have decided to proceed with = TXT, some have preferred to use different or new RRTYPEs, and some have not= yet decided.=C2=A0 I would like the working group to consider this questio= n soon so it doesn't delay consensus later.

On Fri, Mar 15, 2019 at 12:2= 7 PM Paul Hoffman <paul.hoffma= n@icann.org> wrote:
On Mar 15, 2019, at 6:12 AM, Ben Schwartz <bemasc=3D40google.= com@dmarc.ietf..org> wrote:
> 5. Machine-readable content in a TXT record

This is the first I had heard that people objected to using a TXT record, b= ut I might have missed that part of the discussion. Given that this query i= s for a newly-created SUDN that is only used for looking up DoH information= , there is no chance that the TXT record would be in use for anything else.=

Having said that, it would be quite easy for this document to create a new = RRtype for this particular query. (I would not want to re-use the URI RRtyp= e because it would take more effort to explain the priority and weight, as = well as dealing with the common error of people not put the URI in quotatio= ns marks as is required for the URI RRtype.)

--Paul Hoffman
--0000000000000c857a058424de9a-- --00000000000012c063058424de8e Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCYTuD1+FaAJM3d5qGZL2ok mBijFiwDl0icEBMJ5O2ciTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMTUxNjUyNDNaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAPGXGkTvMRdsrMGBprKR00WyljmNZb1a7VQfhgovb 1z1Sp2AArF27HI9FKi+uNbbqJk+y+ru9HLfhAkDdpwLRVn0+2nNZuS3FxBdygV6E+3K4MV0r9npD x9yDa2DcYQyaO+dA2gKL8g4i0HjrVZj0bvVyW3Tn4z718q9pUZtszdLM+07ktxrOmtkcmf0uVdtX y4XWPPsnB0FRvNcd90lu0tOB+MSwPFmrY0Nki2RL5RWshEeWBs2tyP6Ys8s5USCImwwdlMUQhSoJ Dccm4VxDjSVNH5iG8pYsi60HTpA+Acfeh7XuyK40Iq5fsU62o3p1WtodoRUw+/+TSSwvHU78LQ== --00000000000012c063058424de8e-- From nobody Fri Mar 15 09:54:24 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67E7212D4EC for ; Fri, 15 Mar 2019 09:54:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.85 X-Spam-Level: X-Spam-Status: No, score=-1.85 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, KHOP_DYNAMIC=0.85, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CM4Whso8ELc7 for ; Fri, 15 Mar 2019 09:54:20 -0700 (PDT) Received: from mx0b-00190b01.pphosted.com (mx0b-00190b01.pphosted.com [IPv6:2620:100:9005:57f::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE54112705F for ; Fri, 15 Mar 2019 09:54:19 -0700 (PDT) Received: from pps.filterd (m0122331.ppops.net [127.0.0.1]) by mx0b-00190b01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x2FGlScl019492; Fri, 15 Mar 2019 16:54:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=YrthzAnUZmPEYtL9uvCEsdfJeNCNb0/rf6TfC8pfXrM=; b=QvAj9NXrlqxJcKXexeoBUnzl3OGm8pPQOsP5fcePl9/VVavYBLVBdSGMw2LWwuSyWW+a SVr6+31hmloftBePQDq4bIlLLv/MDqceXIKMx6ChBjH6qOqbhkig21xg21AmbeZyuOpb MtQsexHyYnNjuaFAycBCpIuTJnWvi3e7dHRUMB0faNnmneLeaIWkEjo7uGEOAihPAkbG gkW0EE4ykGPgJFHBbVx5Tv7j1dbGVWUD/kn6c8/qiQOv9+2Y53dtKyjrEfPY/MS5rm7y vWlNAUytYk6NbS/XD4FL0PjNGZ6wJ00koY6MW+W931V7NabQYgfNbWXGMQ4YZeAQ2018 6w== Received: from prod-mail-ppoint4 (a96-6-114-87.deploy.static.akamaitechnologies.com [96.6.114.87] (may be forged)) by mx0b-00190b01.pphosted.com with ESMTP id 2r8cnr107q-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 16:54:17 +0000 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x2FGlG7u009207; Fri, 15 Mar 2019 12:54:17 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.30]) by prod-mail-ppoint4.akamai.com with ESMTP id 2r49q0yc8e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 12:54:16 -0400 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com (172.27.27.103) by ustx2ex-dag1mb3.msg.corp.akamai.com (172.27.27.103) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 15 Mar 2019 11:53:22 -0500 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com ([172.27.27.103]) by ustx2ex-dag1mb3.msg.corp.akamai.com ([172.27.27.103]) with mapi id 15.00.1473.003; Fri, 15 Mar 2019 11:53:22 -0500 From: "Hewitt, Rory" To: Ben Schwartz , DoH WG Thread-Topic: [Doh] Reviewing Resolver-Associated DOH Thread-Index: AQHU2zDf0C46PZ1RqE+PSQesFzBXNqYM5Zdg Date: Fri, 15 Mar 2019 16:53:21 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.28.212.170] Content-Type: multipart/alternative; boundary="_000_c1bf24e9731d481caed07e0c5f11e89eustx2exdag1mb3msgcorpak_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-15_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903150119 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-15_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903150119 Archived-At: Subject: Re: [Doh] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:54:23 -0000 --_000_c1bf24e9731d481caed07e0c5f11e89eustx2exdag1mb3msgcorpak_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QmVuLA0KDQpDb21tZW50cyBpbmxpbmU6DQoNCg0KICAxLiAgSVAtYWRkcmVzcyBjZXJ0aWZpY2F0 ZXMNCg0KDQoNCk5vIHBvc2l0aW9uDQoNCg0KDQogIDEuICBBIG5ldyAud2VsbC1rbm93biBlbmRw b2ludA0KDQoNCg0KQXMgd2l0aCBhbGwgLy53ZWxsLWtub3duLyBlbmRwb2ludHMsIHRoZSBpc3N1 ZSBpcyBib3RoIHN0YW5kYXJkaXphdGlvbiBhbmQgcHVibGljaXphdGlvbi4gQUlVSSwgQG1ub3Qn cyBvcmlnaW5hbCBpZGVhbCB3b3VsZCBiZSB0byBoYXZlIC8ud2VsbC1rbm93bi8gYmUgcHJldHR5 ICdnZW5lcmljJy4gVGhlcmVmb3JlIEknbSBub3QgYSBmYW4gb2YgIi9kb2gtc2VydmVycy1hc3Nv Y2lhdGVkLyIgLSBJJ2QgbXVjaCByYXRoZXIgc2VlICIvZG5zL2RvaC8iLCB3aGljaCB3b3VsZCBl bmFibGUgb3RoZXIgKGZ1dHVyZSkgRE5TLXJlbGF0ZWQgZnVuY3Rpb25hbGl0eSB0byBoYXZlIGEg c3ViLWZvbGRlciB3aXRoaW4gIi8ud2VsbC1rbm93bi9kbnMvIi4gSWYgdGhhdCdzIG5vdCBhIHBv c3NpYmlsaXR5LCB3aGF0IGFib3V0ICIvLndlbGwta25vd24vZG5zLWRvaC8iPw0KDQoNCg0KICAx LiAgSlNPTg0KDQoNCg0KTm90IHN1cmUgb2YgdGhlIHF1ZXN0aW9uIGhlcmUuIEFyZSB5b3UgYXNr aW5nIGFib3V0IHRoZSBmb3JtYXQgSlNPTiBzaG91bGQgdGFrZSwgb3Igd2hldGhlciBKU09OIGlz IGEgJ2dvb2QgaWRlYSc/IFllcyB0byB0aGUgbGF0dGVyLg0KDQoNCg0KICAxLiAgUmVjdXJzaXZl IHJlc29sdmVycyBzeW50aGVzaXppbmcgcmVzcG9uc2VzIGFzIGlmIHRoZXkgd2VyZSBhdXRob3Jp dGF0aXZlIGZvciBjZXJ0YWluIG5hbWVzDQoNCg0KDQpObyBwb3NpdGlvbg0KDQoNCg0KICAxLiAg TWFjaGluZS1yZWFkYWJsZSBjb250ZW50IGluIGEgVFhUIHJlY29yZA0KDQoNCg0KQXMgd2l0aCAj MywgZ29vZCBpZGVhLCBidXQgbm90IHN1cmUgb2YgdGhlIGV4YWN0IHF1ZXN0aW9uLg0KDQoNCg0K RmluYWxseSwgSSB0aGluayB0aGUgc3BlYyBzaG91bGQgY29udGFpbiBleGFtcGxlcyBvZiBhICdw cm9wb3NlZCcgSlNPTiByZXNwb25zZSBhbmQgb2YgdGhlIGZvcm1hdCBvZiBhIFRYVCBSUi4gV2l0 aG91dCBleGFtcGxlcyAoZXZlbiB3aGVyZSBtYXJrZWQgYXMgInVub2ZmaWNpYWwgcHJvcG9zYWwi KSwgaXQncyBtdWNoIGhhcmRlciB0byByZWFkIGJ5IHRob3NlIHdobyBkaWRuJ3Qgd3JpdGUgaXQu DQoNClJvcnkNCg0KRnJvbTogQmVuIFNjaHdhcnR6IDxiZW1hc2M9NDBnb29nbGUuY29tQGRtYXJj LmlldGYub3JnPg0KU2VudDogRnJpZGF5LCBNYXJjaCAxNSwgMjAxOSA2OjEzIEFNDQpUbzogRG9I IFdHIDxkb2hAaWV0Zi5vcmc+DQpTdWJqZWN0OiBbRG9oXSBSZXZpZXdpbmcgUmVzb2x2ZXItQXNz b2NpYXRlZCBET0gNCg0KSSdkIGxpa2UgdG8gdGhhbmsgdGhlIHdvcmtpbmcgZ3JvdXAgcGFydGlj aXBhbnRzIGZvciB0aGUgZXh0ZW5zaXZlIGRpc2N1c3Npb24gb2Ygb3VyIG1vc3QgcmVjZW50IGRy YWZ0cy4gIEhvd2V2ZXIsIEkgd291bGQgYXBwcmVjaWF0ZSBtb3JlIHJldmlldyBvZiB0aGUgUmVz b2x2ZXItQXNzb2NpYXRlZCBET0ggZHJhZnQsIHdoaWNoIGhhcyB0aGUgbGFyZ2VzdCB0aW1lIHNl Z21lbnQgYWxsb2NhdGVkIGZvciB0aGUgdXBjb21pbmcgbWVldGluZy4gIFRoaXMgZHJhZnQgY29u dGFpbnMgc2V2ZXJhbCBjb21wb25lbnRzIHRoYXQgaGF2ZSBiZWVuIGNvbnRyb3ZlcnNpYWwgaW4g dGhlIHBhc3Q6DQoNCjEuIElQLWFkZHJlc3MgY2VydGlmaWNhdGVzDQoyLiBBIG5ldyAud2VsbC1r bm93biBlbmRwb2ludA0KMy4gSlNPTg0KNC4gUmVjdXJzaXZlIHJlc29sdmVycyBzeW50aGVzaXpp bmcgcmVzcG9uc2VzIGFzIGlmIHRoZXkgd2VyZSBhdXRob3JpdGF0aXZlIGZvciBjZXJ0YWluIG5h bWVzDQo1LiBNYWNoaW5lLXJlYWRhYmxlIGNvbnRlbnQgaW4gYSBUWFQgcmVjb3JkDQoNCkFsc28s IHRoZSBkcmFmdCBkb2VzIG5vdCBlbmFibGUgdGhlIHVzZSBvZiBEb0ggaWYgKDEpIGFuIGFwcGxp Y2F0aW9uIHJlbGllcyBvbiBQT1NJWC1saWtlIEROUyBBUElzIHRvIGJvb3RzdHJhcCBBTkQgKDIp IHRoZSByZXNvbHZlciBpcyBvbmx5IHJlYWNoYWJsZSBvbiBhIG5vbi1wdWJsaWMgSVAgYWRkcmVz cyAoZS5nLiBSRkMgMTkxOCkuICBUaGlzIGlzIGEgc2lkZSBlZmZlY3Qgb2YgdGhlIHJlcXVpcmVt ZW50IHRoYXQgdGhlIERvSCBzZXJ2ZXIgcHJvdmlkZSBhIHZhbGlkIGNlcnRpZmljYXRlIGZvciBp dHMgbmFtZSwgY2hhaW5lZCB0byBhIHJvb3QgdGhhdCBpcyBhbHJlYWR5IHRydXN0ZWQgYnkgdGhl IGNsaWVudC4gIFRoaXMgZHJhZnQgZG9lcyBub3QgYWx0ZXIgdGhhdCByZXF1aXJlbWVudC4NCg0K SWYgYW55IG9mIHRoZXNlIHRlY2huaWNhbCBlbGVtZW50cyBhcmUgb2YgY29uY2VybiB0byB5b3Us IHBsZWFzZSBjb21tZW50IG5vdywgc28gdGhhdCB0aGUgbWVldGluZyBjYW4gYmUgYXMgcHJvZHVj dGl2ZSBhcyBwb3NzaWJsZS4NCg0KLS1CZW4NCg== --_000_c1bf24e9731d481caed07e0c5f11e89eustx2exdag1mb3msgcorpak_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpWZXJkYW5hOw0KCXBhbm9zZS0xOjIgMTEg NiA0IDMgNSA0IDQgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwg bGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6 dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6 OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAuTXNv TGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2Lk1zb0xpc3RQYXJhZ3JhcGgN Cgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6MGluOw0KCW1hcmdpbi1yaWdo dDowaW47DQoJbWFyZ2luLWJvdHRvbTowaW47DQoJbWFyZ2luLWxlZnQ6LjVpbjsNCgltYXJnaW4t Ym90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1hbDAsIGRpdi5tc29ub3Jt YWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFyZ2luLXRvcC1hbHQ6YXV0 bzsNCgltYXJnaW4tcmlnaHQ6MGluOw0KCW1zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvOw0KCW1h cmdpbi1sZWZ0OjBpbjsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1zdHlsZS10eXBlOnBlcnNv bmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJWZXJkYW5hIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMw MDIwNjA7DQoJZm9udC13ZWlnaHQ6bm9ybWFsOw0KCWZvbnQtc3R5bGU6bm9ybWFsO30NCi5Nc29D aHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5O30NCkBwYWdlIFdvcmRTZWN0 aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4gMS4waW4gMS4waW4gMS4w aW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQovKiBMaXN0IERl ZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxMTI4NDI4MzcxOw0KCW1zby1s aXN0LXR5cGU6aHlicmlkOw0KCW1zby1saXN0LXRlbXBsYXRlLWlkczoxNDIwNDUyNTI0IDY3Njk4 NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAzIDY3Njk4NzEzIDY3Njk4NzE1IDY3Njk4NzAz IDY3Njk4NzEzIDY3Njk4NzE1O30NCkBsaXN0IGwwOmxldmVsMQ0KCXttc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LS4yNWluO30NCkBsaXN0IGwwOmxldmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDphbHBo YS1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBv c2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LS4yNWluO30NCkBsaXN0IGwwOmxldmVsMw0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpyb21hbi1sb3dlcjsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOnJpZ2h0Ow0KCXRleHQtaW5kZW50Oi05 LjBwdDt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNv LWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlz dCBsMDpsZXZlbDUNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YWxwaGEtbG93ZXI7DQoJbXNv LWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0K CXRleHQtaW5kZW50Oi0uMjVpbjt9DQpAbGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6cm9tYW4tbG93ZXI7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpyaWdodDsNCgl0ZXh0LWluZGVudDotOS4wcHQ7fQ0KQGxpc3Qg bDA6bGV2ZWw3DQoJe21zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXIt cG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotLjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJ e21zby1sZXZlbC1udW1iZXItZm9ybWF0OmFscGhhLWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3Rv cDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDot LjI1aW47fQ0KQGxpc3QgbDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OnJvbWFu LWxvd2VyOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9z aXRpb246cmlnaHQ7DQoJdGV4dC1pbmRlbnQ6LTkuMHB0O30NCm9sDQoJe21hcmdpbi1ib3R0b206 MGluO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGluO30NCi0tPjwvc3R5bGU+PCEtLVtpZiBndGUg bXNvIDldPjx4bWw+DQo8bzpzaGFwZWRlZmF1bHRzIHY6ZXh0PSJlZGl0IiBzcGlkbWF4PSIxMDI2 IiAvPg0KPC94bWw+PCFbZW5kaWZdLS0+PCEtLVtpZiBndGUgbXNvIDldPjx4bWw+DQo8bzpzaGFw ZWxheW91dCB2OmV4dD0iZWRpdCI+DQo8bzppZG1hcCB2OmV4dD0iZWRpdCIgZGF0YT0iMSIgLz4N CjwvbzpzaGFwZWxheW91dD48L3htbD48IVtlbmRpZl0tLT4NCjwvaGVhZD4NCjxib2R5IGxhbmc9 IkVOLVVTIiBsaW5rPSIjMDU2M0MxIiB2bGluaz0iIzk1NEY3MiI+DQo8ZGl2IGNsYXNzPSJXb3Jk U2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5 LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAw MjA2MCI+QmVuLDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1m YW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkNvbW1l bnRzIGlubGluZTo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGluIiBzdGFydD0iMSIgdHlwZT0iMSI+DQo8bGkgY2xh c3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAg bGV2ZWwxIGxmbzEiPklQLWFkZHJlc3MgY2VydGlmaWNhdGVzPG86cD48L286cD48L2xpPjwvb2w+ DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+Tm8gcG9zaXRpb248bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29MaXN0UGFyYWdyYXBoIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxvbCBzdHlsZT0i bWFyZ2luLXRvcDowaW4iIHN0YXJ0PSIyIiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTGlzdFBh cmFncmFwaCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjBpbjttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+ QSBuZXcgLndlbGwta25vd24gZW5kcG9pbnQ8bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxwIGNsYXNz PSJNc29MaXN0UGFyYWdyYXBoIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29M aXN0UGFyYWdyYXBoIj5BcyB3aXRoIGFsbCAvLndlbGwta25vd24vIGVuZHBvaW50cywgdGhlIGlz c3VlIGlzIGJvdGggc3RhbmRhcmRpemF0aW9uIGFuZCBwdWJsaWNpemF0aW9uLiBBSVVJLCBAbW5v dCdzIG9yaWdpbmFsIGlkZWFsIHdvdWxkIGJlIHRvIGhhdmUgLy53ZWxsLWtub3duLyBiZSBwcmV0 dHkgJ2dlbmVyaWMnLiBUaGVyZWZvcmUgSSdtIG5vdCBhIGZhbiBvZiAmcXVvdDsvZG9oLXNlcnZl cnMtYXNzb2NpYXRlZC8mcXVvdDsgLSBJJ2QNCiBtdWNoIHJhdGhlciBzZWUgJnF1b3Q7L2Rucy9k b2gvJnF1b3Q7LCB3aGljaCB3b3VsZCBlbmFibGUgb3RoZXIgKGZ1dHVyZSkgRE5TLXJlbGF0ZWQg ZnVuY3Rpb25hbGl0eSB0byBoYXZlIGEgc3ViLWZvbGRlciB3aXRoaW4gJnF1b3Q7Ly53ZWxsLWtu b3duL2Rucy8mcXVvdDsuIElmIHRoYXQncyBub3QgYSBwb3NzaWJpbGl0eSwgd2hhdCBhYm91dCAm cXVvdDsvLndlbGwta25vd24vZG5zLWRvaC8mcXVvdDs/PG86cD48L286cD48L3A+DQo8cCBjbGFz cz0iTXNvTGlzdFBhcmFncmFwaCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8b2wgc3R5bGU9Im1h cmdpbi10b3A6MGluIiBzdGFydD0iMyIgdHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJh Z3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPkpT T048bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj5Ob3Qgc3VyZSBv ZiB0aGUgcXVlc3Rpb24gaGVyZS4gQXJlIHlvdSBhc2tpbmcgYWJvdXQgdGhlIGZvcm1hdCBKU09O IHNob3VsZCB0YWtlLCBvciB3aGV0aGVyIEpTT04gaXMgYSAnZ29vZCBpZGVhJz8gWWVzIHRvIHRo ZSBsYXR0ZXIuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PG86 cD4mbmJzcDs8L286cD48L3A+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGluIiBzdGFydD0iNCIg dHlwZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVm dDowaW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPlJlY3Vyc2l2ZSByZXNvbHZlcnMgc3ludGhl c2l6aW5nIHJlc3BvbnNlcyBhcyBpZiB0aGV5IHdlcmUgYXV0aG9yaXRhdGl2ZSBmb3IgY2VydGFp biBuYW1lczxvOnA+PC9vOnA+PC9saT48L29sPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiPk5vIHBv c2l0aW9uPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8b2wgc3R5bGU9Im1hcmdpbi10b3A6MGluIiBzdGFydD0iNSIgdHlw ZT0iMSI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDow aW47bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPk1hY2hpbmUtcmVhZGFibGUgY29udGVudCBpbiBh IFRYVCByZWNvcmQ8bzpwPjwvbzpwPjwvbGk+PC9vbD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIj5B cyB3aXRoICMzLCBnb29kIGlkZWEsIGJ1dCBub3Qgc3VyZSBvZiB0aGUgZXhhY3QgcXVlc3Rpb24u PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1z aXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xv cjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRh bmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYw Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5GaW5hbGx5LCBJIHRoaW5rIHRoZSBzcGVjIHNob3Vs ZCBjb250YWluIGV4YW1wbGVzIG9mIGEgJ3Byb3Bvc2VkJyBKU09OIHJlc3BvbnNlIGFuZCBvZiB0 aGUgZm9ybWF0IG9mIGEgVFhUIFJSLiBXaXRob3V0IGV4YW1wbGVzIChldmVuIHdoZXJlIG1hcmtl ZCBhcyAmcXVvdDt1bm9mZmljaWFsDQogcHJvcG9zYWwmcXVvdDspLCBpdCdzIG11Y2ggaGFyZGVy IHRvIHJlYWQgYnkgdGhvc2Ugd2hvIGRpZG4ndCB3cml0ZSBpdC48bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2Zv bnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMUYzODY0Ij48 bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMUYzODY0Ij5Sb3J5PC9zcGFuPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiM1 OTU5NTkiPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxiPkZyb206PC9iPiBCZW4gU2Nod2FydHogJmx0O2JlbWFzYz00 MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5 LCBNYXJjaCAxNSwgMjAxOSA2OjEzIEFNPGJyPg0KPGI+VG86PC9iPiBEb0ggV0cgJmx0O2RvaEBp ZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OjwvYj4gW0RvaF0gUmV2aWV3aW5nIFJlc29sdmVy LUFzc29jaWF0ZWQgRE9IPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JJ2QgbGlrZSB0 byB0aGFuayB0aGUgd29ya2luZyBncm91cCBwYXJ0aWNpcGFudHMgZm9yIHRoZSBleHRlbnNpdmUg ZGlzY3Vzc2lvbiBvZiBvdXIgbW9zdCByZWNlbnQgZHJhZnRzLiZuYnNwOyBIb3dldmVyLCBJIHdv dWxkIGFwcHJlY2lhdGUgbW9yZSByZXZpZXcgb2YgdGhlIFJlc29sdmVyLUFzc29jaWF0ZWQgRE9I IGRyYWZ0LCB3aGljaCBoYXMgdGhlIGxhcmdlc3QgdGltZSBzZWdtZW50IGFsbG9jYXRlZCBmb3Ig dGhlDQogdXBjb21pbmcgbWVldGluZy4mbmJzcDsgVGhpcyBkcmFmdCBjb250YWlucyBzZXZlcmFs IGNvbXBvbmVudHMgdGhhdCBoYXZlIGJlZW4gY29udHJvdmVyc2lhbCBpbiB0aGUgcGFzdDo8bzpw PjwvbzpwPjwvcD4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpw PjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjEuIElQLWFkZHJlc3Mg Y2VydGlmaWNhdGVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4yLiBBIG5ldyAud2VsbC1rbm93biBlbmRwb2ludDxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+My4gSlNPTjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+NC4gUmVjdXJzaXZlIHJlc29sdmVy cyBzeW50aGVzaXppbmcgcmVzcG9uc2VzIGFzIGlmIHRoZXkgd2VyZSBhdXRob3JpdGF0aXZlIGZv ciBjZXJ0YWluIG5hbWVzPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj41LiBNYWNoaW5lLXJlYWRhYmxlIGNvbnRlbnQgaW4gYSBUWFQgcmVjb3JkPG86 cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsc28s IHRoZSBkcmFmdCBkb2VzIG5vdCBlbmFibGUgdGhlIHVzZSBvZiBEb0ggaWYgKDEpIGFuIGFwcGxp Y2F0aW9uIHJlbGllcyBvbiBQT1NJWC1saWtlIEROUyBBUElzIHRvIGJvb3RzdHJhcCBBTkQgKDIp IHRoZSByZXNvbHZlciBpcyBvbmx5IHJlYWNoYWJsZSBvbiBhIG5vbi1wdWJsaWMgSVAgYWRkcmVz cyAoZS5nLiBSRkMgMTkxOCkuJm5ic3A7IFRoaXMgaXMgYSBzaWRlIGVmZmVjdCBvZiB0aGUgcmVx dWlyZW1lbnQNCiB0aGF0IHRoZSBEb0ggc2VydmVyIHByb3ZpZGUgYSB2YWxpZCBjZXJ0aWZpY2F0 ZSBmb3IgaXRzIG5hbWUsIGNoYWluZWQgdG8gYSByb290IHRoYXQgaXMgYWxyZWFkeSB0cnVzdGVk IGJ5IHRoZSBjbGllbnQuJm5ic3A7IFRoaXMgZHJhZnQgZG9lcyBub3QgYWx0ZXIgdGhhdCByZXF1 aXJlbWVudC48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+SWYgYW55IG9mIHRoZXNlIHRlY2huaWNhbCBlbGVtZW50cyBhcmUgb2YgY29uY2VybiB0 byB5b3UsIHBsZWFzZSBjb21tZW50IG5vdywgc28gdGhhdCB0aGUgbWVldGluZyBjYW4gYmUgYXMg cHJvZHVjdGl2ZSBhcyBwb3NzaWJsZS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+LS1CZW48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_c1bf24e9731d481caed07e0c5f11e89eustx2exdag1mb3msgcorpak_-- From nobody Fri Mar 15 09:58:09 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 13ACF129284 for ; Fri, 15 Mar 2019 09:58:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.85 X-Spam-Level: X-Spam-Status: No, score=-1.85 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, KHOP_DYNAMIC=0.85, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gusehQUeYyaB for ; Fri, 15 Mar 2019 09:58:06 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72ECE12705F for ; Fri, 15 Mar 2019 09:58:06 -0700 (PDT) Received: from pps.filterd (m0122333.ppops.net [127.0.0.1]) by mx0a-00190b01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x2FGvS6V013951; Fri, 15 Mar 2019 16:57:45 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=0Im5hy4st1qqpOQWpyIRB81OPHl72X2nsfeeDquQf50=; b=kVy7qhYUHe/lbII94b6S/t6yvs7c4UbB4FINzIL0yO/KWfpK5cnn6OjSJiYraDFnLuFn C/3b+4eHg/RIhgE+ITerwxfhYjXUS4AXH2DCJ1pV/yuI+dJV5aL9QiQjgDRaYox7FuOR ID39iLks+/dOfXlJnX+pAv3ja8dt+E3LbUljKu1MNuIsDzg+HCU9l82vTd4kWBEMfHDy xaqN7VyNZgiNRXkOqggJJLoaZX7KHx2jHnMefAElIcyR10/o8LbC1fqZwfD/sKFBdelH iauotT7F25mKbJWDMKCcRLAk+rxDtwAJ1feOpL+yF6dpyuxmnPwBPh05STogRBuykwPh mw== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by mx0a-00190b01.pphosted.com with ESMTP id 2r7qm5dhhk-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 16:57:45 +0000 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x2FGl1TP026620; Fri, 15 Mar 2019 12:57:43 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.32]) by prod-mail-ppoint2.akamai.com with ESMTP id 2r49q13hf3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 12:57:43 -0400 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com (172.27.27.103) by ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 15 Mar 2019 09:57:40 -0700 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com ([172.27.27.103]) by ustx2ex-dag1mb3.msg.corp.akamai.com ([172.27.27.103]) with mapi id 15.00.1473.003; Fri, 15 Mar 2019 11:57:40 -0500 From: "Hewitt, Rory" To: Ben Schwartz , Paul Hoffman CC: DoH WG Thread-Topic: [Doh] Use of TXT records Thread-Index: AQHU20wb1BtgZuOodkiHHGX0BN4SLqYNPC0A//+s9ZA= Date: Fri, 15 Mar 2019 16:57:40 +0000 Message-ID: <0e842b1edfe44bd69e1188e72b8f3873@ustx2ex-dag1mb3.msg.corp.akamai.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.28.212.170] Content-Type: multipart/alternative; boundary="_000_0e842b1edfe44bd69e1188e72b8f3873ustx2exdag1mb3msgcorpak_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-15_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903150119 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-15_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903150120 Archived-At: Subject: Re: [Doh] Use of TXT records X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 16:58:08 -0000 --_000_0e842b1edfe44bd69e1188e72b8f3873ustx2exdag1mb3msgcorpak_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 QmVuLA0KDQpIb3cgaGFzIHRoZSB1c2Ugb2YgVFhUIGJlZW4gYSBwb2ludCBvZiBjb250cm92ZXJz eSBpbiB0aGUgcGFzdD8NCg0KSXMgaXQgYSBnZW5lcmFsICJUWFQgcmVjb3JkcyBhcmUgYmFkIiBv ciAiQWRkaW5nIG5ldyBUWFQgcmVjb3JkcyBpcyBiYWQiIG9yICJUWFQgcmVjb3JkcyBoYXZlIG5l dmVyIGJlZW4gc3RhbmRhcmRpemVkIG9yIGZvcm1hdHRlZCBjb25zaXN0ZW50bHkgYW1vbmcgdGhl aXIgdmFyaW91cyB1c2VzLCBzbyB0aGVyZSdzIGFsd2F5cyB0aGUgcG9zc2liaWxpdHkgb2YgY2xh c2hlcyIuDQoNCkJlY2F1c2UgSSwgZm9yIG9uZSwgd291bGQgYWdyZWUgd2l0aCB0aGUgbGFzdC4N Cg0KUm9yeQ0KDQpGcm9tOiBCZW4gU2Nod2FydHogPGJlbWFzYz00MGdvb2dsZS5jb21AZG1hcmMu aWV0Zi5vcmc+DQpTZW50OiBGcmlkYXksIE1hcmNoIDE1LCAyMDE5IDk6NTMgQU0NClRvOiBQYXVs IEhvZmZtYW4gPHBhdWwuaG9mZm1hbkBpY2Fubi5vcmc+DQpDYzogRG9IIFdHIDxkb2hAaWV0Zi5v cmc+DQpTdWJqZWN0OiBSZTogW0RvaF0gVXNlIG9mIFRYVCByZWNvcmRzDQoNClRvIGJlIGNsZWFy LCBJJ20gbm90IG9iamVjdGluZyB0byB0aGlzIGNob2ljZS4gIEknbSBtZXJlbHkgbm90aW5nIHRo YXQgdXNlIG9mIFRYVCBoYXMgYmVlbiBhIHBvaW50IG9mIGNvbnRyb3ZlcnN5IGluIG90aGVyIGRp c2N1c3Npb25zIGF0IHRoZSBJRVRGLiAgU29tZSBncm91cHMgaGF2ZSBkZWNpZGVkIHRvIHByb2Nl ZWQgd2l0aCBUWFQsIHNvbWUgaGF2ZSBwcmVmZXJyZWQgdG8gdXNlIGRpZmZlcmVudCBvciBuZXcg UlJUWVBFcywgYW5kIHNvbWUgaGF2ZSBub3QgeWV0IGRlY2lkZWQuICBJIHdvdWxkIGxpa2UgdGhl IHdvcmtpbmcgZ3JvdXAgdG8gY29uc2lkZXIgdGhpcyBxdWVzdGlvbiBzb29uIHNvIGl0IGRvZXNu J3QgZGVsYXkgY29uc2Vuc3VzIGxhdGVyLg0KDQpPbiBGcmksIE1hciAxNSwgMjAxOSBhdCAxMjoy NyBQTSBQYXVsIEhvZmZtYW4gPHBhdWwuaG9mZm1hbkBpY2Fubi5vcmc8bWFpbHRvOnBhdWwuaG9m Zm1hbkBpY2Fubi5vcmc+PiB3cm90ZToNCk9uIE1hciAxNSwgMjAxOSwgYXQgNjoxMiBBTSwgQmVu IFNjaHdhcnR6IDxiZW1hc2M9NDBnb29nbGUuY29tQGRtYXJjLmlldGYuLm9yZzxtYWlsdG86YmVt YXNjPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLi5vcmc+PiB3cm90ZToNCj4gNS4gTWFjaGluZS1y ZWFkYWJsZSBjb250ZW50IGluIGEgVFhUIHJlY29yZA0KDQpUaGlzIGlzIHRoZSBmaXJzdCBJIGhh ZCBoZWFyZCB0aGF0IHBlb3BsZSBvYmplY3RlZCB0byB1c2luZyBhIFRYVCByZWNvcmQsIGJ1dCBJ IG1pZ2h0IGhhdmUgbWlzc2VkIHRoYXQgcGFydCBvZiB0aGUgZGlzY3Vzc2lvbi4gR2l2ZW4gdGhh dCB0aGlzIHF1ZXJ5IGlzIGZvciBhIG5ld2x5LWNyZWF0ZWQgU1VETiB0aGF0IGlzIG9ubHkgdXNl ZCBmb3IgbG9va2luZyB1cCBEb0ggaW5mb3JtYXRpb24sIHRoZXJlIGlzIG5vIGNoYW5jZSB0aGF0 IHRoZSBUWFQgcmVjb3JkIHdvdWxkIGJlIGluIHVzZSBmb3IgYW55dGhpbmcgZWxzZS4NCg0KSGF2 aW5nIHNhaWQgdGhhdCwgaXQgd291bGQgYmUgcXVpdGUgZWFzeSBmb3IgdGhpcyBkb2N1bWVudCB0 byBjcmVhdGUgYSBuZXcgUlJ0eXBlIGZvciB0aGlzIHBhcnRpY3VsYXIgcXVlcnkuIChJIHdvdWxk IG5vdCB3YW50IHRvIHJlLXVzZSB0aGUgVVJJIFJSdHlwZSBiZWNhdXNlIGl0IHdvdWxkIHRha2Ug bW9yZSBlZmZvcnQgdG8gZXhwbGFpbiB0aGUgcHJpb3JpdHkgYW5kIHdlaWdodCwgYXMgd2VsbCBh cyBkZWFsaW5nIHdpdGggdGhlIGNvbW1vbiBlcnJvciBvZiBwZW9wbGUgbm90IHB1dCB0aGUgVVJJ IGluIHF1b3RhdGlvbnMgbWFya3MgYXMgaXMgcmVxdWlyZWQgZm9yIHRoZSBVUkkgUlJ0eXBlLikN Cg0KLS1QYXVsIEhvZmZtYW4NCg== --_000_0e842b1edfe44bd69e1188e72b8f3873ustx2exdag1mb3msgcorpak_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpWZXJkYW5hOw0KCXBhbm9zZS0xOjIgMTEg NiA0IDMgNSA0IDQgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwg bGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlz aXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3Jt YWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29u b3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCglt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWls U3R5bGUxOQ0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToi VmVyZGFuYSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwOw0KCWZvbnQtd2VpZ2h0Om5vcm1h bDsNCglmb250LXN0eWxlOm5vcm1hbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkJlbiw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5 OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMDAyMDYwIj5Ib3cgaGFzIHRoZSB1c2Ugb2YgVFhUIGJlZW4gYSBwb2ludCBvZiBjb250 cm92ZXJzeSBpbiB0aGUgcGFzdD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj5JcyBpdCBhIGdlbmVyYWwgJnF1b3Q7VFhUIHJlY29yZHMgYXJlIGJhZCZxdW90OyBvciAm cXVvdDtBZGRpbmcgbmV3IFRYVCByZWNvcmRzIGlzIGJhZCZxdW90OyBvciAmcXVvdDtUWFQgcmVj b3JkcyBoYXZlIG5ldmVyIGJlZW4gc3RhbmRhcmRpemVkIG9yIGZvcm1hdHRlZCBjb25zaXN0ZW50 bHkgYW1vbmcgdGhlaXIgdmFyaW91cw0KIHVzZXMsIHNvIHRoZXJlJ3MgYWx3YXlzIHRoZSBwb3Nz aWJpbGl0eSBvZiBjbGFzaGVzJnF1b3Q7LjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1 b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPkJlY2F1c2UgSSwgZm9yIG9uZSwgd291bGQgYWdyZWUgd2l0aCB0aGUgbGFzdC48 L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJk YW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGMzg2NCI+PG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzFGMzg2NCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzFGMzg2NCI+Um9yeTwvc3Bhbj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojNTk1 OTU5Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBz dHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fu cy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48Yj5Gcm9tOjwvYj4gQmVuIFNjaHdhcnR6ICZsdDtiZW1hc2M9NDBn b29nbGUuY29tQGRtYXJjLmlldGYub3JnJmd0Ow0KPGJyPg0KPGI+U2VudDo8L2I+IEZyaWRheSwg TWFyY2ggMTUsIDIwMTkgOTo1MyBBTTxicj4NCjxiPlRvOjwvYj4gUGF1bCBIb2ZmbWFuICZsdDtw YXVsLmhvZmZtYW5AaWNhbm4ub3JnJmd0Ozxicj4NCjxiPkNjOjwvYj4gRG9IIFdHICZsdDtkb2hA aWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+U3ViamVjdDo8L2I+IFJlOiBbRG9oXSBVc2Ugb2YgVFhUIHJl Y29yZHM8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRvIGJlIGNsZWFyLCBJJ20gbm90 IG9iamVjdGluZyB0byB0aGlzIGNob2ljZS4mbmJzcDsgSSdtIG1lcmVseSBub3RpbmcgdGhhdCB1 c2Ugb2YgVFhUIGhhcyBiZWVuIGEgcG9pbnQgb2YgY29udHJvdmVyc3kgaW4gb3RoZXIgZGlzY3Vz c2lvbnMgYXQgdGhlIElFVEYuJm5ic3A7IFNvbWUgZ3JvdXBzIGhhdmUgZGVjaWRlZCB0byBwcm9j ZWVkIHdpdGggVFhULCBzb21lIGhhdmUgcHJlZmVycmVkIHRvIHVzZSBkaWZmZXJlbnQgb3IgbmV3 DQogUlJUWVBFcywgYW5kIHNvbWUgaGF2ZSBub3QgeWV0IGRlY2lkZWQuJm5ic3A7IEkgd291bGQg bGlrZSB0aGUgd29ya2luZyBncm91cCB0byBjb25zaWRlciB0aGlzIHF1ZXN0aW9uIHNvb24gc28g aXQgZG9lc24ndCBkZWxheSBjb25zZW5zdXMgbGF0ZXIuPG86cD48L286cD48L3A+DQo8L2Rpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBGcmksIE1hciAxNSwgMjAxOSBhdCAxMjoyNyBQTSBQ YXVsIEhvZmZtYW4gJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsLmhvZmZtYW5AaWNhbm4ub3JnIj5w YXVsLmhvZmZtYW5AaWNhbm4ub3JnPC9hPiZndDsgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0ND Q0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFy Z2luLXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiBNYXIgMTUsIDIwMTksIGF0 IDY6MTIgQU0sIEJlbiBTY2h3YXJ0eiAmbHQ7PGEgaHJlZj0ibWFpbHRvOmJlbWFzYz00MGdvb2ds ZS5jb21AZG1hcmMuaWV0Zi4ub3JnIj5iZW1hc2M9NDBnb29nbGUuY29tQGRtYXJjLmlldGYuLm9y ZzwvYT4mZ3Q7IHdyb3RlOjxicj4NCiZndDsgNS4gTWFjaGluZS1yZWFkYWJsZSBjb250ZW50IGlu IGEgVFhUIHJlY29yZDxicj4NCjxicj4NClRoaXMgaXMgdGhlIGZpcnN0IEkgaGFkIGhlYXJkIHRo YXQgcGVvcGxlIG9iamVjdGVkIHRvIHVzaW5nIGEgVFhUIHJlY29yZCwgYnV0IEkgbWlnaHQgaGF2 ZSBtaXNzZWQgdGhhdCBwYXJ0IG9mIHRoZSBkaXNjdXNzaW9uLiBHaXZlbiB0aGF0IHRoaXMgcXVl cnkgaXMgZm9yIGEgbmV3bHktY3JlYXRlZCBTVUROIHRoYXQgaXMgb25seSB1c2VkIGZvciBsb29r aW5nIHVwIERvSCBpbmZvcm1hdGlvbiwgdGhlcmUgaXMgbm8gY2hhbmNlIHRoYXQgdGhlIFRYVA0K IHJlY29yZCB3b3VsZCBiZSBpbiB1c2UgZm9yIGFueXRoaW5nIGVsc2UuPGJyPg0KPGJyPg0KSGF2 aW5nIHNhaWQgdGhhdCwgaXQgd291bGQgYmUgcXVpdGUgZWFzeSBmb3IgdGhpcyBkb2N1bWVudCB0 byBjcmVhdGUgYSBuZXcgUlJ0eXBlIGZvciB0aGlzIHBhcnRpY3VsYXIgcXVlcnkuIChJIHdvdWxk IG5vdCB3YW50IHRvIHJlLXVzZSB0aGUgVVJJIFJSdHlwZSBiZWNhdXNlIGl0IHdvdWxkIHRha2Ug bW9yZSBlZmZvcnQgdG8gZXhwbGFpbiB0aGUgcHJpb3JpdHkgYW5kIHdlaWdodCwgYXMgd2VsbCBh cyBkZWFsaW5nIHdpdGggdGhlIGNvbW1vbg0KIGVycm9yIG9mIHBlb3BsZSBub3QgcHV0IHRoZSBV UkkgaW4gcXVvdGF0aW9ucyBtYXJrcyBhcyBpcyByZXF1aXJlZCBmb3IgdGhlIFVSSSBSUnR5cGUu KTxicj4NCjxicj4NCi0tUGF1bCBIb2ZmbWFuPG86cD48L286cD48L3A+DQo8L2Jsb2NrcXVvdGU+ DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1sPg0K --_000_0e842b1edfe44bd69e1188e72b8f3873ustx2exdag1mb3msgcorpak_-- From nobody Fri Mar 15 10:50:28 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 552441277D7 for ; Fri, 15 Mar 2019 10:50:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rPOpsBm9uDoC for ; Fri, 15 Mar 2019 10:50:24 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 522A912958B for ; Fri, 15 Mar 2019 10:50:23 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id AE54F39DF; Fri, 15 Mar 2019 13:50:21 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23691.58845.697044.466350@gro.dd.org> Date: Fri, 15 Mar 2019 13:50:21 -0400 From: Dave Lawrence To: doh@ietf.org In-Reply-To: References: <23689.7924.461871.555714@gro.dd.org> Archived-At: Subject: Re: [Doh] Working Group Session Agenda @ Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 17:50:26 -0000 We are evaluating the concerns raised about time and the draft agenda and expect to have an update on Monday. From nobody Fri Mar 15 11:37:07 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C1E4130EFA; Fri, 15 Mar 2019 11:36:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HywiLYr_n6yw; Fri, 15 Mar 2019 11:36:51 -0700 (PDT) Received: from mail-io1-xd34.google.com (mail-io1-xd34.google.com [IPv6:2607:f8b0:4864:20::d34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 064C4130EE4; Fri, 15 Mar 2019 11:36:51 -0700 (PDT) Received: by mail-io1-xd34.google.com with SMTP id x7so9116054ioh.4; Fri, 15 Mar 2019 11:36:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IFBqJsF9fwWObW/VL6XRudjgbJR/ExkrM1E1SUuu0Hw=; b=VuJGPOArnwBNVq0yUT9Ko7O7hCDuN8cyGjaFL9k3NYcc6bITkwSTVMNsjN0Ah7MTFJ PiKFvrOgiKv0lazR/evQXbCtoBIHSq0lHF8pFzoWdDbe0foBXQvWqjzK3iiuKxMIpgwE fjXcdy/ef1OhR49BezSr8QrcH485bA0q1VuygS3kuO3yRO/IDQnfHbdonArauvipn0ah To8ZOt687JdtJj8iQYLqfmSWlms76Sk8f+gHsXdfTMiQK1llwx0ufLOcBVAre5Sw66lt N7nEIJ5bdlJ5uGS1bOL2plH5bU+qDyTqyjNndsxbWT8Xx62pY/WQfe9vaNu1jZb+mGVJ +wuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IFBqJsF9fwWObW/VL6XRudjgbJR/ExkrM1E1SUuu0Hw=; b=mVkUuSJd3pHB3wZNyJlDNX+nYwgSHB+MoAuYVQV1FEQL8DAZiUGCrCD1ZhBWF5BkCg uDjID3ENUohQzRAAR/qnEq6NbeS2o5IMemTS66nrbiDpIgZzO8h8HGLatPkOcAdFXKuR TmTCGsfZBdi+dRgFZsJBiZCDYuuAOxEi83cAuTvCBsCc/C+x6fRFOX7gRoe2uAfTJKRN vvCCYLsCFpWoH7NhkofGStwdfJUNy9zbrqc3ounm621SuKot9czXzXRwqfAh2zRQUhiz 2ohiPzgmOL9wkBB2M13pl2PNivUhn0QW4vF6A0YiJT7copGiRxYJEY70Hm9V2lZIXIw7 vplg== X-Gm-Message-State: APjAAAV+fm6aG51l0iJtcnKmjticKgZWHpLmnHcaOSNu8vefND0M+H7o JHGmQcpyz/K5XSVqlFMMAszO0YjLoXcD0tr8t1tyGhJHzJ8= X-Google-Smtp-Source: APXvYqwoY4XdxbN/RBVIvlLVTNd3zSlGixsORj6QiNIA3zppypt6owzYfqh/N38CLgetz43JG6ZU8G7/bN+nGt4S0qg= X-Received: by 2002:a6b:e202:: with SMTP id z2mr3279969ioc.6.1552675009937; Fri, 15 Mar 2019 11:36:49 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: <1900056.F7IrilhNgi@linux-9daj> From: Ted Hardie Date: Fri, 15 Mar 2019 11:36:22 -0700 Message-ID: To: Paul Vixie Cc: dnsop , DoH WG Content-Type: multipart/alternative; boundary="0000000000006b45f00584265253" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 18:36:57 -0000 --0000000000006b45f00584265253 Content-Type: text/plain; charset="UTF-8" Thanks for the thought you've put into this. I've replied in-line. On Fri, Mar 15, 2019 at 12:45 AM Paul Vixie wrote: > On Tuesday, 12 March 2019 20:52:27 UTC Ted Hardie wrote: > > Paul, > > > > Since it is apparent our disagreement is at a more fundamental level, I > > will make only two further comments. > > ted, your comments were of such a nature that i had to sleep on them more > than > once before i felt i could re-engage. i apologize for the delay. let's > continue. > > > The first is that you recently chided someone for using the word "rant", > > saying that it would "diminish and disrespect" someone's words. In the > > note below you use terms like "warfare" to characterize the work of the > > authors; that is both inflammatory and disrespectful. The authors worked > > on a chartered working group item throughout the IETF process. You > > disagree with the security trade-offs made in the chartering and > execution > > of that work, and discussion of that disagreement will hopefully be > > fruitful. But if you want their respect of your opinion, according them > > the respect due theirs will go a long way; they did not make these > choices > > arbitrarily. > > i did not intend the term "warfare" to be taken colloquially. i meant it > in > the literal sense. all war is economic -- the fighting will continue until > one > party cannot afford to continue. not all war is violent. we do not have a > word > like "trade" as in "trade war" to describe what's happening here, and we > need > one, so that i can use that term to describe as accurately as possible > what i > think is happening. > > DoH's stated goals include "prevent on-path interference in DNS > operations." i > am an on-path interferer, and "i aim to misbehave"[1]. DoH is, in that > sense, > targeted at me. i think it was wrong to do so, not morally wrong, but > wrong on > its own terms, to falsely equate all on-path interferers. parental > controls > and corporate security are forms of on-path interference in DNS operations > which have a valid and moral place in our digital society. DoH could have > distinguished between edge network operators who interfere for reasons our > users and their apps are either cooperative with or unwelcome entirely. > they > did not. they lumped us all together. > All of the work on encrypted DNS presumes that there is one or more parties who wishes to observe the flow of traffic to DNS resolvers for the purposes of surveillance. The conclusion of the IETF after IETF 88 was that there was a class of that, pervasive public surveillance, that was so damaging to the trust of the users in the Internet that it amounted to an attack on the value of the Internet as a whole. The plenary where that was discussed is online here: IETF 88 Technical Plenary: Hardening The Internet - YouTube . In a path with multiple links, in other words, we have a condition where we believe there is likely to be an attacker on one or more of those links that would like to see this data and to use it for purposes not approved by the user or the operator of the service to which the user is directing her flows (or any of the network operators through which the flow passes). The response to that has been first to encrypt the flows which carry the user data. That's not an effort championed not only by the IETF or the IAB; see the US Government's HTTPS Only standard for one example of the many other efforts going on to make that the case. In addition to that primary effort, there have been efforts to reduce the amount of metadata about the flows. Some of that has been in updating transport protocols (e.g. QUIC, TCPINC) to reduce their disclosure of state. Some of it has been in reducing the data revealed by the handshake (e.g. the updates in TLS 1.3 and eSNI). And some of it has been to reduce the data disclosed across those links by the use of the DNS. That's the point of DNS over TLS and DNS over DTLS; it's also the point of DNS over HTTPS: to protect the data in those flows from a known, pervasive attacker. You would like your use of similar surveillance techniques to be differentiated from their use by that set of attackers. The IETF cannot do that on moral grounds, much as we might like you and appreciate your desire to protect your network and your children. We need technical mechanisms. If you review the discussion to date, you'll see a number of such mechanisms proposed. They fall into two broad classes: trusting the local network infrastructure and trusting the local configuration. As was pointed out in many groups, trusting the local infrastructure is extremely problematic in nomadic cases as the local infrastructure can often be infected, ill-maintained. or hostile by design. Given the extremely high percentage of users who are now on the Internet by mobile devices which roam and opportunistically use WiFi, ignoring this reality would not make sense. So we rely on configuration of end devices and applications, with the belief that the user has some choice there in both how the end device is configured and in what applications are supported. That's a trade-off, and not a simple one to make, both because it is very difficult for end users to make that assessment and because there's a high reliance on sensible defaults. But that choice is an engineering trade-off, not an act of war against you or any other network operator. If the user configures your DNS service they get it, and their trust in your operations to provide appropriate answers is thereby matched to your desire to see the requests. For a very large number of enterprise networks, the result is that devices are permitted on the network only when under some form of device management, with the proxies, configuration, and limitations that implies. To protect itself, the enterprise insists on a prior relationship with known terms, instantiated by the configuration of device management. There are lighter forms of configuration that do the same thing to lesser degrees, but they each presume that a trusted edge network operator has a relationship to the users that can effect configuration. > > the method of DoH with respect to preventing on-path interference with DNS > operations is to make it too expensive, obviously, because it > (deliberately) > hides recursive DNS transactions in flows which have been, until now, > unaffective of DNS operations. This is certainly not the case for all deployments of DoH. Please read Kenji Baheaux's message on Chrome's plans for an illustrative counter-example. In that case, Chrome will upgrade to DoH on the configured DNS service. If the devices on your network use your DNS service, it will check if DoH is available and upgrade to it if so; it will not change them to another provider. DoH is also not set up to allow any random HTTPS host provide you DNS answers you did not request; this is not a free invitation to cache-poisoning. > i wish the DoH well in their walk with the GFW, > but i predict that the CCCP has effectively infinite resources and > resolve, > and that it is _not possible_ to exceed their expense budget to the point > where they say, "ok, that's the end, everybody in china who wants free and > open DNS access can get it, we just can't deal with this DoH thing." > > however, for non-nation-state actors, such as myself, it's going to be > really > quite costly to prevent intruders and bots and other malware from moving > their > DNS operations out of our sight and out of our control. our costs will > increase. this increase was deliberate. > > it would be dishonest not to call that economic warfare by the DoH > authors. if > this comes as a surprise to them, then so much the worse for all of us, i > think. > > > My second comment is to point out that the IETF has been heading this way > > for about five years now. The IAB formalized its early support of this > > approach in November of 2014 with this text: > > > > > The IAB urges protocol designers to design for confidential operation > by > > > default. We strongly encourage developers to include encryption in > their > > > implementations, and to make them encrypted by default. We similarly > > > encourage network and service operators to deploy encryption where it > is > > > not yet deployed, and we urge firewall policy administrators to permit > > > encrypted traffic. > > > > > > We believe that each of these changes will help restore the trust users > > > must > > > have in the Internet. We acknowledge that this will take time and > > > trouble, > > > though we believe recent successes in content delivery networks, > > > messaging, > > > and Internet application deployments demonstrate the feasibility of > this > > > migration. We also acknowledge that many network operations activities > > > today, from traffic management and intrusion detection to spam > prevention > > > and policy enforcement, assume access to cleartext payload. For many of > > > these activities there are no solutions yet, but the IAB will work with > > > those affected to foster development of new approaches for these > > > activities > > > which allow us to move to an Internet where traffic is confidential by > > > default. > > i remember this text. DoH is not what i expected as "will work with those > affected". the problem of surveillance is differentiated between home and > corporate networks on the one hand, and public networks on the other. one > perfectly valid approach to the goal set out by the IAB above would have > been > to say, all network operators who care about DNS privacy, should run their > own > recursive DNS servers, and, those servers should prefer DoT where > available > when communicating upstream. > > Paul, you are making a major assumption about where the taps for pervasive surveillance are in the statement above, and it is an assumption I do not share. My personal advice would be to have each network operator who cares about DNS privacy run a recursive resolver using DoT or DoH. I would say the same to any multi-site enterprise. > that answer was not politically acceptable by other interpreters (that is, > not > me) of the IAB text. rather, the IAB text was taken as license to change > the > way DNS resolution would be done for all users. that was overreach, and > was a > consensus i could not join, and has created more losers than winners, and > i > view it as either naivety about real internet security issues, or as an > abuse > of power, depending on who knew how much at what time. > > As a reminder, the IAB made the statement, but the IETF chartered the working group and ran the process. Like all working groups, it has been open to all and has passed through a full consensus process. > > By that point, the IETF working groups were already in formation. Moving > > the DNS toward encryption has been going on since DPRIVE and has been > > accompanied by the rise of transports like QUIC which are encrypted by > > default. You have been working around that, rather than developing new > > practices. I invite you instead to consider how you can accomplish what > > you need to in an Internet where all traffic is confidential. > > when you talk about "the Internet" which originally meant simply a > "network of > networks", you could mean something technical, in which case my network is > one > of those networks (of which there is a network), and we would likely agree > that for networks i build and fund, the traffic will be what i accept, not > what is imposed on me. both the payloads, and the form of those payloads. > no > enterprise or home network operator is going to accept the IETF's mandate > as > to which traffic must be encrypted on our networks, for example. > > The IAB has published a statement about the threat model here (RFC 7624) and has been working through the Stack Evolution program at least from the SEMI workshop to develop a view of how to move the network forward with both encryption and appropriate signals to the on-path devices. You can see the discussions around this in radio networks in RFC 8462 and the upcoming work on protocol wire images and path signals ( https://datatracker.ietf.org/doc/draft-iab-wire-image/ and https://datatracker.ietf.org/doc/draft-iab-path-signals/ ). As best as we can, we want a network that is protected against this attack, measurable, and manageable. That's not a simple task, but it is, I personally believe, the right goal. The value of the Internet to its users is too eroded by the lack of confidentiality for it to reach its full potential without it. on the other hand you could mean what christian huitema seems to mean, > which > is an Internet that is viral, and anything that connects to that viral > agency > has to accept all of the payloads and formats decreed by the community. i > do > not expect this view to sway the CCCP, as i wrote above. in any case it > does > not sway me, either as a home network operator or an enterprise network > operator. simply put, i will not have these views imposed on me. not in > the > form of DoH now, and not in the form of spam back in the 1990's. not ever. > > > Enterprises > > are currently doing that via managed software and environments, and that > > approach seems to be well in-line with your practices below. Using > > resolution systems for this will not accomplish what you need now, nor > will > > it do so going forward; it is time for a different approach, rather than > > seeking to return to cleartext. > > i am not asking for cleartext per se, though on my own networks, which i > build > and fund, i ought to be able to ask for that and get it, and if you insist > otherwise, it will be as effective as the IETF's one-time insistence that > the > end to end principle forbade firewalls, and later, the IETF's insistence > that > the end to end principle forbade NAT. the consensus you're seeing appears > to > be in a non-representative bubble. > > using resolution systems for surveillance and control of edge networks is > the > world the IETF finds itself in. they can decide to provide other > approaches, > and they would find me a ready participant. they cannot however simply > decide > that my approach is wrong or outdated, and say that those days are over. > until > there is another way to achieve what the internet security industry > achieves > by watching and controlling DNS operations, those operations will > continue, > and they will be non-optional on many edge networks. the IETF consensus is > not, to borrow a term from christian huitema, "king". > > The past five years have not been the IETF seeking to become a king or king-maker. They have been spent responding to an attack while still building out the facilities of the network. I am glad to find you a ready participant now, as there is still work to be done. But I do not believe we have said that you may not have these facilities; the new methods simply mean you must have a relationship with the users and devices on your network sufficient to effect configuration to use them. An on-path adversary does not, but you do. Yes, that adds a step and some complexity, but dealing with a new class of attack was never likely to be free. > what i'm asking for, though, is not clear text. rather, i'm refusing to > allow > outside answers to naming questions, for the same reasons i would refuse > to > allow outside answers to ARP questions. the internet only exists by > cooperation -- of which interoperability is only one example. when the > wide > area services, the intermediate networks, the edge networks, the apps, and > the > users all agree on what should happen, then it happens. otherwise, not so. > to > want any other system is to be willing to forcibly impose communications > on > others, which is NOT "the Internet way" and cannot become so, because it > would > rely on cooperation which can be withheld. (as in my case, with DoH.) > > > The situation that moved this community to that stance was well-laid out > in > > IETF 88. We must acknowledge that not all devices which are on-path are > > controlled by entities known to the user or network operator and not all > of > > them are acting in the interests of those parties. Protecting against > that > > threat requires us to change our ways. Please help, rather than working > > around the effort. > > i don't think you realize what you're asking. I thought I was asking for your help; if that wasn't clear, sorry. I would rather have your help with this than your opposition, and I believe we can strive for a network that is confidential, measurable, and manageable. We aren't there yet, but I hope we share that goal. regards, Ted Hardie (wearing no hats). > the bad guys didn't attend IETF > 88. we have a world wide digital civilization to run here, and we will > continue doing that, even if it means "working around" disruptions like > DoH. > if someone from the IETF community wants to work on protecting DNS from > the > bad guys without also giving the bad guys greater powers that the good > guys > are nowhere near ready to cope with, my e-mail address is paul@redbarn.org > . > > > regards, > > > > Ted Hardie > > (wearing no hats) > > i am paul vixie, "concerned internet citizen." thank you for your > thoughts. i > hope that you will also read michael sinatra's response to this same > message. > he does not nec'ily speak for me, but he does seem to be making sense here. > > [1] https://www.youtube.com/watch?v=1VR3Av9qfZc > > > --0000000000006b45f00584265253 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks = for the thought you've put into this.=C2=A0 I've replied in-line.

On Fri, Mar 15, 2019 at 12:45 AM Paul Vixie <paul@redbarn.org> wrote:
On Tuesday, 12 March 2019 20:52:27 UTC Ted Hardi= e wrote:
> Paul,
>
> Since it is apparent our disagreement is at a more fundamental level, = I
> will make only two further comments.

ted, your comments were of such a nature that i had to sleep on them more t= han
once before i felt i could re-engage. i apologize for the delay. let's =
continue.

> The first is that you recently chided someone for using the word "= ;rant",
> saying that it would "diminish and disrespect" someone's= words.=C2=A0 In the
> note below you use terms like "warfare" to characterize the = work of the
> authors; that is both inflammatory and disrespectful.=C2=A0 The author= s worked
> on a chartered working group item throughout the IETF process.=C2=A0 Y= ou
> disagree with the security trade-offs made in the chartering and execu= tion
> of that work, and discussion of that disagreement will hopefully be > fruitful.=C2=A0 But=C2=A0 if you want their respect of your opinion, a= ccording them
> the respect due theirs will go a long way; they did not make these cho= ices
> arbitrarily.

i did not intend the term "warfare" to be taken colloquially. i m= eant it in
the literal sense. all war is economic -- the fighting will continue until = one
party cannot afford to continue. not all war is violent. we do not have a w= ord
like "trade" as in "trade war" to describe what's h= appening here, and we need
one, so that i can use that term to describe as accurately as possible what= i
think is happening.

DoH's stated goals include "prevent on-path interference in DNS op= erations." i
am an on-path interferer, and "i aim to misbehave"[1]. DoH is, in= that sense,
targeted at me. i think it was wrong to do so, not morally wrong, but wrong= on
its own terms, to falsely equate all on-path interferers. parental controls=
and corporate security are forms of on-path interference in DNS operations =
which have a valid and moral place in our digital society. DoH could have <= br> distinguished between edge network operators who interfere for reasons our =
users and their apps are either cooperative with or unwelcome entirely. the= y
did not. they lumped us all together.

A= ll of the work on encrypted DNS presumes that there is one or more parties = who wishes to observe the flow of traffic to DNS resolvers for the purposes= of surveillance.=C2=A0 The conclusion of the IETF after IETF 88 was that t= here was a class of that, pervasive public surveillance, that was so damagi= ng to the trust of the users in the Internet that it amounted to an attack = on the value of the Internet as a whole.=C2=A0 The plenary where that was d= iscussed is online here: IETF 88 Technical Plenary: Hard= ening The Internet - YouTube . In a path with multiple links, in other = words, we have a condition where we believe there is likely to be an attack= er on one or more of those links that would like to see this data and to us= e it for purposes not approved by the user or the operator of the service t= o which the user is directing her flows (or any of the network operators th= rough which the flow passes).=C2=A0=C2=A0

The= response to that has been first to encrypt the flows which carry the user = data.=C2=A0 That's not an effort championed not only by the IETF or the= IAB; see the US Government's HTTPS = Only standard for one example of the many other efforts going on to mak= e that the case.=C2=A0 In addition to that primary effort, there have been = efforts to reduce the amount of metadata about the flows.=C2=A0 Some of tha= t has been in updating transport protocols (e.g. QUIC, TCPINC) to reduce th= eir disclosure of state.=C2=A0 Some of it has been in reducing the data rev= ealed by the handshake (e.g. the updates in TLS 1.3 and eSNI).=C2=A0 And so= me of it has been to reduce the data disclosed across those links by the us= e of the DNS.=C2=A0 That's the point of DNS over TLS and DNS over DTLS;= it's also the point of DNS over HTTPS: to protect the data in those fl= ows from a known, pervasive attacker.

You wou= ld like your use of similar surveillance techniques to be differentiated fr= om their use by that set of attackers.=C2=A0 The IETF cannot do that on mor= al grounds, much as we might like you and appreciate your desire to protect= your network and your children. We need technical mechanisms.=C2=A0 If you= review the discussion to date, you'll see a number of such mechanisms = proposed.=C2=A0 They fall into two broad classes: trusting the local networ= k infrastructure and trusting the local configuration.=C2=A0

As was pointed out in many groups, trusting the local infra= structure is extremely problematic in nomadic cases as the local infrastruc= ture can often be infected, ill-maintained. or hostile by design.=C2=A0 Giv= en the extremely high percentage of users who are now on the Internet by mo= bile devices which roam and opportunistically use WiFi, ignoring this reali= ty would not make sense.=C2=A0 So we rely on configuration of end devices a= nd applications, with the belief that the user has some choice there in bot= h how the end device is configured and in what applications are supported.= =C2=A0 That's a trade-off, and not a simple one to make, both because i= t is very difficult for end users to make that assessment and because there= 's a high reliance on sensible defaults.=C2=A0 But that choice is an en= gineering trade-off, not an act of war against you or any other network ope= rator.=C2=A0

If the user configures your DNS = service they get it, and their trust in your operations to provide appropri= ate answers is thereby matched to your desire to see the requests.=C2=A0 Fo= r a very large number of enterprise networks, the result is that devices ar= e permitted on the network only when under some form of device management, = with the proxies, configuration,=C2=A0 and limitations that implies.=C2=A0 = To protect itself, the enterprise insists on a prior relationship with know= n terms, instantiated by the configuration of device management.=C2=A0 Ther= e are lighter forms of configuration that do the same thing to lesser degre= es, but they each presume that a trusted edge network operator has a relati= onship to the users that can effect configuration.=C2=A0
=C2= =A0

the method of DoH with respect to preventing on-path interference with DNS =
operations is to make it too expensive, obviously, because it (deliberately= )
hides recursive DNS transactions in flows which have been, until now,
unaffective of DNS operations.

This is cert= ainly not the case for all deployments of DoH. Please read Kenji Baheaux= 9;s message on Chrome's plans for an illustrative counter-example.=C2= =A0 In that case,=C2=A0 Chrome will upgrade to DoH on the configured DNS se= rvice.=C2=A0 If the devices on your network use your DNS service, it will c= heck if DoH is available and upgrade to it if so; it will not change them t= o another provider.=C2=A0 DoH is also not set up to allow any random HTTPS = host provide you DNS answers you did not request; this is not a free invita= tion to cache-poisoning.

=C2=A0
i wish the DoH well in their walk with the GF= W,
but i predict that the CCCP has effectively infinite resources and resolve,=
and that it is _not possible_ to exceed their expense budget to the point <= br> where they say, "ok, that's the end, everybody in china who wants = free and
open DNS access can get it, we just can't deal with this DoH thing.&quo= t;

however, for non-nation-state actors, such as myself, it's going to be = really
quite costly to prevent intruders and bots and other malware from moving th= eir
DNS operations out of our sight and out of our control. our costs will
increase. this increase was deliberate.

it would be dishonest not to call that economic warfare by the DoH authors.= if
this comes as a surprise to them, then so much the worse for all of us, i <= br> think.

> My second comment is to point out that the IETF has been heading this = way
> for about five years now.=C2=A0 The IAB formalized its early support o= f this
> approach in November of 2014 with this text:
>
> > The IAB urges protocol designers to design for confidential opera= tion by
> > default.=C2=A0 We strongly encourage developers to include encryp= tion in their
> > implementations, and to make them encrypted by default.=C2=A0 We = similarly
> > encourage network and service operators to deploy encryption wher= e it is
> > not yet deployed, and we urge firewall policy administrators to p= ermit
> > encrypted traffic.
> >
> > We believe that each of these changes will help restore the trust= users
> > must
> > have in the Internet.=C2=A0 We acknowledge that this will take ti= me and
> > trouble,
> > though we believe recent successes in content delivery networks,<= br> > > messaging,
> > and Internet application deployments demonstrate the feasibility = of this
> > migration.=C2=A0 We also acknowledge that many network operations= activities
> > today, from traffic management and intrusion detection to spam pr= evention
> > and policy enforcement, assume access to cleartext payload. For m= any of
> > these activities there are no solutions yet, but the IAB will wor= k with
> > those affected to foster development of new approaches for these<= br> > > activities
> > which allow us to move to an Internet where traffic is confidenti= al by
> > default.

i remember this text. DoH is not what i expected as "will work with th= ose
affected". the problem of surveillance is differentiated between home = and
corporate networks on the one hand, and public networks on the other. one <= br> perfectly valid approach to the goal set out by the IAB above would have be= en
to say, all network operators who care about DNS privacy, should run their = own
recursive DNS servers, and, those servers should prefer DoT where available=
when communicating upstream.

Paul, you are making a major assumption about where t= he taps for pervasive surveillance are in the statement above, and it is an= assumption I do not share.=C2=A0 My personal advice would be to have each = network operator who cares about DNS privacy run a recursive resolver using= DoT or DoH.=C2=A0 I would say the same to any multi-site enterprise.
=C2=A0
that answer was not politically acceptable by other interpreters (that is, = not
me) of the IAB text. rather, the IAB text was taken as license to change th= e
way DNS resolution would be done for all users. that was overreach, and was= a
consensus i could not join, and has created more losers than winners, and i=
view it as either naivety about real internet security issues, or as an abu= se
of power, depending on who knew how much at what time.

As a reminder, the IAB made the statement, but the IE= TF chartered the working group and ran the process.=C2=A0 Like all working = groups, it has been open to all and has passed through a full consensus pro= cess.=C2=A0

=C2=A0
> By that point, the IETF working groups were already in formation.=C2= =A0 Moving
> the DNS toward encryption has been going on since DPRIVE and has been<= br> > accompanied by the rise of transports like QUIC which are encrypted by=
> default.=C2=A0 You have been working around that, rather than developi= ng new
> practices.=C2=A0 I invite you instead to consider how you can accompli= sh what
> you need to in an Internet where all traffic is confidential.

when you talk about "the Internet" which originally meant simply = a "network of
networks", you could mean something technical, in which case my networ= k is one
of those networks (of which there is a network), and we would likely agree =
that for networks i build and fund, the traffic will be what i accept, not =
what is imposed on me. both the payloads, and the form of those payloads. n= o
enterprise or home network operator is going to accept the IETF's manda= te as
to which traffic must be encrypted on our networks, for example.

The IAB has published a statement about the threat mo= del here (RFC 7624) and has been working through the Stack Evolution progra= m at least from the SEMI workshop to develop a view of how to move the netw= ork forward with both encryption and appropriate signals to the on-path dev= ices.=C2=A0 You can see the discussions around this in radio networks in RF= C 8462 and the upcoming work on protocol wire images and path signals (https://data= tracker.ietf.org/doc/draft-iab-wire-image/
and https://datatracker.= ietf.org/doc/draft-iab-path-signals/ ).=C2=A0 As best as we can, we wan= t a network that is protected against this attack, measurable, and manageab= le.=C2=A0 That's not a simple task, but it is, I personally believe, th= e right goal.=C2=A0 The value of the Internet to its users is too eroded by= the lack of confidentiality for it to reach its full potential without it.=

on the other hand you could mean what christian huitema seems to mean, whic= h
is an Internet that is viral, and anything that connects to that viral agen= cy
has to accept all of the payloads and formats decreed by the community. i d= o
not expect this view to sway the CCCP, as i wrote above. in any case it doe= s
not sway me, either as a home network operator or an enterprise network operator. simply put, i will not have these views imposed on me. not in the=
form of DoH now, and not in the form of spam back in the 1990's. not ev= er.

> Enterprises
> are currently doing that via managed software and environments, and th= at
> approach seems to be well in-line with your practices below.=C2=A0 Usi= ng
> resolution systems for this will not accomplish what you need now, nor= will
> it do so going forward; it is time for a different approach, rather th= an
> seeking to return to cleartext.

i am not asking for cleartext per se, though on my own networks, which i bu= ild
and fund, i ought to be able to ask for that and get it, and if you insist =
otherwise, it will be as effective as the IETF's one-time insistence th= at the
end to end principle forbade firewalls, and later, the IETF's insistenc= e that
the end to end principle forbade NAT. the consensus you're seeing appea= rs to
be in a non-representative bubble.

using resolution systems for surveillance and control of edge networks is t= he
world the IETF finds itself in. they can decide to provide other approaches= ,
and they would find me a ready participant. they cannot however simply deci= de
that my approach is wrong or outdated, and say that those days are over. un= til
there is another way to achieve what the internet security industry achieve= s
by watching and controlling DNS operations, those operations will continue,=
and they will be non-optional on many edge networks. the IETF consensus is =
not, to borrow a term from christian huitema, "king".

The past five years have not been the IETF seeking to= become a king or king-maker.=C2=A0 They have been spent responding to an a= ttack while still building out the facilities of the network.=C2=A0 I am gl= ad to find you a ready participant now, as there is still work to be done.= =C2=A0 But I do not believe we have said that you may not have these facili= ties; the new methods simply mean you must have a relationship with the use= rs and devices on your network sufficient to effect configuration to use th= em.=C2=A0 An on-path adversary does not, but you do.=C2=A0 Yes, that adds a= step and some complexity, but dealing with a new class of attack was never= likely to be free.=C2=A0

=C2=A0
what i'm asking for, though, is not clear text. rather, i'm refusin= g to allow
outside answers to naming questions, for the same reasons i would refuse to=
allow outside answers to ARP questions. the internet only exists by
cooperation -- of which interoperability is only one example. when the wide=
area services, the intermediate networks, the edge networks, the apps, and = the
users all agree on what should happen, then it happens. otherwise, not so. = to
want any other system is to be willing to forcibly impose communications on=
others, which is NOT "the Internet way" and cannot become so, bec= ause it would
rely on cooperation which can be withheld. (as in my case, with DoH.)

> The situation that moved this community to that stance was well-laid o= ut in
> IETF 88.=C2=A0 We must acknowledge that not all devices which are on-p= ath are
> controlled by entities known to the user or network operator and not a= ll of
> them are acting in the interests of those parties.=C2=A0 Protecting ag= ainst that
> threat requires us to change our ways.=C2=A0 Please help, rather than = working
> around the effort.

i don't think you realize what you're asking.

=
I thought I was asking for your help; if that wasn't clear, = sorry.=C2=A0 I would rather have your help with this than your opposition, = and I believe we can strive for a network that is confidential, measurable,= and manageable.=C2=A0 We aren't there yet, but I hope we share that go= al.

regards,

Ted Hardie
(wearing no hats).
=C2=A0
the bad guys didn't attend IETF
88. we have a world wide digital civilization to run here, and we will
continue doing that, even if it means "working around" disruption= s like DoH.
if someone from the IETF community wants to work on protecting DNS from the=
bad guys without also giving the bad guys greater powers that the good guys=
are nowhere near ready to cope with, my e-mail address is paul@redbarn.org.

> regards,
>
> Ted Hardie
> (wearing no hats)

i am paul vixie, "concerned internet citizen." thank you for your= thoughts. i
hope that you will also read michael sinatra's response to this same me= ssage.
he does not nec'ily speak for me, but he does seem to be making sense h= ere.

[1] https://www.youtube.com/watch?v=3D1VR3Av9qfZc

--0000000000006b45f00584265253-- From nobody Fri Mar 15 12:24:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0387E130EFE for ; Fri, 15 Mar 2019 12:24:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vPAfqFQF8QvD for ; Fri, 15 Mar 2019 12:24:32 -0700 (PDT) Received: from mail-ua1-x943.google.com (mail-ua1-x943.google.com [IPv6:2607:f8b0:4864:20::943]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 900E1130E5B for ; Fri, 15 Mar 2019 12:24:31 -0700 (PDT) Received: by mail-ua1-x943.google.com with SMTP id s26so3467960uao.9 for ; Fri, 15 Mar 2019 12:24:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ZDNS01ZTGjojLrN8DVes1UPEhZZiUuErWYbOrECw3Xo=; b=b5N5ILyvHkTjZ8/5LJYseZ5ycIbaQZ72jCQ548AOxObyBO8RrJivMNPYCU4dZr+qIB GQUMOjkXewDcXRHkb7LsEbjUu/QMGGVPN51TmElldPWf4iGitUJJInuERbdKap2hPIwY NlbZHzmfJBCqjEk6pUwCbSu4Q1GtV/cWI2rz+bQwqs5pSYviuVvHS/1hdoCaSQKeJn3w siLKqgpgT/V0rakBfoGdheYtW9KlWOxVpguj5+n7zNzxPWybnUiHLX6okMUQF4G0ZP+u 21l0JVdFiFq7dGl9vIk2qhkUwGDKdt3L9uq/jcm+a6i4A9HnHRcioz5NIyN9au2MHqTS nIvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ZDNS01ZTGjojLrN8DVes1UPEhZZiUuErWYbOrECw3Xo=; b=H2WbmZyQsy199xMp7JhxPXMuCxaazNzoYyxtzYQ7j9p/pDr2ynhZhozz3Eteur5New V+7zFhhyb5Clv3w5EDAkq8yfhtmbEWjw8lWgrDdtw/NcyPpI8VHCliiaQ+wjYdHYASQP +BlNlUb0p2aPnBbWbdx+9vAUjYZ4sbQ3adYg1Aogcjy9Qti32BPWeeAsV+L86q+yYZPv F7nQGnHOVe5ji/peSKh7fQS1OQ6uHy98b3jlNVzw1bsa0GQv/JdVjhABaojpmKit/aj+ CbSZeHFskv8JbBlZKq6JDGoTPfcp9ydk0VMVYCKslTqyMTqAatTX7GUpUlruD1ECdKDd 8/TQ== X-Gm-Message-State: APjAAAXPZemVmqAokqIp4FESV8kaC8NsjuolmwzVwX7zae9SGktpTzAq vpJO1csb0y6EFP6wr1KINynPpPaLVvzWzOHsy0IqNA== X-Google-Smtp-Source: APXvYqxhzK7VTuwPxjSKGvPvKk2991LA81vrX7NfrRVG41EEz3rhbBTUPNV39T6ab14O7DiiVgTnNVg79nA2weej1kM= X-Received: by 2002:a9f:3381:: with SMTP id p1mr587769uab.140.1552677870178; Fri, 15 Mar 2019 12:24:30 -0700 (PDT) MIME-Version: 1.0 References: <0e842b1edfe44bd69e1188e72b8f3873@ustx2ex-dag1mb3.msg.corp.akamai.com> In-Reply-To: <0e842b1edfe44bd69e1188e72b8f3873@ustx2ex-dag1mb3.msg.corp.akamai.com> From: Ben Schwartz Date: Fri, 15 Mar 2019 15:24:17 -0400 Message-ID: To: "Hewitt, Rory" Cc: Paul Hoffman , DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000ef6d4f058426fc5e" Archived-At: Subject: Re: [Doh] Use of TXT records X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 19:24:35 -0000 --000000000000ef6d4f058426fc5e Content-Type: multipart/alternative; boundary="000000000000e78270058426fc02" --000000000000e78270058426fc02 Content-Type: text/plain; charset="UTF-8" On Fri, Mar 15, 2019 at 12:57 PM Hewitt, Rory wrote: > Ben, > > > > How has the use of TXT been a point of controversy in the past? > See for example https://mailarchive.ietf.org/arch/msg/tls/b0DQpCStJ4RSlp7uVXSobS-ssjA > Is it a general "TXT records are bad" or "Adding new TXT records is bad" > or "TXT records have never been standardized or formatted consistently > among their various uses, so there's always the possibility of clashes". > My understanding is that some DNS experts believe that TXT records should be reserved for human-readable comments, while others believe that it is more expedient to store data in TXT records than to define a new RRTYPE for each new usage. > Because I, for one, would agree with the last. > > > > Rory > > > > *From:* Ben Schwartz > *Sent:* Friday, March 15, 2019 9:53 AM > *To:* Paul Hoffman > *Cc:* DoH WG > *Subject:* Re: [Doh] Use of TXT records > > > > To be clear, I'm not objecting to this choice. I'm merely noting that use > of TXT has been a point of controversy in other discussions at the IETF. > Some groups have decided to proceed with TXT, some have preferred to use > different or new RRTYPEs, and some have not yet decided. I would like the > working group to consider this question soon so it doesn't delay consensus > later. > > > > On Fri, Mar 15, 2019 at 12:27 PM Paul Hoffman > wrote: > > On Mar 15, 2019, at 6:12 AM, Ben Schwartz < > bemasc=40google.com@dmarc.ietf..org> wrote: > > 5. Machine-readable content in a TXT record > > This is the first I had heard that people objected to using a TXT record, > but I might have missed that part of the discussion. Given that this query > is for a newly-created SUDN that is only used for looking up DoH > information, there is no chance that the TXT record would be in use for > anything else. > > Having said that, it would be quite easy for this document to create a new > RRtype for this particular query. (I would not want to re-use the URI > RRtype because it would take more effort to explain the priority and > weight, as well as dealing with the common error of people not put the URI > in quotations marks as is required for the URI RRtype.) > > --Paul Hoffman > > --000000000000e78270058426fc02 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Fri, Mar 15, 2019 at = 12:57 PM Hewitt, Rory <rhewitt@akamai.com> wrote:

Ben,

=C2=A0

How has the use of TXT been a point of controve= rsy in the past?


=C2=A0=C2=A0

Is it a general "TXT records are bad"= or "Adding new TXT records is bad" or "TXT records have nev= er been standardized or formatted consistently among their various uses, so there's always the possibility of clashes".


My understanding is that some DN= S experts believe that TXT records should be reserved for human-readable co= mments, while others believe that it is more expedient to store data in TXT= records than to define a new RRTYPE for each new usage.
=C2= =A0=C2=A0

Because I, for one, would agree with the last.<= /span>

=C2=A0

Rory

=C2=A0

From: Ben Schwartz <bemasc=3D40google.com@dmarc.ietf= .org>
Sent: Friday, March 15, 2019 9:53 AM
To: Paul Hoffman <paul.hoffman@icann.org>
Cc: DoH WG <doh= @ietf.org>
Subject: Re: [Doh] Use of TXT records

=C2=A0

To be clear, I'm not objecting to this choice.= =C2=A0 I'm merely noting that use of TXT has been a point of controvers= y in other discussions at the IETF.=C2=A0 Some groups have decided to proce= ed with TXT, some have preferred to use different or new RRTYPEs, and some have not yet decided.=C2=A0 I would like the working gro= up to consider this question soon so it doesn't delay consensus later.<= u>

=C2=A0

On Fri, Mar 15, 2019 at 12:27 PM Paul Hoffman <paul.hoffman@ican= n.org> wrote:

On Mar 15, 2019, at 6:12 AM, Ben Schwartz <bemasc= =3D40google.com@dmarc.ietf..org> wrote:
> 5. Machine-readable content in a TXT record

This is the first I had heard that people objected to using a TXT record, b= ut I might have missed that part of the discussion. Given that this query i= s for a newly-created SUDN that is only used for looking up DoH information= , there is no chance that the TXT record would be in use for anything else.

Having said that, it would be quite easy for this document to create a new = RRtype for this particular query. (I would not want to re-use the URI RRtyp= e because it would take more effort to explain the priority and weight, as = well as dealing with the common error of people not put the URI in quotations marks as is required for the= URI RRtype.)

--Paul Hoffman

--000000000000e78270058426fc02-- --000000000000ef6d4f058426fc5e Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDM+HgWL7L+lSOjVJs61y5c i4LwV7FXYIXjclBNd5BuzjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMTUxOTI0MzBaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAXyKvf5vAG2PfqoYc5qy7onkg6rrf7PT7kTDszfYm 5VNT5QHszdVI5S7B8+iqJ9PVkGeKZtQIQ1YUIFqYU0+zr8ijFTBy4WKBNeu9yzw4OaQawFCLC4DQ A51mRPXmqdCXPbw02CmZUqMX0CQEYo5t3JBvRWPsSvLCl7jGK+gR9fkZFkrJEOleyHTNAFDqtafl f1C6EX7h14XaSFou2s+sIc7SfUpDV9UQbRIbaehtm4wfxY7zZW/gSUs5wjjAwqsSz/tLroiuq92r LBBU+jlBe9UWB1cq75zJ5/oYcIOEpoWbK8jgfQdwEoa8TnoyiO3TqwPT55SD6lLnLai5xXUWxA== --000000000000ef6d4f058426fc5e-- From nobody Fri Mar 15 12:47:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 367071312F2 for ; Fri, 15 Mar 2019 12:47:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.85 X-Spam-Level: X-Spam-Status: No, score=-1.85 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, KHOP_DYNAMIC=0.85, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Xkb7mU44tZEx for ; Fri, 15 Mar 2019 12:47:35 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63A7C1312D0 for ; Fri, 15 Mar 2019 12:47:35 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x2FJbrkS004989; Fri, 15 Mar 2019 19:47:30 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : mime-version; s=jan2016.eng; bh=t62VqZbtE9ENuY0nbMIe16d78YnpNOgkwlXXdYECfP8=; b=BLSS/mLiLhmqHj3l6QVH6V2f1mImy2Nzc77RKdmXVZsAtf7vrjB83pMNHz0Nyvdb+F3t 8nJahbDv3SRKuNH9hvTXMoHZpZj125q5zOVxj0wL+90JnvxE8mgRBIh+VbZz3kYlagbG Ci3mlfUXabbu0TPcaDdbXYy0rmnpAeYVuV8kVILIoH1ir/1657cPupUgKKMFPyTGdOu2 b7rae/JF7AcHJCkCLvS1XPTdtVDt9DuFogN1aGkT3oTeBHVKLipU7JLD4CQ9uMjBYDiJ GnPmQKBpNVAWzvHM6ihI/zQ11k5Xj5YAMMsw4PZDInyeMzIw5IGAjZNLdpscSMmG1NIs Dg== Received: from prod-mail-ppoint4 (a96-6-114-87.deploy.static.akamaitechnologies.com [96.6.114.87] (may be forged)) by m0050093.ppops.net-00190b01. with ESMTP id 2r7xjwvd2c-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 19:47:30 +0000 Received: from pps.filterd (prod-mail-ppoint4.akamai.com [127.0.0.1]) by prod-mail-ppoint4.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x2FJku75029306; Fri, 15 Mar 2019 15:47:29 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.31]) by prod-mail-ppoint4.akamai.com with ESMTP id 2r49q0yw8s-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Fri, 15 Mar 2019 15:47:29 -0400 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com (172.27.27.103) by ustx2ex-dag1mb3.msg.corp.akamai.com (172.27.27.103) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Fri, 15 Mar 2019 14:47:28 -0500 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com ([172.27.27.103]) by ustx2ex-dag1mb3.msg.corp.akamai.com ([172.27.27.103]) with mapi id 15.00.1473.003; Fri, 15 Mar 2019 14:47:28 -0500 From: "Hewitt, Rory" To: Ben Schwartz CC: Paul Hoffman , DoH WG Thread-Topic: [Doh] Use of TXT records Thread-Index: AQHU20wb1BtgZuOodkiHHGX0BN4SLqYNPC0A//+s9ZCAAH10gP//razQ Date: Fri, 15 Mar 2019 19:47:26 +0000 Message-ID: <5f96d208a4f144968eeabf26edb16627@ustx2ex-dag1mb3.msg.corp.akamai.com> References: <0e842b1edfe44bd69e1188e72b8f3873@ustx2ex-dag1mb3.msg.corp.akamai.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.28.212.170] Content-Type: multipart/alternative; boundary="_000_5f96d208a4f144968eeabf26edb16627ustx2exdag1mb3msgcorpak_" MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-15_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903150134 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-15_12:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903150134 Archived-At: Subject: Re: [Doh] Use of TXT records X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 19:47:47 -0000 --_000_5f96d208a4f144968eeabf26edb16627ustx2exdag1mb3msgcorpak_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VW5kZXJzdG9vZC4NCg0KV2VsbCBwcmVzdW1hYmx5IFRYVCByZWNvcmRzIChnaXZlbiB0aGVpciBu YW1lKSB3ZXJlIE9SSUdJTkFMTFkgSU5URU5ERUQgdG8gb25seSBzdG9yZSBodW1hbi1yZWFkYWJs ZSB0ZXh0LiBCdXQgd2hhdCBkZWZpbmVzIGh1bWFuLXJlYWRhYmxlPyBJIG1lYW4sIGl0J3MgYWxs IEFTQ0lJIGNoYXJhY3RlcnMgKG5vIGJpbmFyeSBkYXRhKSwgc28gaXQncyBhbGwgImh1bWFuLXJl YWRhYmxlIiB0byBzb21lIGV4dGVudC4NCg0KVGhlIHByb2JsZW0gaXMgc3VyZWx5IHRoYXQgYmVj YXVzZSB0aGVyZSBpcyBubyBzdGFuZGFyZCB0aGF0IHNheXMgIlRoZSBmaXJzdCBYIGNoYXJhY3Rl cnMgaW4gYSBUWFQgcmVjb3JkIG11c3QgYmUgb25lIG9mIHRoZSBmb2xsb3dpbmcgSUFOQS1yZWdp c3RlcmVkIHR5cGVzLCBhbmQgdGhlIHN1YnNlcXVlbnQgZGF0YSBtdXN0IGZvbGxvdyB0aGUgcmVs YXRlZCBJQU5BIGZvcm1hdCIsIHRoZW4gQU5ZVEhJTkcgd2hpY2ggcmVhZHMgYSBUWFQgcmVjb3Jk IG11c3QgZG8gc29tZSAocG9zc2libHkgY29tcGxleCkgcHJvY2Vzc2luZyB0byBkZXRlcm1pbmUg d2hhdCBzb3J0IG9mIFRYVCByZWNvcmQgaXQgaXM/DQoNCkZvciBpbnN0YW5jZSwgU1BGIHJlY29y ZHMganVzdCBzdGFydCB3aXRoIHY9c3BmMSBmb2xsb3dlZCBieSBhIGJsYW5rLCB3aGljaCBSRUFM TFkgYnVncyBtZSwgYmVjYXVzZSB0aGVyZSdzIG5vdGhpbmcgdGhhdCBkZWZpbmVzIHdoYXQgJ3R5 cGUnIG9mIFRYVCByZWNvcmQgaXQgaXMuIEJ1dCB0aGUgc3Vic2VxdWVudCB0ZXh0IGlzICdraW5k YScgaHVtYW4tcmVhZGFibGUgLSB5b3UganVzdCBuZWVkIHRvIGtub3cgaXRzIGZvcm1hdC4NCg0K SSdtIGZpbmUgd2l0aCB1c2luZyBUWFQgcmVjb3JkcyBmb3IgRG9ILCBidXQgSSB3b3VsZCBsb3Zl IHRoZW0gdG8gc3RhcnQgd2l0aCB0eXBlPURPSCBmb2xsb3dlZCBieSBhIGJsYW5rLiBXaGF0ZXZl ciBmb3JtYXQgYmV5b25kIHRoYXQgaXMgdXNlZCBkb2Vzbid0IG1hdHRlciwgYXMgbG9uZyBhcyBp dCdzIGNvbnNpc3RlbnQuIFNpbmNlIGl0J3MgZ29pbmcgdG8gYmUgSVAgYWRkcmVzc2VzLCB3aGF0 J3MgdGhlIGNvbmNlcm4gLSBpdCB3b3VsZG4ndCBldmVuIG5lZWQgdG8gYmUgQmFzZTY0LWVuY29k ZWQsIHdvdWxkIGl0Pw0KDQpJZiB5b3UgdXNlIGEgbmV3IFJSVFlQRSwgdGhlbiBldmVyeSBzaW5n bGUgZG9jdW1lbnQgZXZlciB3cml0dGVuIGFib3V0IEROUyByZWNvcmQgdHlwZXMgd2lsbCBoYXZl IHRvIGJlIHVwZGF0ZWQgdG8gaW5jbHVkZSB0aGUgbmV3IFJSVFlQRS4NCg0KTWF5YmUgYSBsaXR0 bGUgaHlwZXJib2xpYywgYnV0IG9ubHkgYSBsaXR0bGUuLi4NCg0KTFNTOyBVc2UgVFhUIHJlY29y ZHMuDQoNClJvcnkNCg0KRnJvbTogQmVuIFNjaHdhcnR6IDxiZW1hc2NAZ29vZ2xlLmNvbT4NClNl bnQ6IEZyaWRheSwgTWFyY2ggMTUsIDIwMTkgMTI6MjQgUE0NClRvOiBIZXdpdHQsIFJvcnkgPHJo ZXdpdHRAYWthbWFpLmNvbT4NCkNjOiBQYXVsIEhvZmZtYW4gPHBhdWwuaG9mZm1hbkBpY2Fubi5v cmc+OyBEb0ggV0cgPGRvaEBpZXRmLm9yZz4NClN1YmplY3Q6IFJlOiBbRG9oXSBVc2Ugb2YgVFhU IHJlY29yZHMNCg0KT24gRnJpLCBNYXIgMTUsIDIwMTkgYXQgMTI6NTcgUE0gSGV3aXR0LCBSb3J5 IDxyaGV3aXR0QGFrYW1haS5jb208bWFpbHRvOnJoZXdpdHRAYWthbWFpLmNvbT4+IHdyb3RlOg0K QmVuLA0KDQpIb3cgaGFzIHRoZSB1c2Ugb2YgVFhUIGJlZW4gYSBwb2ludCBvZiBjb250cm92ZXJz eSBpbiB0aGUgcGFzdD8NCg0KU2VlIGZvciBleGFtcGxlIGh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0 Zi5vcmcvYXJjaC9tc2cvdGxzL2IwRFFwQ1N0SjRSU2xwN3VWWFNvYlMtc3NqQQ0KDQpJcyBpdCBh IGdlbmVyYWwgIlRYVCByZWNvcmRzIGFyZSBiYWQiIG9yICJBZGRpbmcgbmV3IFRYVCByZWNvcmRz IGlzIGJhZCIgb3IgIlRYVCByZWNvcmRzIGhhdmUgbmV2ZXIgYmVlbiBzdGFuZGFyZGl6ZWQgb3Ig Zm9ybWF0dGVkIGNvbnNpc3RlbnRseSBhbW9uZyB0aGVpciB2YXJpb3VzIHVzZXMsIHNvIHRoZXJl J3MgYWx3YXlzIHRoZSBwb3NzaWJpbGl0eSBvZiBjbGFzaGVzIi4NCg0KTXkgdW5kZXJzdGFuZGlu ZyBpcyB0aGF0IHNvbWUgRE5TIGV4cGVydHMgYmVsaWV2ZSB0aGF0IFRYVCByZWNvcmRzIHNob3Vs ZCBiZSByZXNlcnZlZCBmb3IgaHVtYW4tcmVhZGFibGUgY29tbWVudHMsIHdoaWxlIG90aGVycyBi ZWxpZXZlIHRoYXQgaXQgaXMgbW9yZSBleHBlZGllbnQgdG8gc3RvcmUgZGF0YSBpbiBUWFQgcmVj b3JkcyB0aGFuIHRvIGRlZmluZSBhIG5ldyBSUlRZUEUgZm9yIGVhY2ggbmV3IHVzYWdlLg0KDQpC ZWNhdXNlIEksIGZvciBvbmUsIHdvdWxkIGFncmVlIHdpdGggdGhlIGxhc3QuDQoNClJvcnkNCg0K RnJvbTogQmVuIFNjaHdhcnR6IDxiZW1hc2M9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPG1h aWx0bzo0MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc+Pg0KU2VudDogRnJpZGF5LCBNYXJjaCAx NSwgMjAxOSA5OjUzIEFNDQpUbzogUGF1bCBIb2ZmbWFuIDxwYXVsLmhvZmZtYW5AaWNhbm4ub3Jn PG1haWx0bzpwYXVsLmhvZmZtYW5AaWNhbm4ub3JnPj4NCkNjOiBEb0ggV0cgPGRvaEBpZXRmLm9y ZzxtYWlsdG86ZG9oQGlldGYub3JnPj4NClN1YmplY3Q6IFJlOiBbRG9oXSBVc2Ugb2YgVFhUIHJl Y29yZHMNCg0KVG8gYmUgY2xlYXIsIEknbSBub3Qgb2JqZWN0aW5nIHRvIHRoaXMgY2hvaWNlLiAg SSdtIG1lcmVseSBub3RpbmcgdGhhdCB1c2Ugb2YgVFhUIGhhcyBiZWVuIGEgcG9pbnQgb2YgY29u dHJvdmVyc3kgaW4gb3RoZXIgZGlzY3Vzc2lvbnMgYXQgdGhlIElFVEYuICBTb21lIGdyb3VwcyBo YXZlIGRlY2lkZWQgdG8gcHJvY2VlZCB3aXRoIFRYVCwgc29tZSBoYXZlIHByZWZlcnJlZCB0byB1 c2UgZGlmZmVyZW50IG9yIG5ldyBSUlRZUEVzLCBhbmQgc29tZSBoYXZlIG5vdCB5ZXQgZGVjaWRl ZC4gIEkgd291bGQgbGlrZSB0aGUgd29ya2luZyBncm91cCB0byBjb25zaWRlciB0aGlzIHF1ZXN0 aW9uIHNvb24gc28gaXQgZG9lc24ndCBkZWxheSBjb25zZW5zdXMgbGF0ZXIuDQoNCk9uIEZyaSwg TWFyIDE1LCAyMDE5IGF0IDEyOjI3IFBNIFBhdWwgSG9mZm1hbiA8cGF1bC5ob2ZmbWFuQGljYW5u Lm9yZzxtYWlsdG86cGF1bC5ob2ZmbWFuQGljYW5uLm9yZz4+IHdyb3RlOg0KT24gTWFyIDE1LCAy MDE5LCBhdCA2OjEyIEFNLCBCZW4gU2Nod2FydHogPGJlbWFzYz00MGdvb2dsZS5jb21AZG1hcmMu aWV0Zi4ub3JnPG1haWx0bzpiZW1hc2M9NDBnb29nbGUuY29tQGRtYXJjLmlldGYuLm9yZz4+IHdy b3RlOg0KPiA1LiBNYWNoaW5lLXJlYWRhYmxlIGNvbnRlbnQgaW4gYSBUWFQgcmVjb3JkDQoNClRo aXMgaXMgdGhlIGZpcnN0IEkgaGFkIGhlYXJkIHRoYXQgcGVvcGxlIG9iamVjdGVkIHRvIHVzaW5n IGEgVFhUIHJlY29yZCwgYnV0IEkgbWlnaHQgaGF2ZSBtaXNzZWQgdGhhdCBwYXJ0IG9mIHRoZSBk aXNjdXNzaW9uLiBHaXZlbiB0aGF0IHRoaXMgcXVlcnkgaXMgZm9yIGEgbmV3bHktY3JlYXRlZCBT VUROIHRoYXQgaXMgb25seSB1c2VkIGZvciBsb29raW5nIHVwIERvSCBpbmZvcm1hdGlvbiwgdGhl cmUgaXMgbm8gY2hhbmNlIHRoYXQgdGhlIFRYVCByZWNvcmQgd291bGQgYmUgaW4gdXNlIGZvciBh bnl0aGluZyBlbHNlLg0KDQpIYXZpbmcgc2FpZCB0aGF0LCBpdCB3b3VsZCBiZSBxdWl0ZSBlYXN5 IGZvciB0aGlzIGRvY3VtZW50IHRvIGNyZWF0ZSBhIG5ldyBSUnR5cGUgZm9yIHRoaXMgcGFydGlj dWxhciBxdWVyeS4gKEkgd291bGQgbm90IHdhbnQgdG8gcmUtdXNlIHRoZSBVUkkgUlJ0eXBlIGJl Y2F1c2UgaXQgd291bGQgdGFrZSBtb3JlIGVmZm9ydCB0byBleHBsYWluIHRoZSBwcmlvcml0eSBh bmQgd2VpZ2h0LCBhcyB3ZWxsIGFzIGRlYWxpbmcgd2l0aCB0aGUgY29tbW9uIGVycm9yIG9mIHBl b3BsZSBub3QgcHV0IHRoZSBVUkkgaW4gcXVvdGF0aW9ucyBtYXJrcyBhcyBpcyByZXF1aXJlZCBm b3IgdGhlIFVSSSBSUnR5cGUuKQ0KDQotLVBhdWwgSG9mZm1hbg0K --_000_5f96d208a4f144968eeabf26edb16627ustx2exdag1mb3msgcorpak_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpWZXJkYW5hOw0KCXBhbm9zZS0xOjIgMTEg NiA0IDMgNSA0IDQgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwg bGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowaW47DQoJbWFyZ2luLWJvdHRv bTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNh bnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3Jp dHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlz aXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3Jt YWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29u b3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBpbjsNCglt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowaW47DQoJZm9udC1zaXpl OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWls U3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbC1yZXBseTsNCglmb250LWZhbWlseToi VmVyZGFuYSIsc2Fucy1zZXJpZjsNCgljb2xvcjojMDAyMDYwOw0KCWZvbnQtd2VpZ2h0Om5vcm1h bDsNCglmb250LXN0eWxlOm5vcm1hbDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlw ZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQpAcGFn ZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo4LjVpbiAxMS4waW47DQoJbWFyZ2luOjEuMGluIDEuMGlu IDEuMGluIDEuMGluO30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFnZTpXb3JkU2VjdGlvbjE7fQ0K LS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpl eHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYiIC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0 ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBlbGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6 ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0KPC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0t Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tVVMiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90Oyxz YW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPlVuZGVyc3Rvb2QuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250 LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMt c2VyaWY7Y29sb3I6IzAwMjA2MCI+V2VsbCBwcmVzdW1hYmx5IFRYVCByZWNvcmRzIChnaXZlbiB0 aGVpciBuYW1lKSB3ZXJlIE9SSUdJTkFMTFkgSU5URU5ERUQgdG8gb25seSBzdG9yZSBodW1hbi1y ZWFkYWJsZSB0ZXh0LiBCdXQgd2hhdCBkZWZpbmVzIGh1bWFuLXJlYWRhYmxlPyBJIG1lYW4sIGl0 J3MgYWxsIEFTQ0lJDQogY2hhcmFjdGVycyAobm8gYmluYXJ5IGRhdGEpLCBzbyBpdCdzIGFsbCAm cXVvdDtodW1hbi1yZWFkYWJsZSZxdW90OyB0byBzb21lIGV4dGVudC48bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYw Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5UaGUgcHJvYmxlbSBpcyBzdXJlbHkgdGhhdCBiZWNh dXNlIHRoZXJlIGlzIG5vIHN0YW5kYXJkIHRoYXQgc2F5cyAmcXVvdDtUaGUgZmlyc3QgWCBjaGFy YWN0ZXJzIGluIGEgVFhUIHJlY29yZCBtdXN0IGJlIG9uZSBvZiB0aGUgZm9sbG93aW5nIElBTkEt cmVnaXN0ZXJlZCB0eXBlcywgYW5kDQogdGhlIHN1YnNlcXVlbnQgZGF0YSBtdXN0IGZvbGxvdyB0 aGUgcmVsYXRlZCBJQU5BIGZvcm1hdCZxdW90OywgdGhlbiBBTllUSElORyB3aGljaCByZWFkcyBh IFRYVCByZWNvcmQgbXVzdCBkbyBzb21lIChwb3NzaWJseSBjb21wbGV4KSBwcm9jZXNzaW5nIHRv IGRldGVybWluZSB3aGF0IHNvcnQgb2YgVFhUIHJlY29yZCBpdCBpcz88bzpwPjwvbzpwPjwvc3Bh bj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0 O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYw Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDss c2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5Gb3IgaW5zdGFuY2UsIFNQRiByZWNvcmRzIGp1c3Qg c3RhcnQgd2l0aA0KPGI+dj1zcGYxPC9iPiBmb2xsb3dlZCBieSBhIGJsYW5rLCB3aGljaCBSRUFM TFkgYnVncyBtZSwgYmVjYXVzZSB0aGVyZSdzIG5vdGhpbmcgdGhhdCBkZWZpbmVzIHdoYXQgJ3R5 cGUnIG9mIFRYVCByZWNvcmQgaXQgaXMuIEJ1dCB0aGUgc3Vic2VxdWVudCB0ZXh0IGlzICdraW5k YScgaHVtYW4tcmVhZGFibGUgLSB5b3UganVzdCBuZWVkIHRvIGtub3cgaXRzIGZvcm1hdC48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtj b2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1Zl cmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5JJ20gZmluZSB3aXRoIHVzaW5n IFRYVCByZWNvcmRzIGZvciBEb0gsIGJ1dCBJIHdvdWxkIGxvdmUgdGhlbSB0byBzdGFydCB3aXRo DQo8Yj50eXBlPURPSDwvYj4gZm9sbG93ZWQgYnkgYSBibGFuay4gV2hhdGV2ZXIgZm9ybWF0IGJl eW9uZCB0aGF0IGlzIHVzZWQgZG9lc24ndCBtYXR0ZXIsIGFzIGxvbmcgYXMgaXQncyBjb25zaXN0 ZW50LiBTaW5jZSBpdCdzIGdvaW5nIHRvIGJlIElQIGFkZHJlc3Nlcywgd2hhdCdzIHRoZSBjb25j ZXJuIC0gaXQgd291bGRuJ3QgZXZlbiBuZWVkIHRvIGJlIEJhc2U2NC1lbmNvZGVkLCB3b3VsZCBp dD88bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHls ZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1z ZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZx dW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5JZiB5b3UgdXNlIGEg bmV3IFJSVFlQRSwgdGhlbiBldmVyeSBzaW5nbGUgZG9jdW1lbnQgZXZlciB3cml0dGVuIGFib3V0 IEROUyByZWNvcmQgdHlwZXMgd2lsbCBoYXZlIHRvIGJlIHVwZGF0ZWQgdG8gaW5jbHVkZSB0aGUg bmV3IFJSVFlQRS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVv dDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQt ZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5NYXli ZSBhIGxpdHRsZSBoeXBlcmJvbGljLCBidXQgb25seSBhIGxpdHRsZS4uLjxvOnA+PC9vOnA+PC9z cGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4w cHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIw NjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90 OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkxTUzsgVXNlIFRYVCByZWNvcmRzLjxvOnA+PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNp emU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9y OiMwMDIwNjAiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6JnF1b3Q7VmVyZGFu YSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjM4NjQiPlJvcnk8L3NwYW4+PHNwYW4gc3R5bGU9 ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2Vy aWY7Y29sb3I6IzU5NTk1OSI+PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJk YW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+PG86cD4mbmJzcDs8L286cD48L3Nw YW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+RnJvbTo8L2I+IEJlbiBTY2h3YXJ0eiAm bHQ7YmVtYXNjQGdvb2dsZS5jb20mZ3Q7IDxicj4NCjxiPlNlbnQ6PC9iPiBGcmlkYXksIE1hcmNo IDE1LCAyMDE5IDEyOjI0IFBNPGJyPg0KPGI+VG86PC9iPiBIZXdpdHQsIFJvcnkgJmx0O3JoZXdp dHRAYWthbWFpLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IFBhdWwgSG9mZm1hbiAmbHQ7cGF1bC5o b2ZmbWFuQGljYW5uLm9yZyZndDs7IERvSCBXRyAmbHQ7ZG9oQGlldGYub3JnJmd0Ozxicj4NCjxi PlN1YmplY3Q6PC9iPiBSZTogW0RvaF0gVXNlIG9mIFRYVCByZWNvcmRzPG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPk9uIEZyaSwgTWFyIDE1LCAyMDE5IGF0IDEy OjU3IFBNIEhld2l0dCwgUm9yeSAmbHQ7PGEgaHJlZj0ibWFpbHRvOnJoZXdpdHRAYWthbWFpLmNv bSIgdGFyZ2V0PSJfYmxhbmsiPnJoZXdpdHRAYWthbWFpLmNvbTwvYT4mZ3Q7IHdyb3RlOjxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3Jk ZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGluIDBpbiAw aW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8ZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bztt c28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtm b250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+ QmVuLDwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjkuMHB0O2ZvbnQtZmFt aWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAyMDYwIj5Ib3cgaGFz IHRoZSB1c2Ugb2YgVFhUIGJlZW4gYSBwb2ludCBvZiBjb250cm92ZXJzeSBpbiB0aGUgcGFzdD88 L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+U2VlIGZvciBleGFtcGxlJm5ic3A7PGEgaHJlZj0i aHR0cHM6Ly9tYWlsYXJjaGl2ZS5pZXRmLm9yZy9hcmNoL21zZy90bHMvYjBEUXBDU3RKNFJTbHA3 dVZYU29iUy1zc2pBIj5odHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL3Rscy9i MERRcENTdEo0UlNscDd1VlhTb2JTLXNzakE8L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8c3BhbiBzdHlsZT0iZm9udC1zaXplOjku MHB0O2ZvbnQtZmFtaWx5OiZxdW90O1ZlcmRhbmEmcXVvdDssc2Fucy1zZXJpZjtjb2xvcjojMDAy MDYwIj4mbmJzcDs8L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0 eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6 MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXJpZ2h0OjBpbiI+DQo8 ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6 IzAwMjA2MCI+SXMgaXQgYSBnZW5lcmFsICZxdW90O1RYVCByZWNvcmRzIGFyZSBiYWQmcXVvdDsg b3IgJnF1b3Q7QWRkaW5nIG5ldyBUWFQgcmVjb3JkcyBpcyBiYWQmcXVvdDsgb3IgJnF1b3Q7VFhU IHJlY29yZHMgaGF2ZSBuZXZlcg0KIGJlZW4gc3RhbmRhcmRpemVkIG9yIGZvcm1hdHRlZCBjb25z aXN0ZW50bHkgYW1vbmcgdGhlaXIgdmFyaW91cyB1c2VzLCBzbyB0aGVyZSdzIGFsd2F5cyB0aGUg cG9zc2liaWxpdHkgb2YgY2xhc2hlcyZxdW90Oy48L3NwYW4+PG86cD48L286cD48L3A+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxv OnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ TXkgdW5kZXJzdGFuZGluZyBpcyB0aGF0IHNvbWUgRE5TIGV4cGVydHMgYmVsaWV2ZSB0aGF0IFRY VCByZWNvcmRzIHNob3VsZCBiZSByZXNlcnZlZCBmb3IgaHVtYW4tcmVhZGFibGUgY29tbWVudHMs IHdoaWxlIG90aGVycyBiZWxpZXZlIHRoYXQgaXQgaXMgbW9yZSBleHBlZGllbnQgdG8gc3RvcmUg ZGF0YSBpbiBUWFQgcmVjb3JkcyB0aGFuIHRvIGRlZmluZSBhIG5ldyBSUlRZUEUgZm9yIGVhY2gg bmV3IHVzYWdlLjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+Jm5ic3A7PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVv dDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9y ZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21h cmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1i b3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9udC1mYW1pbHk6 JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMwMDIwNjAiPkJlY2F1c2UgSSwg Zm9yIG9uZSwgd291bGQgYWdyZWUgd2l0aCB0aGUgbGFzdC48L3NwYW4+PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6OS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7VmVyZGFuYSZxdW90OyxzYW5zLXNlcmlmO2NvbG9yOiMxRjM4NjQiPiZu YnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt c28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWlseTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNh bnMtc2VyaWY7Y29sb3I6IzFGMzg2NCI+Um9yeTwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTo5LjBwdDtmb250LWZhbWls eTomcXVvdDtWZXJkYW5hJnF1b3Q7LHNhbnMtc2VyaWY7Y29sb3I6IzAwMjA2MCI+Jm5ic3A7PC9z cGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj48Yj5Gcm9tOjwvYj4g QmVuIFNjaHdhcnR6ICZsdDtiZW1hc2M9PGEgaHJlZj0ibWFpbHRvOjQwZ29vZ2xlLmNvbUBkbWFy Yy5pZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPjQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZzwv YT4mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gRnJpZGF5LCBNYXJjaCAxNSwgMjAxOSA5OjUzIEFN PGJyPg0KPGI+VG86PC9iPiBQYXVsIEhvZmZtYW4gJmx0OzxhIGhyZWY9Im1haWx0bzpwYXVsLmhv ZmZtYW5AaWNhbm4ub3JnIiB0YXJnZXQ9Il9ibGFuayI+cGF1bC5ob2ZmbWFuQGljYW5uLm9yZzwv YT4mZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBEb0ggV0cgJmx0OzxhIGhyZWY9Im1haWx0bzpkb2hAaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj5kb2hAaWV0Zi5vcmc8L2E+Jmd0Ozxicj4NCjxiPlN1Ympl Y3Q6PC9iPiBSZTogW0RvaF0gVXNlIG9mIFRYVCByZWNvcmRzPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJv dHRvbS1hbHQ6YXV0byI+VG8gYmUgY2xlYXIsIEknbSBub3Qgb2JqZWN0aW5nIHRvIHRoaXMgY2hv aWNlLiZuYnNwOyBJJ20gbWVyZWx5IG5vdGluZyB0aGF0IHVzZSBvZiBUWFQgaGFzIGJlZW4gYSBw b2ludCBvZiBjb250cm92ZXJzeSBpbiBvdGhlciBkaXNjdXNzaW9ucyBhdCB0aGUgSUVURi4mbmJz cDsgU29tZSBncm91cHMgaGF2ZSBkZWNpZGVkIHRvDQogcHJvY2VlZCB3aXRoIFRYVCwgc29tZSBo YXZlIHByZWZlcnJlZCB0byB1c2UgZGlmZmVyZW50IG9yIG5ldyBSUlRZUEVzLCBhbmQgc29tZSBo YXZlIG5vdCB5ZXQgZGVjaWRlZC4mbmJzcDsgSSB3b3VsZCBsaWtlIHRoZSB3b3JraW5nIGdyb3Vw IHRvIGNvbnNpZGVyIHRoaXMgcXVlc3Rpb24gc29vbiBzbyBpdCBkb2Vzbid0IGRlbGF5IGNvbnNl bnN1cyBsYXRlci48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1h bCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDph dXRvIj5PbiBGcmksIE1hciAxNSwgMjAxOSBhdCAxMjoyNyBQTSBQYXVsIEhvZmZtYW4gJmx0Ozxh IGhyZWY9Im1haWx0bzpwYXVsLmhvZmZtYW5AaWNhbm4ub3JnIiB0YXJnZXQ9Il9ibGFuayI+cGF1 bC5ob2ZmbWFuQGljYW5uLm9yZzwvYT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+ DQo8YmxvY2txdW90ZSBzdHlsZT0iYm9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0ND QyAxLjBwdDtwYWRkaW5nOjBpbiAwaW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdp bi10b3A6NS4wcHQ7bWFyZ2luLXJpZ2h0OjBpbjttYXJnaW4tYm90dG9tOjUuMHB0Ij4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0byI+T24gTWFyIDE1LCAyMDE5LCBhdCA2OjEyIEFNLCBCZW4gU2Nod2Fy dHogJmx0OzxhIGhyZWY9Im1haWx0bzpiZW1hc2M9NDBnb29nbGUuY29tQGRtYXJjLmlldGYuLm9y ZyIgdGFyZ2V0PSJfYmxhbmsiPmJlbWFzYz00MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi4ub3JnPC9h PiZndDsgd3JvdGU6PGJyPg0KJmd0OyA1LiBNYWNoaW5lLXJlYWRhYmxlIGNvbnRlbnQgaW4gYSBU WFQgcmVjb3JkPGJyPg0KPGJyPg0KVGhpcyBpcyB0aGUgZmlyc3QgSSBoYWQgaGVhcmQgdGhhdCBw ZW9wbGUgb2JqZWN0ZWQgdG8gdXNpbmcgYSBUWFQgcmVjb3JkLCBidXQgSSBtaWdodCBoYXZlIG1p c3NlZCB0aGF0IHBhcnQgb2YgdGhlIGRpc2N1c3Npb24uIEdpdmVuIHRoYXQgdGhpcyBxdWVyeSBp cyBmb3IgYSBuZXdseS1jcmVhdGVkIFNVRE4gdGhhdCBpcyBvbmx5IHVzZWQgZm9yIGxvb2tpbmcg dXAgRG9IIGluZm9ybWF0aW9uLCB0aGVyZSBpcyBubyBjaGFuY2UgdGhhdCB0aGUgVFhUDQogcmVj b3JkIHdvdWxkIGJlIGluIHVzZSBmb3IgYW55dGhpbmcgZWxzZS48YnI+DQo8YnI+DQpIYXZpbmcg c2FpZCB0aGF0LCBpdCB3b3VsZCBiZSBxdWl0ZSBlYXN5IGZvciB0aGlzIGRvY3VtZW50IHRvIGNy ZWF0ZSBhIG5ldyBSUnR5cGUgZm9yIHRoaXMgcGFydGljdWxhciBxdWVyeS4gKEkgd291bGQgbm90 IHdhbnQgdG8gcmUtdXNlIHRoZSBVUkkgUlJ0eXBlIGJlY2F1c2UgaXQgd291bGQgdGFrZSBtb3Jl IGVmZm9ydCB0byBleHBsYWluIHRoZSBwcmlvcml0eSBhbmQgd2VpZ2h0LCBhcyB3ZWxsIGFzIGRl YWxpbmcgd2l0aCB0aGUgY29tbW9uDQogZXJyb3Igb2YgcGVvcGxlIG5vdCBwdXQgdGhlIFVSSSBp biBxdW90YXRpb25zIG1hcmtzIGFzIGlzIHJlcXVpcmVkIGZvciB0aGUgVVJJIFJSdHlwZS4pPGJy Pg0KPGJyPg0KLS1QYXVsIEhvZmZtYW48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2txdW90ZT4NCjwv ZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rp dj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_5f96d208a4f144968eeabf26edb16627ustx2exdag1mb3msgcorpak_-- From nobody Fri Mar 15 13:51:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FB09130F56 for ; Fri, 15 Mar 2019 13:51:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.678 X-Spam-Level: X-Spam-Status: No, score=-1.678 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E6RPkllcAeGa for ; Fri, 15 Mar 2019 13:51:49 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A8EE130F3E for ; Fri, 15 Mar 2019 13:51:49 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2FKpkTI031585 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 15 Mar 2019 15:51:47 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1552683108; bh=z7CjMCMRVwMLMAJI1l95foCGSLf7u12lSsF8QfuL1rs=; h=Subject:To:References:From:Date:In-Reply-To; b=XUqJFzDFCGnwLqdwKwJAAWqWtBtMunIVW6PoRwcE9UC3UCVWxUf2TGXpUKxveDcT7 REHBO9UtGLwE4aTcIdjMrxzM+1KUQzea+KS4oQr48iWja6D0TDpSa5lAGmAhARiUh0 JIz1EpRp1wjZchPB3jihgYxJpHH/KqyLQZ1aFePk= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: "Winfield, Alister" , Ben Schwartz , DoH WG References: From: Adam Roach Message-ID: Date: Fri, 15 Mar 2019 15:51:41 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------37FF1A3C323D6378D58B03FC" Content-Language: en-US Archived-At: Subject: Re: [Doh] [EXTERNAL] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 20:51:51 -0000 This is a multi-part message in MIME format. --------------37FF1A3C323D6378D58B03FC Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 3/15/19 8:41 AM, Winfield, Alister wrote: > > 1. IP-address certificates > > Bad ! Especially if the less enlightened think to try to create a > certificate for a private IP. Very bad idea > If you have more detailed thoughts on this to share, I'm sure the ACME working group would appreciate your input on https://tools.ietf.org/html/draft-ietf-acme-ip-05 /a --------------37FF1A3C323D6378D58B03FC Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 3/15/19 8:41 AM, Winfield, Alister wrote:

 

 

  1. IP-address certificates

 

Bad ! Especially if the less enlightened think to try to create a certificate for a private IP. Very bad idea


If you have more detailed thoughts on this to share, I'm sure the ACME working group would appreciate your input on https://tools.ietf.org/html/draft-ietf-acme-ip-05

/a

--------------37FF1A3C323D6378D58B03FC-- From nobody Fri Mar 15 17:20:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A7842130F81; Fri, 15 Mar 2019 17:20:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PlMu0pb_Gfqw; Fri, 15 Mar 2019 17:20:30 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B2D0B130EA6; Fri, 15 Mar 2019 17:20:27 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 99C996A273; Sat, 16 Mar 2019 01:20:23 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1552695623; bh=4E9cgHUwM8DynuskGeKMXVqwMfK1wEM2S2QdxEsQRWk=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=hOn+VYTm3USt5rBpD3AW1SIADZrfea7oBDKbwE+9vLlbsdu/2DBBWbdOGsKd2gNT2 ytZRVomHTzCA8gtQQZzX2acIccrUm+JWULGihNPNv0BPkQkRcCIIVYFlRXXIB4aO7p 2PmtAwgDxph3AsKT1trjAr4jpr3fKNNHa9Hoy3gt/EKXJ5U/WKpbUTmUTKlCP0IFE3 sBAOIPZOWcRCEHRJ5OnDfl1wAwQRlVwkV4vyvFlg6hn7Dw6z+KTzVfnYnhQI0rrMQ2 vUwcfnm6dLErAZvWTnV4VW8UYI9wgvRs1xySc8/YNsKeIYLFBvn2RNHOjA/NYHhOV4 jpBW1IMEIoPPw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 8A4B73C0881; Sat, 16 Mar 2019 01:20:23 +0100 (CET) Date: Sat, 16 Mar 2019 01:20:23 +0100 (CET) From: Vittorio Bertola To: Ted Hardie , Paul Vixie Cc: dnsop , DoH WG Message-ID: <917068158.3571.1552695623505@appsuite.open-xchange.com> In-Reply-To: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_3570_1037743695.1552695623498" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 00:20:35 -0000 ------=_Part_3570_1037743695.1552695623498 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 15 marzo 2019 alle 19.36 Ted Hardie ha scritto: > > As was pointed out in many groups, trusting the local infrastructure is extremely problematic in nomadic cases as the local infrastructure can often be infected, ill-maintained. or hostile by design. Given the extremely high percentage of users who are now on the Internet by mobile devices which roam and opportunistically use WiFi, ignoring this reality would not make sense. > Does anyone have data on this "extremely high"? I am not challenging that the problem exists, though, in my experience of the last couple of years in Europe, the sudden availability of cheap Europe-wide mobile data plans means that people using the Internet from a smartphone tend to use random wi-fi networks less, and to stick to the network of their mobile operator when traveling (I would love to hear about other places). In any case, what's problematic in that trade-off is the non sequitur that since "trusting the local infrastructure is extremely problematic in nomadic cases" then we design technical solutions that never trust the local infrastructure in any case - or even actively try to circumvent it. This is just wrong, and does not consider that there are indeed many very common device use cases in which being nomadic is a rare exception (such as my mother's laptop) or does not happen at all (such as a desktop PC on a corporate network). Perhaps letting the user bless the networks they trust would be a better approach. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_3570_1037743695.1552695623498 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Il 15 marzo 2019 alle 19.36 Ted Hardie <ted.ietf@gmail.com> ha scritto:

As was pointed out in many groups, trusting the local infrastructure is extremely problematic in nomadic cases as the local infrastructure can often be infected, ill-maintained. or hostile by design.  Given the extremely high percentage of users who are now on the Internet by mobile devices which roam and opportunistically use WiFi, ignoring this reality would not make sense. 
Does anyone have data on this "extremely high"? I am not challenging that the problem exists, though, in my experience of the last couple of years in Europe, the sudden availability of cheap Europe-wide mobile data plans means that people using the Internet from a smartphone tend to use random wi-fi networks less, and to stick to the network of their mobile operator when traveling (I would love to hear about other places).

In any case, what's problematic in that trade-off is the non sequitur that since "trusting the local infrastructure is extremely problematic in nomadic cases" then we design technical solutions that never trust the local infrastructure in any case - or even actively try to circumvent it.

This is just wrong, and does not consider that there are indeed many very common device use cases in which being nomadic is a rare exception (such as my mother's laptop) or does not happen at all (such as a desktop PC on a corporate network).

Perhaps letting the user bless the networks they trust would be a better approach.

Regards,

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
------=_Part_3570_1037743695.1552695623498-- From nobody Fri Mar 15 18:47:33 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6C5E13112D; Fri, 15 Mar 2019 18:47:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 68nZyv2QIcrP; Fri, 15 Mar 2019 18:47:21 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B1E9F130DE9; Fri, 15 Mar 2019 18:47:21 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id v20so12224588qtv.12; Fri, 15 Mar 2019 18:47:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tp1SWB34fALNqUXtjVlgODoj2ofAaIDSuklHKIfBhps=; b=adiYfZ6ryXxI/sVb/hZK9ovv4FCqj7yrjoxw5gSlQcYWk/O8iv/K3Z3fikDMPQSuBf FPWYi37pjSgPcnS2tPNyvFs8B+ojWt5aN67bwFAB+syBj3hJtakcoVQwfkU9+86VbHpu +rC0VRtwjbcpy42rc+0ldIquVdqHYAc79+Scz0gSs0/kFP1pzszdPY/gAIuocIBPqHbQ il4CMq4FY/MYNLCV22X7gy2WiJbBuQlZLBAE96g+09C0kkUQ3/SIVmTN63LfmJ0cTokC mMaDSg1Bv1fyuuLm4LIMyDWOYFhliSNOJYGYEaO9nfhtTYYujXzPD4KbrisabeiMs9Bd Iypg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tp1SWB34fALNqUXtjVlgODoj2ofAaIDSuklHKIfBhps=; b=dCv1Bf70mimv8KGFP2vbxQBiAEXlgCti58+OX79149/Jn0u2rvK1bduC9WsEt0UdFr bsfibkNZxXAIbSR4CAcs9iTWCQPYoRa7AtvNKMYvkEm0W7nHpn5it1HNu5Iz73dS/2lC Sy/XzC77IwhPoZO2FZhVCgynsnzXQM/5mnDCqayIGcvWfoEZkA4oX1pYBNrIzAfxOz0P /eR59KVvEdSgZ4lCNNUERXGPcrDKv3Izk8eipUu6pFVffKm6H937wxav4q3OOhjQv8nN vlNWbFDL4ikNntNOWL7Q8dqcH12nuYWLMVPO5D0o82J9VKe2gLCZNQzYBQqsodKA9gfe CWaw== X-Gm-Message-State: APjAAAUy40mM/I+FCTXXCIt5hH20NUfnZxLhcGYN1a7cfBiB+CdQSCd3 ruOKFJxG/Csu/Yt2Q7Wvpb4f7iAQRnXdyYs3IwE= X-Google-Smtp-Source: APXvYqzVkBIhMkYq+/GEtI/WI5YMp8O1flK4rOD5ZB3H6hlrSJmE8IUcTYAFCf9qeCeZ7QghGOJ+scRX0LX0ZdbRZI0= X-Received: by 2002:a0c:9b85:: with SMTP id o5mr4877357qve.62.1552700840645; Fri, 15 Mar 2019 18:47:20 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: From: Brian Dickson Date: Fri, 15 Mar 2019 18:47:05 -0700 Message-ID: To: Ted Hardie Cc: Paul Vixie , dnsop , DoH WG Content-Type: multipart/alternative; boundary="0000000000000c985c05842c5681" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 01:47:24 -0000 --0000000000000c985c05842c5681 Content-Type: text/plain; charset="UTF-8" This has been an excellent discussion, with lots of insightful analysis, examples, and great context. I apologize in advance, but I'd like to pick one particular sentence, to use for teasing out what I think is a foundational issue: On Fri, Mar 15, 2019 at 11:37 AM Ted Hardie wrote: > > This is certainly not the case for all deployments of DoH. > > This is where the distinction between, for example, "normative" vs "informative" are important terms. What I think we (the larger "we" in these threads) need to settle, is what should be the rules (aka "protocol") for what we want or need ALL deployments of DoH to do; or how they do what they do; or how users control what the clients do; or how network operators (last mile or otherwise) can influence/control what DNS protocols and operators can be used. Some of the issues might be how users are able to know the identities of DNS operators (e.g. certs for DoT or DoH); how services are offered, selected, configured, and possibly restricted; and what jurisdictional/regulatory/legal environments might be applicable to any of the parties involved. It's definitely a non-trivial issue, but it needs to be handled in a comprehensive, cooperative, and inclusive manner. My preference would be that no DoH operators, or client software, be deployed in a manner that is deliberately ignorant of or in violation of policies and laws, even if there may be some particular use cases where no laws or policies are violated by a particular set of {operator,client} pairs. Yes, there may be large swaths of jurisdictions vs users where non-cooperative operation is necessary. I would (and I believe a consensus-level of individuals involved in DNS would) prefer that those modes are only engaged where strictly necessary, and that to the greatest degree possible, client and operator implementations are able to recognize when they are not in those particular places/networks, and block hostile operation (to prevent exploitation by e.g. malware). I'm glad we at least have these options now. Lets work together to ensure the best outcomes are achieved, and that we avoid situations where "camps" cannot find a middle ground. Brian --0000000000000c985c05842c5681 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This has been an excellent discussion, wi= th lots of insightful analysis, examples, and great context.

=
I apologize in advance, but I'd like to pick one particular senten= ce, to use for teasing out what I think is a foundational issue:

On Fr= i, Mar 15, 2019 at 11:37 AM Ted Hardie <ted.ietf@gmail.com> wrote:
=

This is certainl= y not the case for all deployments of DoH.=C2=A0


This is where the distinction betwe= en, for example, "normative" vs "informative" are impor= tant terms.

What I think we (the larger "we&q= uot; in these threads) need to settle, is what should be the rules (aka &qu= ot;protocol") for what we want or need ALL deployments of DoH to do; o= r how they do what they do; or how users control what the clients do; or ho= w network operators (last mile or otherwise) can influence/control what DNS= protocols and operators can be used.

Some of the = issues might be how users are able to know the identities of DNS operators = (e.g. certs for DoT or DoH); how services are offered, selected, configured= , and possibly restricted; and what jurisdictional/regulatory/legal environ= ments might be applicable to any of the parties involved.

It's definitely a non-trivial issue, but it needs to be handled= in a comprehensive, cooperative, and inclusive manner.

My preference would be that no DoH operators, or client software, be = deployed in a manner that is deliberately ignorant of or in violation of po= licies and laws, even if there may be some particular use cases where no la= ws or policies are violated by a particular set of {operator,client} pairs.=

Yes, there may be large swaths of jurisdictions v= s users where non-cooperative operation is necessary. I would (and I believ= e a consensus-level of individuals involved in DNS would) prefer that those= modes are only engaged where strictly necessary, and that to the greatest = degree possible,=C2=A0 client and operator implementations are able to reco= gnize when they are not in those particular places/networks, and block host= ile operation (to prevent exploitation by e.g. malware).

I'm glad we at least have these options now.
Lets work= together to ensure the best outcomes are achieved, and that we avoid situa= tions where "camps" cannot find a middle ground.

Brian
--0000000000000c985c05842c5681-- From nobody Sat Mar 16 00:57:34 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D07F12D7EA for ; Sat, 16 Mar 2019 00:57:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j0KVN3mSMXyv for ; Sat, 16 Mar 2019 00:57:31 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 27F2C12AF7F for ; Sat, 16 Mar 2019 00:57:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1726; q=dns/txt; s=iport; t=1552723051; x=1553932651; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=P5iFkSyV1DR/bNQa63x1jzsX0okcSOS9E46EJnHFJ1E=; b=ECB1t1/jSG+TluL0SOevQHXqmg4kCCz1UdguWIjky6CE+rDWuAzN80t7 tHz5+LKTJhPKkatYgq44rjhwiJi7eSgM16vTSSzshF0Jn4F4S36lgWmTV Ou/b0LvOQsmKRbTLfsGcpi0M01Xma9jTZx1o1uaEe4Wv6lOj3gULFq8zq g=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AHAADoq4xc/xbLJq1kGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBUwIBAQEBAQsBg0czJ40GjCslmDGBewgDAQGEbAKEcjY?= =?us-ascii?q?HDQEBAwEBCQEDAm0ohUoBAQEDAWsOBQsLGC5XBhMbgwcBgW0IrCmFRoReD4E?= =?us-ascii?q?vAYFIigGBf4E4DBOCTIMeBIUagiYDkU+SfgmEYY5DGYsNiEebDYJwAgQGBQI?= =?us-ascii?q?VgU4CL4FWMxoIGxVlAYJBPpAOPgMwAY5vAQE?= X-IronPort-AV: E=Sophos;i="5.58,485,1544486400"; d="asc'?scan'208";a="10718853" Received: from aer-iport-nat.cisco.com (HELO aer-core-4.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 16 Mar 2019 07:57:29 +0000 Received: from [10.61.249.212] ([10.61.249.212]) by aer-core-4.cisco.com (8.15.2/8.15.2) with ESMTPS id x2G7vRjZ028993 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Sat, 16 Mar 2019 07:57:28 GMT From: Eliot Lear Message-Id: <99C4A916-7826-4CD7-A90A-59401C10DE93@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_5A7FA063-35B3-414B-BF88-015B9C17A2DC"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Sat, 16 Mar 2019 08:57:26 +0100 In-Reply-To: Cc: Paul Hoffman , DoH WG To: Ben Schwartz References: X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.249.212, [10.61.249.212] X-Outbound-Node: aer-core-4.cisco.com Archived-At: Subject: Re: [Doh] Use of TXT records X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 07:57:33 -0000 --Apple-Mail=_5A7FA063-35B3-414B-BF88-015B9C17A2DC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On 15 Mar 2019, at 17:52, Ben Schwartz = wrote: >=20 > To be clear, I'm not objecting to this choice. I'm merely noting that = use of TXT has been a point of controversy in other discussions at the = IETF. Some groups have decided to proceed with TXT, some have preferred = to use different or new RRTYPEs, and some have not yet decided. I would = like the working group to consider this question soon so it doesn't = delay consensus later. If a slower consensus means a more easily adopted solution, take the = slower consensus. I realize this is a controversial thing to say in a = room full of DNS experts, but rolling out new RRTYPEs is a royal pain. = TXT is far easier to deal with. Eliot --Apple-Mail=_5A7FA063-35B3-414B-BF88-015B9C17A2DC Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyMrGYACgkQh7ZrRtnS ejOHXAf/fcXg/uc24ewdc9BrORCFHvTYJXIveCP4pOVU1YJRmYiLAEf29iKP6Htv 4lGjYa+q+kRSPqSJN1htjazfguIyKpI4qPHoTcn/VTfdGyCKwqjs7qkpIytdWnxi YBY15XmkvmjXjvZSTEfK18RKu0c6mJ4sJaYuZBz9pj/gfFfLedHXNncg7fFU0n0F nRtivNg257vvru+bbWW73l0DDHGNzZXv7QTqX/xFs36CJyvvjq1PQs3JyDJNLSYW vgGvhff+3stTNA6xZYvJF36nIJDaQ1WowOntokapgge6HeTqSfAN4lhW6quENjYY 3m+zrZacCWM0WvZY4zarMuN0zBnGOg== =+HQa -----END PGP SIGNATURE----- --Apple-Mail=_5A7FA063-35B3-414B-BF88-015B9C17A2DC-- From nobody Sat Mar 16 06:22:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4397B1200B3; Sat, 16 Mar 2019 06:22:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XEleXjjqwqy1; Sat, 16 Mar 2019 06:22:43 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 8784E1277D7; Sat, 16 Mar 2019 06:22:43 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 93EF75F42201; Sat, 16 Mar 2019 14:22:40 +0100 (CET) Received: from [172.19.40.118] (p4FF53E78.dip0.t-ipconnect.de [79.245.62.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 94FC05F40723; Sat, 16 Mar 2019 14:22:39 +0100 (CET) From: "Ralf Weber" To: "Ted Hardie" Cc: "Paul Vixie" , dnsop , "DoH WG" Date: Sat, 16 Mar 2019 14:22:37 +0100 X-Mailer: MailMate (1.12.4r5594) Message-ID: <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> In-Reply-To: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 13:22:46 -0000 Moin! On 15 Mar 2019, at 19:36, Ted Hardie wrote: > As was pointed out in many groups, trusting the local infrastructure is > extremely problematic in nomadic cases as the local infrastructure can > often be infected, ill-maintained. or hostile by design. Given the > extremely high percentage of users who are now on the Internet by mobile > devices which roam and opportunistically use WiFi, ignoring this reality > would not make sense. So we rely on configuration of end devices and > applications, with the belief that the user has some choice there in both > how the end device is configured and in what applications are supported. > That's a trade-off, and not a simple one to make, both because it is very > difficult for end users to make that assessment and because there's a high > reliance on sensible defaults. But that choice is an engineering > trade-off, not an act of war against you or any other network operator. You can not get on a network with at least trusting some of its infrastructure, be it SLAAC or DHCP (which BTW both carry information for DNS resolving). The question is where you draw the line and IMHO DNS or name resolution is a basic network function and not an application setting. > If the user configures your DNS service they get it, and their trust in > your operations to provide appropriate answers is thereby matched to your > desire to see the requests. Yes and this capability existed in operating systems for some time and was used by some people. It didn’t cause any concern as if a network for some reason didn’t want to allow user to use external resolving (which is the case in pretty much every enterprise network) they could simply block it. This is not so easy with DoH. > For a very large number of enterprise > networks, the result is that devices are permitted on the network only when > under some form of device management, with the proxies, configuration, and > limitations that implies. To protect itself, the enterprise insists on a > prior relationship with known terms, instantiated by the configuration of > device management. There are lighter forms of configuration that do the > same thing to lesser degrees, but they each presume that a trusted edge > network operator has a relationship to the users that can effect > configuration. This never was fully true and with more and more bring your on device requiring this will get harder, so network providers (ISP, enterprises, my home network ;-) have to have tools to apply their network rules, or if people don’t want to play by the rules block them. So long -Ralf —-- Ralf Weber From nobody Sat Mar 16 08:27:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 20CBF129A85 for ; Sat, 16 Mar 2019 08:27:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sMAit6MaMY5b for ; Sat, 16 Mar 2019 08:27:35 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B8DE91200D7 for ; Sat, 16 Mar 2019 08:27:35 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Sat, 16 Mar 2019 08:27:34 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Sat, 16 Mar 2019 08:27:34 -0700 From: Paul Hoffman To: DoH WG Thread-Topic: [Ext] [Doh] Use of TXT records Thread-Index: AQHU3AzH5yWsywGF/065OUUTwIiBHg== Date: Sat, 16 Mar 2019 15:27:34 +0000 Message-ID: References: <99C4A916-7826-4CD7-A90A-59401C10DE93@cisco.com> In-Reply-To: <99C4A916-7826-4CD7-A90A-59401C10DE93@cisco.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <875DD2C4909F6A4496A48E2E80AD5DA9@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] Use of TXT records X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 15:27:37 -0000 On Mar 16, 2019, at 12:57 AM, Eliot Lear wrote: >=20 > If a slower consensus means a more easily adopted solution, take the slow= er consensus. I realize this is a controversial thing to say in a room ful= l of DNS experts, but rolling out new RRTYPEs is a royal pain. TXT is far = easier to deal with. >=20 I thoroughly disagree in this case. The only application using this will be= one that can create binary messages, so the RRtype number is pretty trivia= l.=20 The reason I chose TXT is that there is zero chance that there is any other= reason for a TXT record for this special-use domain name, and people know = TXT. If the WG wants a new RRtype for this, that's easy for me to change in= the draft. --Paul Hoffman= From nobody Sat Mar 16 08:51:15 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5391A12E7C1 for ; Sat, 16 Mar 2019 08:51:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s9K5DdPDlR5h for ; Sat, 16 Mar 2019 08:51:11 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4DE8D1200D8 for ; Sat, 16 Mar 2019 08:51:11 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 8BDD61A40E3 for ; Sat, 16 Mar 2019 08:51:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552751470; bh=0w7VAoYHF1zTuVrL7DPc6TrE61lrPxFTxKGxMX8EaEg=; h=To:References:From:Subject:Date:In-Reply-To:From; b=kfrkUhO/C57u2SM0glMU0gYO0KesVmQwgWQPzdnrE7OAamuMi9co4N3y0bRixvKYh KKTHj8OBIohlf2ZrJUxg2A+/HKF3AKil6fKEEGSvRVj+8d/WgiB1VcbOql6vb0SPp3 SkDqzGGKocV+bAS2aNI0gZYdJMl6kfgDgBoz8JdQ= X-Riseup-User-ID: 92F8E9B40808D0C8EBEF7EAC7B02E016A6989B93F655ADA1149351E7CEA1114B Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id C67BC1202A1 for ; Sat, 16 Mar 2019 08:51:09 -0700 (PDT) To: doh@ietf.org References: From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> Date: Sat, 16 Mar 2019 15:51:00 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ea7neKLvtxBjVckbzBu7DmdT7JMgB5Ro7" Archived-At: Subject: Re: [Doh] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 15:51:13 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ea7neKLvtxBjVckbzBu7DmdT7JMgB5Ro7 Content-Type: multipart/mixed; boundary="it8pekuXnIrb0fa8NYrqA0tormWSEKfwE"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> Subject: Re: [Doh] Reviewing Resolver-Associated DOH References: In-Reply-To: --it8pekuXnIrb0fa8NYrqA0tormWSEKfwE Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable > Abstract >=20 > Browsers and web applications may want to know if there are one or > more DoH servers associated with the DNS recursive resolver that the= > operating system is already using.=20 [...] > There is a use case for browsers and web applications to want to make it clear that this discovery mechanism can be used by any applica= tion (or even the OS itself) and is not limited to "browsers and web applicati= ons" maybe use something more generic like "Systems and applications may want = know if there are one or more DoH servers ..."? > TXT vs. RRtype For the reasons Paul outlined and since this is a special local-only doma= in name I believe TXT is fine here. I also agree with Eliot that TXT allows easier adoption than a new RRtype= =2E Generally speaking I would find it nice to have a similar discovery mecha= nism for DoT but since that is outside the DoH WG I assume it has to go into a= separate document (even though it could copy most of the text). https://datatracker.ietf.org/wg/doh/about/ wrote: > This will enable the domain name system to > function over certain paths where existing DNS methods (UDP, TLS [RFC 7= 857], there is probably a typo: RFC 7857 (Updates to NAT) vs RFC 7858 (DNS-over-TLS) --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --it8pekuXnIrb0fa8NYrqA0tormWSEKfwE-- --ea7neKLvtxBjVckbzBu7DmdT7JMgB5Ro7 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyNG2gACgkQrWE4wkXN Qn5mQxAAgMOnUSfzhj4XvL0jLrWQsvsid3PGOfZD0UVN73G+k3sRX8lgxBiVWDYL XLgMgAmtTwdXIXnDI/LUMXix9/UN0yg+Lt/dmIbqkCfbHLuFwde5MC+KuFlj3RCT KLkT12kqx9XMBF8aBzwc1TOn2h1jAiFz1fDd+12vkyfs80XBEAlrmABi/9aqAsog AQx9O+gQtADJtk7Vx3wMKtPXDjYwnit+FhNg9goQsWeltqFyIysGox+/qY1l79n8 XtrSgKG7SAcosTYkT1YSQ4LBst3RrwPapIPfrkmIPutJWH/1hWhFzOLgpxeyfZiA izI9eURPxL0hDK8XVR6Nfi7XpBPSrsMUvod6oqte1lLlfTD/uRobiGiMDT17tlPk BL/WNldJv3RBdL3QYATqhaikmPwnkI+jDzdeWOjTgBHo2xPTWGaih6b6LWz5VXoK GkfQW1xYQOtVf1EiTeTq9FSqZ2flzsZU/ddlrDDE/FE8VeRSmgh1Wz5k+P/zqt8n H18ok7Mq7WhBLOWmDo9ZK5BqMqh+4WLoWAINcb3M0FLmKcI9PghJZNat1XHL1gg6 8H1Q7hCw8vzVpdHYNV3csmmH9lcmNS7MTnycTUSdiKIUQ9ZBvTGgm5LEzI+04Zdd JpxAkKFe5JZFHW75dI6GYAA3n4iJaNzq74OMPaxWYkDD1eWwckQ= =fgso -----END PGP SIGNATURE----- --ea7neKLvtxBjVckbzBu7DmdT7JMgB5Ro7-- From nobody Sat Mar 16 08:51:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AEBD1200D8 for ; Sat, 16 Mar 2019 08:51:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KzU1U1OETJhS for ; Sat, 16 Mar 2019 08:51:12 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 98C4E12E04D for ; Sat, 16 Mar 2019 08:51:12 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 203421A01E4 for ; Sat, 16 Mar 2019 08:51:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552751472; bh=3effYcdJAkaVwNm4aL3Djn8hg2CRRH4EynrZIcvQT0g=; h=To:References:From:Subject:Date:In-Reply-To:From; b=G9azztii4dPFnTDcfVX7evi5TxHUc1whWTVIC5KHzwL4Gr1IsvbdBx540D8E38+RT xLLtmLKPrh4QZLdz3IHYXJlBL6BJ4jT76TtO1haHUl7ZL48+2VEQMdSGvV0jBNfRWE yNyo8a44GNrw7mxgNhUlTLBfDoNh4M8At3wC56Jc= X-Riseup-User-ID: 1A53482995BAC06881AC67BB28F406D106F7C1916648E759CA02F0C387499126 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 48A8D1202A1 for ; Sat, 16 Mar 2019 08:51:10 -0700 (PDT) To: doh@ietf.org References: From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: Date: Sat, 16 Mar 2019 15:51:00 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="fJ6b83GSwusyaA1UqBUAqfoEL76Rw9z3N" Archived-At: Subject: Re: [Doh] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 15:51:14 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --fJ6b83GSwusyaA1UqBUAqfoEL76Rw9z3N Content-Type: multipart/mixed; boundary="H6rgJUrSXgAIpXyS8O6UDoWXGTaV3VSKw"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: Subject: Re: [Doh] Reviewing Resolver-Associated DOH References: In-Reply-To: --H6rgJUrSXgAIpXyS8O6UDoWXGTaV3VSKw Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hewitt, Rory wrote: > As with all /.well-known/ endpoints, the issue is both > standardization and publicization. AIUI, @mnot's original ideal would > be to have /.well-known/ be pretty 'generic'. Therefore I'm not a fan > of "/doh-servers-associated/" - I'd much rather see "/dns/doh/", > which would enable other (future) DNS-related functionality to have a > sub-folder within "/.well-known/dns/". If that's not a possibility, > what about "/.well-known/dns-doh/"? +1 I find these suggested .well-known URLs clearer than "doh-servers-associa= ted". Maybe it would be good to have a single matching string used here and in = the .arpa DNS lookup. > Not sure of the question here. Are you asking about the format JSON > should take, or whether JSON is a 'good idea'? Yes to the latter. +1 > Finally, I think the spec should contain examples of a 'proposed' > JSON response and of the format of a TXT RR. Without examples (even > where marked as "unofficial proposal"), it's much harder to read by > those who didn't write it. I was also looking for examples of the JSON response and the TXT RR recor= d, when reading the I-D, so yes to examples in the text. --=20 https://twitter.com/nusenu_ --H6rgJUrSXgAIpXyS8O6UDoWXGTaV3VSKw-- --fJ6b83GSwusyaA1UqBUAqfoEL76Rw9z3N Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyNG2sACgkQrWE4wkXN Qn7/lw/9GRWLk9lvDRmRkrlsTVNpSF3j0L1I7Wj2hycOXTthZ8B+6mpI/4w8/zMM 2vuKANGwYzKBpVnw99bgTM/BBR4WeaTFluv+nCFVdZOMgGTNmZEQlgSB2UvN0IWM z80qlEyHWll2wWYoO+X6lh1G3rXXYPYDoai7CE537HWDWcEmtiJKoPQbPPwOeII4 hq1FOaSyR/cPqjmcllstnwY9C7m+JNbkBOP4sPXLoZpAc61T5TJ239msJfjH7WEp wdtwCSRB3ipS2ZFzC+L71/XOS7jYcoJdfkFdDl+F/MGndJ9Ulot7pmKeGjw/KDCq Bk7Jpj5xxPVHr2GaUaZcGJ7fMqsOjpbC2AqJ57dTVKh+z7aBYFwrYh1cdS9d0AiY gGE4e/4ERc7txY8nDVPSBoKrLvOSIrI2knnK6OVj9hqDtd3TX4Ao7pssaBbFM3zd A5xGnKgiGLSpzmw+2NxZx+OIcxGianBCWNm7BfHkdsOVf12gN2rgFYLNj1CsX/7J hkyn+8AUsmLCzwO9R8bq2TdRseRya3VbFkJFvTwMEsTmZepBQR5x36Zc2Wv7eTsv nQP9cLaQbL2y+PdgHeLU6wqyZDXrJBTTVYdFbmwqsaGAByPL49VPJsR/pikxR9m4 9Y3AqzXRfnwAoO1YaWC1I3E+3Z2HYvA3L2BiN5WAHQgpcwUDpCs= =a0H0 -----END PGP SIGNATURE----- --fJ6b83GSwusyaA1UqBUAqfoEL76Rw9z3N-- From nobody Sat Mar 16 09:04:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9AB5129B88 for ; Sat, 16 Mar 2019 09:04:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oM-CgyI-sB4J for ; Sat, 16 Mar 2019 09:04:53 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E825D1274D0 for ; Sat, 16 Mar 2019 09:04:52 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Sat, 16 Mar 2019 09:04:51 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Sat, 16 Mar 2019 09:04:51 -0700 From: Paul Hoffman To: DoH WG Thread-Topic: [Ext] [Doh] Reviewing Resolver-Associated DOH Thread-Index: AQHU3BH7i/uCxaS830a4yqKpvRp54g== Date: Sat, 16 Mar 2019 16:04:49 +0000 Message-ID: <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> In-Reply-To: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 16:04:55 -0000 On Mar 16, 2019, at 8:51 AM, nusenu wrote: >=20 >> Abstract >>=20 >> Browsers and web applications may want to know if there are one or >> more DoH servers associated with the DNS recursive resolver that the >> operating system is already using.=20 > [...] >> There is a use case for browsers and web applications to want >=20 > to make it clear that this discovery mechanism can be used by any applica= tion > (or even the OS itself) and is not limited to "browsers and web applicati= ons" > maybe use something more generic like "Systems and applications may want = know > if there are one or more DoH servers ..."? Good point. I'll discuss "browser can be almost any application" in the nex= t draft. On Mar 16, 2019, at 8:51 AM, nusenu wrote: > Hewitt, Rory wrote: >> As with all /.well-known/ endpoints, the issue is both >> standardization and publicization. AIUI, @mnot's original ideal would >> be to have /.well-known/ be pretty 'generic'. Therefore I'm not a fan >> of "/doh-servers-associated/" - I'd much rather see "/dns/doh/", >> which would enable other (future) DNS-related functionality to have a >> sub-folder within "/.well-known/dns/". If that's not a possibility, >> what about "/.well-known/dns-doh/"? >=20 > +1 >=20 > I find these suggested .well-known URLs clearer than "doh-servers-associa= ted". I'm generally against this idea for two reasons: - No one will see this URL other than software developers and operators wat= ching their logs. They will not be visible to users. - Layered spaces under a .well-known/ are possible but I don't think they a= re well-understood. > Maybe it would be good to have a single matching string used here and in= =20 > the .arpa DNS lookup. I disagree with this for the same reasons as above. >> Finally, I think the spec should contain examples of a 'proposed' >> JSON response and of the format of a TXT RR. Without examples (even >> where marked as "unofficial proposal"), it's much harder to read by >> those who didn't write it. >=20 >=20 > I was also looking for examples of the JSON response and the TXT RR recor= d, > when reading the I-D, so yes to examples in the text. Fully agree. There will be an example in the next version of the draft. --Paul Hoffman= From nobody Sat Mar 16 13:58:54 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B32E130DC0 for ; Sat, 16 Mar 2019 13:58:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lqKIZXWvuQYo for ; Sat, 16 Mar 2019 13:58:47 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A3771279A1 for ; Sat, 16 Mar 2019 13:58:47 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 4971E1A1CDD for ; Sat, 16 Mar 2019 13:58:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552769926; bh=YQ1ug4avFTXJaGBimVPTm26Tfwpsi3opMf+rmFJWHoQ=; h=To:References:From:Subject:Date:In-Reply-To:From; b=epbS+/Lt2uLSzB9WMpX5Mylu2rrJFWUqQYgF4INLrD/lYsWtrdaZIitFhFL41cmz1 dtjOG03YDyOOConNnha7tOeB+QXK3y1pRp5r5PpO95SKL3rE6KmPjxOlldR0wzxhLf BqgtnqyLS8T2EZ0izMCX9pv79EZ72hPce+86atzY= X-Riseup-User-ID: 378517D4322023B9C8CCADF21070E72021BDC2074EC48A68630EAFE79F8B2E77 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 2E1D31207E3 for ; Sat, 16 Mar 2019 13:58:44 -0700 (PDT) To: doh@ietf.org References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <2f1c705b-d383-60ce-e223-da7ed3c0defd@riseup.net> Date: Sat, 16 Mar 2019 20:58:00 +0000 MIME-Version: 1.0 In-Reply-To: <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="uiFKgLH3dXl0zcXTlv0BvsufCxjpUCfhW" Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Mar 2019 20:58:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --uiFKgLH3dXl0zcXTlv0BvsufCxjpUCfhW Content-Type: multipart/mixed; boundary="sIYvVfPDkByowG5cI0xVMAeczpFwYrIfI"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: <2f1c705b-d383-60ce-e223-da7ed3c0defd@riseup.net> Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> In-Reply-To: <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> --sIYvVfPDkByowG5cI0xVMAeczpFwYrIfI Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable A general question before some more comments: If the application supports the discovery mechanism in this I-D _and_ has an option where the user can explicitly set a DoH URI (like current Firefox has), in that case=20 the DoH URIs discovered via this protocol MUST NOT override the user's choice, correct? (since some of the discovery mechanisms in the current draft use unauthenticated data). the text could be something like: "If the DoH client has a DoH URI configured already,=20 it MUST NOT override the DoH URI learned through the discovery mechanisms in this document." > 3. DoH Servers from DNS >=20 > To find the URI templates for DoH servers associated with a resolver= , > a browser sends that resolver a query for "resolver-associated- > doh.arpa"=20 I believe this specific discovery mechanism=20 introduces a new attack opportunity that is not there today. Imagine a client having statically configured his operating system for Do= 53 via 8.8.8.8 (DNS options in DHCP are ignored on the client) and imagine an attacker being in the temporary position between the user and 8.8.8.8 (i.e. an internet cafe). Under these circumstances "DoH Servers from DNS" allows an attacker=20 to persistently set a victims DoH server URI.=20 Which gives the attacker access to the victims DNS traffic and allows him= to feed the DoH client arbitrary responses even after the=20 victim is out of his reach (i.e. user left the internet cafe).=20 There is also no chance the victim could check the integrity of TXT records via DNSSEC because they will never be signed= =2E The same attack vector also applies if the user uses Do53 via 10.0.0.1 and the attacker sits between 10.0.0.1 and 8.8.8.8 (the upstream resolver= of 10.0.0.1). Same attack vector applies to section 4 (Resolver Addresses from DNS). > A client MUST re-issue the queries in "DoH Servers from DNS" and > "Resolver Addresses from DNS" every time the configured resolver in > the operating system changes. This would break the persistence of the attack but does not help if the u= ser statically configured his resolver (ignoring DNS options in DHCP) or the = internet cafe is using the same resolver as the victim's home network (i.e. 8.8.8.8). To avoid introducing this new attack vector and to prevent downgrade attacks from section 2 to less safe option 3 I would suggest to stick to the safest option in the current I-D (DoH Servers from HTTPS)= and drop the less safe options or at least add the following=20 3 parts to reduce the impact (persistence) of the attack and to make it clear to implementer and operators that they MUST=20 do/provide the option described in section 2 before doing section 3: 1) extend:=20 > A client MUST re-issue the queries in "DoH Servers from DNS" and > "Resolver Addresses from DNS" every time the configured resolver in > the operating system changes=20 with: or whenever the client's IP address changes (even if the resolver does not change).=20 2) extend: > If the array of URI templates returned is empty, that indicates that= > the resolver does not have any DoH servers associated with it. with: > **DoH clients MUST NOT attempt to find DoH servers via the mechanism= =20 > defined in section 3 in that case.** 3) extend section 8 with something like: "The mechanism in section 2 is the safest and MUST be attempted first." You could also consider some downgrade attack protections where the attac= ker simply blocks 443 to force the unauthenticated mechanism in section 3. Such a protection could be implemented via an additional field in the JSO= N file by borrowing max-age from HSTS. https://tools.ietf.org/html/rfc6797#section-6.1.1 > The returned JSON object [RFC8259] MUST contain a member whose name > is "associated-resolvers" and whose value is a JSON array. The arra= y > contains zero or more JSON strings, each of which is a single URI > template. It would be great if the JSON format would specify an optional descriptio= n field. The description could then be displayed in the application UI. Thi= s would allow the operators to provide multiple profiles that can be selected by the us= er. If multiple URIs are defined the DoH client must use the first one by default if the user didn't choose one explicitly (if DoH is used by de= fault). such a JSON file could look like: { "associated-resolvers": [ { "uri": "https://doh.example.com/dns-query", "description": "Non-filtering and DNSSEC-validating resolver" }, { "uri": "https://doh.example.com/dns-query-filtering", "description": "DNSSEC-validating resolver filtering known malware = domains" } ] } >> I find these suggested .well-known URLs clearer than >> "doh-servers-associated". >=20 > I'm generally against this idea for two reasons: >=20 > - No one will see this URL other than software developers and > operators watching their logs. They will not be visible to users. It is probably not so important how the url/file is called in the end but having a speaking name with "dns-over-https-..." in its name would be clearer than just doh-.. even if only operators have to place the file on their servers and no end user will ever see that URL. thanks for working on this! nusenu --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --sIYvVfPDkByowG5cI0xVMAeczpFwYrIfI-- --uiFKgLH3dXl0zcXTlv0BvsufCxjpUCfhW Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyNY3sACgkQrWE4wkXN Qn6zwQ/8DGxlrzH9aMk41wmJg7Yp7Y/b3SB6jUO8ylA3DqdTHN6Vj19SYCaSwcks O1jjmpRPuRNyyBJtVbu2EGaK/e6RvAmSDJSq2UfYr4s7UvAhFVObijgwW+OzVLeG l9f0wrKYdef23ojlCqcsaAPlZHpzywG8jjKgbJU8Xrg9HlCRCo7aKrGbS6vGnb3w e3cJCZ4wAaHigt6qB+QY6cIAoaCCRhqY1V8mPZvo43bw0vnygKgJHBWvdBQSmczD r7WGMAUhwEDK9eB98nT8i4P+Mq9JBls8moA5kcYMnm70ioiQULZbaesh3dr8F6eC xL29cY87y1MhEdZS4cCdzZ1Z+smHAKcijK3HFxWPa+VjjzgeCUeNNKjzShvIH//W n/sBmscu/OzCOh8hhcZLF//yIVBjyhyh72Envr7M7QgaCFZ4KkM549/g2kBKIW5k 54zQqBdmywhfzAx0Qice1mbbnLbB4zpn9YSLU9645YVTUPxBcyTf0rvcIAXFkCnn RRParM2Emgs84M+24wnCBP1rmmxfOncAc4uC1dAPxquIw0OGobDTRDB3u1X9lTtN YcviEe5aGyhBfuqdmilS87HTTiLEoPEU4UZoQo/UwB4vzCbPAoOzJ5uOjbcKowcw IKpU9ArrM1KNyGzYN9VNtA7skB5EdThbJF6g+pb1+309WEQ0cbI= =+r3q -----END PGP SIGNATURE----- --uiFKgLH3dXl0zcXTlv0BvsufCxjpUCfhW-- From nobody Sun Mar 17 13:45:16 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DAFCA1311E1 for ; Sun, 17 Mar 2019 13:45:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=oZtcy3Rx; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=l/yoAJle Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bMed4Tm7YR0d for ; Sun, 17 Mar 2019 13:45:12 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 48EFE1311E0 for ; Sun, 17 Mar 2019 13:45:12 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 61A1E21448 for ; Sun, 17 Mar 2019 16:45:11 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sun, 17 Mar 2019 16:45:11 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=z3KNzcdRElk2lpedny7no0xsky0PxCM Sadt5lRpgYUM=; b=oZtcy3RxNAzlWdyXn6EGawfFITIHw5+Vo1j9Uc+2R3JpSTc VBwamFX/FdpsAwAr3XNPLIOdWvAzJbqxCs/gHC5xC06JKpCs8/c/hsZKUA62uR+Q t9dUA3MaykZLkY8EwNjCB64u6aU2mq2EdbB9VdADHkTmeZK8U1FTgL1ezEAlrxv9 HWrnp7cGUqN4p7e9dOaUBn0MF82t7sQ94iLXumjkmTfbBeCFSiIJ1egW+rju3fUO Kxtfvs9zq8dyVFHtJdjg/q5YbVigub2a2KWwlx6xCvqX8bdgfEilN5bO9uQtUPWe vLEzpYddArOX2onrsD22MngehEWs2BtVqbZ9z9Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=z3KNzc dRElk2lpedny7no0xsky0PxCMSadt5lRpgYUM=; b=l/yoAJlecbL/Q+MHGTl5ih EwmG98aSsiwUwHvjrBhgG3Bjom+9t9mJ90dx7eCncQnv1Xaxg3fYnVX/1INkOSe1 Hj2iS4x6Pr2gyA9vgSEInwSw/pPoBDy+fS6C5umBBpYtlMHaFKxUsEgc7eIyDW8e HUJ1k2fw0D5PWi36uGVDyVXIy88l4HoXnG97kuIRCSeMH/9s0butY9KXAO40jGST CiTgPcCb3lADMQ9L1sMNkqn0WQ91Ad/hoLghdWRJV4HOkrXCmQuvLfRTzGq4nzJG MFOLyObXb5ZRNy6NtaJDlOvELZnoq7s2EDEfuvkhgF5+RWXC2PB46jDXEJnRgPrw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrheelgddugeefucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsehttd ertderredtnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehloh ifvghnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id DF68B7C32E; Sun, 17 Mar 2019 16:45:10 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <2cbff385-7e78-452d-b82d-08acf56ab4df@www.fastmail.com> In-Reply-To: References: Date: Sun, 17 Mar 2019 16:45:12 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] IP address certificates X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 20:45:14 -0000 On Sat, Mar 16, 2019, at 03:22, Paul Hoffman wrote: > Can you say why they are bad? They are not common, but they are > certainly available and have proven useful in some environments for a > long time. Didn't we already discuss this? Sure they can be issued and relied upon, which makes them useful in some environments. They also tend to be useless in more situations than not. From nobody Sun Mar 17 13:51:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 929621311E2 for ; Sun, 17 Mar 2019 13:51:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z-4d-2racLR3 for ; Sun, 17 Mar 2019 13:51:15 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C2CF91311E7 for ; Sun, 17 Mar 2019 13:51:14 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Sun, 17 Mar 2019 13:51:12 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Sun, 17 Mar 2019 13:51:12 -0700 From: Paul Hoffman To: Martin Thomson CC: "doh@ietf.org" Thread-Topic: [Ext] [Doh] IP address certificates Thread-Index: AQHU3QMnMWf8Y1GqUkO+1z5iZ9C9zA== Date: Sun, 17 Mar 2019 20:51:12 +0000 Message-ID: References: <2cbff385-7e78-452d-b82d-08acf56ab4df@www.fastmail.com> In-Reply-To: <2cbff385-7e78-452d-b82d-08acf56ab4df@www.fastmail.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <4692D0667D58AC4A9B55CAFCFB7E5638@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] IP address certificates X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 20:51:18 -0000 On Mar 17, 2019, at 1:45 PM, Martin Thomson wrote: >=20 > On Sat, Mar 16, 2019, at 03:22, Paul Hoffman wrote: >> Can you say why they are bad? They are not common, but they are=20 >> certainly available and have proven useful in some environments for a=20 >> long time. >=20 > Didn't we already discuss this? =20 Yes, but I was asking the person who brought it up for clarity. > Sure they can be issued and relied upon, which makes them useful in some = environments. They also tend to be useless in more situations than not. Do you feel that they are useful or useless for the protocol in draft-ietf= -doh-resolver-associated-doh that lets a resolver advertise its related ser= vers? --Paul Hoffman= From nobody Sun Mar 17 15:03:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 525051311FB for ; Sun, 17 Mar 2019 15:03:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=JPqSr4JB; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=Ra2b9H1s Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ikJs2hYKgykC for ; Sun, 17 Mar 2019 15:03:30 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 395F91279A3 for ; Sun, 17 Mar 2019 15:03:30 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 59BE120B63 for ; Sun, 17 Mar 2019 18:03:29 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sun, 17 Mar 2019 18:03:29 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=OEUk/BJ9UdMw1EDTiUs5Idliee24xFg DbAZOMAxlcw8=; b=JPqSr4JB+Ioa/fe1vV6FMqtgCHUoUyXo5XsrCuv86wZEm7C Y7dSFigwFpvrvaFP6DGok9xYiUCFnVOuudTGRuaEpOaj/ayF7FPLs9itQ6fOpe0a YHLC2yCNEBCXOGvXHi8KHE38ZO7cyHN59l6gJmP1nyiwFC/G4mL9dYz770Sl/1Bk qFxz5BrnyrZzFRvTisgGXQw3ShX+Acj/OUN9aMmEjvaOv3otozCcWWhgtw6szxJ1 +ykjEYxBBGe4m77grY5erxfWIVq2BaZYRUAMXNaucY6W3tWhKNyGQyWNz3cDmc8l 9JiLT719nvLC7KEkplViSt92Owq+FbhgB548mfQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=OEUk/B J9UdMw1EDTiUs5Idliee24xFgDbAZOMAxlcw8=; b=Ra2b9H1sTxlh/XWO06sWPc 8amH+K4g2UVBanQuSYcJq4DiQqwkU3IBLDnF8yCUCu2aBcTb5Rvf5tIcjFOZ7EWb ggtRquezSS4f20cdPSDq/hslLrYiNVA89rU/JWyMAechSrCEIgEZWnqnQQynpOxp Qq4XDJlXgswhUND3heRJSy4sT+o3PU8jVW9HOsPx5+ZtrYnGJzj31X9FZRwg54tc nOmmARVvIa/nKGgcqdmgY2ZBPBM+lUuonoN6R5GjxOr296u30eETLIrjYxTZmtKA OoZ+sG/4JZCeB7bvRa2W2bYCUewHZ8cL04x6g3JF54j6WNgCwkFyzMv/SCRMGzhQ == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrheelgdduheelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsehttd ertderredtnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucffohhmrghinhephhhtthhpshgvrhhvvghrthhoth grlhhkthhordhithdpihgvthhfrdhorhhgnecurfgrrhgrmhepmhgrihhlfhhrohhmpehm theslhhofigvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id CE6357C5FB; Sun, 17 Mar 2019 18:03:28 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: In-Reply-To: References: Date: Sun, 17 Mar 2019 18:03:20 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: [Doh] Talking to my resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 22:03:34 -0000 I've been uncomfortable about this draft for a while. To be clear, I want some of what it sets out to accomplish, but the design gives me concerns that go beyond the short list of mildly offensive design characteristics. It recently occurred to me that these are not so bad if they are necessary, but they might be a consequence of a deeper problem. It's a problem that I think is entirely inappropriate for this working group to be tackling, but that didn't stop us from adopting the draft, so here goes... The problem this attempts to address - at least in part - is talking to a resolver about the resolver itself. In order to do that, it takes a rather circuitous route, depending on how many barriers there are. Now I'm not deep enough into DNS to answer this question, but I wonder why we would ever design a system for talking to a resolver like the one proposed. It barely uses the DNS protocol, meaning that it asks an HTTP server about a DNS server, even to the point of asking the DNS server to tell it which HTTP server to talk to. It also fails to authenticate any of the information that is provided. Arguably, none of this information can be authenticated given its origin, but the number of unauthenticated steps is typically limited, but here we have an additional exposure to attack. It seems like the approach that has been taken with DoT is to try and see. But we're all sufficiently scared of HTTP servers that we don't feel like that is a responsible thing to do with DoH. And - more reasonably - we realize that having a way to find alternative endpoints for a resolver is worth having. But why not provide a mechanism that can do for DoT what this does for DoH? The draft provides two entirely bespoke names in the top-level .arpa space for DoH, but otherwise has no generalized characteristics whatsoever. Maybe there is a better approach. I don't know if there is any hope of adding a general facility to DNS where a client could talk to the server about itself, rather than the data that it can provide. Most of what I can see in the protocol is concentrated on achieving some moving data in some way (RFC 6975 is almost there in talking about client capabilities). Not knowing enough about the protocol, I can't say whether OpCodes, EDNS, or a reserved subtree is the right channel here, but it seems like ad hoc additions to the .arpa tree isn't as much a measured approach as simply a convenient one. In HTTP we have started to use .well-known for providing resources that can talk about an origin as a whole. That's a facility that this draft fixates on. It's a convenient safety valve for those cases where the sophistication of the protocol starts to exceed the secondary channels provided in the protocol (EDNS in DNS, header fields in HTTP). HTTP also has a convenient mechanism for doing exactly what this draft is attempting to do (almost, more later): find an alternative service endpoint for the current service, ideally one with better properties in some way. RFC 7838 describes alternative services, which are implemented as a header field (here, an EDNS0 option seems like it might work). In that design, a response from the resolver contains a list of alternative service endpoints, expressed as a tuple of name (and port) and endpoint type (using ALPN). With some DNS-specific tweaks, I don't see why that would be a terrible approach here. That design wouldn't work for all the stated use cases for resolver-associated DoH, but it would cover some of the more critical ones. The main one that springs to mind being the web application case: as a web site, I want to make a DNS query from the perspective of my clients, so that (I can scan their network)^U I can find service endpoints more appropriate to their network location than mine. I'd like to have a little more discussion of why we think that web sites might want to do their own DNS querying, but I don't believe that the current design helps web sites achieve this goal. FWIW, I'm now unclear on why the draft calls "browsers" out specially. Browsers aren't really special in this context. You might reasonably care about three levels of things: devices (or operating systems), applications, and web sites. The distinction between each being decreasing levels of access to information about their operating environment. Applications might not know about their DHCP configuration and web sites generally can't directly access a DNS resolver directly. --Martin p.s., Happy to talk about how IP address certificates will make this difficult to deploy, but let's try to hit the high points first. p.p.s., I really wish that DoT had decided to add some meta-information channel. That solves a bunch of these issues. I guess we can ALPN-up ourselves a v2 if we needed one. On Sat, Mar 16, 2019, at 00:13, Ben Schwartz wrote: > I'd like to thank the working group participants for the extensive > discussion of our most recent drafts. However, I would appreciate more > review of the Resolver-Associated DOH draft, which has the largest time > segment allocated for the upcoming meeting. This draft contains several > components that have been controversial in the past: > > 1. IP-address certificates > 2. A new .well-known endpoint > 3. JSON > 4. Recursive resolvers synthesizing responses as if they were > authoritative for certain names > 5. Machine-readable content in a TXT record > > Also, the draft does not enable the use of DoH if (1) an application > relies on POSIX-like DNS APIs to bootstrap AND (2) the resolver is only > reachable on a non-public IP address (e.g. RFC 1918). This is a side > effect of the requirement that the DoH server provide a valid > certificate for its name, chained to a root that is already trusted by > the client. This draft does not alter that requirement. > > If any of these technical elements are of concern to you, please > comment now, so that the meeting can be as productive as possible. > > --Ben > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > > Attachments: > * smime.p7s From nobody Sun Mar 17 15:57:17 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFB841311F8 for ; Sun, 17 Mar 2019 15:57:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=dF4K76ri; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=dClan/S8 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ggpwQx258cD1 for ; Sun, 17 Mar 2019 15:57:14 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DDC6130E89 for ; Sun, 17 Mar 2019 15:57:14 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 55E4920241; Sun, 17 Mar 2019 18:57:13 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sun, 17 Mar 2019 18:57:13 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :cc:subject:content-type; s=fm1; bh=CKD4uRbMu2rbfukeTyaJ5WyvBgeX WLPc7NQBexwAsIo=; b=dF4K76ri1G4J7CohfLurRQWyNIwuJo2IOa6+sPWSUV90 fjMG2e6GFjeyuA3YOaK6UoL6mMJGWq6SSALb7k6Oo7YVLM/J2EalV2VBcZ4WcLg+ WNWFKg8szpNJ/YmdA4/9cV+qEHYtRJPXlHoBmdUkh7sB0XX0li9xBlfgDsWhScBQ tgnoW+Atfq0My62tg0qcNG4D9NRq8ohN2M0l1gAVz5VGHYjBCdNPcnAQypVWKJZ1 4hSuSLdCqBIu3S0kdmRtHjotj3FZDq6rHJwT3ySn4z2emn0x+Q9kL/CSTYUZ6SoT V0Ag9kSpunvoz1qzU2BP3ccd0QEZRuKp6ToDWoOGZw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=CKD4uR bMu2rbfukeTyaJ5WyvBgeXWLPc7NQBexwAsIo=; b=dClan/S8ySSAg5u3TcVqIc JN2GBLw7dxrZh/rNnUntCNqoRC1ldxjMTkGghW7Al2lR8aFhJjyjuGKKDRfs2E+8 1NFkTP+Dx2PHnukDGDu1beY1nztE6gpYOOkeEhPsLkthi7K8pKAxRArj/nny+/08 LND61IWKdcJmc18pVvdf0YMfpTZbXR3M/n5JJ+/8ZefEuwz8a6dQlErTAa0/q2ZY ITd4XofXsMnA3UMTckFzOV1YqC9G6GS3DN3zV+LKHEdlTNMEdoE1xzxgrONXYgVV PLoPuCMtbXLWxbyfC/WEAYhgm8e54GfTpbwePUy+FXf51Zqpk3tr53/tzltgoCMg == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddriedtgddthecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenuc fjughrpefofgggkfgjfhffhffvufgtsehttdertderredtnecuhfhrohhmpedfofgrrhht ihhnucfvhhhomhhsohhnfdcuoehmtheslhhofigvnhhtrhhophihrdhnvghtqeenucfrrg hrrghmpehmrghilhhfrhhomhepmhhtsehlohifvghnthhrohhphidrnhgvthenucevlhhu shhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 7826A7C651; Sun, 17 Mar 2019 18:57:12 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <9d99cf89-a62c-467f-9ff1-887ac27a5221@www.fastmail.com> In-Reply-To: References: <2cbff385-7e78-452d-b82d-08acf56ab4df@www.fastmail.com> Date: Sun, 17 Mar 2019 18:57:15 -0400 From: "Martin Thomson" To: "Paul Hoffman" Cc: "doh@ietf.org" Content-Type: text/plain Archived-At: Subject: Re: [Doh] [Ext] IP address certificates X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 22:57:16 -0000 On Mon, Mar 18, 2019, at 07:51, Paul Hoffman wrote: > Do you feel that they are useful or useless for the protocol in > draft-ietf-doh-resolver-associated-doh that lets a resolver advertise > its related servers? It will depend on deployment context whether they can be used. You have to have an IP address that meets the conditions set out in draft-ietf-acme-ip, which means minimally no RFC 1918 or LLA/ULA. I don't think that I'm comfortable recommending a design that doesn't allow for names, unless we can get pretty wide agreement from networks saying that this is feasible in their deployment, even if (and perhaps especially if) they are not currently consdering DoH deployment. Even if we had names, it's not clear that getting certificates for those names is easy. BTW, neither IP address certificates nor names work for the device that ostensibly offers DNS resolution on the network I am in right now. That means that the third-party service is the only option that is likely to work in most private premises and small offices. That might reduce the pressure on this mechanism. From nobody Sun Mar 17 16:25:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4338E129BBF for ; Sun, 17 Mar 2019 16:25:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.922 X-Spam-Level: X-Spam-Status: No, score=-0.922 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=itaoyama.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JEJZ13zcClqT for ; Sun, 17 Mar 2019 16:25:43 -0700 (PDT) Received: from JPN01-OS2-obe.outbound.protection.outlook.com (mail-eopbgr1410119.outbound.protection.outlook.com [40.107.141.119]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E73D01240D3 for ; Sun, 17 Mar 2019 16:25:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=itaoyama.onmicrosoft.com; s=selector1-it-aoyama-ac-jp; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=H71UZlJOG2ub9VJSjd4LsgCFtmEAzBgwut0xQlmeFJc=; b=RkkmwsZ+lO4KgSwswgzn4e9eJnjF3jKIWSsMsaZJ51asmg+232LS8z9dMUe7b+ei9IEKGN0hfppinzTRN161mdnEiNNHCiwNiHSmwZhpFZ2hAM4In/A1V+ziBunGrv2BrQKQJk/tWlzcEE5A/XWHN6DlZ2Kva2TBzznHrAmJRxI= Received: from TYAPR01MB5149.jpnprd01.prod.outlook.com (20.179.187.18) by TYAPR01MB2479.jpnprd01.prod.outlook.com (20.177.105.140) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.14; Sun, 17 Mar 2019 23:25:37 +0000 Received: from TYAPR01MB5149.jpnprd01.prod.outlook.com ([fe80::98b6:d90e:9ae7:302]) by TYAPR01MB5149.jpnprd01.prod.outlook.com ([fe80::98b6:d90e:9ae7:302%3]) with mapi id 15.20.1709.015; Sun, 17 Mar 2019 23:25:37 +0000 From: =?utf-8?B?TWFydGluIEouIETDvHJzdA==?= To: Paul Hoffman , DoH WG Thread-Topic: [Doh] [Ext] Reviewing Resolver-Associated DOH Thread-Index: AQHU3Ri65s1iy12g3kKbR1p/RaqBHg== Date: Sun, 17 Mar 2019 23:25:37 +0000 Message-ID: References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> In-Reply-To: <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-clientproxiedby: TYAPR01CA0227.jpnprd01.prod.outlook.com (2603:1096:404:11e::23) To TYAPR01MB5149.jpnprd01.prod.outlook.com (2603:1096:404:12e::18) authentication-results: spf=none (sender IP is ) smtp.mailfrom=duerst@it.aoyama.ac.jp; x-ms-exchange-messagesentrepresentingtype: 1 x-originating-ip: [223.218.133.122] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 419b9d0f-fb3a-4a49-cfdf-08d6ab2fdca1 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7025125)(7027125)(7023125)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:TYAPR01MB2479; x-ms-traffictypediagnostic: TYAPR01MB2479: x-microsoft-antispam-prvs: x-forefront-prvs: 09796A1B83 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(136003)(39830400003)(366004)(396003)(376002)(346002)(199004)(189003)(8936002)(256004)(31686004)(85202003)(106356001)(31696002)(97736004)(68736007)(305945005)(85182001)(786003)(316002)(25786009)(7736002)(486006)(2616005)(26005)(476003)(5660300002)(508600001)(105586002)(86362001)(99286004)(71190400001)(2906002)(71200400001)(8676002)(52116002)(66066001)(81166006)(81156014)(53936002)(6436002)(6246003)(110136005)(6486002)(6506007)(53546011)(74482002)(229853002)(11346002)(446003)(6512007)(76176011)(386003)(14454004)(186003)(6116002)(102836004)(3846002); DIR:OUT; SFP:1102; SCL:1; SRVR:TYAPR01MB2479; H:TYAPR01MB5149.jpnprd01.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: it.aoyama.ac.jp does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 7eSNfoOk6olQydn7DtarwUFK0OkRFAkV9M9TzOtZFXCchsnf+v6Vq3QI1p4q++tFmM9Ft7WA+u5QRP8laA1ntaw1bltXryoXjyGS4Fk6hrMnvglLWaeUQlBrSKKP1wQHDgoba/6BgajHMdqEV5xaRk0Bh5cYeGlKRoCHfzTMvZovJ4MzA/od6c745A8+YdlW530Rjkvp8YVOzMkvjDAbDSoxxFXG/1aXXnTuWoBWrl+zOjZXs6zi8LlKVPbqzWL5/lEO30KfCjQ4oBPdqcvH/8nPWS46RFukzS4+FxkVBw2sXkC9q5AZR/reh0nJ6xTLzHpbkRss7CVsYZ/gx8EJAd6OczDSHp3g1rTa8V0YhplamnUn0PsCDo706+yn+Mzddj0OzxI81E7qAIU/pZYKj0tjFVCmmMmyGcwo9/twpiE= Content-Type: text/plain; charset="utf-8" Content-ID: <8CDAF1FC70BC9043A4BE91E575C3F760@jpnprd01.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: it.aoyama.ac.jp X-MS-Exchange-CrossTenant-Network-Message-Id: 419b9d0f-fb3a-4a49-cfdf-08d6ab2fdca1 X-MS-Exchange-CrossTenant-originalarrivaltime: 17 Mar 2019 23:25:37.6070 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: e02030e7-4d45-463e-a968-0290e738c18e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: TYAPR01MB2479 Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 23:25:46 -0000 T24gMjAxOS8wMy8xNyAwMTowNCwgUGF1bCBIb2ZmbWFuIHdyb3RlOg0KPiANCj4gT24gTWFyIDE2 LCAyMDE5LCBhdCA4OjUxIEFNLCBudXNlbnUgPG51c2VudS1saXN0c0ByaXNldXAubmV0PiB3cm90 ZToNCg0KPiBPbiBNYXIgMTYsIDIwMTksIGF0IDg6NTEgQU0sIG51c2VudSA8bnVzZW51LWxpc3Rz QHJpc2V1cC5uZXQ+IHdyb3RlOg0KPj4gSGV3aXR0LCBSb3J5IHdyb3RlOg0KPj4+IEFzIHdpdGgg YWxsIC8ud2VsbC1rbm93bi8gZW5kcG9pbnRzLCB0aGUgaXNzdWUgaXMgYm90aA0KPj4+IHN0YW5k YXJkaXphdGlvbiBhbmQgcHVibGljaXphdGlvbi4gQUlVSSwgQG1ub3QncyBvcmlnaW5hbCBpZGVh bCB3b3VsZA0KPj4+IGJlIHRvIGhhdmUgLy53ZWxsLWtub3duLyBiZSBwcmV0dHkgJ2dlbmVyaWMn LiBUaGVyZWZvcmUgSSdtIG5vdCBhIGZhbg0KPj4+IG9mICIvZG9oLXNlcnZlcnMtYXNzb2NpYXRl ZC8iIC0gSSdkIG11Y2ggcmF0aGVyIHNlZSAiL2Rucy9kb2gvIiwNCj4+PiB3aGljaCB3b3VsZCBl bmFibGUgb3RoZXIgKGZ1dHVyZSkgRE5TLXJlbGF0ZWQgZnVuY3Rpb25hbGl0eSB0byBoYXZlIGEN Cj4+PiBzdWItZm9sZGVyIHdpdGhpbiAiLy53ZWxsLWtub3duL2Rucy8iLiBJZiB0aGF0J3Mgbm90 IGEgcG9zc2liaWxpdHksDQo+Pj4gd2hhdCBhYm91dCAiLy53ZWxsLWtub3duL2Rucy1kb2gvIj8N Cj4+DQo+PiArMQ0KPj4NCj4+IEkgZmluZCB0aGVzZSBzdWdnZXN0ZWQgLndlbGwta25vd24gVVJM cyBjbGVhcmVyIHRoYW4gImRvaC1zZXJ2ZXJzLWFzc29jaWF0ZWQiLg0KPiANCj4gSSdtIGdlbmVy YWxseSBhZ2FpbnN0IHRoaXMgaWRlYSBmb3IgdHdvIHJlYXNvbnM6DQo+IA0KPiAtIE5vIG9uZSB3 aWxsIHNlZSB0aGlzIFVSTCBvdGhlciB0aGFuIHNvZnR3YXJlIGRldmVsb3BlcnMgYW5kIG9wZXJh dG9ycyB3YXRjaGluZyB0aGVpciBsb2dzLiBUaGV5IHdpbGwgbm90IGJlIHZpc2libGUgdG8gdXNl cnMuDQo+IA0KPiAtIExheWVyZWQgc3BhY2VzIHVuZGVyIGEgLndlbGwta25vd24vIGFyZSBwb3Nz aWJsZSBidXQgSSBkb24ndCB0aGluayB0aGV5IGFyZSB3ZWxsLXVuZGVyc3Rvb2QuDQoNCkkgdmVy eSBtdWNoIGFncmVlLiBJdCBjb3VsZCBtYWtlIHRoaW5ncyBtb3JlIGNvbXBsaWNhdGVkIGZvciBJ QU5BLCBhbmQgDQppdCBjb3VsZCBtYWtlIHRoaW5ncyBtb3JlIGNvbXBsaWNhdGVkIGZvciBzZXJ2 ZXIgYWRtaW5pc3RyYXRvcnMuIEV2ZW4gaWYgDQp0aGUgYWRkaXRpb25hbCBsZXZlbCBvZiBjb21w bGV4aXR5IGlzIG1pbmltYWwgaW4gbWFueSBjYXNlcywgaXQgbWF5IG5vdCANCmJlIGluIG90aGVy cy4NCg0KSSdtIG5vdCBhZ2FpbnN0IGluY2x1ZGluZyB0aGUgdGhyZWUtbGV0dGVyIGFjcm9ueW0g J2RucycgaW4gdGhlIHN0cmluZyANCnNvbWVob3c7IHRoYXQgbWF5IGhlbHAgYWRtaW5pc3RyYXRv cnMgd2hvIGxvb2sgYXQgLndlbGwta25vd24gYSB3aGlsZSANCmFmdGVyIHNvbWVib2R5IGdvdCB0 aGF0IGZvbGRlciBzZXQgdXAuDQoNClJlZ2FyZHMsICAgTWFydGluLg0K From nobody Sun Mar 17 16:52:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B454130EBC for ; Sun, 17 Mar 2019 16:52:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TB319s105s_F for ; Sun, 17 Mar 2019 16:52:32 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DDA69130EBA for ; Sun, 17 Mar 2019 16:52:31 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id E75D21A5618 for ; Sun, 17 Mar 2019 16:52:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552866751; bh=STkvk9BQ434D81XFGapegthITSqDnZFj9CMNDCDrZA0=; h=To:References:From:Subject:Date:In-Reply-To:From; b=ncshJY7fK8+CkOWcMUiTOBW1xcIp6k0CcKo6cmh19bmeC/UqWZ3UVMEbB/puKQECI M/IuYwfcosi977VAMpOSFvK2xMK2J7X5Ot0K6W9koQach8DwxLGJB5TNwEc1PqLp40 hsiSzC6QMpmr3lDMRn9OTmUqV3FuDRxlc2mfImHc= X-Riseup-User-ID: 57FFB50DF0C79997FB5177B1D318A96F6C47AFE61B1E844E0CEF7F0FA16181DB Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 2C5F8120C54 for ; Sun, 17 Mar 2019 16:52:29 -0700 (PDT) To: doh@ietf.org References: From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> Date: Sun, 17 Mar 2019 23:52:00 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="dvUV1NA6I0DyUyJU0Le6t54b8f1fEAHtO" Archived-At: Subject: Re: [Doh] Talking to my resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 17 Mar 2019 23:52:34 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --dvUV1NA6I0DyUyJU0Le6t54b8f1fEAHtO Content-Type: multipart/mixed; boundary="w2NXlvNFdJWJqJA8U2Gd3l1m6jgwHQHeO"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> Subject: Re: [Doh] Talking to my resolver References: In-Reply-To: --w2NXlvNFdJWJqJA8U2Gd3l1m6jgwHQHeO Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Martin Thomson wrote: > It also fails to authenticate any of the information that is > provided. =20 The mechanism in chapter 2 (DoH Servers from HTTPS) is authenticated, rig= ht? (but still vulnerable to downgrade attacks). If we ignore the fact that the resolver IP has probably been configured over an unsafe protocol in t= he first place (DHCP). > Arguably, none of this information can be authenticated > given its origin, but the number of unauthenticated steps is > typically limited, but here we have an additional exposure to > attack. >=20 > It seems like the approach that has been taken with DoT is to try and > see. =20 Those that do (Android 9 for example) don't really authenticate=20 the endpoint and use it opportunistically, right? > But we're all sufficiently scared of HTTP servers that we don't > feel like that is a responsible thing to do with DoH. And - more > reasonably - we realize that having a way to find alternative > endpoints for a resolver is worth having. But why not provide a > mechanism that can do for DoT what this does for DoH?=20 I'd like to see that happen as well but I assume that will not be on the = DoH WG since it is outside it's charter? The idea I had in mind would be to have "DoT Servers from HTTPS" like section 2 in this draft but without the unauthenticated options in section 3 and 4. =20 > HTTP also has a convenient mechanism for doing exactly what this > draft is attempting to do (almost, more later): find an alternative > service endpoint for the current service, ideally one with better > properties in some way. RFC 7838 describes alternative services, > which are implemented as a header field (here, an EDNS0 option seems > like it might work). In that design, a response from the resolver > contains a list of alternative service endpoints, expressed as a > tuple of name (and port) and endpoint type (using ALPN). With some > DNS-specific tweaks, I don't see why that would be a terrible > approach here. How would the DoH URI be authenticated in that case? > I'd like to have a little more discussion of why we think that > web sites might want to do their own DNS querying +1 > FWIW, I'm now unclear on why the draft calls "browsers" out > specially. Browsers aren't really special in this context. You > might reasonably care about three levels of things: devices (or > operating systems), applications, and web sites. The distinction > between each being decreasing levels of access to information about > their operating environment. Applications might not know about their > DHCP configuration and web sites generally can't directly access a > DNS resolver directly. I brought this up as well and Paul mentioned he will address this in the next version of the draft: https://mailarchive.ietf.org/arch/msg/doh/bOL0JX0QA-y9qA2G88ngSDSzQAI > p.s., Happy to talk about how IP address certificates will make this > difficult to deploy, but let's try to hit the high points first. It will require the resolver to be on a public IP but letsencrypt might issue certificates for IP addresses in the future: "Let=E2=80=99s Encrypt may offer IP address certificates in the future, b= ut as of September 2018 we do not. " https://community.letsencrypt.org/t/certificate-for-public-ip-without-dom= ain-name/6082 https://datatracker.ietf.org/doc/draft-ietf-acme-ip/ --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --w2NXlvNFdJWJqJA8U2Gd3l1m6jgwHQHeO-- --dvUV1NA6I0DyUyJU0Le6t54b8f1fEAHtO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyO3bUACgkQrWE4wkXN Qn4QTw/9GGV3G+s7tSus9PxIh8M+vT8psodN8MxUM/PilyNtitRGxI0+nT8z5gEi GRkvgu1ovj058+RzNzhw+TsyNBDH5s8JD2KNHqjzKRudq+bhGuvwv2V8seQ/Nm6X ie3rfUbv5Q8AJTh58agKH5rYAFOXg8OLkdC5zayGrvkhEgfa2C9uQlB3EB2oluHm 6MPZ9gPvOCW+YF0VRZPjxXO6zNp5hl0pzBEE2ZuTS+8647tGcUWZ3+NjBjleCR6Q fYJ1cw4fFCqXV8uYD43Z4HQhGqYnolngfjj0HuttaTib96wjoG65il92vjDARFWC 6qNHbRsFOfR7y91xnV4MSjG3Njh/m3GNvHbmAwd75WeW3Ml8k6FjQrH+a0s9Ae+1 rCc4MTpSkNyG+otTDhAVIJHCA9JEVJnMWfVDM9wiuhHLGAAES20AH9gC2Zi6MbBa 5Xs3O9OxMPB6slJZhq79JyUXTPoOk0hf+xUcGq+lEz67O6iHyS5p5pJIunsAZAZj h5xB+tDAw8VVGwM2wIixC9lJatDl2bLpoqq70C+zHuu2DPdfsW0dpdwgYfwdoCBD I3KkjOY+s6n/ggzA9xEnz0Y79LIMbAUGXzhbbTSv0P0Qsoww+kH9txD1J8VnKb3b IUW94l2RJuHaxQzyWg3yaTdsvSKQux1NyYHFXgYyxvkJ4GnyboA= =YHOS -----END PGP SIGNATURE----- --dvUV1NA6I0DyUyJU0Le6t54b8f1fEAHtO-- From nobody Sun Mar 17 19:11:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E896131217 for ; Sun, 17 Mar 2019 19:11:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=OnDl9fmp; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=ELs6TLc/ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TlKJFBGo0Y-f for ; Sun, 17 Mar 2019 19:11:18 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33ACE127967 for ; Sun, 17 Mar 2019 19:11:18 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 53B792174F for ; Sun, 17 Mar 2019 22:11:17 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sun, 17 Mar 2019 22:11:17 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=FoJ7LiPlBZMY0gIXJ741NA9HxjDFPJU h9sv6N8MsKVg=; b=OnDl9fmp4/YkaQy1L3h3J7r6TMHBtdzGASkMEfGjpWch4H5 sqrTiPmmj1FNkitIyR1i1bJUF5thER3afP5s7PT6NUWPswrgZSArFfcy+AlQx0ZX P5UwcEMyrWzL6vRYzAph5G0SZc2pdKkyyQ8c7r1MR4rBbhICVZmaq5JDHxqMW366 9AH4CnF71jtq7eAWo/x1qmoeOGMPH0FDVUTsD/PzUfPvCKGdUBZuKakJI5PYwdC2 RdcLUEgQlSzcE/eF9V2PcFA85T+o0iXpl/l8oj+dcz5cgPOI5u0uqyxdYbmwkFXL UQnXUZmvlHojXXEWJBKHoAKAQlnYpx0n1jF/bmA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=FoJ7Li PlBZMY0gIXJ741NA9HxjDFPJUh9sv6N8MsKVg=; b=ELs6TLc/p3EZ88a38tgpmq LoxKuDvyDu+PFo5PcpjmrCyOeEapwULJdA/0pQYYGDnTJOzHmGlBmPwP3YUrecaB WOclV2tyUPEOOmaDaoe5yQdwi960pg8UQ8TPe7jsM+LGj8inBWm9mUeeTfZBU/hK NDSQ1CHm9tfwBIZ2WIq3MvfcmMjOUlQBwOXxpbljLWMwmQgyxYuIPKucCH4XcdmV j6sK2I9FbLIH1yNYcVfJbDT039cF7SZjEYAbDEVJNa82AdQn1W5RSkyDrmrsrbyH Lamn9aHFIdm3pLiHnw4ONyajUhsuhunnGPTa/LP7YFiiONsMwvxsFqcL9z6Yvucw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddriedtgdegfecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 0D39F7C651; Sun, 17 Mar 2019 22:11:17 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: In-Reply-To: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> Date: Sun, 17 Mar 2019 22:10:41 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] Talking to my resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 02:11:20 -0000 On Mon, Mar 18, 2019, at 10:52, nusenu wrote: > The mechanism in chapter 2 (DoH Servers from HTTPS) is authenticated, > right? > (but still vulnerable to downgrade attacks). If we ignore the fact that > the resolver IP has probably been configured over an unsafe protocol in > the first place (DHCP). Yeah, if we assume that the configuration is OK (a big assumption, but there are reasons we might tolerate DHCP authentication being what it is), then you are right. The most troublesome bits are the .arpa lookups, which aren't authenticated, and can't be authenticated. That might be considered a feature: if my home router passes the request on upstream to a resolver that supports this protocol, then that resolver gets a second chance to provide the information. Of course, that assumes that you find unauthenticated anything a feature. I tend to see it as a bug. > Those that do [DoT] (Android 9 for example) don't really authenticate > the endpoint and use it opportunistically, right? That is my understanding. > > But why not provide a > > mechanism that can do for DoT what this does for DoH? > > I'd like to see that happen as well but I assume that will not be on the DoH WG > since it is outside it's charter? I'd hate for our charter to cause us to disregard better solutions. > The idea I had in mind would be to have "DoT Servers from HTTPS" > like section 2 in this draft but without the unauthenticated options > in section 3 and 4. > > > HTTP also has a convenient mechanism for doing exactly what this > > draft is attempting to do (almost, more later): find an alternative > > service endpoint for the current service, [...] > > How would the DoH URI be authenticated in that case? This is a good question. If you have any cause to believe that the server is providing valid responses, then you could take whatever it gives you. That's arguably worse than what is in the draft now. The way Firefox authenticated its configured DoH resolver was by providing both an IP address and a name against which the server is authenticated. But most situations won't have a name configured. One could be added to DHCP, and PvD too I guess, but that doesn't help the web application all that much and it might only help an operating system (or applications on platforms with an interface to DHCP options). From nobody Mon Mar 18 08:28:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F7D4127968 for ; Mon, 18 Mar 2019 08:28:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DunZ6Q1INQfa for ; Mon, 18 Mar 2019 08:28:21 -0700 (PDT) Received: from mail-vs1-xe36.google.com (mail-vs1-xe36.google.com [IPv6:2607:f8b0:4864:20::e36]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6603E1310FD for ; Mon, 18 Mar 2019 08:28:17 -0700 (PDT) Received: by mail-vs1-xe36.google.com with SMTP id z25so8401620vsk.8 for ; Mon, 18 Mar 2019 08:28:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4Fe7dvM2gNtvgyaP+hDHIffD2ZpcysNQMV6XxnBU/ag=; b=JY29i2FLR2piCzXNCFOozlbedX5SEQkc5T+31y2/thnwCdSNekQsN6tlxHF1Z5hgnb gM25NyelRiHaW/lkWzjri/HIPs/MqrRjOqYzo5H/sg6YBJcdd25VcBzfM/kf8w7tZmUq CHyKf2Hr6D1qZRmCc3XNfP9I1BEiHfGVqXZu3x9fOkcTj2fYJDiyAwj9Z9OYK4fgcQJg iQGroIvcNa6tX4/1qHTZakVr7L9OrSFyqt40VZGFiHhwRJ/WMM5nXuquKCpSw/3XaNgB NDlQwFji/IJ9WUhagygapT7oYkyf6iSkz0gfPMVdb0BUvyXlcjRQF0K1Mttyv4DwCZyX ea3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4Fe7dvM2gNtvgyaP+hDHIffD2ZpcysNQMV6XxnBU/ag=; b=Pov7TdWv9Gm6QVKQtZFy1KeWZpsbzmaSfE6/+IwYdg62hBPUqxTHz2pxYrMJ2RDE15 X1DG3a2+rcs+mIsDaLXX3Ouk45IRth3r4tMZtCA3CckHtPV33ThOFwQl0En8ngl468Ya bYgqZ/Zu/IyOPXIU4Uo5pBMYsl8mgOe88JlavsfjCqiF9Npn985QB/sq/IFWUxefgWT8 oyaA2sh0QlrWkaF3bxgn1KKpAB2pnS3L+xOIhf4jovZoIbpOzmwb7qaQT8rAaize2/Zm bju7U/kQCBHDTYedTpFkEVj1t5WqmMvDvUKLRLQWmsjX8S7AUqxXuU+sbyIMAKbc7O1H Nb/Q== X-Gm-Message-State: APjAAAWXwFF339j49CDGuZzeRC80OHcmQ0IzDV0mzDSxWy+ytQjgwA6T 5ikomnAVmp5BCSthlTSGpfxUXaSSx67EKpU/hfiQ7zMU0omhAA== X-Google-Smtp-Source: APXvYqzT8ajj/Dczq4bNWYmHjgRn9Uhk3cWRqNTJhdv9VP5vLBg7d8pn9ddxojMDhIKoGgDlLq4VeK1MC9vTsrBSZEs= X-Received: by 2002:a67:581:: with SMTP id 123mr4983060vsf.207.1552922895744; Mon, 18 Mar 2019 08:28:15 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ben Schwartz Date: Mon, 18 Mar 2019 11:28:04 -0400 Message-ID: To: Martin Thomson Cc: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000009f3a0a0584600963" Archived-At: Subject: Re: [Doh] Talking to my resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 15:28:24 -0000 --0000000000009f3a0a0584600963 Content-Type: multipart/alternative; boundary="00000000000090ea1e0584600996" --00000000000090ea1e0584600996 Content-Type: text/plain; charset="UTF-8" On Sun, Mar 17, 2019 at 6:03 PM Martin Thomson wrote: > I don't know if there is any hope of adding a general facility to DNS > where a client could talk to the server about itself, rather than the data > that it can provide. As a chair, I agree with nusenu that this topic might be out of charter, but if we decide that it is the best course of action then we can make organizational changes as necessary. We may also be able to find a balance, by implementing a DoH-specific practice that seems likely to generalize well. > p.p.s., I really wish that DoT had decided to add some meta-information > channel. That solves a bunch of these issues. I guess we can ALPN-up > ourselves a v2 if we needed one. > Not as chair, here's a free, slightly unsettling idea: use the "h2" ALPN on port 853 to negotiate a DoT-to-DoH upgrade during the TLS handshake. > On Sat, Mar 16, 2019, at 00:13, Ben Schwartz wrote: > > I'd like to thank the working group participants for the extensive > > discussion of our most recent drafts. However, I would appreciate more > > review of the Resolver-Associated DOH draft, which has the largest time > > segment allocated for the upcoming meeting. This draft contains several > > components that have been controversial in the past: > > > > 1. IP-address certificates > > 2. A new .well-known endpoint > > 3. JSON > > 4. Recursive resolvers synthesizing responses as if they were > > authoritative for certain names > > 5. Machine-readable content in a TXT record > > > > Also, the draft does not enable the use of DoH if (1) an application > > relies on POSIX-like DNS APIs to bootstrap AND (2) the resolver is only > > reachable on a non-public IP address (e.g. RFC 1918). This is a side > > effect of the requirement that the DoH server provide a valid > > certificate for its name, chained to a root that is already trusted by > > the client. This draft does not alter that requirement. > > > > If any of these technical elements are of concern to you, please > > comment now, so that the meeting can be as productive as possible. > > > > --Ben > > _______________________________________________ > > Doh mailing list > > Doh@ietf.org > > https://www.ietf.org/mailman/listinfo/doh > > > > Attachments: > > * smime.p7s > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000090ea1e0584600996 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Mar 17, 2019 at 6:03 PM Marti= n Thomson <mt@lowentropy.net>= ; wrote:
I don't know if there is any hope of adding a general facility to DNS w= here a client could talk to the server about itself, rather than the data t= hat it can provide.

As a chair, I= agree with nusenu that this topic might be out of charter, but if we decid= e that it is the best course of action then we can make organizational chan= ges as necessary.=C2=A0 We may also be able to find a balance, by implement= ing a DoH-specific practice that seems likely to generalize well.
=C2=A0
p.p.s., I really wish that DoT had decided to add some meta-information cha= nnel.=C2=A0 That solves a bunch of these issues.=C2=A0 I guess we can ALPN-= up ourselves a v2 if we needed one.

Not= as chair, here's a free, slightly unsettling idea: use the "h2&qu= ot; ALPN on port 853 to negotiate a DoT-to-DoH upgrade during the TLS hands= hake.


On Sat, Mar 16, 2019, at 00:13, Ben Schwartz wrote:
> I'd like to thank the working group participants for the extensive=
> discussion of our most recent drafts. However, I would appreciate more=
> review of the Resolver-Associated DOH draft, which has the largest tim= e
> segment allocated for the upcoming meeting. This draft contains severa= l
> components that have been controversial in the past:
>
> 1. IP-address certificates
> 2. A new .well-known endpoint
> 3. JSON
> 4. Recursive resolvers synthesizing responses as if they were
> authoritative for certain names
> 5. Machine-readable content in a TXT record
>
> Also, the draft does not enable the use of DoH if (1) an application <= br> > relies on POSIX-like DNS APIs to bootstrap AND (2) the resolver is onl= y
> reachable on a non-public IP address (e.g. RFC 1918). This is a side <= br> > effect of the requirement that the DoH server provide a valid
> certificate for its name, chained to a root that is already trusted by=
> the client. This draft does not alter that requirement.
>
> If any of these technical elements are of concern to you, please
> comment now, so that the meeting can be as productive as possible.
>
> --Ben
> _______________________________________________
> Doh mailing list
> Doh@ietf.org
> https://www.ietf.org/mailman/listinfo/doh
>
> Attachments:
> * smime.p7s

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000090ea1e0584600996-- --0000000000009f3a0a0584600963 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCD4VSJ4MmxArHDpjtift0P1 DSi81qjQRVB5J+Mof4GV3DAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMTgxNTI4MTZaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAiLCKQR8NUOW/Zn47i5zinK57pY4fpF/FwSE3RdEc fcKf8gGXlv7dBFHOAswV397mBgjeqtlYPjC2kaXP8r9jdc+dIbfAuy3hfn34V5z4Dxatu7h6M0ED HNns0gEo/CT1SJGAxtG6fCis4AYccyibgb8JDtv7y/8FXW5TQgAQwUZByx6JT4JwbOtTNteFW3Rr /TsZYkvZnRO03mlsFFLsKZRgi8GRoqEmXoI8WVzGsyIVBYJ2s6THjg7/8oZqtPvE9Pyp7CEM/BGr 2OJMasZAdd6dyledsTCmECm6n1g8DzYFs0j9lQrGZjgFw9vl9zXwcBKn/W1no4WkCa6GFt3/2Q== --0000000000009f3a0a0584600963-- From nobody Mon Mar 18 09:45:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5F9D5131117 for ; Mon, 18 Mar 2019 09:44:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.852 X-Spam-Level: X-Spam-Status: No, score=-1.852 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, KHOP_DYNAMIC=0.85, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FwJhocUKUEw3 for ; Mon, 18 Mar 2019 09:44:46 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6315E131135 for ; Mon, 18 Mar 2019 09:44:46 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x2IGb7Tm012986; Mon, 18 Mar 2019 16:44:25 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=jan2016.eng; bh=o6JCiRpxCcEtrRdP9N+W460VoGZVbKS/6DqqNKgJUPI=; b=bE2glDdaFuaSnK8r1RIs4hOC2cIkjnClZUwFLAodegQjMF9Y/g1THMOrs/rObXU5bikC EPOEcGwAHAjRLxNVkivW/bm0CUMhibz2dOU89vh/0ZZfAVWu5vmlhPk7eAIbn/6uELjW dXU/3T6BncgxdZHnsVCQijpSLmfO3ZE4d6wAvZoTWK+mEPkj/epLLbWj9WdZ1urSAa1t FwxkmOvtbrt2T1Or5IuPpA/HB7y21xSp4XDYPZzOYklhIxBuMmWWCgNI32gjVuQK/iZD r+Lz9iGeeC/NcdpvBLH1gzvMDIC+yJWLYNJSI2iPZUX2OkK3QWEbdqvNs0rZMUyKk90S Bw== Received: from prod-mail-ppoint1 (prod-mail-ppoint1.akamai.com [184.51.33.18]) by m0050093.ppops.net-00190b01. with ESMTP id 2r8s9tst4u-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Mar 2019 16:44:25 +0000 Received: from pps.filterd (prod-mail-ppoint1.akamai.com [127.0.0.1]) by prod-mail-ppoint1.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x2IGXeCV018998; Mon, 18 Mar 2019 12:44:23 -0400 Received: from email.msg.corp.akamai.com ([172.27.27.25]) by prod-mail-ppoint1.akamai.com with ESMTP id 2r8vfv33sh-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 18 Mar 2019 12:44:23 -0400 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com (172.27.27.103) by ustx2ex-dag1mb5.msg.corp.akamai.com (172.27.27.105) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 18 Mar 2019 11:44:15 -0500 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com ([172.27.27.103]) by ustx2ex-dag1mb3.msg.corp.akamai.com ([172.27.27.103]) with mapi id 15.00.1473.003; Mon, 18 Mar 2019 11:44:15 -0500 From: "Hewitt, Rory" To: =?iso-8859-1?Q?Martin_J=2E_D=FCrst?= , "Paul Hoffman" , DoH WG Thread-Topic: [Doh] [Ext] Reviewing Resolver-Associated DOH Thread-Index: AQHU3RjEfZ1VPcdKSEuf1fAXMLhziaYRl5QA Date: Mon, 18 Mar 2019 16:44:14 +0000 Message-ID: <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.28.212.170] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-18_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903180122 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-18_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903180123 Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 16:44:50 -0000 I understand that we don't necessarily want a directory structure under /.w= ell-known/ - therefore I would suggest one of the following: /.well-known/dns-doh/ /.well-known/dns-doh-servers/ I just don't want to end up with a situation where a single-layer structure= results in the /.well-known/ folder containing hundreds of poorly-named fi= les. We're already seeing some people using this folder to store not only t= hings like robots.txt, but also assorted Apple and Google files and their o= wn internal 'constant' data. Therefore, at a minimum, 'our' files should be named consistently - meaning= that (IMHO) any DNS-related file should begine with "dns-". Not sure wheth= er we're in a position to influence IANA to implement a naming standard... Rory -----Original Message----- From: Martin J. D=FCrst =20 Sent: Sunday, March 17, 2019 4:26 PM To: Paul Hoffman ; DoH WG Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH On 2019/03/17 01:04, Paul Hoffman wrote: >=20 > On Mar 16, 2019, at 8:51 AM, nusenu wrote: > On Mar 16, 2019, at 8:51 AM, nusenu wrote: >> Hewitt, Rory wrote: >>> As with all /.well-known/ endpoints, the issue is both=20 >>> standardization and publicization. AIUI, @mnot's original ideal=20 >>> would be to have /.well-known/ be pretty 'generic'. Therefore I'm=20 >>> not a fan of "/doh-servers-associated/" - I'd much rather see=20 >>> "/dns/doh/", which would enable other (future) DNS-related=20 >>> functionality to have a sub-folder within "/.well-known/dns/". If=20 >>> that's not a possibility, what about "/.well-known/dns-doh/"? >> >> +1 >> >> I find these suggested .well-known URLs clearer than "doh-servers-associ= ated". >=20 > I'm generally against this idea for two reasons: >=20 > - No one will see this URL other than software developers and operators w= atching their logs. They will not be visible to users. >=20 > - Layered spaces under a .well-known/ are possible but I don't think they= are well-understood. I very much agree. It could make things more complicated for IANA, and it c= ould make things more complicated for server administrators. Even if the ad= ditional level of complexity is minimal in many cases, it may not be in oth= ers. I'm not against including the three-letter acronym 'dns' in the string some= how; that may help administrators who look at .well-known a while after som= ebody got that folder set up. Regards, Martin.=20 From nobody Mon Mar 18 09:58:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ABC94130E94; Mon, 18 Mar 2019 09:57:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=apple.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Rp4S1_XYq73e; Mon, 18 Mar 2019 09:57:37 -0700 (PDT) Received: from nwk-aaemail-lapp01.apple.com (nwk-aaemail-lapp01.apple.com [17.151.62.66]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8A6D7131117; Mon, 18 Mar 2019 09:57:33 -0700 (PDT) Received: from pps.filterd (nwk-aaemail-lapp01.apple.com [127.0.0.1]) by nwk-aaemail-lapp01.apple.com (8.16.0.27/8.16.0.27) with SMTP id x2IGpiga030365; Mon, 18 Mar 2019 09:57:32 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=apple.com; h=mime-version : content-transfer-encoding : content-type : sender : subject : from : in-reply-to : date : cc : message-id : references : to; s=20180706; bh=VcIMMA/gkKbDl6K4vkGIo1bmG98KltRzU7VBdxycJ84=; b=fJKsd4xWSvdDuUF0siyh/JkO8C/wEZdnP2pkTPqX3xkTra7rwiuwyCx71DM+Pl8w5T5o ON2xb+9kdC3f2yS6mQcx2JZyu9BV+/rWTevBy2hZUBulZQEjvaMAQHM8q4iqCg27HNUc OIQvOWbLDb/BcnXsED4jUairPBlnWSryjfoN4qmeWzzxd3j0JI4qrf/RNjoS49+zBvGL RK1HnZNuz9noW/j4Bq6ExKt9AMyn4TcabJ4h6z/7TWMMPr2+u2cPz0YGDCZqCcDl0af3 kpMiSkO6Cfmlwk9m07CPxogwRHcIg0N4SRKjIIJapgzDKIKNOWDEHLXYIrFPGMnrshsz AQ== Received: from mr2-mtap-s02.rno.apple.com (mr2-mtap-s02.rno.apple.com [17.179.226.134]) by nwk-aaemail-lapp01.apple.com with ESMTP id 2r90363kwd-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 18 Mar 2019 09:57:32 -0700 MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; CHARSET=US-ASCII Received: from nwk-mmpp-sz12.apple.com (nwk-mmpp-sz12.apple.com [17.128.115.204]) by mr2-mtap-s02.rno.apple.com (Oracle Communications Messaging Server 8.0.2.3.20181024 64bit (built Oct 24 2018)) with ESMTPS id <0POK00B0DN3W4A30@mr2-mtap-s02.rno.apple.com>; Mon, 18 Mar 2019 09:57:32 -0700 (PDT) Received: from process_milters-daemon.nwk-mmpp-sz12.apple.com by nwk-mmpp-sz12.apple.com (Oracle Communications Messaging Server 8.0.2.3.20181024 64bit (built Oct 24 2018)) id <0POK00500N3F7100@nwk-mmpp-sz12.apple.com>; Mon, 18 Mar 2019 09:57:32 -0700 (PDT) X-Va-A: X-Va-T-CD: 296c58069bb7033e87817fa69e9297e4 X-Va-E-CD: f36d24f4166a51085dfe864b34fd6507 X-Va-R-CD: d217ec155e4277cc4af3bc5201f79542 X-Va-CD: 0 X-Va-ID: 50c831c3-761c-46fe-b081-ba67aef553d7 X-V-A: X-V-T-CD: 148aee0f1043947b2dd199222e4ab243 X-V-E-CD: f36d24f4166a51085dfe864b34fd6507 X-V-R-CD: d217ec155e4277cc4af3bc5201f79542 X-V-CD: 0 X-V-ID: ed123c8c-d74f-4b04-8610-c73a31089f7b X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-03-18_11:,, signatures=0 Received: from [17.192.171.189] (unknown [17.192.171.189]) by nwk-mmpp-sz12.apple.com (Oracle Communications Messaging Server 8.0.2.3.20181024 64bit (built Oct 24 2018)) with ESMTPSA id <0POK00KZ0N1BA000@nwk-mmpp-sz12.apple.com>; Mon, 18 Mar 2019 09:55:59 -0700 (PDT) Sender: tpauly@apple.com From: Tommy Pauly In-reply-to: Date: Mon, 18 Mar 2019 09:55:56 -0700 Cc: doh@ietf.org, captive-portals@ietf.org Message-id: References: <0fce90e8-38ef-4503-8e52-0ef8c8d87f64@www.fastmail.com> <9B23961D-8D05-462C-A444-0139B354F171@rfc1035.com> <0c060e21-c1a4-4768-9fad-27ac85da391f@www.fastmail.com> To: Thomas Peterson X-Mailer: Apple Mail (2.3445.104.2) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-18_11:, , signatures=0 Archived-At: Subject: Re: [Doh] [Captive-portals] Captive portals (was Re: suggested slides for IETF 104 on draft-reid-doh-operator) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 16:57:40 -0000 > On Mar 15, 2019, at 5:22 AM, Thomas Peterson wrote: > > (to those exclusively on the captive-portals list, this email follows on a discussion around a presentation discussing implications of DNS over HTTP in networks where captive portals are present) > > On 15/03/2019 11:26, Martin Thomson wrote: >> If the OS catches the captive portal, everything works nicely once the captive portal is dealt with. If the captive portal manages to evade detection... > > As there are numerous folk from browser and OS vendors within this mailing list who implement capture portal detection, would there benefit in authoring an informational document covering capture portal detection methods in the absence of a network's DHCP service not implementing RFC 7710? Such a document may help describe common methods to inform implementers and minimise detection evading capture portals. It may be better placed in the capport WG instead of doh. Agreed that CAPPORT is a good place for this discussion. As far as providing a document to describe OS-vendor-specific mitigations, I'm not sure if the benefit would be that large. It may be useful as an appendix in our Captive Portal Architecture document? The problem is that captive portals that want to whitelist OS probes for portals always can some way or another. Captive portals that do want to play nice don't whitelist these probes, and the detection generally works fine. Thanks, Tommy > > Regards > > _______________________________________________ > Captive-portals mailing list > Captive-portals@ietf.org > https://www.ietf.org/mailman/listinfo/captive-portals From nobody Mon Mar 18 14:36:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A88A41310B9 for ; Mon, 18 Mar 2019 14:35:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aZaw_htyaiNY for ; Mon, 18 Mar 2019 14:35:54 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2677C131094 for ; Mon, 18 Mar 2019 14:35:54 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 74B291A5AD3 for ; Mon, 18 Mar 2019 14:35:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552944953; bh=k8vNXLm/DgVndARIJcoDseenWCzdrqosw8OWYnJEp5E=; h=To:References:From:Subject:Date:In-Reply-To:From; b=icUfr4nPpsdBF+3AMzKlyJ5FEwOGAjH54wr5q0MclxFHoakro7SrQwap6ZMR58JCY D/jccBiK3xv2nvctK8DzL9GJqTMFaibQTScUFQPAcv/wFIscG1yKpdEA5scrHWV6bZ Z+iRrH4EAtELSM3MFZSEQqnF7JkPUF7DTrXgdzFk= X-Riseup-User-ID: 74837E5347D88094432F2C18B4CA45CACF43960812C3AAC008B4D5E66D931A6B Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 9247712052C for ; Mon, 18 Mar 2019 14:35:52 -0700 (PDT) To: doh@ietf.org References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> Date: Mon, 18 Mar 2019 21:35:00 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="CLHP144RxTkmXcMHZj2FFBU98Ey0Kfr9G" Archived-At: Subject: Re: [Doh] Talking to my resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 21:35:57 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --CLHP144RxTkmXcMHZj2FFBU98Ey0Kfr9G Content-Type: multipart/mixed; boundary="AkLms43d5paQGlJdcTJA9dXdMicIiO4qx"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> Subject: Re: [Doh] Talking to my resolver References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> In-Reply-To: --AkLms43d5paQGlJdcTJA9dXdMicIiO4qx Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Martin Thomson: >>> But why not provide a mechanism that can do for DoT what this >>> does for DoH? >>=20 >> I'd like to see that happen as well but I assume that will not be >> on the DoH WG since it is outside it's charter? >=20 > I'd hate for our charter to cause us to disregard better solutions. These are encouraging words. I'd support the inclusion of a DoT=20 discovery mechanisms if that is asked but I assume a discovery mechanism for DoT will be specified anyway, if not in this one it will be in a sepa= rate document. One reason that makes me think it would be worthwhile to have a single document for both (DoT and DoH) is that we might end up with a better protocol. I'm taking a step back and ask two high level questions and answer them for myself but it would be great to hear more opinions. What use-cases are we aiming to cover? I assume the primary use-case here is "Application (or OS) wants to discover a DoH server associated with the c= urrent Do53 resolver". (also but to a less extend "web application wants to discover ...") What security properties are we aiming for? I'd like to see a protocol that is not vulnerable to man-in-the-middle and downgrade attacks, even if that means that use-cases that can't detect the IP address of the currently used resolver can not be covered. Alternatively we could have a 'strict' and an 'opportunistic' discovery p= rofile with distinct security properties to tackle all currently covered use-cases without weakening the security properties of the entire protoco= l for all use-cases? (example: "A client able to determine the resolver's IP address MUST NOT = use the "DoH Servers from DNS" discovery mechanism.") At the very least we should prevent a temporary on-path attacker getting = a persistent feed of a victim's DoH traffic as described in my other email [1]. =20 [1] https://mailarchive.ietf.org/arch/msg/doh/295yrI72xt0eSnYueiOuqVpSj4s= kind regards, nusenu =20 --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --AkLms43d5paQGlJdcTJA9dXdMicIiO4qx-- --CLHP144RxTkmXcMHZj2FFBU98Ey0Kfr9G Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyQDzEACgkQrWE4wkXN Qn5ltxAAi5bcJeJJ4kHvTgAJQ6oTPdZEi142okvrkNkMWY5+nnZHmJM1tqhp25M/ QJX2LuSi+S5ucy6MkwYSEN+mNaAFYsqG1yg8oZ571XXvK0bvRNiXW2ugc/pO9SS7 fmiJyk6FYuWlm/TcsCeN6EuWBInZgS4lwYpxAgaBD9AqVjaxNaTFg77FFJmvBxC8 2zU6wo2WGdBqX2QS79RKSuuy26J0GzEpHpYjwIwiBg65b0rU7v2+656dOczoWwbn rCmy/9a2FfEYkU3gKA7I07K+ufJf3RjwKt0FjQRfN341SRhtmDQkxApbj7zh1tnh smbqhoQVxT8x2RIl9v+R5OyVud+jwCqdP27vK3CxCl04wTD0y15JnZgqH5XCGqCM mYQGL+UIlcGwa8Ctux6WyEeH6YZpnUev7Nzr+ho850K4A6Oa6PzT910PPx3JzDLC vGfJjPBIbwdxd2tvPy8m+RFZy31LZO32woT9SW6Nkbz6aGgeqd3UVJ5+aW+mWfGQ IUE7DDG6FF3NUexnnVs2ddwNeRb8rFEJvVsxgU27OA+zVnzRThP34pg7+hJhii1F UeZEDtfS1hQG6GxMk99ZKp1umRGfyvDNHQSAyk+MJfXsCH/j4EriXCf2nXaNcq9g CrEuZRPossK7yKamSon9/8B9BWT+Cyn3MautlAd1i1awmS7cGBA= =kAWi -----END PGP SIGNATURE----- --CLHP144RxTkmXcMHZj2FFBU98Ey0Kfr9G-- From nobody Mon Mar 18 14:43:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D499313114B for ; Mon, 18 Mar 2019 14:43:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TgtmLfV_Q8-H for ; Mon, 18 Mar 2019 14:43:55 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 669A11310AB for ; Mon, 18 Mar 2019 14:43:55 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id B6CF71A0201 for ; Mon, 18 Mar 2019 14:43:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552945434; bh=9I3Zkftsp0Ma25yJkxZrUQABUl5AY3Ur+swuQeyvIbA=; h=Subject:To:References:From:Date:In-Reply-To:From; b=Tb5VV3lmGC00K9f1FERQwqcMT+QEmYYre5lIf8omSUfFBL1JXp3750NKnezzMrdSA VAKOdLrKjxIfMJraYzKfHIT+ls6NCrOGx4/EAmwDVOdWvGIa+NR4oVPwzImMWG2QqV Pg8M/FGbNZN4eSiwguAiOMr7PguWDdsxNh9tXvE8= X-Riseup-User-ID: 5ADE43EDECCF9E568C5051C1E9CF023504BDC57EF5F886DABF40755018160F85 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 045151204F6 for ; Mon, 18 Mar 2019 14:43:53 -0700 (PDT) To: doh@ietf.org References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <8d56232b-8933-bf8a-186b-e44597364e14@riseup.net> Date: Mon, 18 Mar 2019 21:43:00 +0000 MIME-Version: 1.0 In-Reply-To: <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="AWcicJ530b1KwgmHO5W4Qw6JIXUDbcd55" Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 21:43:57 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --AWcicJ530b1KwgmHO5W4Qw6JIXUDbcd55 Content-Type: multipart/mixed; boundary="8eDsVk2AEqKaz5JzSG2REv8srZHWkbYCB"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: <8d56232b-8933-bf8a-186b-e44597364e14@riseup.net> Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> In-Reply-To: <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> --8eDsVk2AEqKaz5JzSG2REv8srZHWkbYCB Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Hewitt, Rory: > I understand that we don't necessarily want a directory structure > under /.well-known/ - therefore I would suggest one of the > following: let me throw in a 3rd option: /.well-known/dns-over-https-servers > I just don't want to end up with a situation where a single-layer > structure results in the /.well-known/ folder containing hundreds of > poorly-named files. +1 --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --8eDsVk2AEqKaz5JzSG2REv8srZHWkbYCB-- --AWcicJ530b1KwgmHO5W4Qw6JIXUDbcd55 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyQERMACgkQrWE4wkXN Qn5oHg/+Kd1JBG9O/wKyGA3ITuJdzIzpPIcYA8t8O9/MNFJuxaIdOPqUJzrZdedu pIEbGXcB3tSTaDDx7bV0lNvJ0i6CDoxgKX/5O0UxSpvlGd7+l/fUl0EjSYd0TSy9 EcUp9CizHYDixlqfPLm8lAAyDvo5MB+01LTMZwjX9hOyrNWqcU0zXB8CVAFrZ6Ry ZFMXqHDtS2fxaZv8c6npC0sAAqMWMShQ4efLWc+uRABjRrTsopEhTO1zPK0CIJG7 9wZxf6tdwf41Q+MXw86Cu8bIxABo2HrHI7IkqWyMg26Wr8kIQ0BHWIp5PGYCD4gv kTVCfXLMKxdMQUnFU9R7SZSf4o3G79OKdk9lQtuW24U6eiMyxRG5N387ovkXBXLY EWu3rnK5ho1ByFLT2sUI7tR7AUsGvX4sQBeGIK36AHE9fC3y6rGthwTs1R8D/gz1 D8VyOxAiTlYHZMBdCueCJBEM5jbDOM120zhiVEGNX6VEH4Nd8/nC2zruAwpHot9L mO//bIoRPYVb1RoiePKS9lR9SQXfgLufuFeHw/ydSSHlx2n4fqisE6f4XY3nFBZY hsumrcAWCzixbwyR25dgjErsCv5WRwaJNhWIk1i9N8h/E5kW77fPbl+WS8m5wXBn ZOoe0VWJp9j/zxqHDoazy5IsIyM5DPeFtwVA+1JVl6Jeha0nF+I= =pGtu -----END PGP SIGNATURE----- --AWcicJ530b1KwgmHO5W4Qw6JIXUDbcd55-- From nobody Mon Mar 18 14:56:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D5FB1311A3 for ; Mon, 18 Mar 2019 14:56:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.852 X-Spam-Level: X-Spam-Status: No, score=-1.852 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, KHOP_DYNAMIC=0.85, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DGZr4Wwn8L8d for ; Mon, 18 Mar 2019 14:56:29 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD5B1131188 for ; Mon, 18 Mar 2019 14:56:29 -0700 (PDT) Received: from pps.filterd (m0050095.ppops.net [127.0.0.1]) by m0050095.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x2ILq4mG032435; Mon, 18 Mar 2019 21:56:29 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=jan2016.eng; bh=5RzkTpNz1Rg9Sor4xI76gZsEurdQvG+KfOalIdKXTuk=; b=XybgoaxGhjFwY4qQYV0a383TUdmhI/bJrAc/P0432qx+yDY1R1vnz4weVUZYzGzJ1s78 KGvJL6MDPf+eFT0HeHy95r4WTzzde1JE3yDbGB7asfeMTLjEuT7Uc69VfqxdItznVXSO ZPXrSSNZ8ZahklWY1aYa19WbPMkBNCb6opVw1IgzVIsEjRmw4LX9T59TmQUHA6d6VLid 7/dLGtd/rnumRz9QrWQXAdt/rGbYagiJYIXegY+8JQthauOYnYXOKQ5xToGyb01cCWSI E285CikuRh8ToPpNS6vKtJT4UzrJ/C/P3C93CoSrq0CZoNYgWTVIOPh9jCxmBsRuGbhj eQ== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by m0050095.ppops.net-00190b01. with ESMTP id 2r8sj5tpd7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Mar 2019 21:56:29 +0000 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x2ILl2na001597; Mon, 18 Mar 2019 17:56:28 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.30]) by prod-mail-ppoint2.akamai.com with ESMTP id 2r8vfuuqfw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 18 Mar 2019 17:56:26 -0400 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com (172.27.27.103) by ustx2ex-dag1mb6.msg.corp.akamai.com (172.27.27.107) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 18 Mar 2019 14:56:20 -0700 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com ([172.27.27.103]) by ustx2ex-dag1mb3.msg.corp.akamai.com ([172.27.27.103]) with mapi id 15.00.1473.003; Mon, 18 Mar 2019 16:56:20 -0500 From: "Hewitt, Rory" To: nusenu , "doh@ietf.org" Thread-Topic: [Doh] [Ext] Reviewing Resolver-Associated DOH Thread-Index: AQHU3RjEfZ1VPcdKSEuf1fAXMLhziaYRl5QAgACpKQD//6zswA== Date: Mon, 18 Mar 2019 21:56:20 +0000 Message-ID: <75491a04058f42ef923a01ccc748fad9@ustx2ex-dag1mb3.msg.corp.akamai.com> References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> <8d56232b-8933-bf8a-186b-e44597364e14@riseup.net> In-Reply-To: <8d56232b-8933-bf8a-186b-e44597364e14@riseup.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.28.212.170] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-18_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903180151 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-18_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903180152 Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 21:56:32 -0000 SSdtIGZpcm1seSBpbiBmYXZvciBvZiBoYXZpbmcgYSBuYW1pbmcgJ2NvbnZlbnRpb24nIG9mOg0K DQoJLy53ZWxsLWtub3duL2Rucy1kb2gtc2VydmVycw0KDQpJIHRoaW5rIGl0J3MgY3JpdGljYWwg dG8gaGF2ZSAiZG5zLSIgYXMgdGhlIG5hbWUgcHJlZml4LCB0byBjbGVhcmx5IGluZGljYXRlIHRo YXQgdGhpcyBpcyBhIEROUy1yZWxhdGVkIGZpbGUuIFRoZW4gImRvaC0iIHRvIGluZGljYXRlIHRo YXQgdGhpcyBpcyBhIERvSC1zcGVjaWZpYyBmaWxlIGFuZCBzbyBvbi4uLiBVc2luZyB0aGlzIGNv bnZlbnRpb24gbWVhbnMgdGhhdCB0aGUgRG9UIGZvbGtzIGNhbiBjcmVhdGUgdGhlaXIgb3duIGZp bGVzIGFzDQoNCgkvLndlbGwta25vd24vZG5zLWRvdC1zZXJ2ZXJzDQoNCldoaWxlIHlvdXIgaWRl YSBvZiAiLy53ZWxsLWtub3duL2Rucy1vdmVyLWh0dHBzLXNlcnZlcnMiIGZ1bGZpbGxzIHRoZSBm aXJzdCAiZG5zLSIgcGFydCBvZiBteSBjb252ZW50aW9uIChhbmQgaXQncyBhbHNvIHZlcnkgY2xl YXIgd2hhdCBpdCBpcyDwn5iKKSwgSSBndWVzcyBJJ20gYWx3YXlzIGdvaW5nIHRvIGJlIGFudHN5 IHRoYXQgdGhlcmUncyBnb2luZyB0byBiZSBhIG5ldyBETlMtcmVsYXRlZCAndGVjaG5vbG9neScg aW4gdGhlIGZ1dHVyZSBjYWxsZWQgZS5nLiAiQ2Fycmllci1QaWdlb24gRE5TIiBhbmQgdGhhdCB0 ZWFtIGlzIGdvaW5nIHRvIGNhbGwgdGhlaXIgZmlsZSAiLy53ZWxsLWtub3duL2NhcnJpZXItcGln ZW9uLWRucyIuIFNvIGl0J3MgYmV0dGVyIChJTUhPKSB0byBleHBsaWNpdGx5IGluZGljYXRlIHRo YXQgaXQncyBhIHNlcmllcyBvZiBUaHJlZS1MZXR0ZXItQWNyb255bXMuLi4NCg0KT2YgY291cnNl LCBhIG5hbWluZyBjb252ZW50aW9uIG9ubHkgd29ya3MgaWYgZXZlcnlvbmUgYm90aCBrbm93cyBh Ym91dCBpdCBhbmQgZm9sbG93cyBpdC4gRXZlbiBpZiB3ZSBkZWNpZGUgdG8gdXNlIGEgJ3N0cmlj dCcgbmFtaW5nIGNvbnZlbnRpb24sIHVubGVzcyBpdCdzIGJvdGggJ3B1YmxpY2l6ZWQnIGFuZCAn ZW5mb3JjZWQnLCBpdCdzIGtpbmRhIHVzZWxlc3MuDQoNClJvcnkNCg0KLS0tLS1PcmlnaW5hbCBN ZXNzYWdlLS0tLS0NCkZyb206IG51c2VudSA8bnVzZW51LWxpc3RzQHJpc2V1cC5uZXQ+IA0KU2Vu dDogTW9uZGF5LCBNYXJjaCAxOCwgMjAxOSAyOjQzIFBNDQpUbzogZG9oQGlldGYub3JnDQpTdWJq ZWN0OiBSZTogW0RvaF0gW0V4dF0gUmV2aWV3aW5nIFJlc29sdmVyLUFzc29jaWF0ZWQgRE9IDQoN Ckhld2l0dCwgUm9yeToNCj4gSSB1bmRlcnN0YW5kIHRoYXQgd2UgZG9uJ3QgbmVjZXNzYXJpbHkg d2FudCBhIGRpcmVjdG9yeSBzdHJ1Y3R1cmUgDQo+IHVuZGVyIC8ud2VsbC1rbm93bi8gLSB0aGVy ZWZvcmUgSSB3b3VsZCBzdWdnZXN0IG9uZSBvZiB0aGUNCj4gZm9sbG93aW5nOg0KDQpsZXQgbWUg dGhyb3cgaW4gYSAzcmQgb3B0aW9uOg0KDQovLndlbGwta25vd24vZG5zLW92ZXItaHR0cHMtc2Vy dmVycw0KDQo+IEkganVzdCBkb24ndCB3YW50IHRvIGVuZCB1cCB3aXRoIGEgc2l0dWF0aW9uIHdo ZXJlIGEgc2luZ2xlLWxheWVyIA0KPiBzdHJ1Y3R1cmUgcmVzdWx0cyBpbiB0aGUgLy53ZWxsLWtu b3duLyBmb2xkZXIgY29udGFpbmluZyBodW5kcmVkcyBvZiANCj4gcG9vcmx5LW5hbWVkIGZpbGVz Lg0KDQorMQ0KDQoNCg0KLS0NCmh0dHBzOi8vdHdpdHRlci5jb20vbnVzZW51Xw0KaHR0cHM6Ly9t YXN0b2Rvbi5zb2NpYWwvQG51c2VudQ0KDQo= From nobody Mon Mar 18 14:59:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 98CED1311A3 for ; Mon, 18 Mar 2019 14:59:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=lGEa98zP; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=8InUdm5K Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UJxOuTofwKJT for ; Mon, 18 Mar 2019 14:59:54 -0700 (PDT) Received: from wout1-smtp.messagingengine.com (wout1-smtp.messagingengine.com [64.147.123.24]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7DF8F1311C1 for ; Mon, 18 Mar 2019 14:59:53 -0700 (PDT) Received: from compute3.internal (compute3.nyi.internal [10.202.2.43]) by mailout.west.internal (Postfix) with ESMTP id ACCDB3E1A; Mon, 18 Mar 2019 17:59:52 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute3.internal (MEProxy); Mon, 18 Mar 2019 17:59:53 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; s=fm2; bh=s pb6uYwFfoxW9QZB0RVui3avZ37YbwQykHCg5tdCigE=; b=lGEa98zP2a/BhUHED onCu3JPXMjD9raKWDjT1SAKLuorBb8Uexm2kI+x01XBg+eTz0PVS1Li/PEejewSv CnYdPJ7ddt+P3hjjmRrNhcrmE7bYbwUmu0VRmBTK4mbq+BVawaPY99wSKLiumczE 7Hv60kvQ+haLxKY15urJd2MGfUSl/gbGImGePFaPiINxbkpYr48FfAmEirdLdoZu gsbITo8B0kDkLhCa3FzYyOmqrll3AYQKuwpK/BWo+ase6Y013Pu1/JQqNyVuyHBz iQwo+QkpPU/cCYB+JQ4ZpP/yKmlegjEJ3lvR/P2HhKEc9QZR0Fbe529c8tLSGeVc uQiZA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=spb6uYwFfoxW9QZB0RVui3avZ37YbwQykHCg5tdCi gE=; b=8InUdm5KyNFX0+a/IY6LScIBv004JpRglrhSMvE4/kv57hXWdfElwf0g4 MIxN3f1XJwO15u6RuuRX7sc2N1MHCD5SxX0EWLVpUTPKO3cxDo4FKQeYqXS7csu5 cb2P+UGCG70t0IHuwPEAxufcYKUZmvrFTITMWwaobf2coRSDvPbIWz6za+ym2+Wd eDxAvDd8Rv30HXK/dcwauARnqp1el5zgkx3A1nodUZJKxu8UFwglpFEuNtMKdtjY 7ohIaselUgBpcgBtKVyGPnalotAyuQnLdbOpd8bltBfjHJJwGDOnKlL9H+ZvVJN8 ki+0YdgMUAbsYAhLy60mkTgDaTWwA== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddriedugdduheejucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurheptggguffhjgffgffkfhfvofesthhqmhdthhdtjeenucfhrhhomhepofgrrhhk ucfpohhtthhinhhghhgrmhcuoehmnhhothesmhhnohhtrdhnvghtqeenucffohhmrghinh epmhhnohhtrdhnvghtnecukfhppedugeegrddufeeirddujeehrddvkeenucfrrghrrghm pehmrghilhhfrhhomhepmhhnohhtsehmnhhothdrnhgvthenucevlhhushhtvghrufhiii gvpedt X-ME-Proxy: Received: from attitudadjuster.mnot.net (unknown [144.136.175.28]) by mail.messagingengine.com (Postfix) with ESMTPA id 8EC82E4684; Mon, 18 Mar 2019 17:59:49 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Mark Nottingham In-Reply-To: <75491a04058f42ef923a01ccc748fad9@ustx2ex-dag1mb3.msg.corp.akamai.com> Date: Tue, 19 Mar 2019 08:59:44 +1100 Cc: nusenu , "doh@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <7EAD04F0-5FEB-42DE-92FE-C0B1889B79A2@mnot.net> References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> <8d56232b-8933-bf8a-186b-e44597364e14@riseup.net> <75491a04058f42ef923a01ccc748fad9@ustx2ex-dag1mb3.msg.corp.akamai.com> To: "Hewitt, Rory" X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 21:59:57 -0000 *well-known URI expert hat on* Without speaking to the technical merit of the proposals being = discussed, I'd like to discourage folks from thinking that they can = reserve prefixes within the first well-known URI path segment; it is a = managed space, but if we start this practice, we're going to have a = nightmare managing the competing requirements. If you want to reserve a prefix, reserve something like = /.well-known/dns-servers/ and put the specific flavour after that (or in = the retrieved file, or...). All that said, bike shedding the name at this point probably isn't a = terribly productive use of time. Thanks, > On 19 Mar 2019, at 8:56 am, Hewitt, Rory wrote: >=20 > I'm firmly in favor of having a naming 'convention' of: >=20 > /.well-known/dns-doh-servers >=20 > I think it's critical to have "dns-" as the name prefix, to clearly = indicate that this is a DNS-related file. Then "doh-" to indicate that = this is a DoH-specific file and so on... Using this convention means = that the DoT folks can create their own files as >=20 > /.well-known/dns-dot-servers >=20 > While your idea of "/.well-known/dns-over-https-servers" fulfills the = first "dns-" part of my convention (and it's also very clear what it is = =F0=9F=98=8A), I guess I'm always going to be antsy that there's going = to be a new DNS-related 'technology' in the future called e.g. = "Carrier-Pigeon DNS" and that team is going to call their file = "/.well-known/carrier-pigeon-dns". So it's better (IMHO) to explicitly = indicate that it's a series of Three-Letter-Acronyms... >=20 > Of course, a naming convention only works if everyone both knows about = it and follows it. Even if we decide to use a 'strict' naming = convention, unless it's both 'publicized' and 'enforced', it's kinda = useless. -- Mark Nottingham https://www.mnot.net/ From nobody Mon Mar 18 15:01:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 570511311AD for ; Mon, 18 Mar 2019 15:01:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id plz-fKaebbo9 for ; Mon, 18 Mar 2019 15:01:07 -0700 (PDT) Received: from mail-it1-x130.google.com (mail-it1-x130.google.com [IPv6:2607:f8b0:4864:20::130]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96CC01311A8 for ; Mon, 18 Mar 2019 15:01:07 -0700 (PDT) Received: by mail-it1-x130.google.com with SMTP id w124so5407699itc.0 for ; Mon, 18 Mar 2019 15:01:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0n/hoLXZeyNCDE2+xZQul5BM5+nOCcF/fSYG5hWfFkI=; b=C950sSVewHQJtd+BnJS1E/cRHQVLLxSp8h8KJbVbWpDA07lYD23g3J8yZJvYx/nc4U y4quebr4sxzmQldHRXb7kdituwbTU7VvwoF8Qk5iiqdNFaGk2RXUsh3ZhKR6QnR9eORd befjEzLbUC1Makaj3PiWUoA8BtusncBX+BeRHNq0gqZ3dC8pogDBMGGgZ4EzjO/lgRNP Lp+08yGhax56Rw7vsFsjdKBNFkIqMCYaIMlbMUZAntzEXGvU0RTM2br6DiAT54XlK1xF biNYUPTGOlw37qgGJcpjped8gORb0GUjrVz5Py7BFgATmUPrKLUPXF1tR5GeyMyNKvq6 /eBA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0n/hoLXZeyNCDE2+xZQul5BM5+nOCcF/fSYG5hWfFkI=; b=pyPckIssk+lb1hlze+HqlAmm0btvjw9kkEGCG0VqdTs3gTLT1yMkFLd8j8oATP7wji zXIGaYFQcXprcWjFbEPc9652hB8vUzBwB8zGbajKwA4bAasAfMEyotz2W5AE6UlRTPQI WHJVTM5BhHhiD4yHtHTP/FVEPGw5QRbjy9QtHXAx2fG1QvyUMPBEkdKI/CB+7vlUiDNs pxpxNClAtBO5N5NnyP/D8vztsNSKuY/ECJrPOkRUHoxd5zG06twcJtJM9FFYObAaDQxW ajKAuBTQXctOr3kdGvl3OjJCXPlGWg3YHz4Z/ZjNhqcxY8xW0Rqb0bhQa2mdfM61Emx7 VKuw== X-Gm-Message-State: APjAAAXCqQcHRGALcnnLasSQpcoHGuPHvBdydIknxKetNQfH3j0Fb8IQ o6uyWE2coQt7FqetLjRvVuTBzu/USv/mJFxZi9zFoA== X-Google-Smtp-Source: APXvYqwEcf4KNFgJJOjwXhRzFuJsny5SVCI1TWakAhVU3Qe4TosHnaoimvcQjIY9XfgAoyqOkBKy9i5fSRgPF5Q1pcc= X-Received: by 2002:a05:660c:683:: with SMTP id n3mr725767itk.70.1552946466773; Mon, 18 Mar 2019 15:01:06 -0700 (PDT) MIME-Version: 1.0 References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> In-Reply-To: <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> From: Ben Schwartz Date: Mon, 18 Mar 2019 18:00:53 -0400 Message-ID: To: nusenu Cc: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000087bb4405846586b4" Archived-At: Subject: Re: [Doh] Talking to my resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 22:01:10 -0000 --00000000000087bb4405846586b4 Content-Type: multipart/alternative; boundary="000000000000825256058465860a" --000000000000825256058465860a Content-Type: text/plain; charset="UTF-8" On Mon, Mar 18, 2019 at 5:36 PM nusenu wrote: > Martin Thomson: > >>> But why not provide a mechanism that can do for DoT what this > >>> does for DoH? > >> > >> I'd like to see that happen as well but I assume that will not be > >> on the DoH WG since it is outside it's charter? > > > > I'd hate for our charter to cause us to disregard better solutions. > > These are encouraging words. I'd support the inclusion of a DoT > discovery mechanisms if that is asked but I assume a discovery mechanism > for DoT will be specified anyway, if not in this one it will be in a > separate document. > DoT is currently discovered by probing port 853 on the resolver's IP address. Is this sufficient for your use case? > One reason that makes me think it would be worthwhile to have a > single document for both (DoT and DoH) is that we might end up > with a better protocol. > > > I'm taking a step back and ask two high level questions > and answer them for myself but it would be great to hear more > opinions. > > What use-cases are we aiming to cover? > > I assume the primary use-case here is > "Application (or OS) wants to discover a DoH server associated with the > current Do53 resolver". > (also but to a less extend "web application wants to discover ...") > > What security properties are we aiming for? > > I'd like to see a protocol that is not vulnerable to man-in-the-middle > and downgrade attacks, even if that means that use-cases that can't > detect the IP address of the currently used resolver can not be covered. > An active adversary "in the middle" can fully substitute itself for a Do53 resolver without alerting the user. Do you see an achievable defense against downgrade attacks, or is this not part of your threat model? Alternatively we could have a 'strict' and an 'opportunistic' discovery > profile > with distinct security properties to tackle all currently covered > use-cases without weakening the security properties of the entire protocol > for all use-cases? > (example: "A client able to determine the resolver's IP address MUST NOT > use the > "DoH Servers from DNS" discovery mechanism.") > At the very least we should prevent a temporary on-path attacker getting a > persistent > feed of a victim's DoH traffic as described in my other email [1]. > > [1] https://mailarchive.ietf.org/arch/msg/doh/295yrI72xt0eSnYueiOuqVpSj4s > > kind regards, > nusenu > > > -- > https://twitter.com/nusenu_ > https://mastodon.social/@nusenu > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000825256058465860a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Mar 18, 2019 at 5:36 PM nusenu &l= t;nusenu-lists@riseup.net>= ; wrote:
Martin Thomson:
>>> But why not provide a mechanism that can do for DoT what this<= br> >>> does for DoH?
>>
>> I'd like to see that happen as well but I assume that will not= be
>> on the DoH WG since it is outside it's charter?
>
> I'd hate for our charter to cause us to disregard better solutions= .

These are encouraging words. I'd support the inclusion of a DoT
discovery mechanisms if that is asked but I assume a discovery mechanism for DoT will be specified anyway, if not in this one it will be in a separa= te document.

DoT is currently discovere= d by probing port 853 on the resolver's IP address.=C2=A0 Is this suffi= cient for your use case?
=C2=A0
One reason that makes me think it would be worthwhile to have a
single document for both (DoT and DoH) is that we might end up
with a better protocol.


I'm taking a step back and ask two high level questions
and answer them for myself but it would be great to hear more
opinions.

What use-cases are we aiming to cover?

I assume the primary use-case here is
"Application (or OS) wants to discover a DoH server associated with th= e current Do53 resolver".
(also but to a less extend "web application wants to discover ..."= ;)

What security properties are we aiming for?

I'd like to see a protocol that is not vulnerable to man-in-the-middle<= br> and downgrade attacks, even if that means that use-cases that can't
detect the IP address of the currently used resolver can not be covered.

An active adversary "in the middle&q= uot; can fully substitute itself for a Do53 resolver without alerting the u= ser.=C2=A0 Do you see an achievable defense against downgrade attacks, or i= s this not part of your threat model?

Alternatively we could have a 'strict' and an 'opportunistic= 9; discovery profile
with distinct security properties to tackle all currently covered
use-cases without weakening the security properties of the entire protocol = for all use-cases?
(example: "A client able to determine the resolver's IP address MU= ST NOT use the
"DoH Servers from DNS" discovery mechanism.")
At the very least we should prevent a temporary on-path attacker getting a = persistent
feed of a victim's DoH traffic as described in my other email [1].

[1] https://mailarchive.ietf.or= g/arch/msg/doh/295yrI72xt0eSnYueiOuqVpSj4s

kind regards,
nusenu


--
https://twitter.com/nusenu_
https://mastodon.social/@nusenu

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000825256058465860a-- --00000000000087bb4405846586b4 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCDTNSAR22nD/lamKqXFb6SJ MtknBZo/87udkalCZxeuxjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMTgyMjAxMDdaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAoTTmKhRB7qukPOffhTkNFNzVcifJjYB6uUQHO45L JtEvOxzAnJMB4TeJPYyDwJ2dNXJ6wautlQaxUq7SnGMYiiIHXd8TZ5O3l3Y8V4Otqrz/dEyzBZRp ylKC10ahdjLoZAMTB9PdzxVEo+/CFTdcNKZcM2UHFvkDuq82PjTJygMVGy1VV8yPc00fLAdla1EF Eg5cfIaWBGei7+rgy2cbZzg4JFzfk+XPgrPwQ6KV0ipNk1qqRPz8D+pVBgnPWPS28NchUPw6kXdc 6DBEcHQEEfx1tm8dw16nbDJDLFQIlXzAwRUD8xSEe3IVw1+ccaj7fo+8qNb5geCeuQWplk1/rg== --00000000000087bb4405846586b4-- From nobody Mon Mar 18 15:09:51 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7D9E61311A9 for ; Mon, 18 Mar 2019 15:09:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.852 X-Spam-Level: X-Spam-Status: No, score=-1.852 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, KHOP_DYNAMIC=0.85, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=akamai.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t04GZ6_KkwG5 for ; Mon, 18 Mar 2019 15:09:47 -0700 (PDT) Received: from mx0a-00190b01.pphosted.com (mx0a-00190b01.pphosted.com [IPv6:2620:100:9001:583::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9C2E31311A8 for ; Mon, 18 Mar 2019 15:09:47 -0700 (PDT) Received: from pps.filterd (m0050093.ppops.net [127.0.0.1]) by m0050093.ppops.net-00190b01. (8.16.0.27/8.16.0.27) with SMTP id x2ILvMeG024313; Mon, 18 Mar 2019 22:09:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=akamai.com; h=from : to : cc : subject : date : message-id : references : in-reply-to : content-type : content-transfer-encoding : mime-version; s=jan2016.eng; bh=dilB7Z3STlyRnHD139JcPouqbGBA6Njm+Od1Ug8VBfA=; b=OZ3WMBGqoiiR7TGmtBUxYGIW5mcROJUxZGUMOAiiyYGDRJ0UKRHk0JzPgF7OdEV0g5S/ 5RlXestXXAETl3ZodGwmg5DYhJfcTM/iWqgW4yDr2AppGUtpD016W85NMDMRUO05r9xg 6vDDsc8XvWjnKPnN6Fow4/y9rXguiwL09yET+ecydeHXu1FQrAjGxpAD/Co/jHIFArjl LRWxxgrb0OKeRIgOoaiKGm34Ey77vftVQORHOThF6Za+i7syE+mgTYY67/lUgz99arz2 XZP3uPTX3NXPk1CIKMzC5sYkohi4tqZFcDVoelAEBHiSvU4WDh7Rco4PYOGB11bJWq0A zw== Received: from prod-mail-ppoint2 (prod-mail-ppoint2.akamai.com [184.51.33.19]) by m0050093.ppops.net-00190b01. with ESMTP id 2rafs50tds-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 18 Mar 2019 22:09:25 +0000 Received: from pps.filterd (prod-mail-ppoint2.akamai.com [127.0.0.1]) by prod-mail-ppoint2.akamai.com (8.16.0.27/8.16.0.27) with SMTP id x2IM2rr1025705; Mon, 18 Mar 2019 18:09:24 -0400 Received: from email.msg.corp.akamai.com ([172.27.25.32]) by prod-mail-ppoint2.akamai.com with ESMTP id 2r8vfuurwp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Mon, 18 Mar 2019 18:09:24 -0400 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com (172.27.27.103) by ustx2ex-dag1mb1.msg.corp.akamai.com (172.27.27.101) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 18 Mar 2019 17:09:22 -0500 Received: from USTX2EX-DAG1MB3.msg.corp.akamai.com ([172.27.27.103]) by ustx2ex-dag1mb3.msg.corp.akamai.com ([172.27.27.103]) with mapi id 15.00.1473.003; Mon, 18 Mar 2019 17:09:16 -0500 From: "Hewitt, Rory" To: Mark Nottingham , Paul Hoffman CC: nusenu , "doh@ietf.org" Thread-Topic: [Doh] [Ext] Reviewing Resolver-Associated DOH Thread-Index: AQHU3RjEfZ1VPcdKSEuf1fAXMLhziaYRl5QAgACpKQD//6zswIAAV8EA//+tW3A= Date: Mon, 18 Mar 2019 22:09:16 +0000 Message-ID: References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> <8d56232b-8933-bf8a-186b-e44597364e14@riseup.net> <75491a04058f42ef923a01ccc748fad9@ustx2ex-dag1mb3.msg.corp.akamai.com> <7EAD04F0-5FEB-42DE-92FE-C0B1889B79A2@mnot.net> In-Reply-To: <7EAD04F0-5FEB-42DE-92FE-C0B1889B79A2@mnot.net> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [172.28.212.170] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-18_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903180153 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-18_13:, , signatures=0 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903180153 Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 22:09:49 -0000 QE1hcmsgTm90dGluZ2hhbQ0KDQpUaGlzIGNhbWUgdXAgYmVjYXVzZSB3aGlsZSBjaGF0dGluZyB0 byBAUGF1bCBIb2ZmbWFuIG9mZmxpbmUsIEkgbWFkZSBpdCBjbGVhciB0aGF0IHRoZXJlIGFyZSBs b3RzIG9mIHBlb3BsZSB3aG8gYXJlIHN0aWNraW5nIGFzc29ydGVkIGZpbGVzIGludG8gdGhlaXIg Ly53ZWxsLWtub3duLyBmb2xkZXIsIGVpdGhlciBkaXJlY3RseSBvciB3aXRoaW4gc3ViLWZvbGRl cnMgd2l0aCBubyBhcHBhcmVudCBjb25zaXN0ZW5jeS4gVGhlIGxhc3QgdGhpbmcgYW55b25lIHdh bnRzIGlzIGEgbmFtZS1jbGFzaCB3aXRoIGFuIGV4aXN0aW5nIGZpbGUsIHVubGlrZWx5IHRob3Vn aCB0aGF0IHNlZW1zLiBJJ20gbm90IHN1cmUgdGhlIGV4dGVudCB0byB3aGljaCBmb2xrcyBvbiB0 aGlzIG1haWxpbmcgbGlzdCBhcmUgYXdhcmUgb2YgdGhlIGhvcnJpYmxlLCByaWRpY3Vsb3VzIHdh eXMgaW4gd2hpY2ggcmVhbCBwZW9wbGUgb3BlcmF0ZSB0aGVpciB3ZWIgc2VydmVycyAoYXMgb3Bw b3NlZCB0byB0aGUgJ2lkZWFsaXplZCcgd2F5IHRoZXkgbWF5IGJlIHByZXN1bWVkIGJ5IHN0YW5k YXJkcy13cml0ZXJzKS4NCg0KVGhhdCBiZWluZyBzYWlkLCB5b3VyIHBvaW50IGFib3V0IGJpa2Ut c2hlZGRpbmcgaXMgd2VsbC10YWtlbi4NCg0KVGhhbmtzLA0KDQpSb3J5DQoNClJvcnkgSGV3aXR0 DQpTZW5pb3IgU29sdXRpb25zIEFyY2hpdGVjdA0KR2xvYmFsIFNlcnZpY2VzICYgU3VwcG9ydA0K DQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogTWFyayBOb3R0aW5naGFtIDxtbm90 QG1ub3QubmV0PiANClNlbnQ6IE1vbmRheSwgTWFyY2ggMTgsIDIwMTkgMzowMCBQTQ0KVG86IEhl d2l0dCwgUm9yeSA8cmhld2l0dEBha2FtYWkuY29tPg0KQ2M6IG51c2VudSA8bnVzZW51LWxpc3Rz QHJpc2V1cC5uZXQ+OyBkb2hAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbRG9oXSBbRXh0XSBSZXZp ZXdpbmcgUmVzb2x2ZXItQXNzb2NpYXRlZCBET0gNCg0KKndlbGwta25vd24gVVJJIGV4cGVydCBo YXQgb24qDQoNCldpdGhvdXQgc3BlYWtpbmcgdG8gdGhlIHRlY2huaWNhbCBtZXJpdCBvZiB0aGUg cHJvcG9zYWxzIGJlaW5nIGRpc2N1c3NlZCwgSSdkIGxpa2UgdG8gZGlzY291cmFnZSBmb2xrcyBm cm9tIHRoaW5raW5nIHRoYXQgdGhleSBjYW4gcmVzZXJ2ZSBwcmVmaXhlcyB3aXRoaW4gdGhlIGZp cnN0IHdlbGwta25vd24gVVJJIHBhdGggc2VnbWVudDsgaXQgaXMgYSBtYW5hZ2VkIHNwYWNlLCBi dXQgaWYgd2Ugc3RhcnQgdGhpcyBwcmFjdGljZSwgd2UncmUgZ29pbmcgdG8gaGF2ZSBhIG5pZ2h0 bWFyZSBtYW5hZ2luZyB0aGUgY29tcGV0aW5nIHJlcXVpcmVtZW50cy4NCg0KSWYgeW91IHdhbnQg dG8gcmVzZXJ2ZSBhIHByZWZpeCwgcmVzZXJ2ZSBzb21ldGhpbmcgbGlrZSAvLndlbGwta25vd24v ZG5zLXNlcnZlcnMvIGFuZCBwdXQgdGhlIHNwZWNpZmljIGZsYXZvdXIgYWZ0ZXIgdGhhdCAob3Ig aW4gdGhlIHJldHJpZXZlZCBmaWxlLCBvci4uLikuDQoNCkFsbCB0aGF0IHNhaWQsIGJpa2Ugc2hl ZGRpbmcgdGhlIG5hbWUgYXQgdGhpcyBwb2ludCBwcm9iYWJseSBpc24ndCBhIHRlcnJpYmx5IHBy b2R1Y3RpdmUgdXNlIG9mIHRpbWUuDQoNClRoYW5rcywNCg0KDQo+IE9uIDE5IE1hciAyMDE5LCBh dCA4OjU2IGFtLCBIZXdpdHQsIFJvcnkgPHJoZXdpdHRAYWthbWFpLmNvbT4gd3JvdGU6DQo+IA0K PiBJJ20gZmlybWx5IGluIGZhdm9yIG9mIGhhdmluZyBhIG5hbWluZyAnY29udmVudGlvbicgb2Y6 DQo+IA0KPiAJLy53ZWxsLWtub3duL2Rucy1kb2gtc2VydmVycw0KPiANCj4gSSB0aGluayBpdCdz IGNyaXRpY2FsIHRvIGhhdmUgImRucy0iIGFzIHRoZSBuYW1lIHByZWZpeCwgdG8gY2xlYXJseSBp bmRpY2F0ZSB0aGF0IHRoaXMgaXMgYSBETlMtcmVsYXRlZCBmaWxlLiBUaGVuICJkb2gtIiB0byBp bmRpY2F0ZSB0aGF0IHRoaXMgaXMgYSBEb0gtc3BlY2lmaWMgZmlsZSBhbmQgc28gb24uLi4gVXNp bmcgdGhpcyBjb252ZW50aW9uIG1lYW5zIHRoYXQgdGhlIERvVCBmb2xrcyBjYW4gY3JlYXRlIHRo ZWlyIG93biBmaWxlcyBhcw0KPiANCj4gCS8ud2VsbC1rbm93bi9kbnMtZG90LXNlcnZlcnMNCj4g DQo+IFdoaWxlIHlvdXIgaWRlYSBvZiAiLy53ZWxsLWtub3duL2Rucy1vdmVyLWh0dHBzLXNlcnZl cnMiIGZ1bGZpbGxzIHRoZSBmaXJzdCAiZG5zLSIgcGFydCBvZiBteSBjb252ZW50aW9uIChhbmQg aXQncyBhbHNvIHZlcnkgY2xlYXIgd2hhdCBpdCBpcyDwn5iKKSwgSSBndWVzcyBJJ20gYWx3YXlz IGdvaW5nIHRvIGJlIGFudHN5IHRoYXQgdGhlcmUncyBnb2luZyB0byBiZSBhIG5ldyBETlMtcmVs YXRlZCAndGVjaG5vbG9neScgaW4gdGhlIGZ1dHVyZSBjYWxsZWQgZS5nLiAiQ2Fycmllci1QaWdl b24gRE5TIiBhbmQgdGhhdCB0ZWFtIGlzIGdvaW5nIHRvIGNhbGwgdGhlaXIgZmlsZSAiLy53ZWxs LWtub3duL2NhcnJpZXItcGlnZW9uLWRucyIuIFNvIGl0J3MgYmV0dGVyIChJTUhPKSB0byBleHBs aWNpdGx5IGluZGljYXRlIHRoYXQgaXQncyBhIHNlcmllcyBvZiBUaHJlZS1MZXR0ZXItQWNyb255 bXMuLi4NCj4gDQo+IE9mIGNvdXJzZSwgYSBuYW1pbmcgY29udmVudGlvbiBvbmx5IHdvcmtzIGlm IGV2ZXJ5b25lIGJvdGgga25vd3MgYWJvdXQgaXQgYW5kIGZvbGxvd3MgaXQuIEV2ZW4gaWYgd2Ug ZGVjaWRlIHRvIHVzZSBhICdzdHJpY3QnIG5hbWluZyBjb252ZW50aW9uLCB1bmxlc3MgaXQncyBi b3RoICdwdWJsaWNpemVkJyBhbmQgJ2VuZm9yY2VkJywgaXQncyBraW5kYSB1c2VsZXNzLg0KDQot LQ0KTWFyayBOb3R0aW5naGFtICAgaHR0cHM6Ly93d3cubW5vdC5uZXQvDQoNCg== From nobody Mon Mar 18 15:10:34 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A450C1311A9 for ; Mon, 18 Mar 2019 15:10:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.98 X-Spam-Level: X-Spam-Status: No, score=-1.98 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id k1yfuZYYxb6L for ; Mon, 18 Mar 2019 15:10:31 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 278E31311A8 for ; Mon, 18 Mar 2019 15:10:31 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2IMAQ3t041584 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Mon, 18 Mar 2019 17:10:28 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1552947028; bh=mvBEpUVMngpnp8nOJsV1k9J0JlmcxwxZbPJMbwYsrCs=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=boJnuH/Itrf6OIOaakndAb9OBrc0pbUXlqHogZ7ddfKbfahN3ZVslyuwKXvtApAwr WbgKniXALGBka4yoBDv0UC1q1qeZOWgW/5egCTAB1czid4ACRzfMSsKAc7+0DMoTQY rulMxtOu5wWGwQeia8tveeN5qTjTAv301L8Q4KKQ= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Mark Nottingham , "Hewitt, Rory" Cc: nusenu , "doh@ietf.org" References: <5690c5b2-65ab-55d4-b3ec-d06d82ebbb26@riseup.net> <7F06A457-58C6-47A0-BDCA-D25FF0C6C062@icann.org> <392246eb108b4421b63f0813f71d3b75@ustx2ex-dag1mb3.msg.corp.akamai.com> <8d56232b-8933-bf8a-186b-e44597364e14@riseup.net> <75491a04058f42ef923a01ccc748fad9@ustx2ex-dag1mb3.msg.corp.akamai.com> <7EAD04F0-5FEB-42DE-92FE-C0B1889B79A2@mnot.net> From: Adam Roach Message-ID: Date: Mon, 18 Mar 2019 17:10:21 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <7EAD04F0-5FEB-42DE-92FE-C0B1889B79A2@mnot.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Doh] [Ext] Reviewing Resolver-Associated DOH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 22:10:33 -0000 [no hats] On 3/18/19 4:59 PM, Mark Nottingham wrote: > All that said, bike shedding the name at this point probably isn't a terribly productive use of time. I'm starting to get sad that we defined this as an arbitrary namespace instead of a sequence of integers assigned by IANA. /.well-known/27/ /a From nobody Mon Mar 18 16:24:30 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3E56F1286CD for ; Mon, 18 Mar 2019 16:24:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MLRLMAMTJr-2 for ; Mon, 18 Mar 2019 16:24:27 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 521321279A3 for ; Mon, 18 Mar 2019 16:24:27 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 73C601A0CAE; Mon, 18 Mar 2019 16:24:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552951466; bh=Qav/PwG+P+83gqyTQFz31EFXVFAW8QP0F6+PpatspXg=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=bMNa4p2fTouM/QvqexoKu+eAbNwtvYa+k8JElBsEMKclHyC/2y3hkQazoi10KxT2M jr2t1pg9YMhLxSsoOeZiTyAUl58qQHCkApFGt9TNgWIzKg4519ZcUQn3Muw/pKyKDo hLya+Nbcyp44XCGnx9YSIdvIAQCt1s1rexAyc1X4= X-Riseup-User-ID: CE75AE65C0097258FFFAA764760B4B7CCD4974B80573586EC17D6272EA20F3FB Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 42280120469; Mon, 18 Mar 2019 16:24:24 -0700 (PDT) To: Ben Schwartz Cc: DoH WG References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: Date: Mon, 18 Mar 2019 23:24:00 +0000 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="DvmpkZjJ8WCKWvbEUus2Fib71BW2JAAXF" Archived-At: Subject: Re: [Doh] security goals X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 18 Mar 2019 23:24:29 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --DvmpkZjJ8WCKWvbEUus2Fib71BW2JAAXF Content-Type: multipart/mixed; boundary="GJyqo126b5xndQpWp3buD3I9vbIT4t6GY"; protected-headers="v1" From: nusenu To: Ben Schwartz Cc: DoH WG Message-ID: Subject: Re: [Doh] security goals References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> In-Reply-To: --GJyqo126b5xndQpWp3buD3I9vbIT4t6GY Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Ben Schwartz: > DoT is currently discovered by probing port 853 on the resolver's IP > address. Is this sufficient for your use case? that is the current status quo with no specification that defines DoT discovery mechanisms (or is it?). In an I-D I'd include: - a mechanism that does not force the operator to use the same IP for Do5= 3 and DoT=20 (other than just for the initial discovery mechanism) - allows multiple DoT endpoints for increased redundancy - allows the Do53 resolver operator to support DoT without running DoT servers themselves - running DoT on non-853 ports (i.e. 443) =20 >> What security properties are we aiming for? >> >> I'd like to see a protocol that is not vulnerable to man-in-the-middle= >> and downgrade attacks, even if that means that use-cases that can't >> detect the IP address of the currently used resolver can not be covere= d. >> >=20 > An active adversary "in the middle" can fully substitute itself for a D= o53 > resolver without alerting the user. Do you see an achievable defense > against downgrade attacks, or is this not part of your threat model? Good point, lets define a threat model first: Consider an adversary that has the following capabilities: - can manipulate and read any network traffic from the user (including DH= CP) - the adversary's capabilities are limited to some networks (i.e. public wifis) but he has no global capabilities - the attacker can _not_ issue trusted certificates for arbitrary IP addr= esses - the adversary has _no_ access to the client system =20 security goals: if the victim uses DHCP for Do53 discovery: - prevent attacks that impact the victim's DoH server URI beyond the visit in an adversary-controlled network (i.e. public wifis) if the client is configured to use a static Do53 server (no DHCP for DNS = server discovery used): - prevent the adversary from feeding the victim with his DoH URI - prevent a silent downgrade attack that makes the victim believe a previously discovered DoH server does no longer speak DoH (to force the= victim to plain Do53) As outlined in [1] I believe these goals are currently not met yet and an= adversary can feed a victim his DoH server URI even beyond the victim's visit in the adversary contro= lled network. It would be great if we could improve this (I think we can). kind regards, nusenu [1] https://mailarchive.ietf.org/arch/msg/doh/295yrI72xt0eSnYueiOuqVpSj4s= --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --GJyqo126b5xndQpWp3buD3I9vbIT4t6GY-- --DvmpkZjJ8WCKWvbEUus2Fib71BW2JAAXF Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyQKKAACgkQrWE4wkXN Qn7EMhAAyve7m/F2UT6xUStEupRTQjHNAfX6iwDpwgOWSNBYhQjki4iMYCHaK8K0 aIwCHRJWOsV6eFgWda3oFwvLieu6QNwSDBOz9+rnKNmfhvw8WnLLEoTKxwUYhfYS tE2TbgJmzCXA1wd8UlqiIflFukgHBogsK9lfubiATHjfeJWKbgaYH7qsOOJYCFrK jKGXUc6gi1M1GFJ17qsn7s1YXMIklYm9w38Ygn6f/0/6/ijy6jBOqHklRq3+IXxp PCULtR2uo8rhkvfOGpogSnk6U3pzsr74ATKnhX5GHEpaQJoM0qfwcuE/mguGkvbj q+iW2fB2BYmEBOYfnZs3mDgErG3ItNWsNGWfigDRYHKmw5p05edmUjYm1d3zQAFe mVu1qYVBLYpfUYy0n3RElRYZaQ240RmuhiVnZisSzrVzjZGpuaUwM0ZO/FiOhlJO LZVHGu8zDq6lBx5VrouSMXSywh8/D2gUpbD6o5FpVpke4JrHHG0QN7yp09yOnSAf C8cOZQQuaFpqxKNATAL6AZ5l3PA0DamevT29ug+/+eQW92Y0dyUbNduHkv3T0PsQ Io3YUV5c8joR2qNG3z0O35rfzPTjxsYd7TUFc5ltSVbvIonfCyULGXlPsmpCMY1J Afodq83XSb/v1yCDWlK6C7xrK/JfatCeM9warRrNE3uAyZ59Wzc= =kRgB -----END PGP SIGNATURE----- --DvmpkZjJ8WCKWvbEUus2Fib71BW2JAAXF-- From nobody Mon Mar 18 17:50:38 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D876130EA0 for ; Mon, 18 Mar 2019 17:50:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kb6Bgw29CI-O for ; Mon, 18 Mar 2019 17:50:27 -0700 (PDT) Received: from mail-io1-xd44.google.com (mail-io1-xd44.google.com [IPv6:2607:f8b0:4864:20::d44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E107C130E62 for ; Mon, 18 Mar 2019 17:50:26 -0700 (PDT) Received: by mail-io1-xd44.google.com with SMTP id x4so16205874ion.2 for ; Mon, 18 Mar 2019 17:50:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=osbGCx9CTwW1EEJmPFdOVofldFUdch/krTEjk7gTiME=; b=r0OaS9bYEgctR/49m6rwvPAl4wbTIuuDV0hLBv8xH+LOf27Drl8/c94jRsxK+KFlKJ D2T3bL72dQaGu16ecMWNHPv+xUvOfsjtgfUgHne5z0MX9zSqJW7O/OcLMj69s/ZW09FP dUtyqCLwzUdW8+Rq4uFI8iMTs2EkJ5WLF5NZjFlxNwKJXHMUKhbvrax71rnuQMBJTAMY K967vp4IHMzvDFTZjquv0GH8J99IoLbkBTjHe/3s2ZpRE0lj9WNkhUbk1ShZXcvUJcHI BXPLnV90eCoxIgk7OrsyHGW5s04jaxdbFm5XGBh61Y5RBNKA4K9hu0gu+cTSf4mZbc6I OxFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=osbGCx9CTwW1EEJmPFdOVofldFUdch/krTEjk7gTiME=; b=TZat5LZusfF2A8ZpGAJZ/L8MhRNRbgocXYku2v+WwMRfbCAQezawNHKEH6HvTHIlOV fOj6MJP8GbdZkoPuIKUjO+236vYAz7Wo+qRl35UEKVeGv24Dcd1tny62y4ffbeVP5VUr 1JhdfANR4VSRkhUgybI9qiIXOaKJ40NgfIF2lmBr+l2w7ZaHazuHSXeNaTQhHQylPS9W J+hgsbfjyAkLix9WfT+2HbIstvIJnq0ZPHJiBDoVmj8oqdIx9ZLhCMxG0y2tHKWNvH3E fFvAOKn23I0hYdF7KcsSjbEJiGK5hQI2XEYbZjCNUvRZKS+NuY2CZ1Rp+RVrfRQ6t7Rx BK5w== X-Gm-Message-State: APjAAAXZwog1HhV37jDDZAfpHo97JW0XwnXlwbuoR8bQQc/bm3oppGo3 uVWbIXfZBjtj1yMYgpzpoClPm+J93+FvwcDMeAjHjg== X-Google-Smtp-Source: APXvYqxM3o6nAQgYe21w/vdTMs3wVvn07JdnFeJHAgdVKm3mXAfvtCTyqKzF+AMZU0EosOJouRJBpFY0tQ1ocAA9+6E= X-Received: by 2002:a6b:ec15:: with SMTP id c21mr13919943ioh.152.1552956626040; Mon, 18 Mar 2019 17:50:26 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: From: Matthew Pounsett Date: Mon, 18 Mar 2019 20:50:15 -0400 Message-ID: To: Ted Hardie Cc: Paul Vixie , dnsop , DoH WG Content-Type: multipart/alternative; boundary="0000000000000c0ee0058467e46a" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 00:50:29 -0000 --0000000000000c0ee0058467e46a Content-Type: text/plain; charset="UTF-8" On Fri, 15 Mar 2019 at 14:37, Ted Hardie wrote: > >> The past five years have not been the IETF seeking to become a king or > king-maker. They have been spent responding to an attack while still > building out the facilities of the network. I am glad to find you a ready > participant now, as there is still work to be done. But I do not believe > we have said that you may not have these facilities; the new methods simply > mean you must have a relationship with the users and devices on your > network sufficient to effect configuration to use them. An on-path > adversary does not, but you do. Yes, that adds a step and some complexity, > but dealing with a new class of attack was never likely to be free. > This, again, conflates users with attackers. I'm going to take a stab at restating the positions of several people in this thread, Paul included, because it really seems like the argument is not understood. I have a relationship with my users and I can control the configuration of their *known* applications. I do not have a relationship with the malware author that is trying to steal their data, and cannot control the configuration of that (unknown) application. By running DoT on my borders and blocking all other DNS and DoT traffic, I can provide privacy for my users while still preventing malware from doing its thing. With DoH available at endpoints that my users want to reach using some other application, it is orders of magnitude more complex for me to block the malware while still allowing my users to reach those endpoints. Phrased another way, a DoH endpoint at the same IP address as a popular website gives malware the ability to resolve names I was previously able to prevent. The only recourse I know of, if DoH is adopted, is to proxy all traffic toward that example site (including requiring me to engage in a MitM decryption attack on my users' web traffic) in order to continue to prevent that malware from circumventing network security. And because I can't predict which web sites will launch their own DoH endpoints, that means I need to proxy (and decrypt) all web traffic in order to maintain the same level of security I can today. Somewhere up-thread it was suggested that there are other reasonable steps that a network/security operator can take to maintain the controls over resolution that we have today, but so far I haven't seen them enumerated anywhere. --0000000000000c0ee0058467e46a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, 15 Mar 2019 at 14:37, Ted Har= die <ted.ietf@gmail.com> wr= ote:

The past fi= ve years have not been the IETF seeking to become a king or king-maker.=C2= =A0 They have been spent responding to an attack while still building out t= he facilities of the network.=C2=A0 I am glad to find you a ready participa= nt now, as there is still work to be done.=C2=A0 But I do not believe we ha= ve said that you may not have these facilities; the new methods simply mean= you must have a relationship with the users and devices on your network su= fficient to effect configuration to use them.=C2=A0 An on-path adversary do= es not, but you do.=C2=A0 Yes, that adds a step and some complexity, but de= aling with a new class of attack was never likely to be free.=C2=A0

This, again, co= nflates users with attackers.=C2=A0=C2=A0

I'm = going to take a stab at restating the positions of several people in this t= hread, Paul included, because it really seems like the argument is not unde= rstood.=C2=A0=C2=A0

I have a relationship with my = users and I can control the configuration of their *known* applications.=C2= =A0 I do not have a relationship with the malware author that is trying to = steal their data, and cannot control the configuration of that (unknown) ap= plication.=C2=A0 By running DoT on my borders and blocking all other DNS an= d DoT traffic, I can provide privacy for my users while still preventing ma= lware from doing its thing.=C2=A0 With DoH available at endpoints that my u= sers want to reach using some other application, it is orders of magnitude = more complex for me to block the malware while still allowing my users to r= each those endpoints.=C2=A0 Phrased another way, a DoH endpoint at the same= IP address as a popular website gives malware the ability to resolve names= I was previously able to prevent.=C2=A0 The only recourse I know of, if Do= H is adopted, is to proxy all traffic toward that example site (including r= equiring me to engage in a MitM decryption attack on my users' web traf= fic) in order to continue to prevent that malware from circumventing networ= k security.=C2=A0 And because I can't predict which web sites will laun= ch their own DoH endpoints, that means I need to proxy (and decrypt) all we= b traffic in order to maintain the same level of security I can today.

Somewhere up-thread it was suggested that there are ot= her reasonable steps that a network/security operator can take to maintain = the controls over resolution that we have today, but so far I haven't s= een them enumerated anywhere.


--0000000000000c0ee0058467e46a-- From nobody Mon Mar 18 19:13:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C2F612796B for ; Mon, 18 Mar 2019 19:13:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jn9t_zlZ8W_I for ; Mon, 18 Mar 2019 19:13:24 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB0B71277D0 for ; Mon, 18 Mar 2019 19:13:23 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 18 Mar 2019 19:13:21 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Mon, 18 Mar 2019 19:13:21 -0700 From: Paul Hoffman To: nusenu CC: DoH WG Thread-Topic: [Ext] [Doh] security goals Thread-Index: AQHU3flTujxaXMgiLUG8zrnVWyjlKQ== Date: Tue, 19 Mar 2019 02:13:21 +0000 Message-ID: <4EE8D24D-1CC4-4E57-87B2-BEC9DC465E12@icann.org> References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <3A5777F31A5C934C9A3A69B968F7ECAC@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] security goals X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 02:13:26 -0000 On Mar 18, 2019, at 4:24 PM, nusenu wrote: >=20 > Ben Schwartz: >> DoT is currently discovered by probing port 853 on the resolver's IP >> address. Is this sufficient for your use case? >=20 > that is the current status quo with no specification that defines > DoT discovery mechanisms (or is it?). In an I-D I'd include: >=20 > - a mechanism that does not force the operator to use the same IP for Do5= 3 and DoT=20 > (other than just for the initial discovery mechanism) > - allows multiple DoT endpoints for increased redundancy > - allows the Do53 resolver operator to support DoT without running DoT > servers themselves > - running DoT on non-853 ports (i.e. 443) If you want to update RFC 7858, that's great, but this would all be work fo= r the DPRIVE WG, which is the one that standardized DoT.=20 --Paul Hoffman= From nobody Tue Mar 19 00:13:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B0C621274A1 for ; Tue, 19 Mar 2019 00:13:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uf1UM_kWHD2s for ; Tue, 19 Mar 2019 00:13:44 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 77D551240D3 for ; Tue, 19 Mar 2019 00:13:44 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 877AD1A0C4E for ; Tue, 19 Mar 2019 00:13:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1552979623; bh=SOnYLXum8O39A7zT++iJhumHhgQe8fCVWPhaBi4AM64=; h=References:To:From:Subject:Date:In-Reply-To:From; b=JZseV25OzKKa3MCjudKoauz/zK1Y5THXDgNaYGeDxwqayLWlRxxdDv2gmwa4fWyOi hgIbYLFiNwkRkVpAvZm0JzY2ubRTqz3p9TnM818adhVXKybfC2Jc2tcA6uQ57yCrQO 7L/NTMrkfMSLLdnOHJAK08REQCF7IX4LEhZyPnm0= X-Riseup-User-ID: F41F645C1240A31AF82BAEA7A2779F6380E39AA88B848B1E70664C8F45BD8CDD Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 5B28B1207E5 for ; Tue, 19 Mar 2019 00:13:41 -0700 (PDT) References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> <4EE8D24D-1CC4-4E57-87B2-BEC9DC465E12@icann.org> To: DoH WG From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <328e04f2-884d-7520-3293-b20ca854ad5b@riseup.net> Date: Tue, 19 Mar 2019 07:13:00 +0000 MIME-Version: 1.0 In-Reply-To: <4EE8D24D-1CC4-4E57-87B2-BEC9DC465E12@icann.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="gzpMBdXwDKF3xz9qAPhCCH5NcdtpxRaYV" Archived-At: Subject: [Doh] DoH discovery security goals X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 07:13:47 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gzpMBdXwDKF3xz9qAPhCCH5NcdtpxRaYV Content-Type: multipart/mixed; boundary="8HS5OMiWl2nHmGYlQR4K4ykXPCtfUPcTD"; protected-headers="v1" From: nusenu To: DoH WG Message-ID: <328e04f2-884d-7520-3293-b20ca854ad5b@riseup.net> Subject: [Doh] DoH discovery security goals References: <4de48a75-955d-89e3-7da3-4a1876edc53a@riseup.net> <72a7be2c-918a-c2ab-0df8-dab6253532e5@riseup.net> <4EE8D24D-1CC4-4E57-87B2-BEC9DC465E12@icann.org> In-Reply-To: <4EE8D24D-1CC4-4E57-87B2-BEC9DC465E12@icann.org> --8HS5OMiWl2nHmGYlQR4K4ykXPCtfUPcTD Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable > If you want to update RFC 7858, that's great, but this would all be > work for the DPRIVE WG, which is the one that standardized DoT. =20 Yes I'm aware, I just replied to this question in Ben's email since he as= ked here. The rest of the email was related to the current=20 Resolver-Associated DoH draft: >> An active adversary "in the middle" can fully substitute itself for a = Do53 >> resolver without alerting the user. Do you see an achievable defense >> against downgrade attacks, or is this not part of your threat model? >=20 > Good point, lets define a threat model first: >=20 > Consider an adversary that has the following capabilities: >=20 > - can manipulate and read any network traffic from the user (including = DHCP) >=20 > - the adversary's capabilities are limited to some networks > (i.e. public wifis) but he has no global capabilities >=20 > - the attacker can _not_ issue trusted certificates for arbitrary IP ad= dresses > - the adversary has _no_ access to the client system > =20 > security goals: > if the victim uses DHCP for Do53 discovery: > - prevent attacks that impact the victim's DoH server URI > beyond the visit in an adversary-controlled network (i.e. public wifis)= >=20 > if the client is configured to use a static Do53 server (no DHCP for DN= S server discovery used): > - prevent the adversary from feeding the victim with his DoH URI > - prevent a silent downgrade attack that makes the victim believe > a previously discovered DoH server does no longer speak DoH (to force t= he victim to plain Do53) >=20 > As outlined in [1] I believe these goals are currently not met yet and = an adversary can feed a victim > his DoH server URI even beyond the victim's visit in the adversary cont= rolled network. > It would be great if we could improve this (I think we can). --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --8HS5OMiWl2nHmGYlQR4K4ykXPCtfUPcTD-- --gzpMBdXwDKF3xz9qAPhCCH5NcdtpxRaYV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyQlqAACgkQrWE4wkXN Qn41nxAA0w9xnzRt7bf6fwG7FquoYTjBu47S6Xsjhbcow/jVtCqOHRi/vN3CphzN jf8pWD321oYylnfq9Vhi/RhMozEY/Ih9+GlCjoTI6GHZmMFxLUfAqFANXhYDfKHM K9a8f1YaTX9D5zS6qCP52PTO2OIkzLzdgHtShJh/WMpJljKE5DeYFtHvTk16pTjj Ip7iR9qY3no2HsIjhThlMKCPDDCkc5uInSqxMMyWtlvzF3dCUfM8hPDb6fzOP2IM dCpWhwV5HcK7ipXxWuLEFgC2dj4mc3/DESjXgnaEfo8D+SCQJl69NbDVbnocLAFM oNwP0Jj3+3aTtjoOvpwijtbCUoLtywami2EezxmHNpyez4bRdqFxoWUDogFXFxdK MLcjb6m29LeUE+mdKYTUm5eZjIbidp9ASjtFOnmmr6L+kLTFDcuowidfT6Gf7g8D jOkEFV9tTNFbBKiiuzRwrv0m55C8NoNqA4YdqVQWaFjlUAEZkRpIE4l2WGuGUqM2 zyMdEVN2Ujtcr0POZ751ypnQybswDclQkAtyH/1uQnZ/py5b6fUreTYwCo0TqyYL g7nY2NImUtGdtWS0MYTCfslvEmm9bPABwew48q3sMfzydCE05ke4D8QMuraM9Ogt 0HP08/5g8tSPlv1dK/qRFixtXZdXwdrkF4rgpP6AQbpWlkY6PPs= =j8pG -----END PGP SIGNATURE----- --gzpMBdXwDKF3xz9qAPhCCH5NcdtpxRaYV-- From nobody Tue Mar 19 00:51:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 245F01311BF; Tue, 19 Mar 2019 00:51:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X2gan6shKPip; Tue, 19 Mar 2019 00:51:00 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2AFC91274A1; Tue, 19 Mar 2019 00:51:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=6134; q=dns/txt; s=iport; t=1552981860; x=1554191460; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=Y39Ho1Acxa113SbZ0GVOuin9B+CBF4Z2ZVdBwTokR9o=; b=TtuxlnZ8eQHpHKobnoA9QKLRFqCDIym7An8KhKgJo4gxPMkxDgmkZWfa Ygy9p79BJBhY/LtFl02MMeo5TiqAoYDsHyUAunmOFFh5xsFA/6UrhWsdA H7V98rizT9H0KazZnBbE9xArUdakFwd+hc3xvb0E2sBcQJHQYKBxnWFJa M=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BVAAACn5Bc/xbLJq1jGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZYEPgjohEieEC4h7jDMlkjyHcQgDAQGEbAKEfDgSAQEDAQE?= =?us-ascii?q?JAQMCbSiFSgEBAQMBI1YFCwsECgoqAgJXBhMfgwMBgW0IqVaBL4VGhGwPgS8?= =?us-ascii?q?BgUiJf4F/gTgME4JMiAsxgiYDilyHBJMHCYRhjkoZixKIS5sfgnACBAYFAhW?= =?us-ascii?q?BXiGBVjMaCBsVZQGCQT6BWBeOHz4DMIo1AQE?= X-IronPort-AV: E=Sophos;i="5.58,497,1544486400"; d="asc'?scan'208,217";a="10827738" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 19 Mar 2019 07:50:52 +0000 Received: from [10.61.226.181] ([10.61.226.181]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2J7opdc006812 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 19 Mar 2019 07:50:52 GMT From: Eliot Lear Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_1B84DB7B-41F0-4581-9A4A-D7D6CF962C9E"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 19 Mar 2019 08:50:50 +0100 In-Reply-To: Cc: Ted Hardie , dnsop , DoH WG , Paul Vixie To: Matthew Pounsett References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.226.181, [10.61.226.181] X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 07:51:03 -0000 --Apple-Mail=_1B84DB7B-41F0-4581-9A4A-D7D6CF962C9E Content-Type: multipart/alternative; boundary="Apple-Mail=_5F73E505-3892-45A1-8DB4-E5FE4301B69D" --Apple-Mail=_5F73E505-3892-45A1-8DB4-E5FE4301B69D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Matthew > On 19 Mar 2019, at 01:50, Matthew Pounsett wrote: >=20 > Somewhere up-thread it was suggested that there are other reasonable = steps that a network/security operator can take to maintain the controls = over resolution that we have today, but so far I haven't seen them = enumerated anywhere. >=20 I had stated that one can use an MDM to manage the endpoint=E2=80=99s = use of DoH. This doesn=E2=80=99t eliminate the possibility of malware, = but does reduce misconfiguration in the enterprise, and provides for = some protection against infection by blocking known bad names. In addition, there=E2=80=99s at least a heuristic for detection: compare = data plane activity against ANSWERs. If you=E2=80=99re seeing activity = to addresses that don=E2=80=99t match (modulo some noise), you know an = alternate resolver is active on that device. And while it=E2=80=99s = possible for malware to mimic queries to Do53 for Good sites versus what = it really wants to access, you start tarnishing the rep of the IP = address as and when you detect the problem through other means (AV s/w, = honey pots, binary inspection, et al). That leaves it with cloud = providers to sort their wagons. It might also be possible to whitelist ANSWERs into iptables. I wrote = the code for that for a dnscap plugin some years ago, and you could even = play with it if you want (it=E2=80=99s on GitHub), but I=E2=80=99m not = suggesting it=E2=80=99s a good general answer (it was intended for a = very specific use case involving relatively few domains for (hopefully = cooperating) IoT devices). As you point out, it won=E2=80=99t tackle = shared IP addresses, and quite frankly, little CPE gear won=E2=80=99t = scale with a gazillion iptables entries (I=E2=80=99m not sure big gear = would either). Eliot --Apple-Mail=_5F73E505-3892-45A1-8DB4-E5FE4301B69D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Matthew

On 19 Mar 2019, at 01:50, = Matthew Pounsett <matt@conundrum.com> wrote:

Somewhere up-thread it was suggested that there are other = reasonable steps that a network/security operator can take to maintain = the controls over resolution that we have today, but so far I haven't = seen them enumerated anywhere.


I had stated that one can use an MDM to = manage the endpoint=E2=80=99s use of DoH.  This doesn=E2=80=99t = eliminate the possibility of malware, but does reduce misconfiguration = in the enterprise, and provides for some protection against infection by = blocking known bad names.

In addition, there=E2=80=99s at least a heuristic for = detection: compare data plane activity against ANSWERs.  If = you=E2=80=99re seeing activity to addresses that don=E2=80=99t match = (modulo some noise), you know an alternate resolver is active on that = device.  And while it=E2=80=99s possible for malware to mimic = queries to Do53 for Good sites versus what it really wants to access, = you start tarnishing the rep of the IP address as and when you detect = the problem through other means (AV s/w, honey pots, binary inspection, = et al).  That leaves it with cloud providers to sort their = wagons.

It = might also be possible to whitelist ANSWERs into iptables. I wrote the = code for that for a dnscap plugin some years ago, and you could even = play with it if you want (it=E2=80=99s on GitHub), but I=E2=80=99m not = suggesting it=E2=80=99s a good general answer (it was intended for a = very specific use case involving relatively few domains for (hopefully = cooperating) IoT devices).  As you point out, it won=E2=80=99t = tackle shared IP addresses, and quite frankly, little CPE gear won=E2=80=99= t scale with a gazillion iptables entries (I=E2=80=99m not sure big gear = would either).

Eliot
= --Apple-Mail=_5F73E505-3892-45A1-8DB4-E5FE4301B69D-- --Apple-Mail=_1B84DB7B-41F0-4581-9A4A-D7D6CF962C9E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyQn1oACgkQh7ZrRtnS ejPgtQf9Elm0HzFkga2BC0Q/sxuBm0vg62hetHgu+Nkka20l7529kbmRXle2Z859 n0XSRbDLPio0TMCDol07NtTdnQ+dWrcCFYAYRnv7hW1r7JagJxwigpIn36kUIEc9 2wD/SqL+BHhxWufYqvxaHJkMIR6Oxr6G/RdqjGa9yYZqde1/fypeWZsFHb+Cttxe e2s2Em2OeWOmTtia4G6907F0w+HTjPKJ9v1N61bpxnWQ/MqoPagkiUahtrIwPq34 2tdsb8Qh8figZGy3/EmX3hqxPTdtJhHQpPFIjfBnYocR91r/BKQNVb3MoNtRFyoy zkZ9OYolMj0MyDugGXB9UMIRAHb03w== =BOwP -----END PGP SIGNATURE----- --Apple-Mail=_1B84DB7B-41F0-4581-9A4A-D7D6CF962C9E-- From nobody Tue Mar 19 06:10:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9488212787F for ; Tue, 19 Mar 2019 06:10:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hCbjB15Lbf49 for ; Tue, 19 Mar 2019 06:10:37 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEE1A127B50 for ; Tue, 19 Mar 2019 06:10:36 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id x12so5842547qts.7 for ; Tue, 19 Mar 2019 06:10:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=/Qhd1Cihr66UTzcwXAwzHZLhchzWgnYIdERUCaw/mYM=; b=OJAIklVvMtBuSfI3XfW5LgNmaK20TcStIMkUAS2Q4fHVOlqBWFWnX6IyzyrrjLEVlQ BrLmTIfhqZjWqk3xJGmQ4rbXArRoOot4w8kk1uX2rOHq6fs2kjCaU8TbCZaHfqZu5hGd XJgHY6MIK0+h0XhtQ4TCt87UqWYvrqFrviaCSJ/TDA241RZw5ttTRXEXrGucXEbjsBsk hYbClDz5dN1zdp4qKEIKm2eHfqVHGu1dShrU8MJhF9xjDdHDkVkoeGuUBqPzs1Q73AS5 t4J6D9S141eQZ9NVUoh/5SK/TGTjyFR9fEHH0LCyFTwEmQjrwY3lFGV6cIJzF75bqEbL xMiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=/Qhd1Cihr66UTzcwXAwzHZLhchzWgnYIdERUCaw/mYM=; b=FwjFPeFWn7sZlNJK579qTn9MuhoiCuuQzQ3j9UVfMolyu7xD62hW6FLwWGYtacw8Bn HyeLmwmfROIOyD6HmCqUNKcPyoautbB+1LwxpLy9CIN6PfVcsWE4y1Nmr9WTHAhwvldI EwXyg8WhxlV+3CGg6fMD6tXCV1Kb5XmrYZ19hH96AYytrAoSuqehPrb1GJpZ1rgEl7Cb 63fo1IEgJm4hnKKbRaWOqNK6qTTjVoIzoM4fQrjBkQGbF2S5HUSZk8cvkLLpQtzYKrm5 tMijpfNK4WpGLF2cyplg1tAW4hNrlEcH6A7PPISkVOimIMuTdLT4+4S2PooIUCAqkbJh J+OA== X-Gm-Message-State: APjAAAWgJjuh3x1x8r+gUTMzVCxoGMGErz1xviqgsxD3Mc6Ht8HGw/ZQ EdOr+shQH0t2+Jz/PE7FFMTUEHgah3kr7w== X-Google-Smtp-Source: APXvYqyxumtiZqi3X0D2/AvfQV4M12epFrcTSDSPiOiz1yRslMM2z4AMf9PyH3LNGDJCZ5Kj8fMv1g== X-Received: by 2002:a0c:9e6b:: with SMTP id z43mr1795758qve.131.1553001036063; Tue, 19 Mar 2019 06:10:36 -0700 (PDT) Received: from [10.0.100.12] (c-73-186-137-119.hsd1.nh.comcast.net. [73.186.137.119]) by smtp.gmail.com with ESMTPSA id a20sm3396322qth.88.2019.03.19.06.10.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 19 Mar 2019 06:10:35 -0700 (PDT) From: Ted Lemon Message-Id: <0E83C55B-2546-4C8B-80DB-8E8403C8CA47@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_48A189CD-161E-449B-9CC5-76EF0D1FBBC8" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.2\)) Date: Tue, 19 Mar 2019 09:10:31 -0400 In-Reply-To: Cc: DoH WG , dnsop To: Eliot Lear References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> X-Mailer: Apple Mail (2.3445.104.2) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 13:10:39 -0000 --Apple-Mail=_48A189CD-161E-449B-9CC5-76EF0D1FBBC8 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Mar 19, 2019, at 3:50 AM, Eliot Lear wrote: > It might also be possible to whitelist ANSWERs into iptables. I wrote = the code for that for a dnscap plugin some years ago, and you could even = play with it if you want (it=E2=80=99s on GitHub), but I=E2=80=99m not = suggesting it=E2=80=99s a good general answer (it was intended for a = very specific use case involving relatively few domains for (hopefully = cooperating) IoT devices). As you point out, it won=E2=80=99t tackle = shared IP addresses, and quite frankly, little CPE gear won=E2=80=99t = scale with a gazillion iptables entries (I=E2=80=99m not sure big gear = would either). Link? --Apple-Mail=_48A189CD-161E-449B-9CC5-76EF0D1FBBC8 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Mar 19, 2019, at 3:50 AM, Eliot Lear <lear@cisco.com> wrote:
It might also be possible to whitelist ANSWERs = into iptables. I wrote the code for that for a dnscap plugin some years = ago, and you could even play with it if you want (it=E2=80=99s on = GitHub), but I=E2=80=99m not suggesting it=E2=80=99s a good general = answer (it was intended for a very specific use case involving = relatively few domains for (hopefully cooperating) IoT devices). =  As you point out, it won=E2=80=99t tackle shared IP addresses, and = quite frankly, little CPE gear won=E2=80=99t scale with a gazillion = iptables entries (I=E2=80=99m not sure big gear would = either).

Link?


= --Apple-Mail=_48A189CD-161E-449B-9CC5-76EF0D1FBBC8-- From nobody Tue Mar 19 06:13:40 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 35BE7127B50; Tue, 19 Mar 2019 06:13:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ge0K7ASLc2y9; Tue, 19 Mar 2019 06:13:31 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00DE212787F; Tue, 19 Mar 2019 06:13:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4741; q=dns/txt; s=iport; t=1553001211; x=1554210811; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=WY6J+4oL4RdEuRGkeRc4L7A60L7ZXYesECXSx8z4ay8=; b=XJzjCg0lH7RjgG8YfrIui6sNTbLZLLNj5O6yinwICRnmd2n/ELJAcn94 ft3cemUu3kSsrhr2MZ9cK1danJ5lpP8Mowlc/v5+oxt3ppXwLz+g9qMRR M1P8vvxjNEyYIm9oOhKgntCqZAXRxtW2Qj3qLZIqDGINTmCjnl+gY7tyY k=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A+AAA+6pBc/xbLJq1jGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYEPgWpQIRInhAuIe4wzJZI8h3EIAwEBH4RNAoUNOBI?= =?us-ascii?q?BAQMBAQkBAwJtHAyFSgEBAQECASNWBQsLBAoKJwMCAkYRBhMfgwMBgW0IqVa?= =?us-ascii?q?BL4VGhGkKBYEvAYFIiX+Bf4E4DBOCTIMeAoE6gzExgiYDkWCTCQmEYYJ8i08?= =?us-ascii?q?ZixOIS5BCRYoYgnACBAYFAhWBXiGBVjMaCBsVZQGCQT6BWBeDS4pUPgMwh2i?= =?us-ascii?q?CTQEB?= X-IronPort-AV: E=Sophos;i="5.58,498,1544486400"; d="asc'?scan'208,217";a="10837708" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 19 Mar 2019 13:13:28 +0000 Received: from [10.61.226.181] ([10.61.226.181]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2JDDRXO027526 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 19 Mar 2019 13:13:28 GMT From: Eliot Lear Message-Id: <2248B13A-6323-476F-920E-BBCFB59D62A5@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_2FA178C0-E462-4222-B3F3-B168F9B40130"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 19 Mar 2019 14:13:26 +0100 In-Reply-To: <0E83C55B-2546-4C8B-80DB-8E8403C8CA47@fugue.com> Cc: DoH WG , dnsop To: Ted Lemon References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <0E83C55B-2546-4C8B-80DB-8E8403C8CA47@fugue.com> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.226.181, [10.61.226.181] X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 13:13:34 -0000 --Apple-Mail=_2FA178C0-E462-4222-B3F3-B168F9B40130 Content-Type: multipart/alternative; boundary="Apple-Mail=_F4CC951C-F8B8-4277-B516-3FF8FB089490" --Apple-Mail=_F4CC951C-F8B8-4277-B516-3FF8FB089490 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On 19 Mar 2019, at 14:10, Ted Lemon wrote: >=20 > On Mar 19, 2019, at 3:50 AM, Eliot Lear > wrote: >> It might also be possible to whitelist ANSWERs into iptables. I wrote = the code for that for a dnscap plugin some years ago, and you could even = play with it if you want (it=E2=80=99s on GitHub), but I=E2=80=99m not = suggesting it=E2=80=99s a good general answer (it was intended for a = very specific use case involving relatively few domains for (hopefully = cooperating) IoT devices). As you point out, it won=E2=80=99t tackle = shared IP addresses, and quite frankly, little CPE gear won=E2=80=99t = scale with a gazillion iptables entries (I=E2=80=99m not sure big gear = would either). >=20 > Link? >=20 Sure. It=E2=80=99s my branch off of dnscap. = https://github.com/elear/dnscap . See = plugins/aclm. Limited doc is available, but anyone who wants to play = just let me know. Eliot --Apple-Mail=_F4CC951C-F8B8-4277-B516-3FF8FB089490 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8

On 19 Mar 2019, at 14:10, Ted Lemon <mellon@fugue.com> = wrote:

On Mar 19, 2019, at = 3:50 AM, Eliot Lear <lear@cisco.com> wrote:
It might also be = possible to whitelist ANSWERs into iptables. I wrote the code for that = for a dnscap plugin some years ago, and you could even play with it if = you want (it=E2=80=99s on GitHub), but I=E2=80=99m not suggesting it=E2=80= =99s a good general answer (it was intended for a very specific use case = involving relatively few domains for (hopefully cooperating) IoT = devices).  As you point out, it won=E2=80=99t tackle shared IP = addresses, and quite frankly, little CPE gear won=E2=80=99t scale with a = gazillion iptables entries (I=E2=80=99m not sure big gear would = either).

Link?



Sure.  It=E2=80=99s my branch off of dnscap. =  https://github.com/elear/dnscap.  See plugins/aclm. =  Limited doc is available, but anyone who wants to play just let me = know.

Eliot

= --Apple-Mail=_F4CC951C-F8B8-4277-B516-3FF8FB089490-- --Apple-Mail=_2FA178C0-E462-4222-B3F3-B168F9B40130 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyQ6vYACgkQh7ZrRtnS ejPpSwgA0WX2pyFR9wUgMpgWQJHQiyfsF5t92nQEssnR9JCfFS1yfOo11ZJdTAeW MZ2rqiIdMuI2PmZUYHwr+LJlKXNlNdJYjzCj4l0En2TMhErw0zmfjxLwXzsI28A1 KTr5Zp8/XIcfhqDNI5J4rFY2rTLAIxVvKIFtef2Bcqjhyn1O4Uv63AhCDcxRl3d1 VyynbXmhQn2x+1Mn7o0mqrc5mY9t24NRJtmGzE8BwLJHntc1i8WQ/eOarV3ftT43 CQnq3ST2rNUETN3/45o0mZe4tE8qSKO3m5+B7zZhvoWlOhQNEDnzhsYJli+ny2vJ xbWw82B6BbW8tuDTPFly96OaHv7rhA== =CYGu -----END PGP SIGNATURE----- --Apple-Mail=_2FA178C0-E462-4222-B3F3-B168F9B40130-- From nobody Tue Mar 19 10:37:51 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F38CC1315A7 for ; Tue, 19 Mar 2019 10:37:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CilxY_srZJft for ; Tue, 19 Mar 2019 10:37:42 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E22C1315B1 for ; Tue, 19 Mar 2019 10:37:42 -0700 (PDT) Received: from xsmtp06.mail2web.com ([168.144.250.232]) by mx37.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h6IgD-0004ey-8z for doh@ietf.org; Tue, 19 Mar 2019 18:37:40 +0100 Received: from [10.5.2.14] (helo=xmail04.myhosting.com) by xsmtp06.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h6Ig7-0006XV-IB for doh@ietf.org; Tue, 19 Mar 2019 13:37:35 -0400 Received: (qmail 905 invoked from network); 19 Mar 2019 17:37:21 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail04.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 19 Mar 2019 17:37:20 -0000 To: Eliot Lear , Matthew Pounsett Cc: Ted Hardie , DoH WG , Paul Vixie , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> Date: Tue, 19 Mar 2019 10:37:08 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="VN750uGYpYHVIJ8TAzr8qOOVUkaqMii6v" X-Originating-IP: 168.144.250.232 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.17) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5iHCTjRzujY5H9a5CUljdn5602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxUfLHXnCBF2n8aE3q5g6Wdkh5 mNm/WjPqhYqCeBiCKwzwNnO0oYiZjOnC1Xa7kCO2sYjO05mTPID+/6Aj9ZzRI/vRa7MR4hgRIg8N 1QlY4G7x1YBTEs55LirRLgpsvCFt8i77Wu2Jb/TI0CxS53moc/SlgXpNwUDmiieE9G+9VqfZ1kay mqFCHRp6u+mIhIXg5jssJAnfERZ2C5vj1sOdsnQOD0r6/AaHZiEtdTMtMljoSvSqrGwueTSCQFid cy15jQ4HwbF4aWaRl0axA525ouWBOXp8nHKe0R+FkIqN7hkgzj0zEmu34GPXR572RNl5VgW9/bkt U41htiJ8fk7NkHmplbyYh4+w03es32OzjfSo5Jhwk+hMTKYppuA2BaWeipTPWMHGUquOFNpW9R6n Md9TLrF9l3ItGfA/WrnALV5BhFjwanMsx4Rx/4gso194T4ZD1GbCoCPKxVKv6aZNQCLPq+NPNybe XACIe4ppGmY69TdE5SQ4dxJir0Y8rHr0CnFV4ppbCSIV+5MQOIhZD0YsNwSrwzPbXZMD1WP1LXFD lJBVkCSQ2iLcAY5Y0XJtqwPiG77RlB1oqlzsN7KI5AFgqbLsMBS3CSu0TYW/KPOr2Sqw9KBaAUuM ZylbRx9Edt3aVVKaok/1PVo0OeBYL66HpbD68QKZVuzwXYeRbmUUjH7OdA4AxqY9XSPDZhXTPrVN /Ei+LwvA5O9WtEiFoAxWFSzsWt2uE/YFyU00jIis/mPwCvDktW7CL/oiHuzR7R9lLUJTOMC9AqYW 1lRNjkWXJryJ9+EiOvBe6vFbUGRrwytzyq4nhu0+m3/YUu4UI2GoiS4jWHSkvyyyS8KErWmYf+RR A94if7oLzRs73BRh3+MrOOK4NgfP/RZivWtTzbcnsscMdnMYECIJ64duuA== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 17:37:50 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --VN750uGYpYHVIJ8TAzr8qOOVUkaqMii6v Content-Type: multipart/mixed; boundary="WbjsWAhcR0FX18pYSXTBwZjlao3Gvs2Sf"; protected-headers="v1" From: Christian Huitema To: Eliot Lear , Matthew Pounsett Cc: Ted Hardie , DoH WG , Paul Vixie , dnsop Message-ID: <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: --WbjsWAhcR0FX18pYSXTBwZjlao3Gvs2Sf Content-Type: multipart/alternative; boundary="------------D1D379ABB7DFACBF525FDC3A" Content-Language: en-US This is a multi-part message in MIME format. --------------D1D379ABB7DFACBF525FDC3A Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 3/19/2019 12:50 AM, Eliot Lear wrote: >> On 19 Mar 2019, at 01:50, Matthew Pounsett > > wrote: >> >> Somewhere up-thread it was suggested that there are other reasonable >> steps that a network/security operator can take to maintain the >> controls over resolution that we have today, but so far I haven't >> seen them enumerated anywhere. >> > > I had stated that one can use an MDM to manage the endpoint=E2=80=99s u= se of > DoH. =C2=A0This doesn=E2=80=99t eliminate the possibility of malware, b= ut does > reduce misconfiguration in the enterprise, and provides for some > protection against infection by blocking known bad names. Configuration works well for functions like "phishing protection": the device users in most cases want some form of protection, and then it is a matter of how this protection is configured. It does not work so well for functions like intrusion detection, such as figuring out whether a device is trying to contact a botnet C&C, because we cannot expect the infected device to be amenable to configuration. Third party DNS/DoH providers could probably block resolution of phishing names or=C2=A0 botnet C&C names using the same methods as enterprises do today, but the enterprise network will not be informed that one of its devices just tried to contact a botnet C&C. It would be very nice if the IETF standardized a way to do that. > > In addition, there=E2=80=99s at least a heuristic for detection: compar= e data > plane activity against ANSWERs. =C2=A0If you=E2=80=99re seeing activity= to > addresses that don=E2=80=99t match (modulo some noise), you know an alt= ernate > resolver is active on that device. =C2=A0And while it=E2=80=99s possibl= e for > malware to mimic queries to Do53 for Good sites versus what it really > wants to access, you start tarnishing the rep of the IP address as and > when you detect the problem through other means (AV s/w, honey pots, > binary inspection, et al). =C2=A0That leaves it with cloud providers to= > sort their wagons. Yes, one could imagine IP address or IP prefix reputation systems, similar to the IP address block lists used to protect against spam. This would work, and it would also provide intrusion detection signals when an infected device starts contacting a botnet. The problem of course is the gray line between "blocking phishing sites" and "blocking content that I disagree with". The various attempts to block the whole of Wikipedia in order to block some specific pages shows where this can lead= =2E -- Christian Huitema --------------D1D379ABB7DFACBF525FDC3A Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable


On 3/19/2019 12:50 AM, Eliot Lear wrote:
On 19 Mar 2019, at 01:50, Matthew Pounsett <= matt@conundrum.com> wrote:<= /div>
Somewhere up-thread it was suggested that there are other reasonable steps that a network/security operator can take to maintain the controls over resolution that we have today, but so far I haven't seen them enumerated anywhere.


I had stated that one can use an MDM to manage the endpoint=E2=80=99s use of DoH. =C2=A0This doesn=E2=80=99t elimina= te the possibility of malware, but does reduce misconfiguration in the enterprise, and provides for some protection against infection by blocking known bad names.

Configuration works well for functions like "phishing protection": the device users in most cases want some form of protection, and then it is a matter of how this protection is configured. It does not work so well for functions like intrusion detection, such as figuring out whether a device is trying to contact a botnet C&C, because we cannot expect the infected device to be amenable to configuration.

Third party DNS/DoH providers could probably block resolution of phishing names or=C2=A0 botnet C&C names using the same methods= as enterprises do today, but the enterprise network will not be informed that one of its devices just tried to contact a botnet C&C. It would be very nice if the IETF standardized a way to do that.


In addition, there=E2=80=99s at least a heuristic f= or detection: compare data plane activity against ANSWERs. =C2=A0If you=E2=80=99re seeing activity to addresses that don=E2=80=99t ma= tch (modulo some noise), you know an alternate resolver is active on that device. =C2=A0And while it=E2=80=99s possible for malware to mimi= c queries to Do53 for Good sites versus what it really wants to access, you start tarnishing the rep of the IP address as and when you detect the problem through other means (AV s/w, honey pots, binary inspection, et al). =C2=A0That leaves it with cloud provid= ers to sort their wagons.

Yes, one could imagine IP address or IP prefix reputation systems, similar to the IP address block lists used to protect against spam. This would work, and it would also provide intrusion detection signals when an infected device starts contacting a botnet. The problem of course is the gray line between "blocking phishing sites" and "blocking content that I disagree with". The various attempts to block the whole of Wikipedia in order to block some specific pages shows where this can lead.

-- Christian Huitema



--------------D1D379ABB7DFACBF525FDC3A-- --WbjsWAhcR0FX18pYSXTBwZjlao3Gvs2Sf-- --VN750uGYpYHVIJ8TAzr8qOOVUkaqMii6v Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJckSjRAAoJELba05IUOHVQMToH/RvbpDzJrO0q2xYWWrGlWlXR 66OjV6jTawFeINZ65NkW7bdADUp081XrSGxtcMzNUS1/JMq5/ttuspjkC3H7vvcz e7y/rcQ0KexQsan29tIYEe+PGWlJ4Ot3+E2etmk0/pBK0fMPOwuhuDHWZX9txNGQ fVrBeKYR4+BJh1dhfpilkmjchyIHsvB4CFDM6qSzxZaI1F4AwEPZS6Bm2aWJYIMx boz6xc7B94zt0vvuiGGXvVkKBKpPoJ7zwH4/aykoExE2e5k7ZM8Czoj6Vtx1p1n6 P5e9/m7/WH42zhozZtD4sjaUmvfKclIvmoHnkBl8JrwpefHrw+EviUOr5KpPDaM= =mdWr -----END PGP SIGNATURE----- --VN750uGYpYHVIJ8TAzr8qOOVUkaqMii6v-- From nobody Tue Mar 19 10:45:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E1DC91315DB; Tue, 19 Mar 2019 10:45:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PrX9LzcYgADG; Tue, 19 Mar 2019 10:45:28 -0700 (PDT) Received: from mail-it1-x12c.google.com (mail-it1-x12c.google.com [IPv6:2607:f8b0:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 051971315D0; Tue, 19 Mar 2019 10:45:28 -0700 (PDT) Received: by mail-it1-x12c.google.com with SMTP id m137so11754743ita.0; Tue, 19 Mar 2019 10:45:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=zFLyusuK8RGhYEpisbgBBgmwYJWs+rwU0GHifuGc3eE=; b=OUGBtnSDFE3YwsemBaJ5bRHfq5sYrKpiPDWFVBtHOmzM27i5knYIknReMBkP1EkJUV Iypap6SuA/HfOC0ZiYhcUN9pBtdua3XM4cC1JccmPkkKfo+bf2B6CB4Oa9lpf1HY3rf7 o8VcLpvJNhh4CsALX6LiTM4KUpImJnB80NLtamRIoxfGZb713t/mJWuNv75Kv18NiHbK VqHyMaU9dzGtV4uMxEzrsWX4C049tDY6j6WO4d3DpT22m/gtCW8CetQa9+YwlVMMPs4M gQXnMK/mVAc9MyKNktCAkK1vpnYiTUr3cdAFHd9rxOU/803/RADCsadVkQfarajJnWzl Ph0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zFLyusuK8RGhYEpisbgBBgmwYJWs+rwU0GHifuGc3eE=; b=B6zCb8dluOfqWJmYKmfC2LYLUQr4sTBi+BfC08YLuRvBi1XA6q5xLdI4IwWwnf8PXj Sagx/WjN9DLMqp+iGrJQouyR8NMiU7Qb7aAP8nbg1rKJcPUFnJGtDRuYQb/7v8ZWbjnO /3aLw5QcEIKVLrhOOes3w44JVpz/VOLa8dleLXQ/VWnoToKC8wYlxdMPXAtMzqeM6is4 /qM5tcLfWk1HKhmOQos3QlmizcHUY3uUHLPcD6dTwfH2Ic1GVrqiI2eag+bwCOWwflQW 6gO9qQy0hxpLd+i/rSbSGL44OcziCGKti269C6otmYhP4j+psbFVc5SDDvIqVXkQjca4 HllA== X-Gm-Message-State: APjAAAU9XC8OtGoi877lZ/vddpiIn5JnuqQUK1Ru038Seh33RBztaU4K hApiYkcJyuxL57OsTf4HabZx1MGCVo3IGyvXwBf+3lOR X-Google-Smtp-Source: APXvYqzjakB5rQTbdwpN6g3gYHWSAwFqWhGnZg5Xp/Ict2LksDTzlgqtIUMFKkeJF4x2TutA3t9zZBmCm20cseEUFiQ= X-Received: by 2002:a24:6bcd:: with SMTP id v196mr394576itc.96.1553017527152; Tue, 19 Mar 2019 10:45:27 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: From: Ted Hardie Date: Tue, 19 Mar 2019 10:44:59 -0700 Message-ID: To: Matthew Pounsett Cc: Paul Vixie , dnsop , DoH WG Content-Type: multipart/alternative; boundary="0000000000000933ad0584761287" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 17:45:31 -0000 --0000000000000933ad0584761287 Content-Type: text/plain; charset="UTF-8" Hi Matt, Comments in-line. On Mon, Mar 18, 2019 at 5:50 PM Matthew Pounsett wrote: > > > On Fri, 15 Mar 2019 at 14:37, Ted Hardie wrote: > >> >>> The past five years have not been the IETF seeking to become a king or >> king-maker. They have been spent responding to an attack while still >> building out the facilities of the network. I am glad to find you a ready >> participant now, as there is still work to be done. But I do not believe >> we have said that you may not have these facilities; the new methods simply >> mean you must have a relationship with the users and devices on your >> network sufficient to effect configuration to use them. An on-path >> adversary does not, but you do. Yes, that adds a step and some complexity, >> but dealing with a new class of attack was never likely to be free. >> > > This, again, conflates users with attackers. > > I'm going to take a stab at restating the positions of several people in > this thread, Paul included, because it really seems like the argument is > not understood. > > I have a relationship with my users and I can control the configuration of > their *known* applications. I do not have a relationship with the malware > author that is trying to steal their data, and cannot control the > configuration of that (unknown) application. By running DoT on my borders > and blocking all other DNS and DoT traffic, I can provide privacy for my > users while still preventing malware from doing its thing. > As I said to Paul, I don't think you can if your only defense is blocking DNS access. Coding a system to use a non-standard resolution protocol over TLS is relatively easy; all the malware needs is a specific target to start at. That target can be hard coded, derived from the output of a web search, or produced by the output of an algorithm resident in the malware and some system-available data (commonly the time). My apologies if I have misunderstood your point here, but unless you also block all traffic for which you have seen no resolution event, I believe that it is entirely possible to circumvent the defense you describe. > With DoH available at endpoints that my users want to reach using some > other application, > And this is the critique that is not of DoH as a protocol, but of a specific deployment possibility. You've seen the Quad9 folks point and the Chrome statement of their current deployment plans. The first said they will not deploy DNS resources and other web resources on commingled hosts. The second said that they will only use DoH after a probe reveals that it is available *at the already configured DNS service*. This is entirely in line with Section 3 of RFC 8484: A DoH client MUST NOT use a different URI simply because it was discovered outside of the client's configuration (such as through HTTP/2 server push) or because a server offers an unsolicited response that appears to be a valid answer to a DNS query. This specification does not extend DNS resolution privileges to URIs that are not recognized by the DoH client as configured URIs. Browsers do not have an incentive to permit random websites to poison their caches, so I strongly suspect that there will be no ability to pass a resolution done in JavaScript down into the browser cache; my experience during RTCWeb was that the browsers treated all downloaded JavaScript applications as potentially malign. > it is orders of magnitude more complex for me to block the malware while > still allowing my users to reach those endpoints. Phrased another way, a > DoH endpoint at the same IP address as a popular website gives malware the > ability to resolve names I was previously able to prevent. > In the RFC 8484 terms, this is a DoH server. For this threat to be real, there is an additional requirement: the DoH server at the popular website must also be trusted by the application as a source of DNS data. For the ones you configure, this remains in your control. For JavaScript applications within browsers, see above. So this is probably the case only for pure malware, which already has other circumventions available. > The only recourse I know of, if DoH is adopted, is to proxy all traffic > toward that example site (including requiring me to engage in a MitM > decryption attack on my users' web traffic) in order to continue to prevent > that malware from circumventing network security. And because I can't > predict which web sites will launch their own DoH endpoints, that means I > need to proxy (and decrypt) all web traffic in order to maintain the same > level of security I can today. > > Note that popular Web servers commingling DoH services should answer a DNS query probe, so you will be able to tell readily if any of them choose to do it. And, of course, you could respond by blocking the service rather than with MitM; I suspect some would. regards, Ted > Somewhere up-thread it was suggested that there are other reasonable steps > that a network/security operator can take to maintain the controls over > resolution that we have today, but so far I haven't seen them enumerated > anywhere. > > > --0000000000000933ad0584761287 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Matt,

Comments in-line.

On Mon, Mar 18, 2019 at 5:50 PM Matthew Pouns= ett <matt@conundrum.com> wr= ote:


On Fri, 15 Mar 2019 at 14:37, Ted Hardie <ted.ietf@gmail.com= > wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
The = past five years have not been the IETF seeking to become a king or king-mak= er.=C2=A0 They have been spent responding to an attack while still building= out the facilities of the network.=C2=A0 I am glad to find you a ready par= ticipant now, as there is still work to be done.=C2=A0 But I do not believe= we have said that you may not have these facilities; the new methods simpl= y mean you must have a relationship with the users and devices on your netw= ork sufficient to effect configuration to use them.=C2=A0 An on-path advers= ary does not, but you do.=C2=A0 Yes, that adds a step and some complexity, = but dealing with a new class of attack was never likely to be free.=C2=A0 <= br>

This, aga= in, conflates users with attackers.=C2=A0=C2=A0

I&= #39;m going to take a stab at restating the positions of several people in = this thread, Paul included, because it really seems like the argument is no= t understood.=C2=A0=C2=A0

I have a relationship wi= th my users and I can control the configuration of their *known* applicatio= ns.=C2=A0 I do not have a relationship with the malware author that is tryi= ng to steal their data, and cannot control the configuration of that (unkno= wn) application.=C2=A0 By running DoT on my borders and blocking all other = DNS and DoT traffic, I can provide privacy for my users while still prevent= ing malware from doing its thing.=C2=A0
=
As I said to Paul, I don't think you can if your only de= fense is blocking DNS access.=C2=A0 Coding a system to use a non-standard r= esolution protocol over TLS is relatively easy; all the malware needs is a = specific target to start at.=C2=A0 That target can be hard coded, derived f= rom the output of a web search, or produced by the output of an algorithm r= esident in the malware and some system-available data (commonly the time).= =C2=A0 My apologies if I have misunderstood your point here, but unless you= also block all traffic for which you have seen no resolution=20 event, I believe that it is entirely possible to circumvent the defense you= describe.
=C2=A0
With DoH availabl= e at endpoints that my users want to reach using some other application,

And this is the critique th= at is not of DoH as a protocol, but of a specific deployment possibility.= =C2=A0 You've seen the Quad9 folks point and the Chrome statement of th= eir current deployment plans.=C2=A0 The first said they will not deploy DNS= resources and other web resources on commingled hosts.=C2=A0 The second sa= id that they will only use DoH after a probe reveals that it is available *= at the already configured DNS service*.=C2=A0 This is entirely in line with= Section 3 of RFC 8484:
   A DoH cli=
ent MUST NOT use a different URI simply because it was
   discovered outside of the client's configuration (such as through
   HTTP/2 server push) or because a server offers an unsolicited
   response that appears to be a valid answer to a DNS query.  This
   specification does not extend DNS resolution privileges to URIs that
   are not recognized by the DoH client as configured URIs.

Browsers do not have an incentive to permit random websites to poison= their caches, so I strongly suspect that there will be no ability to pass = a resolution done in JavaScript down into the browser cache; my experience = during RTCWeb was that the browsers treated all downloaded JavaScript appli= cations as potentially malign.

=C2=A0
it is orders of magnitude more complex for me to blo= ck the malware while still allowing my users to reach those endpoints.=C2= =A0 Phrased another way, a DoH endpoint at the same IP address as a popular= website gives malware the ability to resolve names I was previously able t= o prevent.=C2=A0

In the = RFC 8484 terms, this is a DoH server.=C2=A0 For this threat to be real, the= re is an additional requirement:=C2=A0=C2=A0 the DoH server at the popular = website must also be trusted by the application as a source of DNS data.=C2= =A0 For the ones you configure, this remains in your control.=C2=A0 For Jav= aScript applications within browsers, see above.=C2=A0 So this is probably = the case only for pure malware, which already has other circumventions avai= lable.=C2=A0
=C2=A0
The only re= course I know of, if DoH is adopted, is to proxy all traffic toward that ex= ample site (including requiring me to engage in a MitM decryption attack on= my users' web traffic) in order to continue to prevent that malware fr= om circumventing network security.=C2=A0 And because I can't predict wh= ich web sites will launch their own DoH endpoints, that means I need to pro= xy (and decrypt) all web traffic in order to maintain the same level of sec= urity I can today.

Note t= hat popular Web servers commingling DoH services should answer a DNS query = probe, so you will be able to tell readily if any of them choose to do it.= =C2=A0 And, of course, you could respond by blocking the service rather tha= n with MitM; I suspect some would.

regards,
<= div>
Ted
=C2=A0
Somewhere up-thread it was suggested that there are other reasonab= le steps that a network/security operator can take to maintain the controls= over resolution that we have today, but so far I haven't seen them enu= merated anywhere.


--0000000000000933ad0584761287-- From nobody Tue Mar 19 11:45:12 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2CF3C13151C; Tue, 19 Mar 2019 11:45:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f4ww3Jn7PmzI; Tue, 19 Mar 2019 11:45:00 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96E4213150E; Tue, 19 Mar 2019 11:44:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=11405; q=dns/txt; s=iport; t=1553021099; x=1554230699; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=EcpDzdEj4cU8uRg/C4AzRt4KX85wmqcAaGQFVE3WNi4=; b=EJpJVlEv3WzteF14ZginoKH/paJFykjevIOIkEQ/kZt+pCPbADnnVPh+ J3o7Tb6LSjvJ20MhN9kaKpVB6ShlxqHj2fwyJJRx+WamjHTpN72rhx5/x NCJRr1FE/1RUBpaA5xRqgVG5BzuntwlBmbejz9OtLhL/DysAZTCfvGW6Y Y=; X-Files: signature.asc : 488 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0A9AAAHOJFc/xbLJq1jGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBZYEPgjozJ4QLiHuMNSWSPIdxCAMBAYRsAoUNOBIBAQM?= =?us-ascii?q?BAQkBAwJtKIVKAQEBAwEjVgULCxgnAwICRhEGE4MiAYFtCKpngS8fhSeEWQ+?= =?us-ascii?q?BLwGBSIoAgX+BOAwTgkyICzGCJgOKXIFahSqTCQmEYYcDh0gZixOIS5sfgnA?= =?us-ascii?q?CBAYFAhWBXiGBVjMaCBsVZQGCQT6BWBeOHz4DMI9hAQE?= X-IronPort-AV: E=Sophos;i="5.60,245,1549929600"; d="asc'?scan'208,217";a="10783822" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 19 Mar 2019 18:44:57 +0000 Received: from [10.61.194.89] ([10.61.194.89]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2JIiup4016477 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Tue, 19 Mar 2019 18:44:56 GMT From: Eliot Lear Message-Id: <4F2265B7-BF78-498C-9372-AF8884082FCA@cisco.com> Content-Type: multipart/signed; boundary="Apple-Mail=_22B7570F-9E40-4A48-9C22-AEDFB6AAE3FA"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 19 Mar 2019 19:44:55 +0100 In-Reply-To: <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> Cc: Matthew Pounsett , Ted Hardie , DoH WG , Paul Vixie , dnsop To: Christian Huitema References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.194.89, [10.61.194.89] X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 18:45:03 -0000 --Apple-Mail=_22B7570F-9E40-4A48-9C22-AEDFB6AAE3FA Content-Type: multipart/alternative; boundary="Apple-Mail=_89A1019C-2492-42D3-BDBD-94C8E96605CD" --Apple-Mail=_89A1019C-2492-42D3-BDBD-94C8E96605CD Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Christian, > On 19 Mar 2019, at 18:37, Christian Huitema = wrote: >=20 >=20 >=20 > On 3/19/2019 12:50 AM, Eliot Lear wrote: >>> On 19 Mar 2019, at 01:50, Matthew Pounsett > wrote: >>>=20 >>> Somewhere up-thread it was suggested that there are other reasonable = steps that a network/security operator can take to maintain the controls = over resolution that we have today, but so far I haven't seen them = enumerated anywhere. >>>=20 >>=20 >> I had stated that one can use an MDM to manage the endpoint=E2=80=99s = use of DoH. This doesn=E2=80=99t eliminate the possibility of malware, = but does reduce misconfiguration in the enterprise, and provides for = some protection against infection by blocking known bad names. > Configuration works well for functions like "phishing protection": the = device users in most cases want some form of protection, and then it is = a matter of how this protection is configured. It does not work so well = for functions like intrusion detection, such as figuring out whether a = device is trying to contact a botnet C&C, because we cannot expect the = infected device to be amenable to configuration. >=20 Yes. > Third party DNS/DoH providers could probably block resolution of = phishing names or botnet C&C names using the same methods as = enterprises do today, but the enterprise network will not be informed = that one of its devices just tried to contact a botnet C&C. It would be = very nice if the IETF standardized a way to do that. >=20 I don=E2=80=99t see why they wouldn=E2=80=99t, and I could easily = envision them being obliged to do so in the future. >>=20 >> In addition, there=E2=80=99s at least a heuristic for detection: = compare data plane activity against ANSWERs. If you=E2=80=99re seeing = activity to addresses that don=E2=80=99t match (modulo some noise), you = know an alternate resolver is active on that device. And while it=E2=80=99= s possible for malware to mimic queries to Do53 for Good sites versus = what it really wants to access, you start tarnishing the rep of the IP = address as and when you detect the problem through other means (AV s/w, = honey pots, binary inspection, et al). That leaves it with cloud = providers to sort their wagons. > Yes, one could imagine IP address or IP prefix reputation systems, = similar to the IP address block lists used to protect against spam. This = would work, and it would also provide intrusion detection signals when = an infected device starts contacting a botnet. The problem of course is = the gray line between "blocking phishing sites" and "blocking content = that I disagree with". The various attempts to block the whole of = Wikipedia in order to block some specific pages shows where this can = lead. In the enterprise this is not a problem. In the consumer space, it is a = big problem. This goes back to the fundamental issue of whether or not = the user has given meaningful consent and what happens when they do not. = We should be at least mindful of the game of Chicken being played here = with governments. Lessig=E2=80=99s Law is bounded by the fact that = governments have a lot more guns than most of us do (with some notable = and amusing exceptions). The point of my message was not to go into = this discussion, however, but to talk about what is possible, rather = than what is necessarily desirable. The sharing of threat intel is something that could be reasonably = governed by contract in this scenario. Think about that a bit. Eliot --Apple-Mail=_89A1019C-2492-42D3-BDBD-94C8E96605CD Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Christian,

On 19 Mar 2019, at 18:37, Christian Huitema = <huitema@huitema.net> wrote:

=20 =20


On 3/19/2019 12:50 AM, Eliot Lear wrote:
On 19 Mar 2019, at 01:50, Matthew Pounsett = <matt@conundrum.com> wrote:

Somewhere up-thread it was suggested that there are other reasonable steps that a network/security operator can take to maintain the controls over resolution that we have today, but so far I haven't seen them enumerated anywhere.


I had stated that one can use an MDM to manage the endpoint=E2=80=99s use of DoH.  This doesn=E2=80=99t = eliminate the possibility of malware, but does reduce misconfiguration in the enterprise, and provides for some protection against infection by blocking known bad names.

Configuration works well for functions = like "phishing protection": the device users in most cases want some form of protection, and then it is a matter of how this protection is configured. It does not work so well for functions like intrusion detection, such as figuring out whether a device is trying to contact a botnet C&C, because we cannot expect the infected device to be amenable to = configuration.


Yes.


Third = party DNS/DoH providers could probably block resolution of phishing names or  botnet C&C names using the same = methods as enterprises do today, but the enterprise network will not be informed that one of its devices just tried to contact a botnet C&C. It would be very nice if the IETF standardized a way to do that.


I don=E2=80=99t see why they wouldn=E2=80=99t, and I = could easily envision them being obliged to do so in the = future.


In addition, there=E2=80=99s at least a heuristic = for detection: compare data plane activity against ANSWERs.  If you=E2=80=99re seeing activity to addresses that don=E2=80=99t = match (modulo some noise), you know an alternate resolver is active on that device.  And while it=E2=80=99s possible for malware to = mimic queries to Do53 for Good sites versus what it really wants to access, you start tarnishing the rep of the IP address as and when you detect the problem through other means (AV s/w, honey pots, binary inspection, et al).  That leaves it with cloud = providers to sort their wagons.

Yes, one could imagine IP address or IP = prefix reputation systems, similar to the IP address block lists used to protect against spam. This would work, and it would also provide intrusion detection signals when an infected device starts contacting a botnet. The problem of course is the gray line between "blocking phishing sites" and "blocking content that I disagree with". The various attempts to block the whole of Wikipedia in order to block some specific pages shows where this can lead.


In the = enterprise this is not a problem.  In the consumer space, it is a = big problem.  This goes back to the fundamental issue of whether or = not the user has given meaningful consent and what happens when they do = not.  We should be at least mindful of the game of Chicken being = played here with governments.  Lessig=E2=80=99s Law is bounded by = the fact that governments have a lot more guns than most of us do (with = some notable and amusing exceptions).  The point of my message was = not to go into this discussion, however, but to talk about what is = possible, rather than what is necessarily desirable.

The sharing of threat intel is something that = could be reasonably governed by contract in this scenario.  Think = about that a bit.

Eliot

= --Apple-Mail=_89A1019C-2492-42D3-BDBD-94C8E96605CD-- --Apple-Mail=_22B7570F-9E40-4A48-9C22-AEDFB6AAE3FA Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEEmNC9kEYdsJKnsmEdh7ZrRtnSejMFAlyROKcACgkQh7ZrRtnS ejP+VQgAhn2c3GUM7XBzTS3wiFAbZK3JeVp2oiYZNGxfSOI29HhwD3SQZin6cpHq OfRU8BSKqJ3Yn1KN000jsMq+edz+IUQxjj6qIctklwQX4Eb5rQwo77bawcgRacqo 7cVEDAE1Dk2SlSiQ7vvGMRHZAAgvi6LeHQQZjAwjquPlWCouidZwunQdGX+zUzQ4 IkMCMVsLjXaZVhxRGlrZZOUlpOY84zFXnCLkSZB3K5ECf2XDczPtF66DyyVTE2ej O2yjjSpVWS4s4vymepBZ1OycLmVpx3mRs/Yd43esHwAsGtY0sW7ZhbqsekNKd1Ke yAQU8oX3LlEGCBv+jijleaUh8/6dFA== =FF0n -----END PGP SIGNATURE----- --Apple-Mail=_22B7570F-9E40-4A48-9C22-AEDFB6AAE3FA-- From nobody Tue Mar 19 13:33:32 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FBCB12867B for ; Tue, 19 Mar 2019 13:33:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=ENB5vM5J; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=RVmkQ6i6 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xKZxAnJvLIHI for ; Tue, 19 Mar 2019 13:33:28 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7BC911277CD for ; Tue, 19 Mar 2019 13:33:28 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 99A092200A for ; Tue, 19 Mar 2019 16:33:27 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Tue, 19 Mar 2019 16:33:27 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=QMkFeNjDxN9I9aHGPTeEKWmy/24esqz Nc5VURpba25o=; b=ENB5vM5JcBqbL2lLg8AEwNpQl6+fwQpkNbPbPeBJaJ4yZQM FQcjpJUx+7SMJ4FigeJjKjAyrwI5ZCN9R3+XrLsE2x6BRhMK/CCwqjQQFpNJKgAK GcysX6EtDs7UGNFKOKUTstbhbotJlbTKhDagqTARCU+RMbjStDqHLQ+bUB2pvs9f BPz83SnTUKgjj8ZoDcFFpSsrUVHWltPKx+5IqIfRW2IVOix3LkN4g5hxDKRFltNC mQeNqxab2uhz5IQbQmoXPh1truCtdgFAJZF5TwFw27vuR0tz3AxyhmQNOIEjJOo8 X9CLWnKmLtEKFVLcd0fDbGiXAVfjBP/P3GKZ0uA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=QMkFeN jDxN9I9aHGPTeEKWmy/24esqzNc5VURpba25o=; b=RVmkQ6i6RSaW+KespRRhwn j5GGAX/H9Ar0SlE0xeRDhjLt5rTMRuLhHZB8gbcO9yQvm2xFyoqD0Vdwr23mX4+e /YMEaK46EaLpfi8xCCqnM5QxxyCzB4/k0BqZ7k61j6FU9dPx0k2pnZQcOD4lfAF8 SDt3ebhyNol6ozTYPfBBe+SnHW+xEv8STfxgoFZYNAeDPJ1KWQFM5g1LIP8lBlAE 22GrrNPhJqxaKwsRGcJuPckFaFKMJjhSKDvIsvGFHssN/prSExpqq9vPZuiBdnoK JgNsl2YVGF9pdh6SpFAqHOaRNhGjnMIkqkgWmIOC6mo6ZRmBTrn6+XvtxM2AnD3Q == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrieeggddugeduucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpefofgggkfgjfhffhffvufgtsehttd ertderredtnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehloh ifvghnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 13CF57C651; Tue, 19 Mar 2019 16:33:27 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: In-Reply-To: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> Date: Tue, 19 Mar 2019 16:33:28 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 20:33:30 -0000 I agree with Ted. On Wed, Mar 20, 2019, at 04:46, Ted Hardie wrote: > My apologies if I have misunderstood your point > here, but unless you also block all traffic for which you have seen no > resolution event, I believe that it is entirely possible to circumvent > the defense you describe. The problem with blocking packets that can't be traced to a resolution event is that you need to catch all the resolution events. DNS doesn't have a monopoly on address resolution - I mean, that's the whole point of this discussion, isn't it? Yes, there are a great many protocols that include a DNS query before every communication attempt, but not all. If you are comfortable breaking or degrading all the other protocols, this is I guess an OK strategy. I personally wouldn't call the thing that you get out the other end "Internet". Of course, people routinely make that claim with only TCP ports 80 and 443 open. > browsers treated all downloaded > JavaScript applications as potentially malign. Nicely understated. Spend any amount of time on this problem and the word "potentially" just fades away. From nobody Tue Mar 19 13:53:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3088013163D for ; Tue, 19 Mar 2019 13:53:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MrySIrw7ag-W for ; Tue, 19 Mar 2019 13:53:19 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71A801315BA for ; Tue, 19 Mar 2019 13:53:09 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 86321BED9 for ; Tue, 19 Mar 2019 20:53:07 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZgFQd9HZvIQe for ; Tue, 19 Mar 2019 20:53:06 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id DEE1CBEBB for ; Tue, 19 Mar 2019 20:53:05 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553028786; bh=jS+mYHS2A59cL5L/ZXmRSWsTiL4ESselRgA4zFQ0cdA=; h=To:From:Subject:Date:From; b=vhq6uVEoxmm3FIq1yAZmxHltGWo/pUG2U81Nik+CEWIurjCPwcA0NM57iGS0nd1mu 93n61Jay9LoId/IEO1FeGodjk9f9etuHi8cMz9lvwO75bL7Vx0Srnt6RW93DKnx3v3 x77ipc0IDLx8ejBGaxveCUKNHKZEDCnQBcrH6rFk= To: "doh@ietf.org" From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> Date: Tue, 19 Mar 2019 20:53:04 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="UTtbzmbhMAll3uGjDHZ5mj0dsjbKMsGe1" Archived-At: Subject: [Doh] draft-ietf-doh-resolver-associated-doh-02 comments X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 20:53:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --UTtbzmbhMAll3uGjDHZ5mj0dsjbKMsGe1 Content-Type: multipart/mixed; boundary="k7HbxCdUJnU8sJjYNSOh4eYXOvycM0jVM"; protected-headers="v1" From: Stephen Farrell To: "doh@ietf.org" Message-ID: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> Subject: draft-ietf-doh-resolver-associated-doh-02 comments --k7HbxCdUJnU8sJjYNSOh4eYXOvycM0jVM Content-Type: multipart/mixed; boundary="------------23EFCF3299D4B9F3A3012499" Content-Language: en-GB This is a multi-part message in MIME format. --------------23EFCF3299D4B9F3A3012499 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, I had a read of this. I think I share Martin's general concerns, but don't have a concrete high-level suggestion other than to talk more about it and be open to possibly big changes being needed as we work it out. Points that might be worth clarifying as we go: - Section 2: what about OCSP? are we assuming that the OCSP responder is resolved by the precursor system resolver or the DoH resolver or both? I don't think it makes a security difference (OCSP works or doesn't as usual), but it may be a gotcha in terms of establishing the TLS session. Or, are we assuming there's no point in OCSP for an IP-address cert? (I forget;-) - Section 2: "the normal rules for HTTP" - does that mean all re-directs MUST be HTTPS too? And can those URLs use DNS names or must they be IP address certs too? - Sections 3 & 4: the use of special-use domain names here seems ickky to me. ("ickky" being a technical terms for "I don't like that but can't justify my opinion" :-) I think it'd be a pity to see more crap DNS queries emitted from browsers though and would love to see something better. I also wonder what'd happen with these queries in a home n/w with a never-updated router or with a brand-new flashy home router that e.g. has a public DNS name. (In that latter case, I can easily get a cert for the name of my home router, but not for it's IP address.) - Section 7, para 1: that's way too one-sided. DoH could be less privacy-friendly (than say DoT) due to cookies and whatnot. - Section 8: Why diss. DoT? It's not a competition:-) Cheers, S. --------------23EFCF3299D4B9F3A3012499 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------23EFCF3299D4B9F3A3012499-- --k7HbxCdUJnU8sJjYNSOh4eYXOvycM0jVM-- --UTtbzmbhMAll3uGjDHZ5mj0dsjbKMsGe1 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyRVrEACgkQWrL68XsX K+rqdA/9GY+BdUqwICEZqdeRWf3dyIUA00c5tS6iqyY58QpZS9/YwmStZrhA3uXh 0WTkvoYGCpl4nDIXEiyXO1baovc15xeTIT28m3+zV7XKkoM7LtsO0G192+85R6H8 OhrAq29ppIJLwqZWZ10VcaeMYADWLTu21zaS03MipqMfCuzIRb3+Xh90kMpyckzs BRs/C+xAEFKXCjamXVW4qZXuyyZrYbGeRsuBkj8piDrkYnZMZOIVrh6Uqsy7KI5b MwBVi/bSvKj0qKDMMk7DlTeeIsWAm7sHYT3OzdqQZkaH84l84ovz0CTAMOXFEjbt THP5wAhm0j9UgHkur/+vbyPqNmzs/qKK1MzvvmQZ2zn7oPivG2XZsejA1yxc8o59 pe3vEid2OEvNOx942hWTzvheJIG9uVjQlX2ZNoRQotu/UHIGQPY+ohLXJrMl5ndG eqNvrq3jh3F90I0xj47hD8h4VZkl3cTKWX8CMkG4MqqmANmpWViW5sqjovLwgaIJ f7k11TnldoACVVb83mTC+z7AiTFcoNdxvFtsl39NCbBeR2/YCSpu3KLcDmthDWJd W4INNAffIzpnYdpsmfI79gC5C8GMzh/IaKvEg+9JkCt9ZjUThAVv7uVptJduAd3J JfKVWged2RogowmlBqt6+P494YvOU0XY/lTYyXq9ZQLh+1rw9/A= =BK96 -----END PGP SIGNATURE----- --UTtbzmbhMAll3uGjDHZ5mj0dsjbKMsGe1-- From nobody Tue Mar 19 13:53:41 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5886513116C; Tue, 19 Mar 2019 13:53:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uSIaFl2yboVN; Tue, 19 Mar 2019 13:53:36 -0700 (PDT) Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-eopbgr140051.outbound.protection.outlook.com [40.107.14.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 66D3E131142; Tue, 19 Mar 2019 13:53:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s/4VUZ+bNgaYFmUg+VT8CGZeKMx9GBxdNd64ByorQrg=; b=jbzTJ2md4v2qEGH9jcNC2Q68q0nMu3Denauu8c3lBpc/U4U1O+nf3/nvak4z64RVCkWpqmdl2s2st+If0+yOq5TY/Xh/u8BB0G0w9QgiIAT7w8H60hlbso76xk7CtZLIwqIClutBbT7SPFl8yBVqhEPog6GeZ2opjbPIftzI4fM= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2421.eurprd06.prod.outlook.com (10.169.215.15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.13; Tue, 19 Mar 2019 20:53:32 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93%9]) with mapi id 15.20.1709.015; Tue, 19 Mar 2019 20:53:32 +0000 From: "Winfield, Alister" To: Eliot Lear , Christian Huitema CC: Matthew Pounsett , Ted Hardie , DoH WG , Paul Vixie , dnsop Thread-Topic: [EXTERNAL] Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator Thread-Index: AQHU3nqOawO7W748okeo2Aa+V+qrZaYTSruAgAAj7oA= Date: Tue, 19 Mar 2019 20:53:32 +0000 Message-ID: <80F6DCFD-EB8F-4CD7-9E7E-19ACB6CA90FB@sky.uk> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> <4F2265B7-BF78-498C-9372-AF8884082FCA@cisco.com> In-Reply-To: <4F2265B7-BF78-498C-9372-AF8884082FCA@cisco.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2a02:c7d:e20a:2d00:195a:b298:e06a:5351] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b2f658fb-cdcf-4f61-8ce9-08d6acacf2bf x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2421; x-ms-traffictypediagnostic: DB6PR0601MB2421: x-microsoft-antispam-prvs: x-forefront-prvs: 0981815F2F x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(396003)(376002)(136003)(39860400002)(346002)(199004)(189003)(106356001)(99286004)(33656002)(74482002)(105586002)(7736002)(36756003)(86362001)(97736004)(83716004)(71200400001)(71190400001)(6306002)(4326008)(6246003)(6512007)(72206003)(53936002)(54896002)(5660300002)(256004)(14444005)(5024004)(76176011)(2616005)(476003)(11346002)(486006)(446003)(82746002)(2906002)(14454004)(6436002)(110136005)(478600001)(54906003)(58126008)(6486002)(81166006)(25786009)(102836004)(81156014)(93886005)(6506007)(316002)(229853002)(8936002)(68736007)(6116002)(186003)(8676002)(46003); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2421; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: QyBJYfuX4XX6wGiLBXHyEI4LTqe1+towbhN/Upu4G29uM4fW5Sq2p6wAg6xNe+jeh3MUKesPi7t+GQaBeqJjtZqiTnF59OF/TqWEj1fgm0bULos6gejhrryA31drs544uVBQo6lMyOia7YIW3YwznNiY/ioTWFm+hjEXHuQuaDyl9t5czMxcnWoZ9obhNdf+uCv0tKLLlTKFv7CvLM1ng6eUYK2U3hKtCJZtLnXfsrB/IeNAey9XiUSC43RZ82cMyE1aQ/mTQdtMCOgONKDJzTUJMczTngHvijFss3l8fAt41oz+lQpzhWbjl0mwXM5zwacbx31zoE1CXTSraAuATRCRyqiG8IueDA5kWX767otEY8PtXkWPARlBTOhODl30KoBzkYltvJOPGtK7iWQBJTx4XqJf6FdcnSG8osHYjFw= Content-Type: multipart/alternative; boundary="_000_80F6DCFDEB8F4CD79E7E19ACB6CA90FBskyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: b2f658fb-cdcf-4f61-8ce9-08d6acacf2bf X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Mar 2019 20:53:32.5545 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2421 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 20:53:39 -0000 --_000_80F6DCFDEB8F4CD79E7E19ACB6CA90FBskyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpUaGlyZCBwYXJ0eSBETlMvRG9IIHByb3ZpZGVycyBjb3VsZCBwcm9iYWJseSBibG9jayByZXNv bHV0aW9uIG9mIHBoaXNoaW5nIG5hbWVzIG9yICBib3RuZXQgQyZDIG5hbWVzIHVzaW5nIHRoZSBz YW1lIG1ldGhvZHMgYXMgZW50ZXJwcmlzZXMgZG8gdG9kYXksIGJ1dCB0aGUgZW50ZXJwcmlzZSBu ZXR3b3JrIHdpbGwgbm90IGJlIGluZm9ybWVkIHRoYXQgb25lIG9mIGl0cyBkZXZpY2VzIGp1c3Qg dHJpZWQgdG8gY29udGFjdCBhIGJvdG5ldCBDJkMuIEl0IHdvdWxkIGJlIHZlcnkgbmljZSBpZiB0 aGUgSUVURiBzdGFuZGFyZGl6ZWQgYSB3YXkgdG8gZG8gdGhhdC4NCg0KSSBkb27igJl0IHNlZSB3 aHkgdGhleSB3b3VsZG7igJl0LCBhbmQgSSBjb3VsZCBlYXNpbHkgZW52aXNpb24gdGhlbSBiZWlu ZyBvYmxpZ2VkIHRvIGRvIHNvIGluIHRoZSBmdXR1cmUuDQoNClRoZXkgc2F5IHRvIHlvdSBJUCBh LmIuYy5kIHdoaWNoIHNhZGx5IGlzIHRoZSBleHRlcm5hbCBJUCBvbiB0aGUgTkFUIGV4aXRpbmcg dGhlIGNvcnBvcmF0ZSBuZXR3b3JrIGhhcyBhIHByb2JsZW0uIFNvIGdyZWF0IG9uZSBvZiBwb3Rl bnRpYWxseSAxMDAw4oCZcyBvZiBkZXZpY2VzIGlzIGluZmVjdGVkIGJ1dCBub3QgcmVhbGx5IG11 Y2ggYmV0dGVyIGluZm9ybWF0aW9uIHRoYW4gdGhhdC4gSW4gZWZmZWN0IGV4YWN0bHkgd2hhdCBt b3N0IHNlY3VyaXR5IG9wZXJhdGlvbnMgdGVhbXMgYXNzdW1lIGlzIHRydWUgZXZlcnkgZGF5IG9m IHRoZSB3ZWVrLg0KDQpBbGlzdGVyIFdpbmZpZWxkDQpJbmZvcm1hdGlvbiBpbiB0aGlzIGVtYWls IGluY2x1ZGluZyBhbnkgYXR0YWNobWVudHMgbWF5IGJlIHByaXZpbGVnZWQsIGNvbmZpZGVudGlh bCBhbmQgaXMgaW50ZW5kZWQgZXhjbHVzaXZlbHkgZm9yIHRoZSBhZGRyZXNzZWUuIFRoZSB2aWV3 cyBleHByZXNzZWQgbWF5IG5vdCBiZSBvZmZpY2lhbCBwb2xpY3ksIGJ1dCB0aGUgcGVyc29uYWwg dmlld3Mgb2YgdGhlIG9yaWdpbmF0b3IuIElmIHlvdSBoYXZlIHJlY2VpdmVkIGl0IGluIGVycm9y LCBwbGVhc2Ugbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0 IGZyb20geW91ciBzeXN0ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwg c3RvcmUsIHJldHJhbnNtaXQsIHVzZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25l LiBQbGVhc2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwg Y29tbXVuaWNhdGlvbiB0aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQgZXh0ZXJuYWwgbmV0d29ya3Mu IFNLWSBhbmQgdGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQg U2t5IEludGVybmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQoNClNreSBV SyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNl IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2 aWNlcyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRl ZCAoUmVnaXN0cmF0aW9uIE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNp ZGlhcmllcyBvZiBTa3kgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMjQ3NzM1KS4gQWxsIG9m IHRoZSBjb21wYW5pZXMgbWVudGlvbmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBvcmF0 ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQgb2Zm aWNlIGF0IEdyYW50IFdheSwgSXNsZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0K --_000_80F6DCFDEB8F4CD79E7E19ACB6CA90FBskyuk_ Content-Type: text/html; charset="utf-8" Content-ID: <8F2C757622A11744982034969E223089@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNYWxndW4g R290aGljIjsNCglwYW5vc2UtMToyIDExIDUgMyAyIDAgMCAyIDAgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5Oi13ZWJraXQtc3RhbmRhcmQ7DQoJcGFub3NlLTE6MiAxMSA2IDQgMiAyIDIg MiAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiXEBNYWxndW4gR290aGljIjt9DQov KiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1z b05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCmE6bGluaywg c3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiMwNTYz QzE7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlw ZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCWNvbG9yOiM5NTRGNzI7 DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25vcm1h bDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90dG9t LWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQt ZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21zby1z dHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNl cmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxlLXR5 cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBXb3JkU2VjdGlvbjEN Cgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcy LjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30NCi0tPjwvc3R5 bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1HQiIgbGluaz0iIzA1NjNDMSIgdmxpbms9IiM5 NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi PjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJtYXJnaW4t dG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQ7Y2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTtm b250LXZhcmlhbnQtY2Fwczogbm9ybWFsO29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3 aWRvd3M6IGF1dG87LXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0OiBhdXRvOy13ZWJraXQtdGV4dC1z dHJva2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xh c3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4t Ym90dG9tLWFsdDphdXRvIj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7LXdlYmtpdC1z dGFuZGFyZCZxdW90OyxzZXJpZjtjb2xvcjpibGFjayI+VGhpcmQgcGFydHkgRE5TL0RvSCBwcm92 aWRlcnMgY291bGQgcHJvYmFibHkgYmxvY2sgcmVzb2x1dGlvbiBvZiBwaGlzaGluZyBuYW1lcyBv ciZuYnNwOyBib3RuZXQgQyZhbXA7QyBuYW1lcyB1c2luZyB0aGUgc2FtZQ0KIG1ldGhvZHMgYXMg ZW50ZXJwcmlzZXMgZG8gdG9kYXksIGJ1dCB0aGUgZW50ZXJwcmlzZSBuZXR3b3JrIHdpbGwgbm90 IGJlIGluZm9ybWVkIHRoYXQgb25lIG9mIGl0cyBkZXZpY2VzIGp1c3QgdHJpZWQgdG8gY29udGFj dCBhIGJvdG5ldCBDJmFtcDtDLiBJdCB3b3VsZCBiZSB2ZXJ5IG5pY2UgaWYgdGhlIElFVEYgc3Rh bmRhcmRpemVkIGEgd2F5IHRvIGRvIHRoYXQuPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+ DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7LXdlYmtpdC1zdGFuZGFyZCZxdW90OyxzZXJpZjtj b2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEzLjVwdDtmb250LWZhbWlseTom cXVvdDstd2Via2l0LXN0YW5kYXJkJnF1b3Q7LHNlcmlmO2NvbG9yOmJsYWNrIj5JIGRvbuKAmXQg c2VlIHdoeSB0aGV5IHdvdWxkbuKAmXQsIGFuZCBJIGNvdWxkIGVhc2lseSBlbnZpc2lvbiB0aGVt IGJlaW5nIG9ibGlnZWQgdG8gZG8gc28gaW4gdGhlIGZ1dHVyZS48L3NwYW4+PG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxicj4NClRoZXkgc2F5IHRvIHlvdSBJ UCBhLmIuYy5kIHdoaWNoIHNhZGx5IGlzIHRoZSBleHRlcm5hbCBJUCBvbiB0aGUgTkFUIGV4aXRp bmcgdGhlIGNvcnBvcmF0ZSBuZXR3b3JrIGhhcyBhIHByb2JsZW0uIFNvIGdyZWF0IG9uZSBvZiBw b3RlbnRpYWxseSAxMDAw4oCZcyBvZiBkZXZpY2VzIGlzIGluZmVjdGVkIGJ1dCBub3QgcmVhbGx5 IG11Y2ggYmV0dGVyIGluZm9ybWF0aW9uIHRoYW4gdGhhdC4gSW4gZWZmZWN0IGV4YWN0bHkgd2hh dCBtb3N0IHNlY3VyaXR5DQogb3BlcmF0aW9ucyB0ZWFtcyBhc3N1bWUgaXMgdHJ1ZSBldmVyeSBk YXkgb2YgdGhlIHdlZWsuPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpw PiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFsaXN0ZXIgV2luZmllbGQ8 bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRp bmcgYW55IGF0dGFjaG1lbnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlz IGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVz c2VkIG1heSBub3QgYmUgb2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9m IHRoZSBvcmlnaW5hdG9yLiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNl DQogbm90aWZ5IHRoZSBzZW5kZXIgYnkgcmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20g eW91ciBzeXN0ZW0uIFlvdSBzaG91bGQgbm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUs IHJldHJhbnNtaXQsIHVzZSBvciBkaXNjbG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVh c2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSByaWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVu aWNhdGlvbiB0aHJvdWdoIG91ciBpbnRlcm5hbCBhbmQNCiBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZ IGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtzIG9mIFNreSBMaW1pdGVkIGFuZCBTa3kg SW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5kZXIgbGljZW5jZS4NCjxicj4NCjxicj4N ClNreSBVSyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBT ZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVy cyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1Ag TGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0 IHN1YnNpZGlhcmllcyBvZiBTa3kgTGltaXRlZCAoUmVnaXN0cmF0aW9uDQogTm8uIDIyNDc3MzUp LiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJlIGlu Y29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVnaXN0 ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNleCBUVzcgNVFEDQo8 L2JvZHk+DQo8L2h0bWw+DQo= --_000_80F6DCFDEB8F4CD79E7E19ACB6CA90FBskyuk_-- From nobody Tue Mar 19 14:24:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0982912B001 for ; Tue, 19 Mar 2019 14:24:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jsokUoeaEpKa for ; Tue, 19 Mar 2019 14:24:43 -0700 (PDT) Received: from mail-lf1-x134.google.com (mail-lf1-x134.google.com [IPv6:2a00:1450:4864:20::134]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 112A81274D0 for ; Tue, 19 Mar 2019 14:24:43 -0700 (PDT) Received: by mail-lf1-x134.google.com with SMTP id u2so267955lfd.4 for ; Tue, 19 Mar 2019 14:24:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6VxRlAZB+9uoRO4zhs2ktzcoCqrHbg1mslzaEs4ok0o=; b=SJZGt/XSjeceLb862jUCbTFhBLY22Buk+8TsG49VP9sdvW1uLUpdtwDoDyt6f9yRAB DllEXPupaUIUHEbBPBPOiBj6epjQwaR2bhjSvDusCiCfEMjqeAaI6mlVN0DuhaTm5EKb eDM067Al2NVP699Pq2IgtNp4iUvP/0/0QHSoZ8A6YRYGyBFEgwcQLYh7zLF6pWsfGcIs NP0N/jsthdFK5VHhdvhctLMoSx0Ja10uxgo28vyacrr4+jclXLtlZPUX7F7AtmhjDF7c QP/41WJPP5KvLvCG4T57elM0cKMzZItpYG/Lwz+eq1cuzUBmH9+kSTUADz3oiPzcwvuh faQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6VxRlAZB+9uoRO4zhs2ktzcoCqrHbg1mslzaEs4ok0o=; b=PE8O//vc7+YOyybjrBKkB2j81StVqxWVEo2LUrm7LIl0niyYDix10M0cke4sA4B9Np oeD1HVqoFEclQWwYz5QrNS162R1bAV5IYTVUQNKxaoHhGjSmL5CeXP+iQBv6aPb3UVod enDHph8CZWaE+GMuDAgItAPVCqtjOMK5Er+kFqq44Bql4DhWdArEJeQftJrGJuXxz/Kj sja2TGcV6sS2vuPTZiY2c88LuhcfVQIj6lZHptY+XwOQ4DtoXRbCViUpZszB4KbuhHFj +04Q5zP9T/WktcNOJgtEfhX64/dYCZmyuxzXzxzEQ7o1fZHthSu9Mt7AaqVcHzXGT8pc 17uQ== X-Gm-Message-State: APjAAAUigm8hQ0M2mtKDcO5fPZxncC6k+XjA6zokASRjsgRA+B289Chw KjXaghNz7IVLOnrzH2CBSv1R+y2Zg0zfhgz7iSZFEPIA X-Google-Smtp-Source: APXvYqyre3utR7Y9NcPaLevPksI/q4BAtryGu8nTDIgdBXQjEDgmkWibL1ol3YW/YsuW4k7NZZmDzX1DZzYhUX1aqgs= X-Received: by 2002:ac2:518b:: with SMTP id u11mr2641325lfi.123.1553030681286; Tue, 19 Mar 2019 14:24:41 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: From: Eric Rescorla Date: Tue, 19 Mar 2019 14:24:04 -0700 Message-ID: To: Martin Thomson Cc: DoH WG Content-Type: multipart/alternative; boundary="00000000000015744505847922ad" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 21:24:45 -0000 --00000000000015744505847922ad Content-Type: text/plain; charset="UTF-8" On Tue, Mar 19, 2019 at 1:33 PM Martin Thomson wrote: > I agree with Ted. > > On Wed, Mar 20, 2019, at 04:46, Ted Hardie wrote: > > My apologies if I have misunderstood your point > > here, but unless you also block all traffic for which you have seen no > > resolution event, I believe that it is entirely possible to circumvent > > the defense you describe. > > The problem with blocking packets that can't be traced to a resolution > event is that you need to catch all the resolution events. DNS doesn't have > a monopoly on address resolution - I mean, that's the whole point of this > discussion, isn't it? > Even ignoring that, consider, for instance ICE. -Ekr > Yes, there are a great many protocols that include a DNS query before > every communication attempt, but not all. If you are comfortable breaking > or degrading all the other protocols, this is I guess an OK strategy. I > personally wouldn't call the thing that you get out the other end > "Internet". Of course, people routinely make that claim with only TCP > ports 80 and 443 open. > > > browsers treated all downloaded > > JavaScript applications as potentially malign. > > Nicely understated. Spend any amount of time on this problem and the word > "potentially" just fades away. > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000015744505847922ad Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 19, 2019 at 1:33 PM Marti= n Thomson <mt@lowentropy.net>= ; wrote:
I agree= with Ted.

On Wed, Mar 20, 2019, at 04:46, Ted Hardie wrote:
> My apologies if I have misunderstood your point
> here, but unless you also block all traffic for which you have seen no=
> resolution event, I believe that it is entirely possible to circumvent=
> the defense you describe.

The problem with blocking packets that can't be traced to a resolution = event is that you need to catch all the resolution events. DNS doesn't = have a monopoly on address resolution - I mean, that's the whole point = of this discussion, isn't it?

Even = ignoring that, consider, for instance ICE.

-Ekr


Yes, there are a great many protocols that include a DNS query before every= communication attempt, but not all.=C2=A0 If you are comfortable breaking = or degrading all the other protocols, this is I guess an OK strategy.=C2=A0= I personally wouldn't call the thing that you get out the other end &q= uot;Internet".=C2=A0 Of course, people routinely make that claim with = only TCP ports 80 and 443 open.

> browsers treated all downloaded
> JavaScript applications as potentially malign.

Nicely understated.=C2=A0 Spend any amount of time on this problem and the = word "potentially" just fades away.

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000015744505847922ad-- From nobody Tue Mar 19 16:04:04 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1113F131192 for ; Tue, 19 Mar 2019 16:04:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.979 X-Spam-Level: X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lNKk_leZdeid for ; Tue, 19 Mar 2019 16:04:00 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D409A13118B for ; Tue, 19 Mar 2019 16:04:00 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2JN3wAS084958 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Tue, 19 Mar 2019 18:04:00 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553036640; bh=uWpH1tzlTSA6Tp0iXrsW7+cnQ2F3uPmCABb1VDyAb6M=; h=Subject:To:References:From:Date:In-Reply-To; b=P4aEDn6ffoRKFLqXKgJSHgV3qM9fDkuQF0a22tyK8Jx0fk9yMRQ9aZtB9+JPLOk3f El+3MCKFtm24H1i+rPJg/xx3b/PAcVL4NsGMo0vLxZ8rRPMHFlsm8tFtPS8c8+WKQh duIJuKu1e1NI27Hr+hwqvmae7E7HOyOdeEgRbH54= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Martin Thomson , doh@ietf.org References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> From: Adam Roach Message-ID: <1bc67e19-cdfc-c1c0-1431-fbd15c0f0d02@nostrum.com> Date: Tue, 19 Mar 2019 18:03:52 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 23:04:03 -0000 On 3/19/19 3:33 PM, Martin Thomson wrote: > I agree with Ted. > > On Wed, Mar 20, 2019, at 04:46, Ted Hardie wrote: >> My apologies if I have misunderstood your point >> here, but unless you also block all traffic for which you have seen no >> resolution event, I believe that it is entirely possible to circumvent >> the defense you describe. > The problem with blocking packets that can't be traced to a resolution event is that you need to catch all the resolution events. DNS doesn't have a monopoly on address resolution - I mean, that's the whole point of this discussion, isn't it? It's also pretty trivial to defeat: if I were malware that used DoH to resolve "cnc.horriblebotnet.example" to 192.0.2.17, I could then do a Do53 query for "192-0-2-17.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.plex.direct", which triggers a valid resolution response for the IP address I want to get to and lets my traffic through. Sure, you can block the entire "plex.direct" tree, but it's not the only resolver that acts like this. You'll be playing a long game of whack-a-mole. /a From nobody Tue Mar 19 16:43:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02874130F08 for ; Tue, 19 Mar 2019 16:43:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=JP2hxEdq; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=3gUXmJDq Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PGsmtrrxSmMi for ; Tue, 19 Mar 2019 16:42:59 -0700 (PDT) Received: from out2-smtp.messagingengine.com (out2-smtp.messagingengine.com [66.111.4.26]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 26FC5130DEF for ; Tue, 19 Mar 2019 16:42:59 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 746FC22044 for ; Tue, 19 Mar 2019 19:42:58 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Tue, 19 Mar 2019 19:42:58 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=D79ljYhP77GeqFqC6dKYf2tfV86Cd7E VWQr3yZdztUQ=; b=JP2hxEdqdjiRfuoZLspN9ms1GtTKF0YqXlsCeEXeQljbVDh hiHSwqXveAs128cdJyj8v5wS6tFWeh6xFqWyaxRhfUeAC/zp3demAj3z9VH0ShPt xUkpD6nWGvii+GP7+dSrwmGRVo7TQvocCAAecoAqT8OaUupcmJ6Uz+3Q9jAwARS4 9AGKzI8w7ODUImsr9n68Mli88KUczjtzklFknB50RT5zyBigndEZcIZg1NCZonpf APsaARF0ZMGZCgsXyyVypayUHKGtj/M7QE1TO7/vYqKzKZK3oyzb9QT5KrG4Kf2S rimTK90OBHwZjUWnvIvcsLfZbsRV55TuVOdMYCA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=D79ljY hP77GeqFqC6dKYf2tfV86Cd7EVWQr3yZdztUQ=; b=3gUXmJDqp4SzEMjNaFyhWt FooXld5HK2u03lft8uRk/3j2eU+SCDJ3l0neHRu36GwP9wO4/3I8yvadBZDvqwC7 ZO7jji8UrEmewJQuIbg0IiOqrsThjUPSiAIsD/3hJUzSy3knqK8MDVu0nIKOwHGM Gt3h884lu34m/uMHmF8uBL8AdJn+YxaLvtQVMXvB0WuZy6+qKPvkjGztI+dHxwKz jmnw1VO0iDTR5cKFeFPkzb6lG3xm7M2F6lfdd/9vQ1tNSIRCaxggnZi4SPHEPNGA VyBCLbb2bjQyXr9sVh/c65tiBGBQTiqjulGITNH/hUdq9sxih7YsnpYBqx9Po0mw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrieehgddugecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecuffhomhgrihhnpehhthhtphgrnhgurhgvughirhgvtg htshdrhihouhdpughishhsrdguohhtnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmthes lhhofigvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id D544D7C63D; Tue, 19 Mar 2019 19:42:57 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <8657a914-dc1c-4f48-a2d7-01949da1604c@www.fastmail.com> In-Reply-To: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> Date: Tue, 19 Mar 2019 19:42:59 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] draft-ietf-doh-resolver-associated-doh-02 comments X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 23:43:01 -0000 On Wed, Mar 20, 2019, at 07:53, Stephen Farrell wrote: > - Section 2: what about OCSP? are we assuming that the OCSP > responder is resolved by the precursor system resolver or > the DoH resolver or both? I don't think it makes a security > difference (OCSP works or doesn't as usual), but it may be > a gotcha in terms of establishing the TLS session. Or, are > we assuming there's no point in OCSP for an IP-address > cert? (I forget;-) In capport we've made some recommendations about what can be done when you have limited network access. The situation isn't identical, but the guidance is the same: staple OCSP responses and provide all intermediates (i.e., don't send people chasing after AIA URLs that they can't resolve). > - Section 2: "the normal rules for HTTP" - does that mean > all re-directs MUST be HTTPS too? And can those URLs use > DNS names or must they be IP address certs too? There are no "normal rules" for HTTP and redirects. You have to explicitly say that redirects to unauthenticated resources are not permitted. > - Section 7, para 1: that's way too one-sided. DoH could > be less privacy-friendly (than say DoT) due to cookies and > whatnot. I think that it might pay to spend some time on this particular meme on a separate thread. My view is that while the opportunities exist, a lot of the concern here comes more from this being different and new and less from real provable problems. For instance, both parties have to work pretty hard to get cookies. Even in the contexts where you think that you might not have to (like a browser). > - Section 8: Why diss. DoT? It's not a competition:-) I agree. It is, but it's our responsibility to rise above that. From nobody Tue Mar 19 16:59:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 534D7130DEF for ; Tue, 19 Mar 2019 16:59:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IoGjRiU5lowa for ; Tue, 19 Mar 2019 16:59:38 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A4508130FF3 for ; Tue, 19 Mar 2019 16:59:36 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7C579BED9; Tue, 19 Mar 2019 23:59:33 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P24ivB61VRFS; Tue, 19 Mar 2019 23:59:31 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id B8C3EBEBB; Tue, 19 Mar 2019 23:59:31 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553039971; bh=rX+ZJ9iD+tPuIkogPH5alnF5LVKiAMWmRWEawx+5Ij0=; h=Subject:To:References:From:Date:In-Reply-To:From; b=bOo8hKJAqiXbLCtDyNSbvxiWm0q8aR+BLqo4e47JUkvNuiDG+bcv4VP8iaYo/hZE2 CcuypGDtQst2rMaXajsN05xSa4cQX0BrfVvwwZ1pnwvFPluryns1wdYs2XLSNZ99Ol J5W1qu5aRG2vTG9Wx0FBpCc8M9fQqxGasC8SNH4I= To: Martin Thomson , doh@ietf.org References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> <8657a914-dc1c-4f48-a2d7-01949da1604c@www.fastmail.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <35c2c6fc-1fbf-32da-dd0e-f5ab4e3d021d@cs.tcd.ie> Date: Tue, 19 Mar 2019 23:59:30 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <8657a914-dc1c-4f48-a2d7-01949da1604c@www.fastmail.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="gkR7lssQha1sPppUad8QcgJ3m3g9C6NWM" Archived-At: Subject: Re: [Doh] draft-ietf-doh-resolver-associated-doh-02 comments X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 19 Mar 2019 23:59:40 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --gkR7lssQha1sPppUad8QcgJ3m3g9C6NWM Content-Type: multipart/mixed; boundary="tkqtPR99kACFvHEz4n6iRiFk48Fg0lAJL"; protected-headers="v1" From: Stephen Farrell To: Martin Thomson , doh@ietf.org Message-ID: <35c2c6fc-1fbf-32da-dd0e-f5ab4e3d021d@cs.tcd.ie> Subject: Re: [Doh] draft-ietf-doh-resolver-associated-doh-02 comments References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> <8657a914-dc1c-4f48-a2d7-01949da1604c@www.fastmail.com> In-Reply-To: <8657a914-dc1c-4f48-a2d7-01949da1604c@www.fastmail.com> --tkqtPR99kACFvHEz4n6iRiFk48Fg0lAJL Content-Type: multipart/mixed; boundary="------------9DA1D0C3B744B789FCD7AC63" Content-Language: en-GB This is a multi-part message in MIME format. --------------9DA1D0C3B744B789FCD7AC63 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 19/03/2019 23:42, Martin Thomson wrote: >> - Section 7, para 1: that's way too one-sided. DoH could be less >> privacy-friendly (than say DoT) due to cookies and whatnot. > > I think that it might pay to spend some time on this particular meme > on a separate thread. =20 Yeah, that's reasonable. > My view is that while the opportunities exist, > a lot of the concern here comes more from this being different and > new and less from real provable problems. For instance, both parties > have to work pretty hard to get cookies. Even in the contexts where > you think that you might not have to (like a browser). That's also fair. OTOH, the heritage of the web here is somewhat, to gigantically, depressing, and given the capability exists... S. --------------9DA1D0C3B744B789FCD7AC63 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------9DA1D0C3B744B789FCD7AC63-- --tkqtPR99kACFvHEz4n6iRiFk48Fg0lAJL-- --gkR7lssQha1sPppUad8QcgJ3m3g9C6NWM Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyRgmIACgkQWrL68XsX K+rpEw/+PVAN92uYrz11ubTWvS2nEH+Ijqp54KxiZLEFqHG+3w7VSXEJjOzMr5ll cpV9UlUktFUX8hF6pEVLGExLa2wcRbAWvx7DhDh1AzCb8dm4s2HaOSBW0bWcKiq3 AxyeGXF7E0jVtZne3YD2renbuw9F0JurU7M9n1HMHbInaHpQq4BIR4qhq+a7TVyQ 9TWLyVvqvu4MHNSv5w3nXxWwjwv9vcSkjHv3HOewqbu1y5l4w48oysnTc4H3OMVs GZSl+285eiyrNZi8EJtOx/jDP9z3SNZYcAo5yR+rgD1kir6oUh3qv56IiS+gOR0p CjXOzd7BNkW9gS1N/bxKhYHj/S/RmZusCvLZNScXGGBzj9kmtaYB6qEvoAD9Cs+l dM6NGFfLfcha1qtLBXTVTfVZjpCgtPj97em9QLp+hOXAPfSGRR+yBVtHw5wwPFC1 B/BWopU2p/ND+be8piMT6ODIy0ymlnkI/9y4gc18ZebCQaeNwmEeYJ83OG9X51Wa t9e6FgnyzaI0qQ78a6pQsxgynW15WKH9MbnM2T9k0mkFUHep/zA60JbGUQXlCoS5 Rnn3sgtIhAq4KT4N11Lv6HOL2Ub2LYVUTwHLpdfFj6mJYkJzvRg9z5yG1Z/nSUlN PjY0go19RFLA5HdW3pyRyM79H8hx4X8I8gpo7p/67iK0Wdm694c= =vitN -----END PGP SIGNATURE----- --gkR7lssQha1sPppUad8QcgJ3m3g9C6NWM-- From nobody Tue Mar 19 17:41:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E7A9130E6B for ; Tue, 19 Mar 2019 17:41:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qm63grYbNCcv for ; Tue, 19 Mar 2019 17:41:01 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E88341310D2 for ; Tue, 19 Mar 2019 17:40:54 -0700 (PDT) Received: from xsmtp03.mail2web.com ([168.144.250.223]) by mx114.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h6PHp-000t2y-96 for doh@ietf.org; Wed, 20 Mar 2019 01:40:54 +0100 Received: from [10.5.2.13] (helo=xmail03.myhosting.com) by xsmtp03.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h6PHk-00053C-UL for doh@ietf.org; Tue, 19 Mar 2019 20:40:49 -0400 Received: (qmail 31162 invoked from network); 20 Mar 2019 00:40:48 -0000 Received: from unknown (HELO [192.168.1.103]) (Authenticated-user:_huitema@huitema.net@[172.56.42.166]) (envelope-sender ) by xmail03.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 20 Mar 2019 00:40:47 -0000 To: "Winfield, Alister" , Eliot Lear Cc: Matthew Pounsett , Ted Hardie , DoH WG , Paul Vixie , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> <4F2265B7-BF78-498C-9372-AF8884082FCA@cisco.com> <80F6DCFD-EB8F-4CD7-9E7E-19ACB6CA90FB@sky.uk> From: Christian Huitema Openpgp: preference=signencrypt Autocrypt: addr=huitema@huitema.net; prefer-encrypt=mutual; keydata= mQENBFIRX8gBCAC26usy/Ya38IqaLBSu33vKD6hP5Yw390XsWLaAZTeQR64OJEkoOdXpvcOS HWfMIlD5s5+oHfLe8jjmErFAXYJ8yytPj1fD2OdSKAe1TccUBiOXT8wdVxSr5d0alExVv/LO I/vA2aU1TwOkVHKSapD7j8/HZBrqIWRrXUSj2f5n9tY2nJzG9KRzSG0giaJWBfUFiGb4lvsy IaCaIU0YpfkDDk6PtK5YYzuCeF0B+O7N9LhDu/foUUc4MNq4K3EKDPb2FL1Hrv0XHpkXeMRZ olpH8SUFUJbmi+zYRuUgcXgMZRmZFL1tu6z9h6gY4/KPyF9aYot6zG28Qk/BFQRtj7V1ABEB AAG0J0NocmlzdGlhbiBIdWl0ZW1hIDxodWl0ZW1hQGh1aXRlbWEubmV0PokBOQQTAQIAIwUC UhFfyAIbLwcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheAAAoJEJNDCbJVyA1yhbYH/1ud6x6m VqGIp0JcZUfSQO8w+TjugqxCyGNn+w/6Qb5O/xENxNQ4HaMQ5uSRK9n8WKKDDRSzwZ4syKKf wbkfj05vgFxrjCynVbm1zs2X2aGXh+PxPL/WHUaxzEP7KjYbLtCUZDRzOOrm+0LMktngT/k3 6+EZoLEM52hwwpIAzJoscyEz7QfqMOZtFm6xQnlvDQeIrHx0KUvwo/vgDLK3SuruG1CSHcR0 D24kEEUa044AIUKBS3b0b8AR7f6mP2NcnLpdsibtpabi9BzqAidcY/EjTaoea46HXALk/eJd 6OLkLE6UQe1PPzQC4jB7rErX2BxnSkHDw50xMgLRcl5/b1a5AQ0EUhFfyAEIAKp7Cp8lqKTV CC9QiAf6QTIjW+lie5J44Ad++0k8gRgANZVWubQuCQ71gxDWLtxYfFkEXjG4TXV/MUtnOliG 5rc2E+ih6Dg61Y5PQakm9OwPIsOx+2R+iSW325ngln2UQrVPgloO83QiUoi7mBJPbcHlxkhZ bd3+EjFxSLIQogt29sTcg2oSh4oljUpz5niTt69IOfZx21kf29NfDE+Iw56gfrxI2ywZbu5o G+d0ZSp0lsovygpk4jK04fDTq0vxjEU5HjPcsXC4CSZdq5E2DrF4nOh1UHkHzeaXdYR2Bn1Y wTePfaHBFlvQzI+Li/Q6AD/uxbTM0vIcsUxrv3MNHCUAEQEAAYkCPgQYAQIACQUCUhFfyAIb LgEpCRCTQwmyVcgNcsBdIAQZAQIABgUCUhFfyAAKCRC22tOSFDh1UOlBB/94RsCJepNvmi/c YiNmMnm0mKb6vjv43OsHkqrrCqJSfo95KHyl5Up4JEp8tiJMyYT2mp4IsirZHxz/5lqkw9Az tcGAF3GlFsj++xTyD07DXlNeddwTKlqPRi/b8sppjtWur6Pm+wnAHp0mQ7GidhxHccFCl65w uT7S/ocb1MjrTgnAMiz+x87d48n1UJ7yIdI41Wpg2XFZiA9xPBiDuuoPwFj14/nK0elV5Dvq 4/HVgfurb4+fd74PV/CC/dmd7hg0ZRlgnB5rFUcFO7ywb7/TvICIIaLWcI42OJDSZjZ/MAzz BeXm263lHh+kFxkh2LxEHnQGHCHGpTYyi4Z3dv03HtkH/1SI8joQMQq00Bv+RdEbJXfEExrT u4gtdZAihwvy97OPA2nCdTAHm/phkzryMeOaOztI4PS8u2Ce5lUB6P/HcGtK/038KdX5MYST Fn8KUDt4o29bkv0CUXwDzS3oTzPNtGdryBkRMc9b+yn9+AdwFEH4auhiTQXPMnl0+G3nhKr7 jvzVFJCRif3OAhEm4vmBNDE3uuaXFQnbK56GJrnqVN+KX5Z3M7X3fA8UcVCGOEHXRP/aubiw Ngawj0V9x+43kUapFp+nF69R53UI65YtJ95ec4PTO/Edvap8h1UbdEOc4+TiYwY1TBuIKltY 1cnrjgAWUh/Ucvr++/KbD9tD6C8= Message-ID: <026fdb87-68ec-f8a8-7f56-7b825bcb517a@huitema.net> Date: Tue, 19 Mar 2019 17:40:48 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <80F6DCFD-EB8F-4CD7-9E7E-19ACB6CA90FB@sky.uk> Content-Type: multipart/alternative; boundary="------------42A03887BF260D6A60892F97" Content-Language: en-US X-Originating-IP: 168.144.250.223 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.13) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5sFRfxXaA3DOpAcCrktXCXl602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6Bxa1wdtg7I/HC36yqO86nwYEh5 mNm/WjPqhYqCeBiCKwwnRtk/d5gNfEtjtud5V8jpAx8WiOp3k5R0E3oWxTrHKR/TBCf6oYXAWGet lavcAjD9ytQxIHf9lN5jjLJaPK8l4YBmPrqPoeRXD34azf1rYZv5uZUEePrXZkexHL9EC3AAJAfA 9MMVcQ9WVjD1q+Rbd9IPG/DQ2p+GU04sTuYFs91jhnM/Mbva2XLV/LIEzaKyLm0zESXAkIAT8ZKA DvsGI5uh86ZVnyOrYkLMWyEaRt9fxN2oReTDHAyOynaY0CmHJLVH4DfVNbPXJmiLfub/IRFsicyJ MEhQFtD8PLoiniWmsFByBoXAuCZEyg59LM/9rUJrEbVA84BZVscMTXpbpuxXJTL417vaJWq5kk+j cuidX4Ts4xdG+C13IyWeZaLTlBAGukp2GWE0xnvo4iFfPwUimsNGvJJilSn4u6QSZASRpWp53/vo GLer/6vgOJ0s95DGoDQyh90npG6wuAU16Y3oZJdQ0WXQEIKhyt8GANo5bn0tFTz4SVUdCy2MVE6+ P+NMWgh0hdHFCOgNkMJ392PNDpgLsd6Ddd/s7VM53tGWQiV0zRVsA5SL7kYV1JnAMgFPp7+h3kLe NmBV53UGz7DzCbBvH/Ys8La+ytq9VyYWYHeaKXHWbzOpUH8qmLpRXxKF5tPxTxfD0dMN+t5ZP6zO upSxHMPsAHfGhZAC/IAhemhJdBSJkER04dYNqSf7G3ch6MdB0XuALpEgtIRSdxZ/cxSnpMWdGZZ8 NIOHnN40eTXlWiUAYdLmsJdAoPJHNvQfAjIDptXbNSradnS0Zqm0mOdPl1LeUTNmkYtBTuxv0/1e /nzlq13wYTxncOSJHdsd+cwIgRT6euCWiMrA+4FHNKsiy9wMVtQ6ai8zTQ== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 00:41:03 -0000 This is a multi-part message in MIME format. --------------42A03887BF260D6A60892F97 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit On 3/19/2019 1:53 PM, Winfield, Alister wrote: > >   > > Third party DNS/DoH providers could probably block resolution of > phishing names or  botnet C&C names using the same methods as > enterprises do today, but the enterprise network will not be > informed that one of its devices just tried to contact a botnet > C&C. It would be very nice if the IETF standardized a way to do that. > >   > > I don’t see why they wouldn’t, and I could easily envision them being > obliged to do so in the future. > > > They say to you IP a.b.c.d which sadly is the external IP on the NAT > exiting the corporate network has a problem. So great one of > potentially 1000’s of devices is infected but not really much better > information than that. In effect exactly what most security operations > teams assume is true every day of the week. > That when IPv6 sounds good... -- Christian Huitema --------------42A03887BF260D6A60892F97 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit


On 3/19/2019 1:53 PM, Winfield, Alister wrote:

 

Third party DNS/DoH providers could probably block resolution of phishing names or  botnet C&C names using the same methods as enterprises do today, but the enterprise network will not be informed that one of its devices just tried to contact a botnet C&C. It would be very nice if the IETF standardized a way to do that.

 

I don’t see why they wouldn’t, and I could easily envision them being obliged to do so in the future.


They say to you IP a.b.c.d which sadly is the external IP on the NAT exiting the corporate network has a problem. So great one of potentially 1000’s of devices is infected but not really much better information than that. In effect exactly what most security operations teams assume is true every day of the week.

That when IPv6 sounds good...

-- Christian Huitema

--------------42A03887BF260D6A60892F97-- From nobody Tue Mar 19 18:03:23 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C05D130E68 for ; Tue, 19 Mar 2019 18:03:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gF83uMw0VVUn for ; Tue, 19 Mar 2019 18:03:20 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5E5B0128DFF for ; Tue, 19 Mar 2019 18:03:20 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Tue, 19 Mar 2019 18:03:18 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Tue, 19 Mar 2019 18:03:18 -0700 From: Paul Hoffman To: Stephen Farrell CC: "doh@ietf.org" Thread-Topic: [Ext] [Doh] draft-ietf-doh-resolver-associated-doh-02 comments Thread-Index: AQHU3pXQS3mzifcedk+qXWIs0U3KpKYUKZSA Date: Wed, 20 Mar 2019 01:03:18 +0000 Message-ID: References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> In-Reply-To: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.32.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <5F90B0CC3E621546AB2AA2B49C546005@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] draft-ietf-doh-resolver-associated-doh-02 comments X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 01:03:22 -0000 On Mar 19, 2019, at 1:53 PM, Stephen Farrell wr= ote: > - Section 2: what about OCSP? are we assuming that the OCSP > responder is resolved by the precursor system resolver or > the DoH resolver or both? I don't think it makes a security > difference (OCSP works or doesn't as usual), but it may be > a gotcha in terms of establishing the TLS session. Or, are > we assuming there's no point in OCSP for an IP-address > cert? (I forget;-) This is an interesting question. It assumes that the application has no DNS= resolver when the HTTPS query is sent, and that getting the associated DoH= server is a prerequisite to sending DNS (in this case, to locate the OCSP = server). That was certainly not the intention, given that the application can send D= NS queries for the other protocols described. I'll add a note to that effec= t in the next draft. > - Section 2: "the normal rules for HTTP" - does that mean > all re-directs MUST be HTTPS too? And can those URLs use > DNS names or must they be IP address certs too? The term "normal HTTP" was used in the DoH spec (RFC 8484), and here "norma= l rules for HTTP" were assumed to be the same. > - Sections 3 & 4: the use of special-use domain names here > seems ickky to me. ("ickky" being a technical terms for "I > don't like that but can't justify my opinion" :-) I think > it'd be a pity to see more crap DNS queries emitted from > browsers though and would love to see something better. Better suggestions are still heartily welcomed. These are the result of man= y comments on earlier drafts, but you are not alone in disliking the use of= special-use domain names. > I > also wonder what'd happen with these queries in a home n/w > with a never-updated router or with a brand-new flashy > home router that e.g. has a public DNS name. Nothing special. If a resolver doesn't understand the SUDN, it will pass it= upstream and get an NXDOMAIN answer back. > (In that > latter case, I can easily get a cert for the name of my > home router, but not for it's IP address.) Certificates are not useful for the protocols in these sections. > - Section 7, para 1: that's way too one-sided. DoH could > be less privacy-friendly (than say DoT) due to cookies and > whatnot. The sentence explicitly says "communication privacy", not overall privacy, = for the very reason you give. I guess that wasn't clear enough. I'll add "H= owever, using a DoH server can also reduce overall privacy because both TLS= and HTTPS allow for user identification in ways that plain Do53 does not." > - Section 8: Why diss. DoT? It's not a competition:-) For many people, it is. That is, people constantly ask why should DoH even = exist if DoT already exists. This helps explain that. --Paul Hoffman= From nobody Tue Mar 19 18:14:06 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90024128DFF; Tue, 19 Mar 2019 18:14:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N_nIqWpntjOF; Tue, 19 Mar 2019 18:14:03 -0700 (PDT) Received: from puck.nether.net (puck.nether.net [204.42.254.5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1521B1277E7; Tue, 19 Mar 2019 18:14:03 -0700 (PDT) Received: from [IPv6:2603:3015:3606:cbe1:cd14:2c86:15f5:ed4e] (unknown [IPv6:2603:3015:3606:cbe1:cd14:2c86:15f5:ed4e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by puck.nether.net (Postfix) with ESMTPSA id 79018540EE9; Tue, 19 Mar 2019 21:14:00 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Jared Mauch In-Reply-To: Date: Tue, 19 Mar 2019 21:13:59 -0400 Cc: Ted Hardie , paul vixie , dnsop , DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> To: Michael Sinatra X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 01:14:04 -0000 > On Mar 12, 2019, at 5:52 PM, Michael Sinatra = wrote: >=20 > [1] As an example, I am personally and practically opposed to inline = TLS > decryption in most enterprises. DoH gives further ammo for security > folks to insist on inline TLS decryption, IMO. DoT, not as much, = since > the protocol can be easily identified on the wire and any necessary > actions taken. Manipulating DoT transactions is a far cry from > manipulating/decrypting all TLS... My impression is there are people who will not be satisfied until all = traffic looks identical and you have zero way to protect your home, enterprise or = similar. (The lack of protection is a side-effect, not a design criteria of making it = harder to detect variation in endpoint behavior) I don=E2=80=99t support efforts to offer standards that make everything = look the same when they are not the same. Next someone is going to show up in IDR saying how we must TLS all the = routing data because reasons. =20 - Jared= From nobody Tue Mar 19 18:24:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 884CE128DFF for ; Tue, 19 Mar 2019 18:24:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jGArk0D2V1vM for ; Tue, 19 Mar 2019 18:24:07 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8E7891277E7 for ; Tue, 19 Mar 2019 18:24:07 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 73C07BEE5; Wed, 20 Mar 2019 01:24:05 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UmO2aI3B0lmX; Wed, 20 Mar 2019 01:24:04 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id D2EA4BEDB; Wed, 20 Mar 2019 01:24:03 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553045044; bh=fney1SnbJJBMi4dPRotzDY+cFY8jtmHq6WCEevy4zX4=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=MN9ql5aEj25TTm4I1nPmRa+eTTSGo64YNJUZvqnksD8s9gqES0FyVG7XPu+Cf9F2x yAcC5epELh1Emik3C8xLOWguXZxQigKki2GiJrZX8ea4TC6RiDql8f51fPkxjzbp07 JEyflQS6LvRsPozjYy+Iz/n5T2SDSgQ/4MiI9A3s= To: Paul Hoffman Cc: "doh@ietf.org" References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <77c2aa7e-b48b-e74a-4e03-0e8f00843e6d@cs.tcd.ie> Date: Wed, 20 Mar 2019 01:24:03 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="RoUgZSCrE3YHGkk6tnXP295MpeIbWnVGA" Archived-At: Subject: Re: [Doh] [Ext] draft-ietf-doh-resolver-associated-doh-02 comments X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 01:24:11 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --RoUgZSCrE3YHGkk6tnXP295MpeIbWnVGA Content-Type: multipart/mixed; boundary="slrWNdA038UjrPF7LvAcdF8QxPO9O28Dr"; protected-headers="v1" From: Stephen Farrell To: Paul Hoffman Cc: "doh@ietf.org" Message-ID: <77c2aa7e-b48b-e74a-4e03-0e8f00843e6d@cs.tcd.ie> Subject: Re: [Doh] [Ext] draft-ietf-doh-resolver-associated-doh-02 comments References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> In-Reply-To: --slrWNdA038UjrPF7LvAcdF8QxPO9O28Dr Content-Type: multipart/mixed; boundary="------------727C722977D4513FAD317263" Content-Language: en-GB This is a multi-part message in MIME format. --------------727C722977D4513FAD317263 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, Other bits will resolve themselves in time (which is to say, I may agree or not but we can do that later:-), but on these two... On 20/03/2019 01:03, Paul Hoffman wrote: >> - Section 7, para 1: that's way too one-sided. DoH could be less >> privacy-friendly (than say DoT) due to cookies and whatnot. > The sentence explicitly says "communication privacy", not overall > privacy, for the very reason you give. I guess that wasn't clear > enough.=20 I don't know that there is actually a discrete and useful concept of "communication privacy" TBH. Regardless of that, it'd seem wiser to steer away from such debates if possible, and it should be easy enough in this case to recognise the dangers inherent in HTTPs vs DoT. (That being said, I'd be happy if the kind of "why it's in practice hard to be that privacy-unfriendly using DoH" text that Martin earlier implied could be useful were included as well.) I'll add "However, using a DoH server can also reduce overall > privacy because both TLS and HTTPS allow for user identification in > ways that plain Do53 does not." >=20 >> - Section 8: Why diss. DoT? It's not a competition:-) > > For many people, it is.=20 They are incorrect. Better to not pander to that error. > That is, people constantly ask why should DoH > even exist if DoT already exists. This helps explain that. The current text did not help me at all and I can't see how it helps anyone really, unless one is willing to accept that: "DoT=3D=3Dbad && DoH=3D=3Dgood" (or some such absolutist nonsense), is a sensible proposition. Cheers, S. --------------727C722977D4513FAD317263 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------727C722977D4513FAD317263-- --slrWNdA038UjrPF7LvAcdF8QxPO9O28Dr-- --RoUgZSCrE3YHGkk6tnXP295MpeIbWnVGA Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyRljMACgkQWrL68XsX K+qbbBAAzWJQldfvE8C+2D9VYX8rpUJcKVS89EfYxuAG8/yIZXevsI2g0IugnizW OiXGAxNdY+9t7aeaSGqI49XAKJzCTsXh/6bUTqygwruFZ3RVdKv0dFrRqElwYUYV 20BLH69KxVd7ixgA0lA5uNYDiuiLxO1HLAIi8mcIbButvfVbCp+R9oXAEiP4ItaD heLc4AQjvPipC5Oyi4b/C80r1qfs/O8dCkEwtpovlKI203I8rbFK5REo2Zfir1N/ pfIe9Bh1CyQJsBKSMQC+MaMPHc7N19JbgBT7lsbd9WPjtgA9kRrVu7UR9+rkJ/+7 FWigRGeGVEup6Sokf1xQ7FAjz66ensXS23obD5lp+pK3vCIA4TE6BhfcyobPvYLK jJA/6Nrrp7Q7oIxyLWwcfyviS+Z3L2z7LIjfy4OCeZ2GmtcmLWTMJLyd2KdWHsmZ gvIZfXovqH55jiin5Ci2YkCsar2Pw0U63omqJpFgSRWp2C6VAZD1wGf23H4/dsNZ R144WEJ5KArg4Yymce640AWy0VVNDzUgbcNYz390Ql3CaDBNnqnOYu+33B5YGswj UgBnIXfPw81vCqQUsE7jNKrAaEMQNLKtbUwySfJZ5LcSJJeRUBjL1aiVyb9fwR2p V+Rhm0Z7WZwIetYDeT59b5gOY/VHXXdT/khkEgDVxRi/uGunuuw= =wnXn -----END PGP SIGNATURE----- --RoUgZSCrE3YHGkk6tnXP295MpeIbWnVGA-- From nobody Tue Mar 19 18:24:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42E0E130DC2; Tue, 19 Mar 2019 18:24:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EPQFDKyUYnpf; Tue, 19 Mar 2019 18:24:36 -0700 (PDT) Received: from puck.nether.net (puck.nether.net [204.42.254.5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BAFA6128DFF; Tue, 19 Mar 2019 18:24:36 -0700 (PDT) Received: from [IPv6:2603:3015:3606:cbe1:cd14:2c86:15f5:ed4e] (unknown [IPv6:2603:3015:3606:cbe1:cd14:2c86:15f5:ed4e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by puck.nether.net (Postfix) with ESMTPSA id 1EFF0540DB8; Tue, 19 Mar 2019 21:24:34 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Jared Mauch In-Reply-To: Date: Tue, 19 Mar 2019 21:24:33 -0400 Cc: paul vixie , dnsop , DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <1ABC0E84-1653-4B27-AA89-AA1A53536CA2@puck.nether.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> To: Ted Hardie X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 01:24:38 -0000 > On Mar 15, 2019, at 2:36 PM, Ted Hardie wrote: >=20 > All of the work on encrypted DNS presumes that there is one or more = parties who wishes to observe the flow of traffic to DNS resolvers for = the purposes of surveillance. The conclusion of the IETF after IETF 88 = was that there was a class of that, pervasive public surveillance, that = was so damaging to the trust of the users in the Internet that it = amounted to an attack on the value of the Internet as a whole. The = plenary where that was discussed is online here: IETF 88 Technical = Plenary: Hardening The Internet - YouTube . In a path with multiple = links, in other words, we have a condition where we believe there is = likely to be an attacker on one or more of those links that would like = to see this data and to use it for purposes not approved by the user or = the operator of the service to which the user is directing her flows (or = any of the network operators through which the flow passes). =20 >=20 > The response to that has been first to encrypt the flows which carry = the user data. That's not an effort championed not only by the IETF or = the IAB; see the US Government's HTTPS Only standard for one example of = the many other efforts going on to make that the case. In addition to = that primary effort, there have been efforts to reduce the amount of = metadata about the flows. Some of that has been in updating transport = protocols (e.g. QUIC, TCPINC) to reduce their disclosure of state. Some = of it has been in reducing the data revealed by the handshake (e.g. the = updates in TLS 1.3 and eSNI). And some of it has been to reduce the = data disclosed across those links by the use of the DNS. That's the = point of DNS over TLS and DNS over DTLS; it's also the point of DNS over = HTTPS: to protect the data in those flows from a known, pervasive = attacker.=20 >=20 > You would like your use of similar surveillance techniques to be = differentiated from their use by that set of attackers. The IETF cannot = do that on moral grounds, much as we might like you and appreciate your = desire to protect your network and your children. We need technical = mechanisms. If you review the discussion to date, you'll see a number = of such mechanisms proposed. They fall into two broad classes: trusting = the local network infrastructure and trusting the local configuration. =20= >=20 Once you make all traffic look the same, expect it to be treated the = same as possibly malicious by network operators. =20 Do you know why software has options like avoid-v4-udp-ports as a config = directive? Expect that to happen regardless of where you move the = transport to. I=E2=80=99m writing this from my own machine that I own, purchased and = paid for with my own $$. If you=E2=80=99re writing from a corporate = owned machine, or reading on a corporate owned machine they likely have = their own rules for them. I believe in the open internet, but I also = don=E2=80=99t believe in the absolutes people see this in. You aren=E2=80= =99t entitled to all communication in the world. The IETF can try to = carve out a moral high ground that you are referring to. It may be = sound footing, but if you=E2=80=99re in a place where a DNS query for = example.com is problematic, one of the solutions is to NOT look up = example.com. It may not be =E2=80=9Cright=E2=80=9D in your mind, but it = is a way to prevent being jailed or otherwise which we may both morally = agree is the wrong outcome but those other locations that made = example.com bad may not care and no writing to/in an IETF WG will change = that a single bit. That change lives outside the IETF WG process. - Jared From nobody Tue Mar 19 18:41:54 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0DBE7128CF3; Tue, 19 Mar 2019 18:41:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kkK0bTYUBhhu; Tue, 19 Mar 2019 18:41:50 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CD5E1130E62; Tue, 19 Mar 2019 18:41:49 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AF52BBEE3; Wed, 20 Mar 2019 01:41:47 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WoiiPg0H8fSM; Wed, 20 Mar 2019 01:41:45 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 710C7BEDB; Wed, 20 Mar 2019 01:41:45 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553046105; bh=ymk3VkCMLY8QWJE4LXnPD3vIxMqN4GbXMuCkvxth4es=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=n3L1bfni7M3sPKwfpiEzVtpFqHWvfVUL/CeuIeQ8ldmneojTvaHizv3gM6uE+hCSA OrRSqGKB7SE3ozX5Pe4XuF5B6f2d7P7Brm321PfuZRQZi5hel8sxudwywCMN+vNrik 79G+9UD9etkUjK8SFuFyjn/Ej65AUlRQo0Dj9wGM= To: Jared Mauch , Michael Sinatra Cc: Ted Hardie , DoH WG , paul vixie , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: Date: Wed, 20 Mar 2019 01:41:44 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="0wcgu3jWHVQ53mT5spVC0d19pW4BG9eNH" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 01:41:53 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --0wcgu3jWHVQ53mT5spVC0d19pW4BG9eNH Content-Type: multipart/mixed; boundary="coyoCJpTwR6eGCN3AImvImAxxP2mX1FeK"; protected-headers="v1" From: Stephen Farrell To: Jared Mauch , Michael Sinatra Cc: Ted Hardie , DoH WG , paul vixie , dnsop Message-ID: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> In-Reply-To: <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> --coyoCJpTwR6eGCN3AImvImAxxP2mX1FeK Content-Type: multipart/mixed; boundary="------------B64FF48B66B17ABA8E1D1C44" Content-Language: en-GB This is a multi-part message in MIME format. --------------B64FF48B66B17ABA8E1D1C44 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, One individualistic data point on this sub-topic, and a real point: On 20/03/2019 01:13, Jared Mauch wrote: > My impression is there are people who will not be satisfied until all t= raffic looks > identical and you have zero way to protect your home, I would be happier if my home emitted no cleartext and have no intention of MITMing any TLS in my home. And that leaves me with plenty of ways to protect my home network (and as an aside that is absolutely not the same as protecting my home at all - such overstatement still doesn't help the discussion). For example, I discourage use of certain OSes, products and services, and try help the people using the network to understand enough about what they're doing to be less than randomly unsafe. Of course I have some f/w rules and do some monitoring but I would never use a net-nanny type thing. I do not claim that everyone ought do the same, but I absolutely do claim that encouraging voluntary policy adherence by dealing with the people using the n/w is preferable to many egregiously invasive attempts to force technical policy enforcement on unwilling serf-like users. And to be clear (but repetitive, sorry;-) my general point is that my policy is not the only defensible one, just as yours is not, (even if you claim it is). And nor is Paul V's - "My network, my rules" can also mean a much more permissive technical enforcement regime than is often assumed when hearing such a forceful-sounding catchphrase. Not all policies need to be enforced technically. Cheers, S. --------------B64FF48B66B17ABA8E1D1C44 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------B64FF48B66B17ABA8E1D1C44-- --coyoCJpTwR6eGCN3AImvImAxxP2mX1FeK-- --0wcgu3jWHVQ53mT5spVC0d19pW4BG9eNH Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyRmlgACgkQWrL68XsX K+pw6w//Ued+mcMvasEIRkQkpchRPChZ47YgfJqPWIvuH7ywN6HyAMwpy8sPj1B6 eBv60OK9AlVOV9w3tPA//r3wANqS5E4USF4EznbgMv2PC1SH4WScJEpdwlU1eo40 MAtwz62s4khXPjOmXmlwk4ndWwRB8BS6Z6XSj1agUrbK9TWSGm/XyqyrqjmzGoVx WNIJNE+zqTRX0L3P9IN1IqAE8YBU9BQQ9PkXwPa3bheeL2vg/0pwfkyvmalIFREc r/t3FcCgg7hplhA41S+u+Uh4X8rD9tmrumcUdi0sORkr+TA/Ly1gersT3MXkUgjh FpSs83G2GRYQzLY8GYK0S/osvzGJohAbd0LBglUWp/tiHAhOhZ6/Gtgi0P3ttSD5 CNaILwnIE5sCDNkRv2H51vmvPBh6ZcyiIPzj8eUnElaWbe3tsBShH+h9Y+9U7asT pmnOWy0sUttQSJ8utq3iuxuuRW7wsQUhhfdVfWwAGVfkaGpngyACORAAlJMIg3wa GOF3QQ4Tkk3lIEB7XTOSoG+dlPcpg2VMiwEnHfG3KIsguuAtxifE+Ivxh3D/IbIN pcF/9ZRpuNKo1Su70QXTUm07Xx0pY+aKkWzhU/WLGSN+9EAxWK7f97Alk28I8ldK N//4qxcowGAB5rUIAStyq4uCHTsd5jQVecmT0jTJV1uc0FtUE2A= =S72x -----END PGP SIGNATURE----- --0wcgu3jWHVQ53mT5spVC0d19pW4BG9eNH-- From nobody Tue Mar 19 19:12:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF5441277D8 for ; Tue, 19 Mar 2019 19:12:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8jnP2L7tzdN6 for ; Tue, 19 Mar 2019 19:12:09 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C46BB124B0C for ; Tue, 19 Mar 2019 19:12:09 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id 52E6F299A2; Tue, 19 Mar 2019 22:12:06 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23697.41334.322033.435466@gro.dd.org> Date: Tue, 19 Mar 2019 22:12:06 -0400 From: Dave Lawrence To: doh@ietf.org Archived-At: Subject: [Doh] Revised Agenda, Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 02:12:12 -0000 Here is the revised agenda for next week. As there are some notable questions about how to handle the recently submitted drafts on operational issues with DoH, after Paul's block we will use the balance of our time to discuss what the possible next steps for the working group and other documents. * Note Well https://www.ietf.org/about/note-well/ * Resolving issues in draft-ietf-doh-resolver-associated-doh (30 min) Paul Hoffman https://datatracker.ietf.org/doc/draft-ietf-doh-resolver-associated-doh/ * Re-chartering or new working group (balance of time): * Operational issues regard DoH Jason Livingood and Jim Reid * Discussion of appropriate venue for this sort of work From nobody Tue Mar 19 19:28:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2390130DE5; Tue, 19 Mar 2019 19:28:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dEFrMfcPHcjZ; Tue, 19 Mar 2019 19:28:32 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C0E3712D4F3; Tue, 19 Mar 2019 19:28:32 -0700 (PDT) Received: from [10.46.99.137] (unknown [12.184.218.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id C67F1892C6; Wed, 20 Mar 2019 02:28:30 +0000 (UTC) To: DoH WG , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> From: Paul Vixie Message-ID: Date: Tue, 19 Mar 2019 19:28:28 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.12 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 02:28:34 -0000 Stephen Farrell wrote on 2019-03-19 18:41: ... > Not all policies need to be enforced technically. if some of you were wondering why i've grown silent on this thread, this is an exemplar. -- P Vixie From nobody Tue Mar 19 20:17:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CC251277E0; Tue, 19 Mar 2019 20:17:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KCv70RQH8EhM; Tue, 19 Mar 2019 20:17:38 -0700 (PDT) Received: from mail-qt1-x82e.google.com (mail-qt1-x82e.google.com [IPv6:2607:f8b0:4864:20::82e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7ED03126C15; Tue, 19 Mar 2019 20:17:38 -0700 (PDT) Received: by mail-qt1-x82e.google.com with SMTP id k14so971975qtb.0; Tue, 19 Mar 2019 20:17:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tOKjhdaNzuisyE8mpv9CeuJ6GZEs9tarv+sxE5ceaWc=; b=XNF4hDJHB797qahxIGwdEweaekVIbCxklb9BCQB18SFuZtqxKh7Pe5YVVE/25MarDn ZQ01Zt1nDN46GvyDhDJK76lJtYW/N/4lxxdOLCRnUjs+dS4ZO9AZO18wL9i1lgYfluOL z0coCpIJhPVf90cJ0/PWqoO32/9QHxRjieZIdX5ErLnG9mkD3MkAViAT5AhSgGQ8+zNL D66cfMHUnxhfGAQH/IAeFT0jWrPH3gkxD3rLVl96aBsPgop8Qt/LEmWKgBsRenpWF6Uw D+0nbne9nnCMcfA1iZrbQXvwqG4yFACqVaaJKE9ZvKrLZZMj1QpTwBuUZRbJH1Te4KEn 0YeQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tOKjhdaNzuisyE8mpv9CeuJ6GZEs9tarv+sxE5ceaWc=; b=bjhEoENXLPpi/uezD2y6um631gciwT1prqA3c8iLJtfUcfGYSdRIKbd/Q3HWuSbPmd 1Ht80B7juq/SFay+DggGExjZJGagUamoXIBXkzFBJa5YnrpxSnSlYvx4oyBoP9j7AclM uLgAlEyGBnaGXga3ncLu08WRMnH2Ix83MUnbKQvv4Xb2Y7v8ygkUiPlWzlaiQVxzSjZq cHlgUo0kSkcQNimzsdGLY14w8UEWp/rth+bDxYHQes8rNmox8Cg2abkZr0xE6YKDk1oW dt+y1G0G1beNi11wFVrzDqOZfZYhEkWMoA8DSan1UPAGLUIehZpfNbVHmpveVDsIXLT3 9a6g== X-Gm-Message-State: APjAAAU0NeXNC9mMPuOy3/7/u8bkg6DyzMyxp1LpjZzq2u9PWgHbhM5V 7QOfgCOlcaW87L7mM0/bIQA68MmKNSh67pmf1p8= X-Google-Smtp-Source: APXvYqzDP7GWIj6pKx+aNOdBwBW6X85snZKXZlLP4rWlJPVhUGLenBJk2MvzP9DoWNsRggE6r5VtxtUSp0LGX3fFUkw= X-Received: by 2002:ac8:2b83:: with SMTP id m3mr4994681qtm.305.1553051857579; Tue, 19 Mar 2019 20:17:37 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> In-Reply-To: From: Brian Dickson Date: Tue, 19 Mar 2019 20:17:25 -0700 Message-ID: To: Stephen Farrell Cc: Jared Mauch , Michael Sinatra , Ted Hardie , DoH WG , paul vixie , dnsop Content-Type: multipart/alternative; boundary="00000000000049f3a805847e105c" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 03:17:41 -0000 --00000000000049f3a805847e105c Content-Type: text/plain; charset="UTF-8" On Tue, Mar 19, 2019 at 6:42 PM Stephen Farrell wrote: > > Hiya, > > One individualistic data point on this sub-topic, and a real point: > > On 20/03/2019 01:13, Jared Mauch wrote: > > My impression is there are people who will not be satisfied until all > traffic looks > > identical and you have zero way to protect your home, > > I do not claim that everyone ought do the same, but I absolutely > do claim that encouraging voluntary policy adherence by dealing > with the people using the n/w is preferable to many egregiously > invasive attempts to force technical policy enforcement on > unwilling serf-like users. > So, this is the problem: - If a network operator has any policy that is enforceable, ONLY the technical policy enforcement model scales. - In such an environment, there are only, ever, "willing users", because, in order to use the network, they are required to agree to the policies. This makes the argument you have above, a vacuously defined one. You want to encourage voluntary policy adherence for a non-existent set of otherwise unwilling users. I understand your position: you would prefer that {some,all} networks were not employing policies that {you,some people} disagree with. I sympathize, but I disagree. What we need are mechanisms that scale. My position (personally) is that we find ways to have scalable, technical mechanisms. They should allow users (or machine administrators) to be as compliant as they are willing, and no more. They should allow networks to enforce their policies, while treading as lightly as possible. It should be possible to use technical means to handle this negotiation with little to no user input required. The analogy is roughly that of escalation-of-force in law enforcement, starting at a level of "polite requests". You can disagree, but I implore you: please don't stand in the way of those wanting to find consensus on scalable, flexible, technical solutions that encompass a wide range of network policies and enforcement needs. The main point is, I believe the end result will be mechanisms that allow you to deploy networks that meet your needs, and software that you can configure to bypass such controls, but that neither of those should ever be the default configurations. If the results allow you to do what you want/need, and also allow others to do what they want/need, everyone should be happy enough with the result. Can we at least agree on this as a desired goal for this work? Brian --00000000000049f3a805847e105c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 19, 2019 at 6:42 PM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:

Hiya,

One individualistic data point on this sub-topic, and a real point:

On 20/03/2019 01:13, Jared Mauch wrote:
> My impression is there are people who will not be satisfied until all = traffic looks
> identical and you have zero way to protect your home,

I do not claim that everyone ought do the same, but I absolutely
do claim that encouraging voluntary policy adherence by dealing
with the people using the n/w is preferable to many egregiously
invasive attempts to force technical policy enforcement on
unwilling serf-like users.

So, this is = the problem:
- If a network operator has any policy that is enfor= ceable, ONLY the technical policy enforcement model scales.
- In = such an environment, there are only, ever, "willing users", becau= se, in order to use the network, they are required to agree to the policies= .

This makes the argument you have above, a vacuou= sly defined one.=C2=A0
You want to encourage voluntary policy adh= erence for a non-existent set of otherwise unwilling users.
<= br>
I understand your position: you would prefer that {some,all} = networks were not employing policies that {you,some people} disagree with.<= /div>
I sympathize, but I disagree. What we need are mechanisms that sc= ale.
My position (personally) is that we find ways to have scalab= le, technical mechanisms.
They should allow users (or machine adm= inistrators) to be as compliant as they are willing, and no more.
They should allow networks to enforce their policies, while treading as li= ghtly as possible.
It should be possible to use technical means t= o handle this negotiation with little to no user input required.
= The analogy is roughly that of escalation-of-force in law enforcement, star= ting at a level of "polite requests".

Yo= u can disagree, but I implore you: please don't stand in the way of tho= se wanting to find consensus on scalable, flexible, technical solutions tha= t encompass a wide range of network policies and enforcement needs.

The main point is, I believe the end result will be mecha= nisms that allow you to deploy networks that meet your needs, and software = that you can configure to bypass such controls, but that neither of those s= hould ever be the default configurations.

If the r= esults allow you to do what you want/need, and also allow others to do what= they want/need, everyone should be happy enough with the result.

Can we at least agree on this as a desired goal for this wo= rk?

Brian
--00000000000049f3a805847e105c-- From nobody Tue Mar 19 20:36:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECA9A130F0B; Tue, 19 Mar 2019 20:36:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IBlKIsCzcgnn; Tue, 19 Mar 2019 20:36:36 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C24312785F; Tue, 19 Mar 2019 20:36:35 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AF5C0BEDB; Wed, 20 Mar 2019 03:36:32 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OjlGZOGKsHI8; Wed, 20 Mar 2019 03:36:30 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 97DCCBEE3; Wed, 20 Mar 2019 03:36:30 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553052990; bh=EvVKTDqflKPJOt0Qpbinm7ReGV7BFN78nXvOeK+ROqU=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=ysuwq7zj0lt1nNlaJWmNiOxkjTSCBzJ35LZ+LNN4wVy6XgM+7nDvYLWfqWOynL02Q owoPA4VUMAXIVoDILCJ8C5zvmETGt3FZJpozFFjlo8z/6/u8z88Y3v58JrN6SvbVhV zzMv1iRlTgoVADxfrBTedTdAMHz32IQPaLE8dMnU= To: Brian Dickson Cc: Ted Hardie , DoH WG , Jared Mauch , dnsop , paul vixie , Michael Sinatra References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <7f0e4b4f-3b69-cc99-37a6-abff7c0573c0@cs.tcd.ie> Date: Wed, 20 Mar 2019 03:36:29 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="06t1YtqyAKicOQtSYmolzutA1XZyeRvn7" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 03:36:40 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --06t1YtqyAKicOQtSYmolzutA1XZyeRvn7 Content-Type: multipart/mixed; boundary="DZ93nNPNpL7YJmaMSP7tTuWgCBhOAciLp"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: Ted Hardie , DoH WG , Jared Mauch , dnsop , paul vixie , Michael Sinatra Message-ID: <7f0e4b4f-3b69-cc99-37a6-abff7c0573c0@cs.tcd.ie> Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> In-Reply-To: --DZ93nNPNpL7YJmaMSP7tTuWgCBhOAciLp Content-Type: multipart/mixed; boundary="------------222DA199356EF328CE117543" Content-Language: en-GB This is a multi-part message in MIME format. --------------222DA199356EF328CE117543 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 20/03/2019 03:17, Brian Dickson wrote: > On Tue, Mar 19, 2019 at 6:42 PM Stephen Farrell > wrote: >=20 >> >> Hiya, >> >> One individualistic data point on this sub-topic, and a real point: >> >> On 20/03/2019 01:13, Jared Mauch wrote: >>> My impression is there are people who will not be satisfied until all= >> traffic looks >>> identical and you have zero way to protect your home, >> >> I do not claim that everyone ought do the same, but I absolutely >> do claim that encouraging voluntary policy adherence by dealing >> with the people using the n/w is preferable to many egregiously >> invasive attempts to force technical policy enforcement on >> unwilling serf-like users. >> >=20 > So, this is the problem: There's only one problem? Great! :-) > - If a network operator has any policy that is enforceable, ONLY the > technical policy enforcement model scales. My mail was about my policy for my home network and explicitly said that I do not claim that policy ought be followed by all home networks, never mind other kinds of network. Your argument about scale is not therefore relevant. (At least, not unless you want to give up all argument along the lines of "consider the children.") My policy, for my network, is as defensible as many others. And that isn't peculiar to home networks. > - In such an environment, there are only, ever, "willing users", becaus= e, > in order to use the network, they are required to agree to the policies= =2E Wrong. In my home network, my children and their friends have no real choice to not use the network until they are relatively economically independent. (And in earlier days, they could not have given informed consent in any case, being too young.) In work environments what you say is also not completely correct, at least in some EU locales, where employees retain rights of various kinds whilst at work using an employer-provided n/w. We don't need to argue the rights and wrongs of that, it just is. > This makes the argument you have above, a vacuously defined one. Surprising as it may be I disagree that my argument is vacuous:-) > You want to encourage voluntary policy adherence for a non-existent set= of > otherwise unwilling users. >=20 > I understand your position: you would prefer that {some,all} networks w= ere > not employing policies that {you,some people} disagree with. Ah. You apparently don't understand my non-vacuous argument. I guess that's better than the opposite:-) Once more: my policy for my network is defensible but is not one I claim ought be followed by everyone. And the same applies for all of the more intrusive policies being espoused here by those with concerns about DoH. That doesn't mean those concerns are vacuous or otherwise to be ignored, but does mean that claims as to such-and-such a policy being a necessity are not valid. Only one counter-example is needed to demonstrate that, and I've provided one (that is real, not invented). S. > I sympathize, but I disagree. What we need are mechanisms that scale. > My position (personally) is that we find ways to have scalable, technic= al > mechanisms. > They should allow users (or machine administrators) to be as compliant = as > they are willing, and no more. > They should allow networks to enforce their policies, while treading as= > lightly as possible. > It should be possible to use technical means to handle this negotiation= > with little to no user input required. > The analogy is roughly that of escalation-of-force in law enforcement, > starting at a level of "polite requests". >=20 > You can disagree, but I implore you: please don't stand in the way of t= hose > wanting to find consensus on scalable, flexible, technical solutions th= at > encompass a wide range of network policies and enforcement needs. >=20 > The main point is, I believe the end result will be mechanisms that all= ow > you to deploy networks that meet your needs, and software that you can > configure to bypass such controls, but that neither of those should eve= r be > the default configurations. >=20 > If the results allow you to do what you want/need, and also allow other= s to > do what they want/need, everyone should be happy enough with the result= =2E >=20 > Can we at least agree on this as a desired goal for this work? >=20 > Brian >=20 >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh >=20 --------------222DA199356EF328CE117543 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------222DA199356EF328CE117543-- --DZ93nNPNpL7YJmaMSP7tTuWgCBhOAciLp-- --06t1YtqyAKicOQtSYmolzutA1XZyeRvn7 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyRtT0ACgkQWrL68XsX K+rYihAAsZ0wCN+hZTBShRx0MuNnsyb58EqrlJC3errq2LzZ+LNb1cGOKz9Sf6iS 8f9B/MjDzrXAJbUkts98Amv9zy7LOyLNwo/pwH/r0j33ZsS35QcAYzWptwCYOjXr 6jB85P/BiGMKvygmHe3th40ES8qWxMKS3hbnrJnUFLGeP/tC3fGaJOztaKJFt9M6 Bhi/hf4P91lqOxi6VBt76Mt8MrMYCtk1/aXOui7LC46stuNMLVbe4G4Gk/BQPn6j BSh4HQdc4jNinGC/j2npsDfCAphlSLRZuO2jnbYVZPIeea/RDGKi1ItHMO+oN3I8 zSG9Cjn91g9uV8Du+3Cr+ILrW6QWfmV6oIdeMNcj+Kv1h2UWcRgmsjp+mNwa+gjW dv2jgaEF4eXEcaNZixRitB3QqdbjiH+nuYWB3Z7QJMkmACwdgIYeEovEIlQkdZJo P/wyFHiMgCa9caMHkEIkOZVjmenZpIfXjPzoC1Vujf4ziTrpxeayJuY3h8KIM+53 PL1He9LkXq7QfeYvlsqueyzgXSyNZUd5p3QZOwYlzGSDxrOYJgjn+hQszFJrG8t0 EN76N5rLI2pvDW8dsHrRrY+ZkTGvuNo9MaJAuDBOvwzjrgXEmL4nXc/Vd4HMrd9t bA60sneRViyVfOvdl3dBDvUSbSKG7g3F+CKav4MRkfUxg2xIwtc= =j1bG -----END PGP SIGNATURE----- --06t1YtqyAKicOQtSYmolzutA1XZyeRvn7-- From nobody Tue Mar 19 20:39:20 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 07C3C130F0B for ; Tue, 19 Mar 2019 20:39:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=e-dco-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YwH0TNCl4HwC for ; Tue, 19 Mar 2019 20:39:16 -0700 (PDT) Received: from mail-lf1-x136.google.com (mail-lf1-x136.google.com [IPv6:2a00:1450:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD9EB12785F for ; Tue, 19 Mar 2019 20:39:15 -0700 (PDT) Received: by mail-lf1-x136.google.com with SMTP id u68so751771lff.7 for ; Tue, 19 Mar 2019 20:39:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=e-dco-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=tGZ8Ea9fMXQSaOkxtCD/CCDXfWLcFxopptXGfKBPrSs=; b=yPffSwCG/Z9tswRNLqLqS/yMxPKGioAPCCBxzQ+kc6jTSC1RT2KpSWs1sBjo2I6sob /vmYhrmRjUl4OjwMw6wklMxdkHdUPmcQZKZH1QeU+zSFsIL8TBA+jxcIVVDHQNV3c5OI nyg7gFlnUGbeNnpZqB+K9x3ZSRF94sLUFuAIYcCFFKLvOYYShUzsQHiGH5QHkqadwQXu h985qpgjNtuCzFwE+OL5E84zSXGMAbAudtc7dq9O42KLOID704P5kAloiNgOPJ6qj9V0 WixuTUrXOgwY8NSAfOkJGDE7WvuIhJf2butwul7o0uvHCt1yZHPAKR82LcX5yZyfs1FT QIlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=tGZ8Ea9fMXQSaOkxtCD/CCDXfWLcFxopptXGfKBPrSs=; b=nqqoysj/P0sH+DQtKFyPDr/2a11NSdANw2IvUjpZQblQs8Lm1waHOE57vQhWaP9CuP kYjf2xPkNvllujFq1IAq+u3v6b6zv9xK2C+0PXLpMENCZB/ZpqrZZnMk/7MEsdbwsCIV /9qHJ7nwjPdS499WzRAXZqz4FM29ePnoHavf99GhjgO2kp95sXMeeUn6yvVE4YPRgbGK aMOxb/GANxh6oPR7BDgkBlP80JgVLRHZ5xJ/UzS/7fuDsuzgvQyO3oTkL5J+KRZ70Z4c eGqjyKPN8KFwSdHDB6fFNpU3s0u5Ek1YoG17t4QiA38uIat/YwTlRgvV7kIY6BK341NH X0bg== X-Gm-Message-State: APjAAAXg540xnXrhNa2WZ5BdfQay1xRfwUU5op7OaufED8q8JPRbVtnn BG+MYBF9iThT1un9dfa+Pg0bxvAwm0+YwOJny0MHUA== X-Google-Smtp-Source: APXvYqzHKocMbRCDAkmMXQTSgnaxWmmWLht1lze2fBpK/QgRWXOYjcl02S8g2iBmm5pSeQZRC5pgw4N93TW2aTyYIKI= X-Received: by 2002:a19:95cf:: with SMTP id x198mr14408907lfd.73.1553053153870; Tue, 19 Mar 2019 20:39:13 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> In-Reply-To: From: nalini elkins Date: Wed, 20 Mar 2019 09:09:03 +0530 Message-ID: To: Brian Dickson Cc: Stephen Farrell , Ted Hardie , DoH WG , Jared Mauch , dnsop , paul vixie , Michael Sinatra Content-Type: multipart/alternative; boundary="0000000000008dcc6505847e5d3b" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 03:39:19 -0000 --0000000000008dcc6505847e5d3b Content-Type: text/plain; charset="UTF-8" Brian, Thank you for a thoughtful, well-stated, reasonable comment that seeks to achieve compromise with the points of view of all being considered. Nalini On Wed, Mar 20, 2019 at 8:48 AM Brian Dickson wrote: > > > On Tue, Mar 19, 2019 at 6:42 PM Stephen Farrell > wrote: > >> >> Hiya, >> >> One individualistic data point on this sub-topic, and a real point: >> >> On 20/03/2019 01:13, Jared Mauch wrote: >> > My impression is there are people who will not be satisfied until all >> traffic looks >> > identical and you have zero way to protect your home, >> >> I do not claim that everyone ought do the same, but I absolutely >> do claim that encouraging voluntary policy adherence by dealing >> with the people using the n/w is preferable to many egregiously >> invasive attempts to force technical policy enforcement on >> unwilling serf-like users. >> > > So, this is the problem: > - If a network operator has any policy that is enforceable, ONLY the > technical policy enforcement model scales. > - In such an environment, there are only, ever, "willing users", because, > in order to use the network, they are required to agree to the policies.. > > This makes the argument you have above, a vacuously defined one. > You want to encourage voluntary policy adherence for a non-existent set of > otherwise unwilling users. > > I understand your position: you would prefer that {some,all} networks were > not employing policies that {you,some people} disagree with. > I sympathize, but I disagree. What we need are mechanisms that scale. > My position (personally) is that we find ways to have scalable, technical > mechanisms. > They should allow users (or machine administrators) to be as compliant as > they are willing, and no more. > They should allow networks to enforce their policies, while treading as > lightly as possible. > It should be possible to use technical means to handle this negotiation > with little to no user input required. > The analogy is roughly that of escalation-of-force in law enforcement, > starting at a level of "polite requests". > > You can disagree, but I implore you: please don't stand in the way of > those wanting to find consensus on scalable, flexible, technical solutions > that encompass a wide range of network policies and enforcement needs. > > The main point is, I believe the end result will be mechanisms that allow > you to deploy networks that meet your needs, and software that you can > configure to bypass such controls, but that neither of those should ever be > the default configurations. > > If the results allow you to do what you want/need, and also allow others > to do what they want/need, everyone should be happy enough with the result. > > Can we at least agree on this as a desired goal for this work? > > Brian > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > -- Thanks, Nalini Elkins President Enterprise Data Center Operators www.e-dco.com --0000000000008dcc6505847e5d3b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Brian,

Thank you for a thoughtful, well-stated, reasonable comment that seeks t= o achieve compromise with the points of view of all being considered.
=

Nalini

On Wed, Mar 20, 2019 at 8:48 AM Brian Dickson <= ;brian.p= eter.dickson@gmail.com> wrote:


On Tue, Mar 19,= 2019 at 6:42 PM Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:
=

Hiya,

One individualistic data point on this sub-topic, and a real point:

On 20/03/2019 01:13, Jared Mauch wrote:
> My impression is there are people who will not be satisfied until all = traffic looks
> identical and you have zero way to protect your home,

I do not claim that everyone ought do the same, but I absolutely
do claim that encouraging voluntary policy adherence by dealing
with the people using the n/w is preferable to many egregiously
invasive attempts to force technical policy enforcement on
unwilling serf-like users.

So, this is = the problem:
- If a network operator has any policy that is enfor= ceable, ONLY the technical policy enforcement model scales.
- In = such an environment, there are only, ever, "willing users", becau= se, in order to use the network, they are required to agree to the policies= ..

This makes the argument you have above, a vacuo= usly defined one.=C2=A0
You want to encourage voluntary policy ad= herence for a non-existent set of otherwise unwilling users.
=
I understand your position: you would prefer that {some,all}= networks were not employing policies that {you,some people} disagree with.=
I sympathize, but I disagree. What we need are mechanisms that s= cale.
My position (personally) is that we find ways to have scala= ble, technical mechanisms.
They should allow users (or machine ad= ministrators) to be as compliant as they are willing, and no more.
They should allow networks to enforce their policies, while treading as l= ightly as possible.
It should be possible to use technical means = to handle this negotiation with little to no user input required.
The analogy is roughly that of escalation-of-force in law enforcement, sta= rting at a level of "polite requests".

Y= ou can disagree, but I implore you: please don't stand in the way of th= ose wanting to find consensus on scalable, flexible, technical solutions th= at encompass a wide range of network policies and enforcement needs.
<= div>
The main point is, I believe the end result will be mech= anisms that allow you to deploy networks that meet your needs, and software= that you can configure to bypass such controls, but that neither of those = should ever be the default configurations.

If the = results allow you to do what you want/need, and also allow others to do wha= t they want/need, everyone should be happy enough with the result.

Can we at least agree on this as a desired goal for this w= ork?

Brian
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh


--
Thanks,<= /div>
Nalini Elkins
President
Enterprise Data= Center Operators

=
--0000000000008dcc6505847e5d3b-- From nobody Tue Mar 19 21:35:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC23D1279A9 for ; Tue, 19 Mar 2019 21:35:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=GcmDbHNs; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=P2qRgdQY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XCKshll2_gtn for ; Tue, 19 Mar 2019 21:35:11 -0700 (PDT) Received: from wout1-smtp.messagingengine.com (wout1-smtp.messagingengine.com [64.147.123.24]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 53512127990 for ; Tue, 19 Mar 2019 21:35:11 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 74D0035E5 for ; Wed, 20 Mar 2019 00:35:10 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Wed, 20 Mar 2019 00:35:10 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=j561+y+i9nQnjHDhQqj3W+FAl5Io7td sXN621ZiGg3o=; b=GcmDbHNsnNX7UK9OCC4DOUHuf3c0ZkYOPBQKCASFSRV+PRi JFWBb41kd9YSsPB6QJfpYinFHTik8GuLA7ILfz0tHvnz1LGctkTmpE16pCLaGi2O FsSnl9qEY8BpMGE9NJXoYlP8h8SDsi+OE/TjFJ1DCVSDKdaJ+zcc9HR2M2a0gi2t Pbpo9OgKJKUMoQiNNsMOrrjTs6u+V2tU5Mpi9Yju3QMCG/Rx271HNgXyvAUwVSSZ vbTySFUHTValT9s+xomV4oKB2NLtIsfQNm9UZQ4y4rEbchJTRWFwC4nt2jHv56in 3W71vVTukERYwjpJG6GkiHtgLESGt2LHSq4lT7A== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=j561+y +i9nQnjHDhQqj3W+FAl5Io7tdsXN621ZiGg3o=; b=P2qRgdQYnCFIRwhO7Kthr8 EVYBpRvQ7C9leVwfNdLbMUaQosjB6daHo/RVoYFFj5Fpcp6dFBWXs6UFxPDwLCmS wkrm1W67TS+O0DgXXBE7mPkFpEvhbjh1aG8ua9e3YzspFkwRh+PghpcPIAyUM9uY KjmQ9E/Ymmy+A0lv4NTGnFK2s2dHWHvXrUk2OAAQZCaXmuW+4+eX2IIoV4Rh6T1Z pGFQ4BLD+D4s3mF2/ZrUsAH6Ofk14Njr5RZg12YQLK3CxodUhsiWqPvAAc3tvHf8 DmK5UC1r28b9V4tgKl+lhvTOnvLNufcO7bgRSSoBLUjp8XcTDmrk3CdToKndBkdw == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrieehgdejgecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreertdenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 7D20E7C299; Wed, 20 Mar 2019 00:35:09 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <2862180c-c5cb-4b8b-9f18-6468dab1d623@www.fastmail.com> In-Reply-To: References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> Date: Wed, 20 Mar 2019 00:35:07 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] [Ext] draft-ietf-doh-resolver-associated-doh-02 comments X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 04:35:13 -0000 On Wed, Mar 20, 2019, at 12:03, Paul Hoffman wrote: > This is an interesting question. It assumes that the application has no > DNS resolver when the HTTPS query is sent, and that getting the > associated DoH server is a prerequisite to sending DNS (in this case, > to locate the OCSP server). > > That was certainly not the intention, given that the application can > send DNS queries for the other protocols described. I'll add a note to > that effect in the next draft. I would be unhappy with that. Our implementation can currently operate without another source of name resolution. Given that the mechanisms we are talking about are just best practice, why not just recommend that resolvers follow them? I would not mandate anything, but explaining the consequences of diverging from best practice has its own normative impetus. From nobody Tue Mar 19 22:46:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C77FC130F84; Tue, 19 Mar 2019 22:46:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.701 X-Spam-Level: X-Spam-Status: No, score=0.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FIN_FREE=2.7, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ej6GY_v-4QML; Tue, 19 Mar 2019 22:46:41 -0700 (PDT) Received: from mail-qk1-x734.google.com (mail-qk1-x734.google.com [IPv6:2607:f8b0:4864:20::734]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 262D212426E; Tue, 19 Mar 2019 22:46:41 -0700 (PDT) Received: by mail-qk1-x734.google.com with SMTP id k189so8149173qkc.0; Tue, 19 Mar 2019 22:46:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LYYacSO2tnzoskAztZec85lc3XW+pnHoFVCgxGfYTTo=; b=G3wV3Rwc1FOyY9+52SjkNMlZSu1AZXGkieb52CamLpcoqDyQpTBw0FScLY/oD1akB0 WkkYQKAnuNFnG1SJrVxW6pVTafYe/AxoaZvKhUFGZwUl2nzz3cP5Jbp5S/b5C1onP3lP Hn8GeoCw9a12FQ78P/7MV3+G6PIbo0tHFcOmXBxL3yBAyXz3XOJTJPf6ILzEgVIrPTu6 x8l7J84NgexmzrPGOe1ckPb0PORcAQb5qJwDqwjRDGk2YMunoC6GILZVcgvTtXpmYG9H 4HIjfyyl1oyr61GyxKCh/eVeeJQOWt418W9E02HT51Ilt69OBQ0ikqBK+Z5vxkbpKxBy pySg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LYYacSO2tnzoskAztZec85lc3XW+pnHoFVCgxGfYTTo=; b=EyG+34JLs0/2fRon+/1xBB1mlFPDwqQY/an/hC3mQCVdfjqSwr43zTNpV6f8lHCemR V4RWHRCif6uRuTX0T7hPyB6x6zGRLrelJqoWlK5MG0LkltigLqL4CDqgqPcpfl1JEMjx WsKF/A3BKVWJyOkDv1tjQDKl2rAqMt5OjJ+em+6vjxnwBrQX9vjmsVq2eXWRcb8KfPru XUFVEP0WV1jxOxLdvuvx+aRcJVa9Mp8pdF4zxYzGe3MIq0LPwo6yauHkT3QCLoAzYTjq 2hlQ+RKT+CJExNaj8+ycdjb2Ic3RMP4p0A00HJ4FEW5gR5XipwNkRxfZ+8LnoXCn+QbY RGbA== X-Gm-Message-State: APjAAAXnOBOiaaXkt/j8hFWaOt4+1L7OZhu8J3IU/VuUrXBjwaSosEET IfQg0INxnPLDKrUFPXrLiYKpQTr3rVRhwXjKmz0= X-Google-Smtp-Source: APXvYqx4nPJGiFyy94Hj4tgr9pKvpCHIdSncZqTbl7Wy2gAP6VUQWwAR6sjHyqOmFP+CovMN3g4dDV58jBdreXxZqwg= X-Received: by 2002:a37:6814:: with SMTP id d20mr5182159qkc.102.1553060800175; Tue, 19 Mar 2019 22:46:40 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <7f0e4b4f-3b69-cc99-37a6-abff7c0573c0@cs.tcd.ie> In-Reply-To: <7f0e4b4f-3b69-cc99-37a6-abff7c0573c0@cs.tcd.ie> From: Brian Dickson Date: Tue, 19 Mar 2019 22:46:28 -0700 Message-ID: To: Stephen Farrell Cc: Ted Hardie , DoH WG , Jared Mauch , dnsop , paul vixie , Michael Sinatra Content-Type: multipart/alternative; boundary="0000000000004f236605848025b2" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 05:46:43 -0000 --0000000000004f236605848025b2 Content-Type: text/plain; charset="UTF-8" On Tue, Mar 19, 2019 at 8:36 PM Stephen Farrell wrote: > > > On 20/03/2019 03:17, Brian Dickson wrote: > > > - If a network operator has any policy that is enforceable, ONLY the > > technical policy enforcement model scales. > > My mail was about my policy for my home network and explicitly said > that I do not claim that policy ought be followed by all home networks, > never mind other kinds of network. Your argument about scale is not > therefore relevant. (At least, not unless you want to give up all > argument along the lines of "consider the children.") > I am saying, that the work product envisioned by participants of the side meeting, needs to be some framework that scales, regardless of where it gets used. It does not matter whether any policy does or does not require scalable mechanisms. What does matter is that there exist networks where the mechanisms need to scale. What is being envisioned and proposed, is a flexible-enough framework, that scales. If something scales, it scales. If it scales, it won't make it impossible to do what you want, tautologically. Let's try this using classical logic: Suppose there is a rule: "A implies B". The negation of that rule is: "Not B implies Not A". The negation of that rule is NOT: "Not A implies Not B". I believe your argument(s) falls into the "Not A implies Not B" category. (I hope I'm mistaken there.) However, I am also having a little trouble following your actual meaning. More below on my challenge with following what you are saying... > > My policy, for my network, is as defensible as many others. And that > isn't peculiar to home networks. > > > - In such an environment, there are only, ever, "willing users", because, > > in order to use the network, they are required to agree to the policies. > > Wrong. In my home network, my children and their friends have > no real choice to not use the network until they are relatively > economically independent. (And in earlier days, they could not > have given informed consent in any case, being too young.) > So, I am trying to understand. Does their lack of real choice make them unwilling users? Are you arguing that they should be able to bypass whatever rules you have for your children? Do you want your children to be able to undetectably use a third party DNS resolver, such as DoH, and access naughty networks or malware? Or do you want to block that particular use case? I think their category as "unwilling" is mooted by their being minors and not being able to give informed consent. In any case, if you do want to give them (all of them or some of them) access to such third party resolvers, should that not be something explicitly under your control? And should it not be easy to do (where I roughly equate "easy to do" with "scalable", for argument purposes). > > In work environments what you say is also not completely correct, > at least in some EU locales, where employees retain rights of > various kinds whilst at work using an employer-provided n/w. We > don't need to argue the rights and wrongs of that, it just is. > I think I am also having difficulty with the argument here. What is the exact scenario (or set of scenarios) you are using in your example? Is it an employee located in an EU locale, using a work network? And is the employee's network applying policies that violate the employees rights? If the answer to the second question is "yes", I believe there are many recourses that do not involve any technology at all, such as civil suits or whatever mechanisms an employee has under the laws of the EU or their local jurisdiction. I think that any proffered mechanism over and above that is largely redundant, and/or generally within the means of a financially independent adult to work around, e.g. using a personal device on a mobile network not provided by the employer. Or, is the employee's network not applying policies that violate the employees rights, which I think makes the argument moot, since the employee's rights are not actually being infringed. So, yes, the employee has rights, and I don't have any issue with either the existence of rights, or any opinion on whether that is right or wrong. What I don't follow from that is, that any network operator using technology to interfere with those rights, is able to do so with impunity, and that there is a need to provide mechanisms to bypass that technology. Is that really the case, currently, in specific jurisdictions? Can you provide some kind of reference to that, that is verifiable, in the EU? We all know about the issue with authoritarian regimes, and all that. I think we can all agree that in those cases, the use of technological methods to bypass restrictions requires individuals to violate the laws in those places. And I am in no way arguing against the technology involved. I'm saying that outside of those specific jurisdictions/environments, there is no explicit need for making the privacy technology operate in a strictly unilateral mode, in such a way as to evade any sort of detection. I'm saying that it is reasonable to expect that whatever legally-permissible policies any network operator has, can be enforced cooperatively between client (software/devices), network(s) (operator(s)), and server (provider of whatever permitted degree of privacy-enhanced is permitted by network operators' policies). The extent of what I'm suggesting is, aside from the authoritarian regime situation, networks whose policies are not violating local laws (including whatever "rights" laws may apply), need to be able to implement those policies in a scalable fashion, including detecting anomalous activity easily (for e.g. malware detection), and that client software/devices should be able to, at their discretion, negotiate the maximal privacy setting desired, including reaching a privacy equivalent of "no networks available" (don't connect at all). > Once more: my policy for my network is defensible but is not > one I claim ought be followed by everyone. And the same applies > for all of the more intrusive policies being espoused here by > those with concerns about DoH. We (speaking for everyone else) are NOT espousing policies. We are espousing mechanisms for policy enforcement. There is a huge difference. Our position on the enforcement is policy-agnostic. It doesn't matter what the policies themselves are, the mechanisms need to scale. The policies themselves are, honestly, completely out of scope, other than the mechanics. If a particular policy is legal in any jurisdiction on this planet, and is sufficiently well defined and sufficiently distinct from other policies, the policy framework needs to accommodate it. There aren't *that* many conceivable policies that apply to DNS in the intersection spaces of transport protocol (DoH, DoT, TCP, UDP), third party operators (yes/no), encryption (yes/no), and privacy (yes/no/MITM). > That doesn't mean those concerns > are vacuous or otherwise to be ignored, but does mean that > claims as to such-and-such a policy being a necessity are not > valid. Only one counter-example is needed to demonstrate that, > and I've provided one (that is real, not invented). > If it is the EU one, please read above: I don't think it actually does what you think it does, per se. If it is the home network one, it isn't about policy, it is about mechanisms, and your not needing your policy to scale, isn't germane. If anyone needs the policy framework to scale, that needs to be taken into consideration. As long as there is anything close to consensus on the existence of a non-trivial number of networks who require scalable solutions to this problem, that should really be the end of it. I don't understand anyone taking a position that anything doesn't need to scale, and I think that is what you are saying (from your home network bit.) Is that really your position? Brian --0000000000004f236605848025b2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 19, 2019 at 8:36 PM Steph= en Farrell <stephen.farrell= @cs.tcd.ie> wrote:


On 20/03/2019 03:17, Brian Dickson wrote:

> - If a network operator has any policy that is enforceable, ONLY the > technical policy enforcement model scales.

My mail was about my policy for my home network and explicitly said
that I do not claim that policy ought be followed by all home networks,
never mind other kinds of network. Your argument about scale is not
therefore relevant. (At least, not unless you want to give up all
argument along the lines of "consider the children.")

I am saying, that the work product envisioned by p= articipants of the side meeting,
needs to be some framework that = scales, regardless of where it gets used.

It does = not matter whether any policy does or does not require scalable mechanisms.=
What does matter is that there exist networks where the mechanis= ms need to scale.

What is being envisioned and pro= posed, is a flexible-enough framework, that scales.

If something scales, it scales. If it scales, it won't make it imposs= ible to do what you want, tautologically.

Let'= s try this using classical logic:

Suppose there is= a rule: "A implies B".

The negation of = that rule is: "Not B implies Not A".
The negation of th= at rule is NOT: "Not A implies Not B".

I= believe your argument(s) falls into the "Not A implies Not B" ca= tegory. (I hope I'm mistaken there.)

However, = I am also having a little trouble following your actual meaning.
= More below on my challenge with following what you are saying...
= =C2=A0

My policy, for my network, is as defensible as many others. And that
isn't peculiar to home networks.

> - In such an environment, there are only, ever, "willing users&qu= ot;, because,
> in order to use the network, they are required to agree to the policie= s.

Wrong. In my home network, my children and their friends have
no real choice to not use the network until they are relatively
economically independent. (And in earlier days, they could not
have given informed consent in any case, being too young.)
=

So, I am trying to understand.
Does their lac= k of real choice make them unwilling users?
Are you arguing that = they should be able to bypass whatever rules you have for your children?
Do you want your children to be able to undetectably use a third pa= rty DNS resolver, such as DoH, and access naughty networks or malware?
Or do you want to block that particular use case?
I think t= heir category as "unwilling" is mooted by their being minors and = not being able to give informed consent.

In any ca= se, if you do want to give them (all of them or some of them) access to suc= h third party resolvers, should that not be something explicitly under your= control?
And should it not be easy to do (where I roughly equate "= easy to do" with "scalable", for argument purposes).
=C2=A0

In work environments what you say is also not completely correct,
at least in some EU locales, where employees retain rights of
various kinds whilst at work using an employer-provided n/w. We
don't need to argue the rights and wrongs of that, it just is.

I think I am also having difficulty with the ar= gument here.

What is the exact scenario (or set of= scenarios) you are using in your example?

Is it a= n employee located in an EU locale, using a work network?
And is = the employee's network applying policies that violate the employees rig= hts?
If the answer to the second question is "yes", I b= elieve there are many recourses that do not involve any technology at all, = such as civil suits or whatever mechanisms an employee has under the laws o= f the EU or their local jurisdiction.
I think that any proffered = mechanism over and above that is largely redundant, and/or generally within= the means of a financially independent adult to work around, e.g. using a = personal device on a mobile network not provided by the employer.

Or, is the employee's network not applying policies tha= t violate the employees rights, which I think makes the argument moot, sinc= e the employee's rights are not actually being infringed.
So, yes, the employee has rights, and I don't have any issu= e with either the existence of rights, or any opinion on whether that is ri= ght or wrong.
What I don't follow from that is, that any netw= ork operator using technology to interfere with those rights, is able to do= so with impunity, and that there is a need to provide mechanisms to bypass= that technology.
Is that really the case, currently, in specific= jurisdictions? Can you provide some kind of reference to that, that is ver= ifiable, in the EU?

We all know about the issue wi= th authoritarian regimes, and all that. I think we can all agree that in th= ose cases, the use of technological methods to bypass restrictions requires= individuals to violate the laws in those places.
And I am in no = way arguing against the technology involved.

I'= ;m saying that outside of those specific jurisdictions/environments, there = is no explicit need for making the privacy technology operate in a strictly= unilateral mode, in such a way as to evade any sort of detection.
I'm saying that it is reasonable to expect that whatever legally-perm= issible policies any network operator has, can be enforced cooperatively be= tween client (software/devices), network(s) (operator(s)), and server (prov= ider of whatever permitted degree of privacy-enhanced is permitted by netwo= rk operators' policies).

The extent of what I&= #39;m suggesting is, aside from the authoritarian regime situation, network= s whose policies are not violating local laws (including whatever "rig= hts" laws may apply), need to be able to implement those policies in a= scalable fashion, including detecting anomalous activity easily (for e.g. = malware detection), and that client software/devices should be able to, at = their discretion, negotiate the maximal privacy setting desired, including = reaching a privacy equivalent of "no networks available" (don'= ;t connect at all).


Once more: my policy for my network is defensible but is not
one I claim ought be followed by everyone. And the same applies
for all of the more intrusive policies being espoused here by
those with concerns about DoH.

We (speakin= g for everyone else) are NOT espousing policies.=C2=A0
We are esp= ousing mechanisms for policy enforcement.
There is a huge differe= nce.
Our position on the enforcement is policy-agnostic.
It doesn't matter what the policies themselves are, the mechanisms ne= ed to scale.
The policies themselves are, honestly, completely ou= t of scope, other than the mechanics.
If a particular policy is l= egal in any jurisdiction on this planet, and is sufficiently well defined a= nd sufficiently distinct from other policies, the policy framework needs to= accommodate it.
There aren't *that* many conceivable policie= s that apply to DNS in the intersection spaces of transport protocol (DoH, = DoT, TCP, UDP), third party operators (yes/no), encryption (yes/no), and pr= ivacy (yes/no/MITM).=C2=A0
=C2=A0
That doesn't mean those concerns
are vacuous or otherwise to be ignored, but does mean that
claims as to such-and-such a policy being a necessity are not
valid. Only one counter-example is needed to demonstrate that,
and I've provided one (that is real, not invented).

If it is the EU one, please read above: I don't think = it actually does what you think it does, per se.
If it is the hom= e network one, it isn't about policy, it is about mechanisms, and your = not needing your policy to scale, isn't germane.
If anyone ne= eds the policy framework to scale, that needs to be taken into consideratio= n.
As long as there is anything close to consensus on the existen= ce of a non-trivial number of networks who require scalable solutions to th= is problem, that should really be the end of it.

I= don't understand anyone taking a position that anything doesn't ne= ed to scale, and I think that is what you are saying (from your home networ= k bit.)
Is that really your position?

Br= ian=C2=A0
--0000000000004f236605848025b2-- From nobody Wed Mar 20 00:30:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D88B130F1F; Wed, 20 Mar 2019 00:30:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sGuNnoHa3Q5G; Wed, 20 Mar 2019 00:30:45 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C3EA130FF4; Wed, 20 Mar 2019 00:30:41 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 44218A0532; Wed, 20 Mar 2019 08:30:39 +0100 (CET) Received: by godin (Postfix, from userid 1000) id 2EA26EC0B0F; Wed, 20 Mar 2019 08:29:21 +0100 (CET) Date: Wed, 20 Mar 2019 08:29:21 +0100 From: Stephane Bortzmeyer To: doh@ietf.org, dprive@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <20190320072921.GA20969@laperouse.bortzmeyer.org> References: <20190311165813.ilrz5ocxomraavbq@nic.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20190311165813.ilrz5ocxomraavbq@nic.fr> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 07:30:47 -0000 On Mon, Mar 11, 2019 at 05:58:13PM +0100, Stephane Bortzmeyer wrote a message of 19 lines which said: > [Sorry for the long list of working groups but the discussion already > started in different places.] ... > It was suggested to have a side meeting in Prague at IETF 104. I > propose monday, 1400-1600 in Tyrolka. The proposal is at > . You > are welcome to agree/disagree/meet in a bar instead. I modified the title of the meeting because there is obviously no consensus on the problem or on the agenda. Anyway, a room is reserved if people want to meet on wednesday. From nobody Wed Mar 20 02:27:41 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49BBD1310C2; Wed, 20 Mar 2019 02:27:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.601 X-Spam-Level: X-Spam-Status: No, score=-1.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FIN_FREE=2.7, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Avkow1rTnJIR; Wed, 20 Mar 2019 02:27:20 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B55321310BF; Wed, 20 Mar 2019 02:27:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 57B8CBEE6; Wed, 20 Mar 2019 09:27:17 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V27BBWNRJh3S; Wed, 20 Mar 2019 09:27:14 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 08F80BE8A; Wed, 20 Mar 2019 09:27:14 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553074034; bh=Ti67uok1WO2uOgtpb1U5p/IKg/gJvqFSPjXEk1efv+M=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=UTgzMBQS1YNQh23lIFU8J3Y+m4Q1GhOVEFbn8N0ro8F+ZmKl3kKu5kfisP+UWbLcD M5Wi1x1tZ5xxnBGTyb024Yof78r3DpyWa6GX9sjS916dQkHcgOuaPKaJpemLXzdTmT hfGm0AL/+Y9H96uiujA+tuth8HZkshN2zmSOHPFM= To: Brian Dickson Cc: Ted Hardie , DoH WG , Jared Mauch , dnsop , paul vixie , Michael Sinatra References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <7f0e4b4f-3b69-cc99-37a6-abff7c0573c0@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <32c359a7-0b3a-aedf-a761-e8ffc4ccd414@cs.tcd.ie> Date: Wed, 20 Mar 2019 09:27:12 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="kc6zBpHlYjAstC4BfRMVwv0ydGcAl4HHw" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 09:27:23 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --kc6zBpHlYjAstC4BfRMVwv0ydGcAl4HHw Content-Type: multipart/mixed; boundary="1zjPBMaGnJQlBuQA1Dg5gRrUvUC73d2JX"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: Ted Hardie , DoH WG , Jared Mauch , dnsop , paul vixie , Michael Sinatra Message-ID: <32c359a7-0b3a-aedf-a761-e8ffc4ccd414@cs.tcd.ie> Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <7f0e4b4f-3b69-cc99-37a6-abff7c0573c0@cs.tcd.ie> In-Reply-To: --1zjPBMaGnJQlBuQA1Dg5gRrUvUC73d2JX Content-Type: multipart/mixed; boundary="------------68BE9E12224AA62152C82585" Content-Language: en-GB This is a multi-part message in MIME format. --------------68BE9E12224AA62152C82585 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 20/03/2019 05:46, Brian Dickson wrote: > On Tue, Mar 19, 2019 at 8:36 PM Stephen Farrell > wrote: >=20 >> >> >> On 20/03/2019 03:17, Brian Dickson wrote: >> >>> - If a network operator has any policy that is enforceable, ONLY the >>> technical policy enforcement model scales. >> >> My mail was about my policy for my home network and explicitly said >> that I do not claim that policy ought be followed by all home networks= , >> never mind other kinds of network. Your argument about scale is not >> therefore relevant. (At least, not unless you want to give up all >> argument along the lines of "consider the children.") >> >=20 > I am saying, that the work product envisioned by participants of the si= de > meeting, > needs to be some framework that scales, regardless of where it gets use= d. I'm not at all sure about a "framework" being the output. I do agree that solutions for networks at all scales are required. >=20 > It does not matter whether any policy does or does not require scalable= > mechanisms. > What does matter is that there exist networks where the mechanisms need= to > scale. More than one thing matters. That needs to be kept in mind. >=20 > What is being envisioned and proposed, is a flexible-enough framework, = that > scales. >=20 > If something scales, it scales. If it scales, it won't make it impossib= le > to do what you want, tautologically. >=20 > Let's try this using classical logic: >=20 > Suppose there is a rule: "A implies B". >=20 > The negation of that rule is: "Not B implies Not A". > The negation of that rule is NOT: "Not A implies Not B". >=20 > I believe your argument(s) falls into the "Not A implies Not B" categor= y. > (I hope I'm mistaken there.) >=20 > However, I am also having a little trouble following your actual meanin= g. > More below on my challenge with following what you are saying... >=20 >=20 >> >> My policy, for my network, is as defensible as many others. And that >> isn't peculiar to home networks. >> >>> - In such an environment, there are only, ever, "willing users", beca= use, >>> in order to use the network, they are required to agree to the polici= es. >> >> Wrong. In my home network, my children and their friends have >> no real choice to not use the network until they are relatively >> economically independent. (And in earlier days, they could not >> have given informed consent in any case, being too young.) >> >=20 > So, I am trying to understand. > Does their lack of real choice make them unwilling users? One could describe it that way. I'm sure many kids might do so;-) But it's not great terminology. > Are you arguing that they should be able to bypass whatever rules you h= ave > for your children? Most of the "rules" are not enforced by computers, and hence don't need to be written down precisely. For example, I'd encourage them to not create accounts on web sites. But I don't try enforce that in any technical way and accept that sometimes they do end up creating web accounts. Talking to them about what they're doing and scaring 'em that I could snoop if I was bothered are often sufficient. > Do you want your children to be able to undetectably use a third party = DNS > resolver, such as DoH, I don't care about that. > and access naughty networks=20 No, I'd prefer they not. But I have no technical barriers in place to do such blocking. To the extent that there's a policy at all, it's defined and (not enforced) purely in the human realm. > or malware? Bad question IMO. But in any case, encouraging human behaviour that doesn't result in malware being executed is IMO more effective. (E.g. avoiding certain OSes etc.) > Or do you want to block that particular use case? > I think their category as "unwilling" is mooted by their being minors a= nd > not being able to give informed consent. As I said neither willing nor unwilling are good descriptive terms for home network users. They are however quite different from employees in a corporate network (esp in a case like mine with a technically permissive policy) and that needs to be recognised. >=20 > In any case, if you do want to give them (all of them or some of them) > access to such third party resolvers, should that not be something > explicitly under your control? I don't care about that. > And should it not be easy to do (where I roughly equate "easy to do" wi= th > "scalable", for argument purposes). Ease of use is generally good. I think the challenge for e.g. browsers, will not reside in networks like mine. I do have some minor split-horizon issues but nothing that'd break badly for anyone but me and I know how to handle it. >> In work environments what you say is also not completely correct, >> at least in some EU locales, where employees retain rights of >> various kinds whilst at work using an employer-provided n/w. We >> don't need to argue the rights and wrongs of that, it just is. >> >=20 > I think I am also having difficulty with the argument here. Then feel free to ignore it. My main point is about home networks but i was responding to how you brought up employees. But in case it helps... I'm thinking of the issues that were raised in [1]. The end result there was that telling employees in advance meant typical corporate policies were ok, but it's not clear to me if the kind of blocking we could be discussing here (meaning blocking access to name resolution) would or wouldn't be considered proportionate, because it might depend on what services end up being blocked. (IANAL of course, so I make no claims as to what might happen.) [1] https://www.reuters.com/article/us-privacy-emails-echr/european-court-rul= es-firms-must-tell-employees-of-email-checks-idUSKCN1BG0YA > What is the exact scenario (or set of scenarios) you are using in your > example? It wasn't my example. It was yours:-) >=20 > Is it an employee located in an EU locale, using a work network? > And is the employee's network applying policies that violate the employ= ees > rights? > If the answer to the second question is "yes", I believe there are many= > recourses that do not involve any technology at all, such as civil suit= s or > whatever mechanisms an employee has under the laws of the EU or their l= ocal > jurisdiction. > I think that any proffered mechanism over and above that is largely > redundant, and/or generally within the means of a financially independe= nt > adult to work around, e.g. using a personal device on a mobile network = not > provided by the employer. >=20 > Or, is the employee's network not applying policies that violate the > employees rights, which I think makes the argument moot, since the > employee's rights are not actually being infringed. >=20 > So, yes, the employee has rights, and I don't have any issue with eithe= r > the existence of rights, or any opinion on whether that is right or wro= ng. > What I don't follow from that is, that any network operator using > technology to interfere with those rights, is able to do so with impuni= ty, > and that there is a need to provide mechanisms to bypass that technolog= y. > Is that really the case, currently, in specific jurisdictions? Can you > provide some kind of reference to that, that is verifiable, in the EU? >=20 > We all know about the issue with authoritarian regimes, and all that. I= > think we can all agree that in those cases, the use of technological > methods to bypass restrictions requires individuals to violate the laws= in > those places. Where there is disagreement is that it's not clear how one could provide help in that case, but yet allow blocking access to external recursives in the case of a typical restrictive corporate policy. > And I am in no way arguing against the technology involved. >=20 > I'm saying that outside of those specific jurisdictions/environments, t= here > is no explicit need for making the privacy technology operate in a stri= ctly > unilateral mode, in such a way as to evade any sort of detection. It's not clear, to me at least, that what you say there is possible. But I'm not clear what "unilateral" might mean there. > I'm saying that it is reasonable to expect that whatever > legally-permissible policies any network operator has, can be enforced > cooperatively between client (software/devices), network(s) (operator(s= )), > and server (provider of whatever permitted degree of privacy-enhanced i= s > permitted by network operators' policies). >=20 > The extent of what I'm suggesting is, aside from the authoritarian regi= me > situation, networks whose policies are not violating local laws (includ= ing > whatever "rights" laws may apply), need to be able to implement those > policies in a scalable fashion, including detecting anomalous activity > easily (for e.g. malware detection), and that client software/devices > should be able to, at their discretion, negotiate the maximal privacy > setting desired, including reaching a privacy equivalent of "no network= s > available" (don't connect at all). >=20 >=20 >> Once more: my policy for my network is defensible but is not >> one I claim ought be followed by everyone. And the same applies >> for all of the more intrusive policies being espoused here by >> those with concerns about DoH. >=20 >=20 > We (speaking for everyone else) are NOT espousing policies. I don't accept that you can speak for everyone else. On what basis do you say that? I have seen mails in this discussion asserting that more restrictive policies do need to be enforced. I hadn't yet seen anyone making such statements acknowledge that more permissive policies can be as valid. Hence my bringing up my home network example. Cheers, S. > We are espousing mechanisms for policy enforcement. > There is a huge difference. > Our position on the enforcement is policy-agnostic. > It doesn't matter what the policies themselves are, the mechanisms need= to > scale. > The policies themselves are, honestly, completely out of scope, other t= han > the mechanics. > If a particular policy is legal in any jurisdiction on this planet, and= is > sufficiently well defined and sufficiently distinct from other policies= , > the policy framework needs to accommodate it. > There aren't *that* many conceivable policies that apply to DNS in the > intersection spaces of transport protocol (DoH, DoT, TCP, UDP), third p= arty > operators (yes/no), encryption (yes/no), and privacy (yes/no/MITM). >=20 >=20 >> That doesn't mean those concerns >> are vacuous or otherwise to be ignored, but does mean that >> claims as to such-and-such a policy being a necessity are not >> valid. Only one counter-example is needed to demonstrate that, >> and I've provided one (that is real, not invented). >> >=20 > If it is the EU one, please read above: I don't think it actually does = what > you think it does, per se. > If it is the home network one, it isn't about policy, it is about > mechanisms, and your not needing your policy to scale, isn't germane. > If anyone needs the policy framework to scale, that needs to be taken i= nto > consideration. > As long as there is anything close to consensus on the existence of a > non-trivial number of networks who require scalable solutions to this > problem, that should really be the end of it. >=20 > I don't understand anyone taking a position that anything doesn't need = to > scale, and I think that is what you are saying (from your home network = bit.) > Is that really your position? >=20 > Brian >=20 >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh >=20 --------------68BE9E12224AA62152C82585 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------68BE9E12224AA62152C82585-- --1zjPBMaGnJQlBuQA1Dg5gRrUvUC73d2JX-- --kc6zBpHlYjAstC4BfRMVwv0ydGcAl4HHw Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlySB3AACgkQWrL68XsX K+oLMA//U8f76F9AkjEdv0oV/BGBobZjelOZ03RYXaOD/X/sDuHfhFOi3U/rRzm+ 1mmqyKWGTaQbUzOKm8Fq0PaUSbtbxTsVVqrIip22cPUomGf5cCsswrs1/oFw+IqE dmVTtJUgElXxR+uFo+Nsd0Zh7Thg4tVNy8P/IVZoL6DKTYUw5e2L/okMRLXIT6MM kIsq6mQNjkam7S6d4190VqFNxNIoX+wtjLAIwdoY7a+xJehImCmaWKpczS3ATZ2a 8A80o1nRtXQ+WKBxGLD6ZsLWiaSe2CpfBgY0ynFKvHNfpZ63ayA40MB96FxbkLHS CEK9Fh2gaNt6xSJIPXY45n1kdYBAszfQmXiFmFoEUG0eLnPIgzlGtOiOAXIfPQip hILZSbBhqWWRIi2om0iP8yt+OsBFAVJ10JjRBG+dtdXOXEmQDSG4sgch43BJ/TL3 n7l+tMlsBtA3QgZnFZN5gmK/F8+fdq1bQ5muTP8jP02zbGi5+qJdzo2vOuwtXS1Q Xm7EKA1GZee2EFC2tJbY6RnAwg4A9G9qPALcZtnJv1jkFQnhcnntIrJ42fbJ+4zV M0ihWEHGg+lIV7KFuE8W7h6kMho7J4S4RXt6DeShGQgXtJO/QaF8tYRQgnfFcs2P GKw9r85a67FvQAFTGgAMxofkLKu3l9SS4O7Efu9J/ilkC35GDx4= =Z5eS -----END PGP SIGNATURE----- --kc6zBpHlYjAstC4BfRMVwv0ydGcAl4HHw-- From nobody Wed Mar 20 03:09:57 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3978D1310BF; Wed, 20 Mar 2019 03:09:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fM8fvekojy_J; Wed, 20 Mar 2019 03:09:49 -0700 (PDT) Received: from puck.nether.net (puck.nether.net [IPv6:2001:418:3f4::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6950C130F84; Wed, 20 Mar 2019 03:09:49 -0700 (PDT) Received: from [IPv6:2603:3015:3606:cbe1:cd14:2c86:15f5:ed4e] (unknown [IPv6:2603:3015:3606:cbe1:cd14:2c86:15f5:ed4e]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by puck.nether.net (Postfix) with ESMTPSA id E52A3540F55; Wed, 20 Mar 2019 06:09:36 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Jared Mauch In-Reply-To: Date: Wed, 20 Mar 2019 06:09:36 -0400 Cc: Stephen Farrell , Michael Sinatra , Ted Hardie , DoH WG , paul vixie , dnsop Content-Transfer-Encoding: quoted-printable Message-Id: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> To: Brian Dickson X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 10:09:51 -0000 > On Mar 19, 2019, at 11:17 PM, Brian Dickson = wrote: >=20 >=20 >=20 > On Tue, Mar 19, 2019 at 6:42 PM Stephen Farrell = wrote: >=20 > Hiya, >=20 > One individualistic data point on this sub-topic, and a real point: >=20 > On 20/03/2019 01:13, Jared Mauch wrote: > > My impression is there are people who will not be satisfied until = all traffic looks > > identical and you have zero way to protect your home, >=20 > I do not claim that everyone ought do the same, but I absolutely > do claim that encouraging voluntary policy adherence by dealing > with the people using the n/w is preferable to many egregiously > invasive attempts to force technical policy enforcement on > unwilling serf-like users. >=20 > So, this is the problem: > - If a network operator has any policy that is enforceable, ONLY the = technical policy enforcement model scales. > - In such an environment, there are only, ever, "willing users", = because, in order to use the network, they are required to agree to the = policies. >=20 > This makes the argument you have above, a vacuously defined one.=20 > You want to encourage voluntary policy adherence for a non-existent = set of otherwise unwilling users. >=20 > I understand your position: you would prefer that {some,all} networks = were not employing policies that {you,some people} disagree with. > I sympathize, but I disagree. What we need are mechanisms that scale. > My position (personally) is that we find ways to have scalable, = technical mechanisms. > They should allow users (or machine administrators) to be as compliant = as they are willing, and no more. > They should allow networks to enforce their policies, while treading = as lightly as possible. > It should be possible to use technical means to handle this = negotiation with little to no user input required. > The analogy is roughly that of escalation-of-force in law enforcement, = starting at a level of "polite requests". >=20 > You can disagree, but I implore you: please don't stand in the way of = those wanting to find consensus on scalable, flexible, technical = solutions that encompass a wide range of network policies and = enforcement needs. >=20 > The main point is, I believe the end result will be mechanisms that = allow you to deploy networks that meet your needs, and software that you = can configure to bypass such controls, but that neither of those should = ever be the default configurations. >=20 > If the results allow you to do what you want/need, and also allow = others to do what they want/need, everyone should be happy enough with = the result. >=20 > Can we at least agree on this as a desired goal for this work? Often as an industry we may discuss various solutions that are great for = oneself but don=E2=80=99t scale when looking at the big picture. I=E2=80=99= m of the feeling that not everything should be a standard, even things = that look like they might be standard-ish. I could encode many things = over TCP over TLS over QUIC over HTTP. I=E2=80=99ve seen unencoded data = stored in DNS TXT records that have sorted/ordered information so you = can do interesting things. Just because one can do these things doesn=E2=80=99t mean one should, or = that the entirety of the industry should (or even will). Goals and motivations are key here, if the goal is to make it such that = dissidents whose lives may be threatened (this is an example a co-worker = always uses on me in these types of conversations to support their = position) by the local regime may face a threatening situation or die as = a result of using technology, it=E2=80=99s not the fault of the = protocol. Should we improve for every corner case like this? As vixie = has pointed it, it may be an innocuous device like a chromecast where = the ISP provided DNS is horrible. (I can think of many bad devices in = the consumer space that break the DNS spec in really unique ways). = It=E2=80=99s entirely possible that the appliance works best when not = using that ISP service, but it is also data leakage to a large global = company that for reasonable or unreasonable purposes he doesn=E2=80=99t = want to transact with. When we create technologies that can bypass and traverse the existing = security posture of networks (evil foreign telecoms, where=E2=80=99s my = pitchfork) or a coffee shop, library, home or large enterprise=E2=80=A6 = expect the work to be held to a higher standard. It may be that there=E2=80=99s not consensus on this topic. It may be = I=E2=80=99m an outlier and have been subverted by , but the most likely case is there be dragons here and we = should tread carefully to not burn down the entire place. - Jared= From nobody Wed Mar 20 04:38:23 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24F4E130EF2 for ; Wed, 20 Mar 2019 04:38:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6ncfAi8wxeWL for ; Wed, 20 Mar 2019 04:38:19 -0700 (PDT) Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com [IPv6:2a00:1450:4864:20::42e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E617A12423B for ; Wed, 20 Mar 2019 04:38:18 -0700 (PDT) Received: by mail-wr1-x42e.google.com with SMTP id t5so2349351wri.7 for ; Wed, 20 Mar 2019 04:38:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=nroxriPw49FcN0DkaybBkMS8nLs5CD+/YXuXi6CAwnU=; b=DQfZ5kojv2TlCeexOrnYjUKfMw3ErvME17EYJlTtZIsQrMYklGZLAAXBCkIS+pFzh2 D/uINPPQrY3NitdxWHpAFLSxTow5e0Q6fXduVSildBocOsgbmYiLrnTmiL6W1aPlUlCH JG4yTRlvg5hKavMtyrTutxXsYb4w9QIQwT8WQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=nroxriPw49FcN0DkaybBkMS8nLs5CD+/YXuXi6CAwnU=; b=Y9B1o3q7zKix7HD3Xw/iXAc+Ip4OJ3vSP4R3JmxmRQq1C9Qu4YS3LU+6aQ9eVcuW31 CdYhJTVZPCuYRK8KlIOFt48aa7nEmKg7mxEr4gNy0ojAsU5YQOpxkMtCuCVf7trwmPei M2CuJYyre7BVCk1B26K67EZrcCA6Xe/P5h1P1buX8lUsITFAO205XF6qyC4CT42aDwGp Ne1MwPmHRX0nKryUaPLemjM6NGLa42M6Cumvu4+mujC6jKYns+ZgGuiW2nC7gBnuNbIS oNi2qqqsVMpPXiWUCSr2/hIj8vc9bNgjMBej1juWJPZTGeuITapsEAZj6JOb88NfIA2q pfRw== X-Gm-Message-State: APjAAAWRssiRLaJs1XWUBQjciUVffunntFSy7UpNCoQHHAVXv+3wWIoJ fg0VicSjSbrq04vUtx/t3MywBA== X-Google-Smtp-Source: APXvYqxnDg6CWZc681MvMGChkwu6noTRxxU7fHOsdD57x3f0BMrYd+2fBWk/SyANzqdzn+mmr0Bw2Q== X-Received: by 2002:a5d:4a8a:: with SMTP id o10mr21576206wrq.189.1553081897379; Wed, 20 Mar 2019 04:38:17 -0700 (PDT) Received: from [192.168.122.171] ([41.216.172.202]) by smtp.gmail.com with ESMTPSA id s4sm1552800wmc.34.2019.03.20.04.38.13 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 20 Mar 2019 04:38:15 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Joe Abley In-Reply-To: Date: Wed, 20 Mar 2019 12:38:05 +0100 Cc: Brian Dickson , Ted Hardie , DoH WG , dnsop , paul vixie , Michael Sinatra , Stephen Farrell Content-Transfer-Encoding: quoted-printable Message-Id: <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> To: Jared Mauch X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 11:38:21 -0000 [There is actually a proposal at the bottom of this e-mail. Bear with = me.] On 20 Mar 2019, at 11:09, Jared Mauch wrote: > Often as an industry we may discuss various solutions that are great = for oneself but don=E2=80=99t scale when looking at the big picture. I think what we are seeing is the fundamental tension between privacy = and control. You need to give up some privacy in order to make the = control possible; you need to give up some control in order to afford = privacy. Some in this thread want certainty that they are able to exercise = control, e.g. for devices in their network. Some in this thread want certainty that they can obtain privacy, e.g. = for for their device in any network. When those people meet, the pitchforks come out. This is already true = today; it's not a new DoH problem. I think the balance of the tensions = has shifted with the prospect of a change in default behaviour, not = because any of this is fundamentally new. The change in defaults tips = the power balance (e.g. the balance of cost) between control and = privacy. This is Paul's basic point, I think. Some people seem to be getting worked up about whether the desire for = control is more important than the desire for privacy. I don't think = that question has an answer, but I think most reasonable people could = acknowledge that both positions exist. This is Stephen's basic point, I = think. It's possible today to communicate over covert channels in order to = avoid control. This is different from *all* communication happening over = covert channels so that no control in the future is possible. That's not = how things happen today; that would be a change, a new situation. This = is your basic point, I think (that's how I read "scale" in your e-mail, = above). Seems to me that there's a middle ground within sight here. Standardise this privacy mechanism, and specify (with reasoning) that it = should be implemented such that the existence of the channel (but not = the content) can be identified as distinct from other traffic by third = parties. Maybe specify use of a different port number, as was done with = DoT. Those who choose to ignore that direction and create a covert channel = using port 443 instead will do so. Nothing much we can do to stop that = today (I guarantee it is already happening). The future is not really = different. Of course when people shift the focus of the conversation from DoH in = general to resolverless DNS, and want to interleave DNS messages with = HTML and cat GIFs over the same HTTPS bundles, the pitchforks will need = to come out again. So keep them handy. Joe= From nobody Wed Mar 20 10:59:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CD1DD130ECE; Wed, 20 Mar 2019 10:59:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4AkPQ_KxT2YM; Wed, 20 Mar 2019 10:59:15 -0700 (PDT) Received: from mx2.cira.ca (mx2.cira.ca [192.228.22.117]) by ietfa.amsl.com (Postfix) with ESMTP id 36DA6126C87; Wed, 20 Mar 2019 10:59:15 -0700 (PDT) X-Virus-Scanned: by SpamTitan at cira.ca Received: from CRP-EX16-02.CORP.CIRA.CA (10.2.36.121) by CRP-EX16-02.CORP.CIRA.CA (10.2.36.121) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1531.3; Wed, 20 Mar 2019 13:59:13 -0400 Received: from CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7]) by CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7%13]) with mapi id 15.01.1531.010; Wed, 20 Mar 2019 13:59:13 -0400 From: Jacques Latour To: Jared Mauch , Brian Dickson CC: Ted Hardie , DoH WG , dnsop , paul vixie , Michael Sinatra , Stephen Farrell Thread-Topic: [DNSOP] [Doh] New I-D: draft-reid-doh-operator Thread-Index: AQHU3st9h0GdiQaaLkiocBQxqOUcOaYUj4IAgAA4OCA= Date: Wed, 20 Mar 2019 17:59:13 +0000 Message-ID: <6c5968b28fc04566aa71df4c6666e8e2@cira.ca> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> In-Reply-To: Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.16.4.56] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 17:59:18 -0000 SSdtIHRyeWluZyB0byBiYWxhbmNlIGluIG15IG1pbmQgdGhlIHJlcXVpcmVtZW50cyB0byBwcm90 ZWN0IHRoZSBETlMgdnMuIHdoYXQgaXMgaGFwcGVuaW5nIG9uIHRoZSB3aXJlLCBpbiB0aGUgZW5k LCB0aGUgYnJvd3NlciB3aWxsIGNvbm5lY3QgdG8gYW4gSVAgYWRkcmVzcyB3aGljaCBjYW4gYmUg KGluIG1vc3QgY2FzZSkgbWFwcGVkIHRvIGEgZG9tYWluIG5hbWUsIHdoaWNoIHdlJ3JlIHRyeWlu ZyB0byBwcm90ZWN0L2hpZGUgd2l0aCBhbGwgc29ydHMgb2YgZW5jcnlwdGlvbi4gIFNvbWVvbmUg dGhhdCBoYXMgYWNjZXNzIHRvIHRoZSBETlMgb24gdGhlIHdpcmUgY2FuIHNlZSB3aGF0IGlzIHF1 ZXJpZWQsIHNvbWVvbmUgd2l0aCB3aXJlIGFjY2VzcyBjYW4gc2VlIHdobyBpcyBjb25uZWN0aW5n IHdoZXJlLiAgV2hlcmUncyB0aGUgcHJpdmFjeSBwcm90ZWN0ZWQgaGVyZT8gRG8gd2UgbmVlZCB0 byBiYWxhbmNlIGJvdGg/DQoNCkRvSCBpcyBnb2luZyB0byBmb3JjZSBlbnRlcnByaXNlcy9uZXR3 b3JrIG9wZXJhdG9yIHRvIGJlZWYgdXAgdGhlaXIgc2VjdXJpdHkgcG9saWNpZXMgYnkgZW5mb3Jj aW5nIGhpZ2hlciBsZXZlbCBvZiBvdXRib3VuZCBJUCBhZGRyZXNzIGZpbHRlcmluZy4gSGF2aW5n IGEgbWF0Y2hpbmcgRE5TIGJsb2NrIGxpc3QgaW4gY29ycmVzcG9uZGluZyBvdXRib3VuZCBJUCBh ZGRyZXNzIGZpbHRlcnMuIEdvaW5nIHRvIGJlIG1lc3N5IDotKQ0KDQpKYWNxdWVzDQoNCiANCg0K Pi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+RnJvbTogRE5TT1AgPGRuc29wLWJvdW5jZXNA aWV0Zi5vcmc+IE9uIEJlaGFsZiBPZiBKYXJlZCBNYXVjaA0KPlNlbnQ6IE1hcmNoIDIwLCAyMDE5 IDY6MTAgQU0NCj5UbzogQnJpYW4gRGlja3NvbiA8YnJpYW4ucGV0ZXIuZGlja3NvbkBnbWFpbC5j b20+DQo+Q2M6IFRlZCBIYXJkaWUgPHRlZC5pZXRmQGdtYWlsLmNvbT47IERvSCBXRyA8ZG9oQGll dGYub3JnPjsgZG5zb3ANCj48ZG5zb3BAaWV0Zi5vcmc+OyBwYXVsIHZpeGllIDxwYXVsQHJlZGJh cm4ub3JnPjsgTWljaGFlbCBTaW5hdHJhDQo+PG1pY2hhZWxAYnJva2VuZG5zLm5ldD47IFN0ZXBo ZW4gRmFycmVsbCA8c3RlcGhlbi5mYXJyZWxsQGNzLnRjZC5pZT4NCj5TdWJqZWN0OiBSZTogW0RO U09QXSBbRG9oXSBOZXcgSS1EOiBkcmFmdC1yZWlkLWRvaC1vcGVyYXRvcg0KPg0KPg0KPg0KPj4g T24gTWFyIDE5LCAyMDE5LCBhdCAxMToxNyBQTSwgQnJpYW4gRGlja3Nvbg0KPjxicmlhbi5wZXRl ci5kaWNrc29uQGdtYWlsLmNvbT4gd3JvdGU6DQo+Pg0KPj4NCj4+DQo+PiBPbiBUdWUsIE1hciAx OSwgMjAxOSBhdCA2OjQyIFBNIFN0ZXBoZW4gRmFycmVsbCA8c3RlcGhlbi5mYXJyZWxsQGNzLnRj ZC5pZT4NCj53cm90ZToNCj4+DQo+PiBIaXlhLA0KPj4NCj4+IE9uZSBpbmRpdmlkdWFsaXN0aWMg ZGF0YSBwb2ludCBvbiB0aGlzIHN1Yi10b3BpYywgYW5kIGEgcmVhbCBwb2ludDoNCj4+DQo+PiBP biAyMC8wMy8yMDE5IDAxOjEzLCBKYXJlZCBNYXVjaCB3cm90ZToNCj4+ID4gTXkgaW1wcmVzc2lv biBpcyB0aGVyZSBhcmUgcGVvcGxlIHdobyB3aWxsIG5vdCBiZSBzYXRpc2ZpZWQgdW50aWwNCj4+ ID4gYWxsIHRyYWZmaWMgbG9va3MgaWRlbnRpY2FsIGFuZCB5b3UgaGF2ZSB6ZXJvIHdheSB0byBw cm90ZWN0IHlvdXINCj4+ID4gaG9tZSwNCj4+DQo+PiBJIGRvIG5vdCBjbGFpbSB0aGF0IGV2ZXJ5 b25lIG91Z2h0IGRvIHRoZSBzYW1lLCBidXQgSSBhYnNvbHV0ZWx5IGRvDQo+PiBjbGFpbSB0aGF0 IGVuY291cmFnaW5nIHZvbHVudGFyeSBwb2xpY3kgYWRoZXJlbmNlIGJ5IGRlYWxpbmcgd2l0aCB0 aGUNCj4+IHBlb3BsZSB1c2luZyB0aGUgbi93IGlzIHByZWZlcmFibGUgdG8gbWFueSBlZ3JlZ2lv dXNseSBpbnZhc2l2ZQ0KPj4gYXR0ZW1wdHMgdG8gZm9yY2UgdGVjaG5pY2FsIHBvbGljeSBlbmZv cmNlbWVudCBvbiB1bndpbGxpbmcgc2VyZi1saWtlDQo+PiB1c2Vycy4NCj4+DQo+PiBTbywgdGhp cyBpcyB0aGUgcHJvYmxlbToNCj4+IC0gSWYgYSBuZXR3b3JrIG9wZXJhdG9yIGhhcyBhbnkgcG9s aWN5IHRoYXQgaXMgZW5mb3JjZWFibGUsIE9OTFkgdGhlIHRlY2huaWNhbA0KPnBvbGljeSBlbmZv cmNlbWVudCBtb2RlbCBzY2FsZXMuDQo+PiAtIEluIHN1Y2ggYW4gZW52aXJvbm1lbnQsIHRoZXJl IGFyZSBvbmx5LCBldmVyLCAid2lsbGluZyB1c2VycyIsIGJlY2F1c2UsIGluDQo+b3JkZXIgdG8g dXNlIHRoZSBuZXR3b3JrLCB0aGV5IGFyZSByZXF1aXJlZCB0byBhZ3JlZSB0byB0aGUgcG9saWNp ZXMuDQo+Pg0KPj4gVGhpcyBtYWtlcyB0aGUgYXJndW1lbnQgeW91IGhhdmUgYWJvdmUsIGEgdmFj dW91c2x5IGRlZmluZWQgb25lLg0KPj4gWW91IHdhbnQgdG8gZW5jb3VyYWdlIHZvbHVudGFyeSBw b2xpY3kgYWRoZXJlbmNlIGZvciBhIG5vbi1leGlzdGVudCBzZXQgb2YNCj5vdGhlcndpc2UgdW53 aWxsaW5nIHVzZXJzLg0KPj4NCj4+IEkgdW5kZXJzdGFuZCB5b3VyIHBvc2l0aW9uOiB5b3Ugd291 bGQgcHJlZmVyIHRoYXQge3NvbWUsYWxsfSBuZXR3b3JrcyB3ZXJlDQo+bm90IGVtcGxveWluZyBw b2xpY2llcyB0aGF0IHt5b3Usc29tZSBwZW9wbGV9IGRpc2FncmVlIHdpdGguDQo+PiBJIHN5bXBh dGhpemUsIGJ1dCBJIGRpc2FncmVlLiBXaGF0IHdlIG5lZWQgYXJlIG1lY2hhbmlzbXMgdGhhdCBz Y2FsZS4NCj4+IE15IHBvc2l0aW9uIChwZXJzb25hbGx5KSBpcyB0aGF0IHdlIGZpbmQgd2F5cyB0 byBoYXZlIHNjYWxhYmxlLCB0ZWNobmljYWwNCj5tZWNoYW5pc21zLg0KPj4gVGhleSBzaG91bGQg YWxsb3cgdXNlcnMgKG9yIG1hY2hpbmUgYWRtaW5pc3RyYXRvcnMpIHRvIGJlIGFzIGNvbXBsaWFu dCBhcw0KPnRoZXkgYXJlIHdpbGxpbmcsIGFuZCBubyBtb3JlLg0KPj4gVGhleSBzaG91bGQgYWxs b3cgbmV0d29ya3MgdG8gZW5mb3JjZSB0aGVpciBwb2xpY2llcywgd2hpbGUgdHJlYWRpbmcgYXMg bGlnaHRseQ0KPmFzIHBvc3NpYmxlLg0KPj4gSXQgc2hvdWxkIGJlIHBvc3NpYmxlIHRvIHVzZSB0 ZWNobmljYWwgbWVhbnMgdG8gaGFuZGxlIHRoaXMgbmVnb3RpYXRpb24gd2l0aA0KPmxpdHRsZSB0 byBubyB1c2VyIGlucHV0IHJlcXVpcmVkLg0KPj4gVGhlIGFuYWxvZ3kgaXMgcm91Z2hseSB0aGF0 IG9mIGVzY2FsYXRpb24tb2YtZm9yY2UgaW4gbGF3IGVuZm9yY2VtZW50LCBzdGFydGluZw0KPmF0 IGEgbGV2ZWwgb2YgInBvbGl0ZSByZXF1ZXN0cyIuDQo+Pg0KPj4gWW91IGNhbiBkaXNhZ3JlZSwg YnV0IEkgaW1wbG9yZSB5b3U6IHBsZWFzZSBkb24ndCBzdGFuZCBpbiB0aGUgd2F5IG9mIHRob3Nl DQo+d2FudGluZyB0byBmaW5kIGNvbnNlbnN1cyBvbiBzY2FsYWJsZSwgZmxleGlibGUsIHRlY2hu aWNhbCBzb2x1dGlvbnMgdGhhdA0KPmVuY29tcGFzcyBhIHdpZGUgcmFuZ2Ugb2YgbmV0d29yayBw b2xpY2llcyBhbmQgZW5mb3JjZW1lbnQgbmVlZHMuDQo+Pg0KPj4gVGhlIG1haW4gcG9pbnQgaXMs IEkgYmVsaWV2ZSB0aGUgZW5kIHJlc3VsdCB3aWxsIGJlIG1lY2hhbmlzbXMgdGhhdCBhbGxvdyB5 b3UNCj50byBkZXBsb3kgbmV0d29ya3MgdGhhdCBtZWV0IHlvdXIgbmVlZHMsIGFuZCBzb2Z0d2Fy ZSB0aGF0IHlvdSBjYW4gY29uZmlndXJlDQo+dG8gYnlwYXNzIHN1Y2ggY29udHJvbHMsIGJ1dCB0 aGF0IG5laXRoZXIgb2YgdGhvc2Ugc2hvdWxkIGV2ZXIgYmUgdGhlIGRlZmF1bHQNCj5jb25maWd1 cmF0aW9ucy4NCj4+DQo+PiBJZiB0aGUgcmVzdWx0cyBhbGxvdyB5b3UgdG8gZG8gd2hhdCB5b3Ug d2FudC9uZWVkLCBhbmQgYWxzbyBhbGxvdyBvdGhlcnMgdG8gZG8NCj53aGF0IHRoZXkgd2FudC9u ZWVkLCBldmVyeW9uZSBzaG91bGQgYmUgaGFwcHkgZW5vdWdoIHdpdGggdGhlIHJlc3VsdC4NCj4+ DQo+PiBDYW4gd2UgYXQgbGVhc3QgYWdyZWUgb24gdGhpcyBhcyBhIGRlc2lyZWQgZ29hbCBmb3Ig dGhpcyB3b3JrPw0KPg0KPk9mdGVuIGFzIGFuIGluZHVzdHJ5IHdlIG1heSBkaXNjdXNzIHZhcmlv dXMgc29sdXRpb25zIHRoYXQgYXJlIGdyZWF0IGZvciBvbmVzZWxmDQo+YnV0IGRvbuKAmXQgc2Nh bGUgd2hlbiBsb29raW5nIGF0IHRoZSBiaWcgcGljdHVyZS4gIEnigJltIG9mIHRoZSBmZWVsaW5n IHRoYXQgbm90DQo+ZXZlcnl0aGluZyBzaG91bGQgYmUgYSBzdGFuZGFyZCwgZXZlbiB0aGluZ3Mg dGhhdCBsb29rIGxpa2UgdGhleSBtaWdodCBiZQ0KPnN0YW5kYXJkLWlzaC4gIEkgY291bGQgZW5j b2RlIG1hbnkgdGhpbmdzIG92ZXIgVENQIG92ZXIgVExTIG92ZXIgUVVJQyBvdmVyDQo+SFRUUC4g IEnigJl2ZSBzZWVuIHVuZW5jb2RlZCBkYXRhIHN0b3JlZCBpbiBETlMgVFhUIHJlY29yZHMgdGhh dCBoYXZlDQo+c29ydGVkL29yZGVyZWQgaW5mb3JtYXRpb24gc28geW91IGNhbiBkbyBpbnRlcmVz dGluZyB0aGluZ3MuDQo+DQo+SnVzdCBiZWNhdXNlIG9uZSBjYW4gZG8gdGhlc2UgdGhpbmdzIGRv ZXNu4oCZdCBtZWFuIG9uZSBzaG91bGQsIG9yIHRoYXQgdGhlDQo+ZW50aXJldHkgb2YgdGhlIGlu ZHVzdHJ5IHNob3VsZCAob3IgZXZlbiB3aWxsKS4NCj4NCj5Hb2FscyBhbmQgbW90aXZhdGlvbnMg YXJlIGtleSBoZXJlLCBpZiB0aGUgZ29hbCBpcyB0byBtYWtlIGl0IHN1Y2ggdGhhdCBkaXNzaWRl bnRzDQo+d2hvc2UgbGl2ZXMgbWF5IGJlIHRocmVhdGVuZWQgKHRoaXMgaXMgYW4gZXhhbXBsZSBh IGNvLXdvcmtlciBhbHdheXMgdXNlcyBvbg0KPm1lIGluIHRoZXNlIHR5cGVzIG9mIGNvbnZlcnNh dGlvbnMgdG8gc3VwcG9ydCB0aGVpciBwb3NpdGlvbikgYnkgdGhlIGxvY2FsIHJlZ2ltZQ0KPm1h eSBmYWNlIGEgdGhyZWF0ZW5pbmcgc2l0dWF0aW9uIG9yIGRpZSBhcyBhIHJlc3VsdCBvZiB1c2lu ZyB0ZWNobm9sb2d5LCBpdOKAmXMgbm90DQo+dGhlIGZhdWx0IG9mIHRoZSBwcm90b2NvbC4gIFNo b3VsZCB3ZSBpbXByb3ZlIGZvciBldmVyeSBjb3JuZXIgY2FzZSBsaWtlIHRoaXM/ICBBcw0KPnZp eGllIGhhcyBwb2ludGVkIGl0LCBpdCBtYXkgYmUgYW4gaW5ub2N1b3VzIGRldmljZSBsaWtlIGEg Y2hyb21lY2FzdCB3aGVyZSB0aGUNCj5JU1AgcHJvdmlkZWQgRE5TIGlzIGhvcnJpYmxlLiAgKEkg Y2FuIHRoaW5rIG9mIG1hbnkgYmFkIGRldmljZXMgaW4gdGhlIGNvbnN1bWVyDQo+c3BhY2UgdGhh dCBicmVhayB0aGUgRE5TIHNwZWMgaW4gcmVhbGx5IHVuaXF1ZSB3YXlzKS4gIEl04oCZcyBlbnRp cmVseSBwb3NzaWJsZSB0aGF0DQo+dGhlIGFwcGxpYW5jZSB3b3JrcyBiZXN0IHdoZW4gbm90IHVz aW5nIHRoYXQgSVNQIHNlcnZpY2UsIGJ1dCBpdCBpcyBhbHNvIGRhdGENCj5sZWFrYWdlIHRvIGEg bGFyZ2UgZ2xvYmFsIGNvbXBhbnkgdGhhdCBmb3IgcmVhc29uYWJsZSBvciB1bnJlYXNvbmFibGUg cHVycG9zZXMNCj5oZSBkb2VzbuKAmXQgd2FudCB0byB0cmFuc2FjdCB3aXRoLg0KPg0KPldoZW4g d2UgY3JlYXRlIHRlY2hub2xvZ2llcyB0aGF0IGNhbiBieXBhc3MgYW5kIHRyYXZlcnNlIHRoZSBl eGlzdGluZyBzZWN1cml0eQ0KPnBvc3R1cmUgb2YgbmV0d29ya3MgKGV2aWwgZm9yZWlnbiB0ZWxl Y29tcywgd2hlcmXigJlzIG15IHBpdGNoZm9yaykgb3IgYSBjb2ZmZWUNCj5zaG9wLCBsaWJyYXJ5 LCBob21lIG9yIGxhcmdlIGVudGVycHJpc2XigKYgZXhwZWN0IHRoZSB3b3JrIHRvIGJlIGhlbGQg dG8gYSBoaWdoZXINCj5zdGFuZGFyZC4NCj4NCj5JdCBtYXkgYmUgdGhhdCB0aGVyZeKAmXMgbm90 IGNvbnNlbnN1cyBvbiB0aGlzIHRvcGljLiAgSXQgbWF5IGJlIEnigJltIGFuIG91dGxpZXIgYW5k DQo+aGF2ZSBiZWVuIHN1YnZlcnRlZCBieSA8aW5zZXJ0IGJvb2dleW1hbiBvZiB0aGUgd2VlayBo ZXJlPiwgYnV0IHRoZSBtb3N0DQo+bGlrZWx5IGNhc2UgaXMgdGhlcmUgYmUgZHJhZ29ucyBoZXJl IGFuZCB3ZSBzaG91bGQgdHJlYWQgY2FyZWZ1bGx5IHRvIG5vdCBidXJuDQo+ZG93biB0aGUgZW50 aXJlIHBsYWNlLg0KPg0KPi0gSmFyZWQNCj5fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fXw0KPkROU09QIG1haWxpbmcgbGlzdA0KPkROU09QQGlldGYub3JnDQo+ aHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kbnNvcA0K From nobody Wed Mar 20 11:15:03 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AF1F13120F; Wed, 20 Mar 2019 11:15:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Z6tTdR2ziZiR; Wed, 20 Mar 2019 11:15:00 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E12E131205; Wed, 20 Mar 2019 11:14:58 -0700 (PDT) Received: from MacBook-Pro.roach.at (99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2KIEcGD072473 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Wed, 20 Mar 2019 13:14:39 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553105681; bh=Jad7dgelowDq81FHGatz+x/ZmYroDN1oh7emSASXvWw=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=CadBUvYLRA4CionF7FkPZltgsrx8GhraHMiU8c8vEoW23dDV7xB4j+NSz9zlmE6eK EZoia86YleX9WkgUdQL+A1plyjNtd0TiDpJUg1YpRet0ICNzR9IW3YQE/QZkKezsn4 Eycj+SvKiPXvhiLkzKrNwPyHuy4QLK/woX6SwlNo= X-Authentication-Warning: raven.nostrum.com: Host 99-152-146-228.lightspeed.dllstx.sbcglobal.net [99.152.146.228] claimed to be MacBook-Pro.roach.at To: Jacques Latour , Jared Mauch , Brian Dickson Cc: Ted Hardie , DoH WG , dnsop , paul vixie , Michael Sinatra , Stephen Farrell References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <6c5968b28fc04566aa71df4c6666e8e2@cira.ca> From: Adam Roach Message-ID: <81ec8759-fcaf-c559-de75-b08f25a75d81@nostrum.com> Date: Wed, 20 Mar 2019 13:14:32 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <6c5968b28fc04566aa71df4c6666e8e2@cira.ca> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 18:15:02 -0000 On 3/20/19 12:59 PM, Jacques Latour wrote: > I'm trying to balance in my mind the requirements to protect the DNS vs. what is happening on the wire, in the end, the browser will connect to an IP address which can be (in most case) mapped to a domain name I don't think this second assertion is true in 2019. See if you can make even a first-order reasonable guess what I'm accessing at 172.217.1.129 or 23.227.38.32 or 52.40.19.98 or 216.105.38.15 or 104.20.1.85. (Hint: I took these all from sites I visit frequently, and none are particularly obscure sites) /a From nobody Wed Mar 20 11:40:15 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A32F130F25; Wed, 20 Mar 2019 11:40:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.669 X-Spam-Level: X-Spam-Status: No, score=-0.669 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, FROM_EXCESS_BASE64=0.979, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cwhP6RjKhrlw; Wed, 20 Mar 2019 11:40:11 -0700 (PDT) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EB6EB1200B3; Wed, 20 Mar 2019 11:40:10 -0700 (PDT) Received: by mail-wm1-f54.google.com with SMTP id a184so274153wma.2; Wed, 20 Mar 2019 11:40:10 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=rQ3kdgZuenk4U0DtAD9p8rEVK9qsyMgYZ/0Ux2nfnxw=; b=a6wSIlC8YridIDdpGNLPUCE4IaIHSjhrCLhk63H9bt+sKt/sorvgIUMfTQGWIv+5T7 SPN/sUYfXVZpu7qoojRrejpo794KKWqbRuXlyePeHjAP1lXqpaIRhi/Top68moVBJLnf /F7bVNZ+n+e6RlEKLHT3EtaIipG8bic7yz4hmpuvvY3B8WOdZOkNnSre4C4wfgfFDB/Q ud/ab1SL5vmxjXnoBhrxMTEjgZkOP7A/N38O8+PmpP+e9TUxl7uoMetOrnIVIrF1ztqX Oq0G4kXSWLMqnO3TgktKgtJJWDoHa9JsLC41+D1lk3XbM3m8yMSV+aXbQfsjJE1YrfZS QB8g== X-Gm-Message-State: APjAAAUGUgWbqwNfTCAqv89aq/GE/Klgk0RrpjIU2fzR6Jbc7R7530+7 Asg7X6qjuukxsu8zZPIrQP8inYTdRFe3oOtxCKk= X-Google-Smtp-Source: APXvYqzLoP6avYU7dtXPqxn0I7GBz+AmBmjnH/leoaEzJj++2hHAGa+0wsPjCPlqpGsPUq7RUIPiAXCeLgMhc7TYK7o= X-Received: by 2002:a1c:4641:: with SMTP id t62mr9767076wma.53.1553107209255; Wed, 20 Mar 2019 11:40:09 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> In-Reply-To: <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> From: =?UTF-8?B?56We5piO6YGU5ZOJ?= Date: Wed, 20 Mar 2019 11:39:57 -0700 Message-ID: To: Joe Abley Cc: Jared Mauch , Ted Hardie , DoH WG , Brian Dickson , dnsop , paul vixie , Michael Sinatra , Stephen Farrell Content-Type: multipart/alternative; boundary="00000000000081802a05848af30c" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 18:40:13 -0000 --00000000000081802a05848af30c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable At Wed, 20 Mar 2019 12:38:05 +0100, Joe Abley wrote: > > Often as an industry we may discuss various solutions that are great for oneself but don=E2=80=99t scale when looking at the big picture. > > I think what we are seeing is the fundamental tension between privacy and control. You need to give up some privacy in order to make the control possible; you need to give up some control in order to afford privacy. > Some in this thread want certainty that they are able to exercise control, e.g. for devices in their network. > Some in this thread want certainty that they can obtain privacy, e.g. for for their device in any network. [...] Thank you for the nice, concise summary. I think it's well-balanced observation of where we are. (I'm so glad I can finally see a constructive post after seeing a common pattern of boring IETF discussion, where people with different opinions just keep stating their views without making any real progress:). > Seems to me that there's a middle ground within sight here. > > Standardise this privacy mechanism, and specify (with reasoning) that it should be implemented such that the existence of the channel (but not the content) can be identified as distinct from other traffic by third parties. Maybe specify use of a different port number, as was done with DoT. I see that those who want to exercise control can live with this (or at least using a different set of IP addresses for DoH servers than those for other ordinary web services). But I'm not so sure if that's acceptable for the other group. In that sense I'm curious whether some big possible DoH providers are now willing to accept this middle ground. If my memory is correct the longer term plan at Google (and maybe also Clouldflare?) is to provide DoH service on the same IP addresses as those for other ordinary and popular web services (and on port 443, of course), so that an intermediate operator cannot easily block access to their DoH services. > Those who choose to ignore that direction and create a covert channel using port 443 instead will do so. Nothing much we can do to stop that today (I guarantee it is already happening). The future is not really different. True. But I think giant providers tend to respect a community consensus. Niche or really malicious players may/will still ignore it, but it would be very difficult for them to collocate their DoH services with other important web services that can hardly be blocked, so it shouldn't be a big problem for "those who want certainty of control". So if we can really agree on the above "middle ground" and publish a BCP or something that describes the consensus, I guess we can now really work on technical issues. But I'm not sure if we can reach that consensus. -- JINMEI, Tatuya --00000000000081802a05848af30c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
At Wed, 20 Mar 2019 12:38:05 +0100,
Jo= e Abley <jabley@hopcount.ca>= ; wrote:

> > Often as an industry we may discuss various solut= ions that are great for oneself but don=E2=80=99t scale when looking at the= big picture.
>
> I think what we are seeing is the fundamenta= l tension between privacy and control. You need to give up some privacy in = order to make the control possible; you need to give up some control in ord= er to afford privacy.

> Some in this thread want certainty that t= hey are able to exercise control, e.g. for devices in their network.
> Some in this thread want certainty that they can obtain privacy, e.g.= for for their device in any network.

[...]

Thank you for the= nice, concise summary.=C2=A0 I think it's well-balanced
observation= of where we are.=C2=A0 (I'm so glad I can finally see a
constructiv= e post after seeing a common pattern of boring IETF
discussion, where pe= ople with different opinions just keep stating
their views without makin= g any real progress:).

> Seems to me that there's a middle gr= ound within sight here.
>
> Standardise this privacy mechanism= , and specify (with reasoning) that it should be implemented such that the = existence of the channel (but not the content) can be identified as distinc= t from other traffic by third parties. Maybe specify use of a different por= t number, as was done with DoT.

I see that those who want to exercis= e control can live with this (or
at least using a different set of IP ad= dresses for DoH servers than
those for other ordinary web services).=C2= =A0 But I'm not so sure if that's
acceptable for the other group= .=C2=A0 In that sense I'm curious whether
some big possible DoH prov= iders are now willing to accept this middle
ground.=C2=A0 If my memory i= s correct the longer term plan at Google (and
maybe also Clouldflare?) i= s to provide DoH service on the same IP
addresses as those for other ord= inary and popular web services (and on
port 443, of course), so that an = intermediate operator cannot easily
block access to their DoH services.<= br>
> Those who choose to ignore that direction and create a covert c= hannel using port 443 instead will do so. Nothing much we can do to stop th= at today (I guarantee it is already happening). The future is not really di= fferent.

True.=C2=A0 But I think giant providers tend to respect a c= ommunity
consensus.=C2=A0 Niche or really malicious players may/will sti= ll ignore
it, but it would be very difficult for them to collocate their= DoH
services with other important web services that can hardly be block= ed,
so it shouldn't be a big problem for "those who want certai= nty of
control".=C2=A0 So if we can really agree on the above "= ;middle ground" and
publish a BCP or something that describes the c= onsensus, I guess we
can now really work on technical issues.=C2=A0 But = I'm not sure if we can
reach that consensus.

--
JINMEI, Ta= tuya
--00000000000081802a05848af30c-- From nobody Wed Mar 20 12:32:07 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 456FF130FC7; Wed, 20 Mar 2019 12:31:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.601 X-Spam-Level: X-Spam-Status: No, score=-2.601 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9dE6smN2UWLe; Wed, 20 Mar 2019 12:31:55 -0700 (PDT) Received: from mx2.cira.ca (mx2.cira.ca [192.228.22.117]) by ietfa.amsl.com (Postfix) with ESMTP id 993781288AB; Wed, 20 Mar 2019 12:31:55 -0700 (PDT) X-Virus-Scanned: by SpamTitan at cira.ca Received: from CRP-EX16-02.CORP.CIRA.CA (10.2.36.121) by CRP-EX16-02.CORP.CIRA.CA (10.2.36.121) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1531.3; Wed, 20 Mar 2019 15:31:54 -0400 Received: from CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7]) by CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7%13]) with mapi id 15.01.1531.010; Wed, 20 Mar 2019 15:31:54 -0400 From: Jacques Latour To: Adam Roach , Jared Mauch , "Brian Dickson" CC: Ted Hardie , DoH WG , dnsop , paul vixie , Michael Sinatra , Stephen Farrell Thread-Topic: [Doh] [DNSOP] New I-D: draft-reid-doh-operator Thread-Index: AQHU30jRzIqBQt8xXUeC8PFs/ddm0KYU5d0Q Date: Wed, 20 Mar 2019 19:31:54 +0000 Message-ID: <37da69429cbf49e480db5355deafddd2@cira.ca> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <6c5968b28fc04566aa71df4c6666e8e2@cira.ca> <81ec8759-fcaf-c559-de75-b08f25a75d81@nostrum.com> In-Reply-To: <81ec8759-fcaf-c559-de75-b08f25a75d81@nostrum.com> Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.16.4.56] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 19:31:59 -0000 SXQncyBub3Qgd2hhdCB5b3UgYWNjZXNzLCBpdCdzIHdoYXQgeW91IGJsb2NrLCBzaW5jZSByZXZl cnNlIEROUyBpcyBub3QgYSBnb29kIHNvbHV0aW9uIGluIHRoaXMgaW5zdGFuY2UsIHlvdSBuZWVk IHRvIG1hcCB0aGUgRE5TIGJsb2NrIGxpc3QgdG8gaXQncyBJUCBhZGRyZXNzZXMgYW5kIGJsb2Nr IHRob3NlIElQcywgYW5kIHJlYWRqdXN0IGJhc2VkIG9uIFRUTCwgeW91J2xsIGVuZCB1cCBibG9j a2luZyBtb3JlIHN0dWZmIHRoYW4gaW50ZW5kZWQsIGh1Z2UgbWVzcywgYnV0IGlmIHlvdSBjYW4n dCB0cnVzdCB0aGUgRE5TIHRvIGJlIGNsZWFuIHRoZW4gdGhhdCdzIG9uZSBvcHRpb24gdG8gZW5m b3JjZSBhIHNlY3VyaXR5IHBvbGljeSB3aGVuIGJyb3dzZXJzIGFyZSB1c2luZyBEb0guIFRoaXMg c2hvdWxkIHByb2JhYmx5IGdvIGluIGRyYWZ0LWxpdmluZ29vZC1kb2gtaW1wbGVtZW50YXRpb24t cmlza3MtaXNzdWVzDQoNCkphY3F1ZXMNCg0KPi0tLS0tT3JpZ2luYWwgTWVzc2FnZS0tLS0tDQo+ RnJvbTogQWRhbSBSb2FjaCA8YWRhbUBub3N0cnVtLmNvbT4NCj5TZW50OiBNYXJjaCAyMCwgMjAx OSAyOjE1IFBNDQo+VG86IEphY3F1ZXMgTGF0b3VyIDxKYWNxdWVzLkxhdG91ckBjaXJhLmNhPjsg SmFyZWQgTWF1Y2gNCj48amFyZWRAcHVjay5uZXRoZXIubmV0PjsgQnJpYW4gRGlja3NvbiA8YnJp YW4ucGV0ZXIuZGlja3NvbkBnbWFpbC5jb20+DQo+Q2M6IFRlZCBIYXJkaWUgPHRlZC5pZXRmQGdt YWlsLmNvbT47IERvSCBXRyA8ZG9oQGlldGYub3JnPjsgZG5zb3ANCj48ZG5zb3BAaWV0Zi5vcmc+ OyBwYXVsIHZpeGllIDxwYXVsQHJlZGJhcm4ub3JnPjsgTWljaGFlbCBTaW5hdHJhDQo+PG1pY2hh ZWxAYnJva2VuZG5zLm5ldD47IFN0ZXBoZW4gRmFycmVsbCA8c3RlcGhlbi5mYXJyZWxsQGNzLnRj ZC5pZT4NCj5TdWJqZWN0OiBSZTogW0RvaF0gW0ROU09QXSBOZXcgSS1EOiBkcmFmdC1yZWlkLWRv aC1vcGVyYXRvcg0KPg0KPk9uIDMvMjAvMTkgMTI6NTkgUE0sIEphY3F1ZXMgTGF0b3VyIHdyb3Rl Og0KPj4gSSdtIHRyeWluZyB0byBiYWxhbmNlIGluIG15IG1pbmQgdGhlIHJlcXVpcmVtZW50cyB0 byBwcm90ZWN0IHRoZSBETlMNCj4+IHZzLiB3aGF0IGlzIGhhcHBlbmluZyBvbiB0aGUgd2lyZSwg aW4gdGhlIGVuZCwgdGhlIGJyb3dzZXIgd2lsbA0KPj4gY29ubmVjdCB0byBhbiBJUCBhZGRyZXNz IHdoaWNoIGNhbiBiZSAoaW4gbW9zdCBjYXNlKSBtYXBwZWQgdG8gYQ0KPj4gZG9tYWluIG5hbWUN Cj4NCj4NCj5JIGRvbid0IHRoaW5rIHRoaXMgc2Vjb25kIGFzc2VydGlvbiBpcyB0cnVlIGluIDIw MTkuIFNlZSBpZiB5b3UgY2FuIG1ha2UgZXZlbiBhDQo+Zmlyc3Qtb3JkZXIgcmVhc29uYWJsZSBn dWVzcyB3aGF0IEknbSBhY2Nlc3NpbmcgYXQgMTcyLjIxNy4xLjEyOSBvcg0KPjIzLjIyNy4zOC4z MiBvciA1Mi40MC4xOS45OCBvciAyMTYuMTA1LjM4LjE1IG9yIDEwNC4yMC4xLjg1Lg0KPg0KPihI aW50OiBJIHRvb2sgdGhlc2UgYWxsIGZyb20gc2l0ZXMgSSB2aXNpdCBmcmVxdWVudGx5LCBhbmQg bm9uZSBhcmUgcGFydGljdWxhcmx5DQo+b2JzY3VyZSBzaXRlcykNCj4NCj4vYQ0KDQo= From nobody Wed Mar 20 12:45:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CD0512D550 for ; Wed, 20 Mar 2019 12:45:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E1bLThDRVuEm for ; Wed, 20 Mar 2019 12:45:45 -0700 (PDT) Received: from mail-io1-xd43.google.com (mail-io1-xd43.google.com [IPv6:2607:f8b0:4864:20::d43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AC23012008F for ; Wed, 20 Mar 2019 12:45:45 -0700 (PDT) Received: by mail-io1-xd43.google.com with SMTP id u12so3155855iop.11 for ; Wed, 20 Mar 2019 12:45:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=hTsr91n3iasDpnSIKMygLHqeh+MbNIGkKkemE5V+IZc=; b=v1FaYCP4le1roWmtaKF6xEVgfbCN0H4fBeIS/Vyi5u5SawogzXxUzlk8mPAZEVBxY/ Damhk1QJgQ/M7FaJ0ahAUGkNEMb3aKaufnhPyuf5UulJzaVu5Y9c3sexW6JcJCUqeLnp h8jr8EPJbDzomfIWHgYwoal073+VeFmxfG/Iqctcy8s5Zr4qvIpTIuCJMUbmwtLxlRzt mELhgr3gp7z5FHHjHgxZS1EtmIVYV4AGaGxjLycQAltSlkFghH+Ex/MR/LOQoc9fuwzA KBBnXkGeocRKiGVUQYem0XMwMbQOCgUobRUnbNlEtn/gAUKXHBsb8JXoxuaoQXcKlM5q IVdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=hTsr91n3iasDpnSIKMygLHqeh+MbNIGkKkemE5V+IZc=; b=ih8mTD6whOnzLT6UhwdtQ+i5Crj417qKgLONO1dTmX+11mS/PMIshIsL01nV5c93ze yZXXh+KmmFqVwRZaqj9zhkC+iSEUF7DzS8wWs9Fl33y0Gc8NVLn3dl5hYuDK9eYWUUSy IDo3QEz/i73csJ7XBpi+bsn/V3SsCNp4XwHado/J6l61rPpsiupn/VzFmko49sg4f7Wa v5MWgaDcE0wZ9UxyhqfrcUQkFYw4I5KNgTy7/0tpRbQy9yfk1uG6zuFu6jbPmoBjxKJO rqbwVEb/XwqHuoRsRA/XBSFzC76Zh0wZdhjxbFUbCW5RMVTtbQ2cObAn8nKty1q9ZciZ Vd4g== X-Gm-Message-State: APjAAAVaDnwUw/RzT+4kmqz0ExD2EKImUbn4XTc6svYtEqo68wKTDlDD Lvx4M97dj8zjwxWaHJOLU+Ze+2BYYEyvn6pq35DGSg== X-Google-Smtp-Source: APXvYqx5cXQM2sMkb5b6msPEUFxIWYX7L8/mlMpoYypM4t53UEGvk0QbzQdFS9jopw1NBE49Lgjw9AfCSEsWMbyVklQ= X-Received: by 2002:a6b:6007:: with SMTP id r7mr6610906iog.124.1553111144894; Wed, 20 Mar 2019 12:45:44 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> In-Reply-To: <0ea5c3ed-f0d9-8b95-515e-c555855a9c5c@huitema.net> From: Matthew Pounsett Date: Wed, 20 Mar 2019 15:45:33 -0400 Message-ID: To: Christian Huitema Cc: Eliot Lear , Ted Hardie , DoH WG , Paul Vixie , dnsop Content-Type: multipart/alternative; boundary="00000000000016a11605848bdefc" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 19:45:49 -0000 --00000000000016a11605848bdefc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, 19 Mar 2019 at 13:37, Christian Huitema wrote= : > > On 3/19/2019 12:50 AM, Eliot Lear wrote: > > On 19 Mar 2019, at 01:50, Matthew Pounsett wrote: > > Somewhere up-thread it was suggested that there are other reasonable step= s > that a network/security operator can take to maintain the controls over > resolution that we have today, but so far I haven't seen them enumerated > anywhere. > > > I had stated that one can use an MDM to manage the endpoint=E2=80=99s use= of DoH. > This doesn=E2=80=99t eliminate the possibility of malware, but does reduc= e > misconfiguration in the enterprise, and provides for some protection > against infection by blocking known bad names. > > Configuration works well for functions like "phishing protection": the > device users in most cases want some form of protection, and then it is a > matter of how this protection is configured. It does not work so well for > functions like intrusion detection, such as figuring out whether a device > is trying to contact a botnet C&C, because we cannot expect the infected > device to be amenable to configuration. > Yes. I'm not particularly concerned about cooperative clients. Even if it's not possible today, the economics of large enterprises will force browsers et. al. to make their software configurable in some automated, mass-update way that works for 50k+ employee companies. I'll be able to use the same controls to force cooperative clients to use my resolver, whether that be DoT or DoH. It's the uncooperative clients that I'm concerned about, and the presence of DoH endpoints at the same IP:port pair as other web sites means that in order to deal with uncooperative clients, operators will have to block/proxy all external port 443 traffic in order to make sure malware can't get access to resolution they don't control. In addition, there=E2=80=99s at least a heuristic for detection: compare da= ta plane > activity against ANSWERs. If you=E2=80=99re seeing activity to addresses= that > don=E2=80=99t match (modulo some noise), you know an alternate resolver i= s active > on that device. And while it=E2=80=99s possible for malware to mimic que= ries to > Do53 for Good sites versus what it really wants to access, you start > tarnishing the rep of the IP address as and when you detect the problem > through other means (AV s/w, honey pots, binary inspection, et al). That > leaves it with cloud providers to sort their wagons. > > Yes, one could imagine IP address or IP prefix reputation systems, simila= r > to the IP address block lists used to protect against spam. This would > work, and it would also provide intrusion detection signals when an > infected device starts contacting a botnet. The problem of course is the > gray line between "blocking phishing sites" and "blocking content that I > disagree with". The various attempts to block the whole of Wikipedia in > order to block some specific pages shows where this can lead. > The distinction between blocking single pages vs. blocking whole domains isn't really relevant here since we're talking about DNS-based blocking in the first place. However, there's a similar problem between blocking domain resolution and blocking the IP address a domain resolves to. Right now operators can block access to malwareCnC.com even if it resides on the same web server as useful.website.net because of the way virtual hosting works. If operators have to replace their domain reputation feeds with address reputation feeds there's going to be less fine-grained control and collateral damage. --00000000000016a11605848bdefc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, 19 Mar 2019 at 13:37, Christi= an Huitema <huitema@huitema.net> wrote:
=20 =20 =20


On 3/19/2019= 12:50 AM, Eliot Lear wrote:

Somewhere up-thread it was suggested that there are other reasonable steps that a network/security operator can take to maintain the controls over resolution that we have today, but so far I haven't seen them enumerated anywhere.


I had stated that one can use an MDM to manage the endpoint=E2=80=99s use of DoH.=C2=A0 This doesn=E2=80=99t eliminate= the possibility of malware, but does reduce misconfiguration in the enterprise, and provides for some protection against infection by blocking known bad names.

Configuration works well for functions like "phishing protection": the device users in most cases want some form of protection, and then it is a matter of how this protection is configured. It does not work so well for functions like intrusion detection, such as figuring out whether a device is trying to contact a botnet C&C, because we cannot expect the infected device to be amenable to configuration.

Ye= s.=C2=A0 I'm not particularly concerned about cooperative clients.=C2= =A0 Even if it's not possible today, the economics of large enterprises= will force browsers et. al. to make their software configurable in some au= tomated, mass-update way that works for 50k+ employee companies.=C2=A0 I= 9;ll be able to use the same controls to force cooperative clients to use m= y resolver, whether that be DoT or DoH.

It's t= he uncooperative clients that I'm concerned about, and the presence of = DoH endpoints at the same IP:port pair as other web sites means that in ord= er to deal with uncooperative clients, operators will have to block/proxy a= ll external port 443 traffic in order to make sure malware can't get ac= cess to resolution they don't control.=C2=A0

In addition, there=E2=80=99s at least a heuristic for detection: compare data plane activity against ANSWERs.=C2=A0 If you=E2=80=99re seeing activity to addresses that don=E2=80=99t matc= h (modulo some noise), you know an alternate resolver is active on that device.=C2=A0 And while it=E2=80=99s possible for malware to mimic = queries to Do53 for Good sites versus what it really wants to access, you start tarnishing the rep of the IP address as and when you detect the problem through other means (AV s/w, honey pots, binary inspection, et al).=C2=A0 That leaves it with cloud provider= s to sort their wagons.

Yes, one could imagine IP address or IP prefix reputation systems, similar to the IP address block lists used to protect against spam. This would work, and it would also provide intrusion detection signals when an infected device starts contacting a botnet. The problem of course is the gray line between "blocking phishing sites" and "blocking content that I disagree with&= quot;. The various attempts to block the whole of Wikipedia in order to block some specific pages shows where this can lead.

The distinction between blocking single pages vs. blocking whole = domains isn't really relevant here since we're talking about DNS-ba= sed blocking in the first place.=C2=A0 However, there's a similar probl= em between blocking domain resolution and blocking the IP address a domain = resolves to.=C2=A0 Right now operators can block access to malwareCnC.com e= ven if it resides on the same web server as useful.website.net because of the way virtual hosting works.=C2= =A0 If operators have to replace their domain reputation feeds with address= reputation feeds there's going to be less fine-grained control and col= lateral damage.


--00000000000016a11605848bdefc-- From nobody Wed Mar 20 13:08:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 49B3D131084 for ; Wed, 20 Mar 2019 13:08:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iMPsaX2xIjXs for ; Wed, 20 Mar 2019 13:08:38 -0700 (PDT) Received: from mail-it1-x12c.google.com (mail-it1-x12c.google.com [IPv6:2607:f8b0:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A847E1277CC for ; Wed, 20 Mar 2019 13:08:38 -0700 (PDT) Received: by mail-it1-x12c.google.com with SMTP id w15so880532itc.0 for ; Wed, 20 Mar 2019 13:08:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=nF6vbHAIGBtbzZxLmLxnins9oJ+xUCo37ezMJVt+EdE=; b=KRkrBa++x3OxvtOthjxReKJ860Bwr08Iwil5SMIf2+BNaVWP222ApaVTXUq6tAVPwe SYl1CZ/SuJoqIK0GOYyeMabdfR2UMp1ihHvvL1gMX2GzmvQm3d6YtWy9Zjn0UGAp3X4b KrH60bJjiI0W6O+rXG8Up38TZhJxdBTWS0Cnj+tPJLoFMQioAx/tbLypHBOQJEgO5Cw5 vsePk2lz9TbkRF2LX7UsRNEZeDKHdFW4zPpjVF5B3CoUaJ7YC/F/SUfSkkWMMdV7zWGc S2ij+Y9Ti6j5DMhz8R9x32yII6ABxek2igE0eRdUCZlLq0gf3zK5robmU9QyDkUwndxu 5ucg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=nF6vbHAIGBtbzZxLmLxnins9oJ+xUCo37ezMJVt+EdE=; b=C6LwUVgWiqUantY+GTUBrXbjDXrEudJAZS/097XozusWkpUHxt05RxYV461C5mnef/ y+SR6kIwDcbLJKCuDolFYy0EQ2rDBEdg/VcGzTf7QDveL9Tjrm77fzKjdmBLgK3MJFiT 0Ht3+1vvrAknYfNBaIMFc1zDaOrlsJnyUG/Zr8p8wlPaClDnnOAUhWv8s8wuVJLElIdK yY+K3XjnixhXUL8EYuuB5GY3mE2FhCEFxyWg5rB53mQi60lnjnL2SUwiW71qsExyXFSI 16bnhNnAZrEG/5XMktZ4AAKqRmkEiDTuJuxGqHp2eFapjDlDLlJ7w2OqNClToRXsvvN9 VlOw== X-Gm-Message-State: APjAAAWopjZAwkgysIZmBWBVV9Jp8sE/66WO/C0ASRzkkegklkgTLQYu RDYDrMbvTVkGE90cpIFRxQUpeyZL6JNIbVikcXRLDQ== X-Google-Smtp-Source: APXvYqz1c73Jnlk+oLIFH1x7p79sX++76LJjTnLUkwsv2gVp6UoLa4NB0RyWQBuMn/XHNc2aCoFHDqUASNShob3JfV8= X-Received: by 2002:a05:660c:a18:: with SMTP id e24mr93791itk.129.1553112517889; Wed, 20 Mar 2019 13:08:37 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> In-Reply-To: From: Matthew Pounsett Date: Wed, 20 Mar 2019 16:08:26 -0400 Message-ID: To: Ted Hardie Cc: Paul Vixie , dnsop , DoH WG Content-Type: multipart/alternative; boundary="000000000000ecf05a05848c2f6e" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 20:08:43 -0000 --000000000000ecf05a05848c2f6e Content-Type: text/plain; charset="UTF-8" On Tue, 19 Mar 2019 at 13:45, Ted Hardie wrote: > >> I have a relationship with my users and I can control the configuration >> of their *known* applications. I do not have a relationship with the >> malware author that is trying to steal their data, and cannot control the >> configuration of that (unknown) application. By running DoT on my borders >> and blocking all other DNS and DoT traffic, I can provide privacy for my >> users while still preventing malware from doing its thing. >> > > As I said to Paul, I don't think you can if your only defense is blocking > DNS access. Coding a system to use a non-standard resolution protocol over > TLS is relatively easy; all the malware needs is a specific target to start > at. That target can be hard coded, derived from the output of a web > search, or produced by the output of an algorithm resident in the malware > and some system-available data (commonly the time). My apologies if I have > misunderstood your point here, but unless you also block all traffic for > which you have seen no resolution event, I believe that it is entirely > possible to circumvent the defense you describe. > I think you need to understand a bit of the history of malware development and the arms race to block it. Malware C&C started out at hard-coded IP addresses. They quickly realized this didn't work because going to a single address for your C&C is easily spotted, easily filtered, and easily taken down. So they moved to using domain names and DNS; they could change the IP addresses that their C&C domains resolved to very quickly, and move C&C around, avoiding takedown. After a while, the domain sales business got better at domain takedowns, and so malware developers moved from single domains to DGAs. Which is where we are today. Using a hard-coded endpoint for domain resolution, even if it's TLS encrypted, is as easily spotted and dealt with as using a single hard-coded endpoint for C&C.. it can be filtered as soon as the anomaly is detected. Using DGAs to bootstrap such hidden resolution systems has the same limitations as DGAs above. It's just adding an extra layer of abstraction, using identical systems, over the C&C in the first place. The fact that they are NOT doing this today, even in the face of domain reputation systems and RPZ feeds should tell you something. I'd bet any malware author who's though of doing what you suggest got at most a few dozen lines into writing the code, realized they were just reimplementing their existing C&C, and stopped. > > >> With DoH available at endpoints that my users want to reach using some >> other application, >> > > And this is the critique that is not of DoH as a protocol, but of a > specific deployment possibility. You've seen the Quad9 folks point and the > Chrome statement of their current deployment plans. The first said they > will not deploy DNS resources and other web resources on commingled hosts. > The second said that they will only use DoH after a probe reveals that it > is available *at the already configured DNS service*. This is entirely in > line with Section 3 of RFC 8484: > Quad9 and Chrome's current policies are no guarantee of their future policies, nor the policies of other major browser developers or web properties. I cannot assume a statement made by either organization is binding on the entire Internet. When have you ever seen the Internet writ large choose NOT to do a thing that was enabled by the technology? The protocol enables (and even encourages) the deployment possibility, so why shouldn't I expect it? As soon as DoH the protocol is in GA codebase of major web browsers there will immediately be enough uptake on DoH server operation to enable the thing operators are concerned about. And remember, the protocol is DESIGNED to inhibit interference by hiding resolution streams along side other, less easily blocked traffic. You seem to be making the argument here, "don't worry, you'll still be able to interfere with DoH resolution by clients you don't control." If so, that is disingenuous at best. > A DoH client MUST NOT use a different URI simply because it was > discovered outside of the client's configuration (such as through > HTTP/2 server push) or because a server offers an unsolicited > response that appears to be a valid answer to a DNS query. This > specification does not extend DNS resolution privileges to URIs that > are not recognized by the DoH client as configured URIs. > > > Browsers do not have an incentive to permit random websites to poison > their caches, so I strongly suspect that there will be no ability to pass a > resolution done in JavaScript down into the browser cache; my experience > during RTCWeb was that the browsers treated all downloaded JavaScript > applications as potentially malign. > As I (and others) have stated several times, browsers aren't the ultimate problem. They will be configurable and thus controllable, when they're cooperative. It's the uncooperative clients that are the problem, but they're going to be enabled by adoption by the browsers. > it is orders of magnitude more complex for me to block the malware while >> still allowing my users to reach those endpoints. Phrased another way, a >> DoH endpoint at the same IP address as a popular website gives malware the >> ability to resolve names I was previously able to prevent. >> > > In the RFC 8484 terms, this is a DoH server. For this threat to be real, > there is an additional requirement: the DoH server at the popular website > must also be trusted by the application as a source of DNS data. For the > ones you configure, this remains in your control. For JavaScript > applications within browsers, see above. So this is probably the case only > for pure malware, which already has other circumventions available. > I wish you'd name those other circumventions. A large part of edge security these days is predicated on the ability to control malware's ability to resolve C&C names. > >> The only recourse I know of, if DoH is adopted, is to proxy all traffic >> toward that example site (including requiring me to engage in a MitM >> decryption attack on my users' web traffic) in order to continue to prevent >> that malware from circumventing network security. And because I can't >> predict which web sites will launch their own DoH endpoints, that means I >> need to proxy (and decrypt) all web traffic in order to maintain the same >> level of security I can today. >> >> Note that popular Web servers commingling DoH services should answer a > DNS query probe, so you will be able to tell readily if any of them choose > to do it. And, of course, you could respond by blocking the service rather > than with MitM; I suspect some would. > I can't afford to probe every IP address on the planet on a regular basis, and dynamically modify my blocking based on that. It's far, far less expensive to just automatically MitM all web traffic on my network, even though that is far more expensive than what I have to do today. --000000000000ecf05a05848c2f6e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, 19 Mar 2019 at 13:45, Ted Har= die <ted.ietf@gmail.com> wr= ote:

I h= ave a relationship with my users and I can control the configuration of the= ir *known* applications.=C2=A0 I do not have a relationship with the malwar= e author that is trying to steal their data, and cannot control the configu= ration of that (unknown) application.=C2=A0 By running DoT on my borders an= d blocking all other DNS and DoT traffic, I can provide privacy for my user= s while still preventing malware from doing its thing.=C2=A0

As I said to Paul, I don't think yo= u can if your only defense is blocking DNS access.=C2=A0 Coding a system to= use a non-standard resolution protocol over TLS is relatively easy; all th= e malware needs is a specific target to start at.=C2=A0 That target can be = hard coded, derived from the output of a web search, or produced by the out= put of an algorithm resident in the malware and some system-available data = (commonly the time).=C2=A0 My apologies if I have misunderstood your point = here, but unless you also block all traffic for which you have seen no reso= lution=20 event, I believe that it is entirely possible to circumvent the defense you= describe.

I think you ne= ed to understand a bit of the history of malware development and the arms r= ace to block it.

Malware C&C started out at ha= rd-coded IP addresses.=C2=A0 They quickly realized this didn't work bec= ause going to a single address for your C&C is easily spotted, easily f= iltered, and easily taken down.=C2=A0 So they moved to using domain names a= nd DNS; they could change the IP addresses that their C&C domains resol= ved to very quickly, and move C&C around, avoiding takedown.=C2=A0 Afte= r a while, the domain sales business got better at domain takedowns, and so= malware developers moved from single domains to DGAs.=C2=A0 Which is where= we are today.

Using a hard-coded endpoint for dom= ain resolution, even if it's TLS encrypted, is as easily spotted and de= alt with as using a single hard-coded endpoint for C&C.. it can be filt= ered as soon as the anomaly is detected.=C2=A0 Using DGAs to bootstrap such= hidden resolution systems has the same limitations as DGAs above.=C2=A0 It= 's just adding an extra layer of abstraction, using identical systems, = over the C&C in the first place.=C2=A0 The fact that they are NOT doing= this today, even in the face of domain reputation systems and RPZ feeds sh= ould tell you something.=C2=A0 I'd bet any malware author who's tho= ugh of doing what you suggest got at most a few dozen lines into writing th= e code, realized they were just reimplementing their existing C&C, and = stopped.
=C2=A0
=C2=A0
With DoH available at endpoints that my users want to reac= h using some other application,

And this is the critique that is not of DoH as a protocol, but of a = specific deployment possibility.=C2=A0 You've seen the Quad9 folks poin= t and the Chrome statement of their current deployment plans.=C2=A0 The fir= st said they will not deploy DNS resources and other web resources on commi= ngled hosts.=C2=A0 The second said that they will only use DoH after a prob= e reveals that it is available *at the already configured DNS service*.=C2= =A0 This is entirely in line with Section 3 of RFC 8484:
<= /blockquote>

Quad9 and Chrome's current policies are= no guarantee of their future policies, nor the policies of other major bro= wser developers or web properties.=C2=A0 I cannot assume a statement made b= y either organization is binding on the entire Internet.

When have you ever seen the Internet writ large choose NOT to do a t= hing that was enabled by the technology?=C2=A0 The protocol enables (and ev= en encourages) the deployment possibility, so why shouldn't I expect it= ?=C2=A0 As soon as DoH the protocol is in GA codebase of major web browsers= there will immediately be enough uptake on DoH server operation to enable = the thing operators are concerned about.=C2=A0 And remember, the protocol i= s DESIGNED to inhibit interference by hiding resolution streams along side = other, less easily blocked traffic.=C2=A0 You seem to be making the argumen= t here, "don't worry, you'll still be able to interfere with D= oH resolution by clients you don't control."=C2=A0 If so, that is = disingenuous at best.
   A DoH client MUST NOT use a different UR=
I simply because it was
   discovered outside of the client's configuration (such as through
   HTTP/2 server push) or because a server offers an unsolicited
   response that appears to be a valid answer to a DNS query.  This
   specification does not extend DNS resolution privileges to URIs that
   are not recognized by the DoH client as configured URIs.

Browsers do not have an incentive to permit random websites to poison= their caches, so I strongly suspect that there will be no ability to pass = a resolution done in JavaScript down into the browser cache; my experience = during RTCWeb was that the browsers treated all downloaded JavaScript appli= cations as potentially malign.

=
As I (and others) have stated several times, browsers aren't= the ultimate problem.=C2=A0 They will be configurable and thus controllabl= e, when they're cooperative.=C2=A0 It's the uncooperative clients t= hat are the problem, but they're going to be enabled by adoption by the= browsers.
=C2=A0
it is orders of magnitude more complex for me to block the malware = while still allowing my users to reach those endpoints.=C2=A0 Phrased anoth= er way, a DoH endpoint at the same IP address as a popular website gives ma= lware the ability to resolve names I was previously able to prevent.=C2=A0 =

In the RFC 8484 terms, t= his is a DoH server.=C2=A0 For this threat to be real, there is an addition= al requirement:=C2=A0=C2=A0 the DoH server at the popular website must also= be trusted by the application as a source of DNS data.=C2=A0 For the ones = you configure, this remains in your control.=C2=A0 For JavaScript applicati= ons within browsers, see above.=C2=A0 So this is probably the case only for= pure malware, which already has other circumventions available.=C2=A0
=

I wish you'd name th= ose other circumventions.=C2=A0 A large part of edge security these days is= predicated on the ability to control malware's ability to resolve C&am= p;C names.

=C2=A0
The only recourse I know of, if DoH is adopted, = is to proxy all traffic toward that example site (including requiring me to= engage in a MitM decryption attack on my users' web traffic) in order = to continue to prevent that malware from circumventing network security.=C2= =A0 And because I can't predict which web sites will launch their own D= oH endpoints, that means I need to proxy (and decrypt) all web traffic in o= rder to maintain the same level of security I can today.

Note that popular Web servers commingling D= oH services should answer a DNS query probe, so you will be able to tell re= adily if any of them choose to do it.=C2=A0 And, of course, you could respo= nd by blocking the service rather than with MitM; I suspect some would.

I can't afford to probe = every IP address on the planet on a regular basis, and dynamically modify m= y blocking based on that.=C2=A0 It's far, far less expensive to just au= tomatically MitM all web traffic on my network, even though that is far mor= e expensive than what I have to do today.
--000000000000ecf05a05848c2f6e-- From nobody Wed Mar 20 13:33:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16D821310F9; Wed, 20 Mar 2019 13:33:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mo1v-31FneQ7; Wed, 20 Mar 2019 13:33:11 -0700 (PDT) Received: from puck.nether.net (puck.nether.net [204.42.254.5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 362671310DC; Wed, 20 Mar 2019 13:33:11 -0700 (PDT) Received: from [IPv6:2607:fb90:7daf:af70:29fa:1a9f:2a8d:f180] (unknown [IPv6:2607:fb90:7daf:af70:29fa:1a9f:2a8d:f180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by puck.nether.net (Postfix) with ESMTPSA id A9FCB54099D; Wed, 20 Mar 2019 16:33:02 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Jared Mauch X-Mailer: iPhone Mail (16D57) In-Reply-To: Date: Wed, 20 Mar 2019 16:33:01 -0400 Cc: Ted Hardie , dnsop , DoH WG , Paul Vixie Content-Transfer-Encoding: quoted-printable Message-Id: <086B617A-797A-4436-A62B-5258C12F1087@puck.nether.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> To: Matthew Pounsett Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 20:33:13 -0000 It=E2=80=99s also about DLP and other related topics. There is a deep well h= ere we keep tiptoeing around. Some things are mitigated by enterprise certif= icates and others are far more tricky.=20 Doing this with DNS helps with that defense in depth. Removing that layer of= defense will increase risks on one side while decreasing them on the other.= =20 You also have a hard time telling employees why you have a MITM box and it r= educes your talent pool.=20 People here may not worry about it but the insurance carriers for the busine= sses do.=20 Sent from my iCar > On Mar 20, 2019, at 4:08 PM, Matthew Pounsett wrote: >=20 > I can't afford to probe every IP address on the planet on a regular basis,= and dynamically modify my blocking based on that. It's far, far less expen= sive to just automatically MitM all web traffic on my network, even though t= hat is far more expensive than what I have to do today. From nobody Wed Mar 20 13:33:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF2F61311C1 for ; Wed, 20 Mar 2019 13:33:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 84PnkmgvOTQR for ; Wed, 20 Mar 2019 13:33:29 -0700 (PDT) Received: from mail-it1-x12f.google.com (mail-it1-x12f.google.com [IPv6:2607:f8b0:4864:20::12f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 355C7131213 for ; Wed, 20 Mar 2019 13:33:29 -0700 (PDT) Received: by mail-it1-x12f.google.com with SMTP id w18so988463itj.4 for ; Wed, 20 Mar 2019 13:33:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=4vIfuXb8+/6apmytLwQgu3S5Vxd5Sh7NRO1JWyioBfk=; b=rpHJ3HdIAOkhJl8jGXm2fGxhptR+Lc41iolDPjgbRX7+BePqIZqfsje8VWUqYrm+eh l3wTNL5s0XsR2txf9GvT6/yeLRXriGlXO62K0O2EAEyiDGHMmrfqLRCmyjs5SoatA0Ml 4+5rg+MqztY+XYoPFjUJ9J5RrlSQaiYfxaXsumJjdolGmYoXPMFP71IX5cV2SvPSePVn mYO0kdTODRDGagNHymTZS/lW+mWJ81egrV+tsIEYMHwNPSus1HW8TB1wbfMWsrORoJvD F5L3KTzjV4NDD5TXOvoNBTPiH+C5ePrShgzG4YklbHhgx1lOfXxzIQKDsaR5vF20VTLY 7msg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=4vIfuXb8+/6apmytLwQgu3S5Vxd5Sh7NRO1JWyioBfk=; b=F3ZByVZOK0nD8X6tNWbDlMjI8pbCzevi2tkV/Zw92Xdn3p5nLIE9BeKBm3Gbqx0yxV prKwG2JDuoRJ9PccClpyajlg3YUFreo9TaG3o9YFMDTPXSkK97c5xaL5bD3FRVshFRf6 Tb+4AQOX+FKWolWyRB9EmzzT/kSHmJ30GJ5Gi0Ti9j8QDWYp1Gbt+h7b0FVAeuFx1y1c Xil5Y0oCRh5CX+FQe3Px5T5/pE+9lErPYIZ8wGwJb08TI75DfXSz3p9vAEngH15/+la+ kELVVPzZ9z70q2Ra5KLoSTs/92mmQR3pdhBy1tEacKrP1GxK0SIks8cBUV/JPTM1aIH2 RFCQ== X-Gm-Message-State: APjAAAVNN+grypjwFYAQVOV6Sr+9llopGZMAy9ZkPiKh0rqxio8CeYn4 S0CBil/KasyzEmqwsL7e40OHLhyB1sLyD+BvaQgNwA== X-Google-Smtp-Source: APXvYqzgtEsAze//lP7/YTKlxWymX30DNh1m9cDEAjSuxqJm3P6szNGbcgFQ7kIksSi8OgsIOTxZIAs+jslc8XAnM7w= X-Received: by 2002:a24:ba1a:: with SMTP id p26mr203317itf.150.1553114008201; Wed, 20 Mar 2019 13:33:28 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> In-Reply-To: <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> From: Matthew Pounsett Date: Wed, 20 Mar 2019 16:33:17 -0400 Message-ID: To: Joe Abley Cc: Jared Mauch , Ted Hardie , DoH WG , Brian Dickson , dnsop , paul vixie , Michael Sinatra , Stephen Farrell Content-Type: multipart/alternative; boundary="000000000000c16a3805848c8898" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 20:33:36 -0000 --000000000000c16a3805848c8898 Content-Type: text/plain; charset="UTF-8" On Wed, 20 Mar 2019 at 07:38, Joe Abley wrote: > [There is actually a proposal at the bottom of this e-mail. Bear with me.] > And it's a good proposal! > > Standardise this privacy mechanism, and specify (with reasoning) that it > should be implemented such that the existence of the channel (but not the > content) can be identified as distinct from other traffic by third parties. > Maybe specify use of a different port number, as was done with DoT. > I think this would alleviate most people's concerns... certainly it deals wth mine. I have difficulty believing it is acceptable to pro-DoH community though, considering the first of the two use-cases defined in the Introduction of RFC8484: "... preventing on-path devices from interfering with DNS operations..." I eagerly welcome the -bis document that removes this statement, and defines a new port number which DoH traffic SHOULD use. Those who choose to ignore that direction and create a covert channel using > port 443 instead will do so. Nothing much we can do to stop that today (I > guarantee it is already happening). The future is not really different. > Indeed. If everyone above-board is using port 5443 (to pull a number out of the air) for their DoH traffic, the below-board usage should be about as visible as any such usage is today. Of course when people shift the focus of the conversation from DoH in > general to resolverless DNS, and want to interleave DNS messages with HTML > and cat GIFs over the same HTTPS bundles, the pitchforks will need to come > out again. So keep them handy. > I don't actually own a pitchfork, but I'll keep my Woodsman's Pal sharp. :) > > --000000000000c16a3805848c8898 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, 20 Mar 2019 = at 07:38, Joe Abley <jabley@hopcou= nt.ca> wrote:
[There is actually a proposal at the bottom of this e-mail. Bear with = me.]

And it's a good proposal!
=C2=A0

Standardise this privacy mechanism, and specify (with reasoning) that it sh= ould be implemented such that the existence of the channel (but not the con= tent) can be identified as distinct from other traffic by third parties. Ma= ybe specify use of a different port number, as was done with DoT.

I think this would alleviate most people's c= oncerns... certainly it deals wth mine.=C2=A0 I have difficulty believing i= t is acceptable to pro-DoH community though, considering the first of the t= wo use-cases defined in the Introduction of RFC8484: "... preventing o= n-path devices from interfering with DNS operations..."

=
I eagerly welcome the -bis document that removes this statement,= and defines a new port number which DoH traffic SHOULD use.

=
Those who choose to= ignore that direction and create a covert channel using port 443 instead w= ill do so. Nothing much we can do to stop that today (I guarantee it is alr= eady happening). The future is not really different.
<= br>
Indeed.=C2=A0 If everyone above-board is using port 5443 (to = pull a number out of the air) for their DoH traffic, the below-board usage = should be about as visible as any such usage is today.

=
Of course when people shi= ft the focus of the conversation from DoH in general to resolverless DNS, a= nd want to interleave DNS messages with HTML and cat GIFs over the same HTT= PS bundles, the pitchforks will need to come out again. So keep them handy.=

I don't actually own a pitchfork, = but I'll keep my Woodsman's Pal sharp. :)

--000000000000c16a3805848c8898-- From nobody Wed Mar 20 15:05:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 555D8131202; Wed, 20 Mar 2019 15:05:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6M7rZ4gAUtde; Wed, 20 Mar 2019 15:05:51 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2193D131212; Wed, 20 Mar 2019 15:05:50 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id A57DC6A28D; Wed, 20 Mar 2019 23:05:48 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1553119548; bh=GT3dmf8EUT6UIhpNlv0E1ZP6OXeDG73i2sbUVDcTQ+k=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=Qvhbrzhk8fiz09glf/SgqzYCyXx5KS1VAZlKM/4G08wtSz0fMQU1s36jcZSRm/fgS 78K0dBQbbrHs/6fjz4MCSUX21vl3OMtgV27GOovMpoyncSA27a80slbPe7GbLbxXab iJ8OIDpo7RGyjVwwH97ZI1CIXA4x4tTZB3khgXKD1QGSEub6Jq5m5iudVA5uc7j/ME wOFpKzGYZcdzlWuwxhrwvHI15m92MmUD7mq+0YSnuKy1IKNOimonEdm2PgiVjh0ThL ErrRVClsPdLrxNBh6udcG9UqgNAmlFnu3DaFRtlK9JEFves1Es4WFm2qFz8zG1v7+N +gl3CJH8wX2bg== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 97D313C0294; Wed, 20 Mar 2019 23:05:48 +0100 (CET) Date: Wed, 20 Mar 2019 23:05:48 +0100 (CET) From: Vittorio Bertola To: Joe Abley Cc: DoH WG , dnsop Message-ID: <2145465817.5147.1553119548565@appsuite.open-xchange.com> In-Reply-To: <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Mar 2019 22:05:53 -0000 > Il 20 marzo 2019 alle 12.38 Joe Abley ha scritto: > > Seems to me that there's a middle ground within sight here. > > Standardise this privacy mechanism, and specify (with reasoning) that it should be implemented such that the existence of the channel (but not the content) can be identified as distinct from other traffic by third parties. Maybe specify use of a different port number, as was done with DoT. > > Those who choose to ignore that direction and create a covert channel using port 443 instead will do so. Nothing much we can do to stop that today (I guarantee it is already happening). The future is not really different. This is actually the recommendation in section 4.6 of my draft :-) And I agree, it looks like the only possible and reasonable compromise between the two viewpoints. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Thu Mar 21 01:10:07 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C1A3130F2C; Thu, 21 Mar 2019 01:09:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WA4iyAIhhY6v; Thu, 21 Mar 2019 01:09:49 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A2ACD130F3E; Thu, 21 Mar 2019 01:09:49 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 0F3BB6A25A; Thu, 21 Mar 2019 09:09:47 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1553155787; bh=x5aKzYJyQaNeev8Kn1OI/SDQdaiMJwmCatkT2xmCpEE=; h=Date:From:To:In-Reply-To:References:Subject:From; b=P0vhf2y37wFx9eDyFaTgsBBt4poY7YZQbfZSQHksAbLS0q7TcQOsTxq7gm4hWUS6c HVBeA52qEd0ZujE2lxiZhXZU8Acx6FAQFajJ6q2WH7VEWJKcVcbThQQfXD4a8yhvJQ VDR60fIOER2YjhYbzE4D20MJLb+9+crI1L9B8ig5EqpCNXDSpS4naHdjeaj189mvL/ 2WnH5dyvU5EtTeU+G2kniOTQjX7buWCWnwxMDUgQWutlOr9Y1lH6OjGvpO+bRFqefz 6Z0SoSjo81N2FjtmQtFruVnADLgvC+wUd3nsG9jzEooW1kzumTUPdvD7TMtXpB34Kr rAeK0Ou4TL0nA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 016D93C0292; Thu, 21 Mar 2019 09:09:47 +0100 (CET) Date: Thu, 21 Mar 2019 09:09:46 +0100 (CET) From: Vittorio Bertola To: Stephane Bortzmeyer , doh@ietf.org, dprive@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <664389125.5470.1553155786949@appsuite.open-xchange.com> In-Reply-To: <20190320072921.GA20969@laperouse.bortzmeyer.org> References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <20190320072921.GA20969@laperouse.bortzmeyer.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 08:09:53 -0000 > Il 20 marzo 2019 alle 8.29 Stephane Bortzmeyer ha scritto: > > I modified the title of the meeting > because > there is obviously no consensus on the problem or on the > agenda. Anyway, a room is reserved if people want to meet on > wednesday. Given that this is not going to happen in the doh session on Tuesday, perhaps the meeting on Wednesday could start with the presentation of the three drafts. If the meeting on Tuesday gets to some preliminary ideas on work to do, we could then work out some plans among those that want to contribute. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Thu Mar 21 08:14:08 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2DC5B13129F for ; Thu, 21 Mar 2019 08:13:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SKgSbYPnIPTL for ; Thu, 21 Mar 2019 08:13:45 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 76CD0131277 for ; Thu, 21 Mar 2019 08:13:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1553181219; x=2417094819; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=L9nyweo+trfFv8+NVc3YqgIzF37+ifehhRuKpv9mIh8=; b=PZun7h1IFYzgLKQNy31xD4l4h5FjvNidYviU9w9pfsJmT4v/zTyOrZdlmvr+zRmo gfuArnWTiIgrd8RipmUNSRficV+ueqNLf1hidLUVERrfIBq2R5tMTA3hL8rGeKEa olYphR9eMBBbyGrVljK4sxnyL2Yh0g+OlBRR7QUBpfJF0vDEPNlhnoQ+ERVwCgVI 3iUDhZgH86zYw7XaFxKcRnElB0B6W0ff3oGHApLzK8IUv9y5sJtwMyRHxl2mgD6c s9EmR/6eH00VNkTIe3X0MH1bnL0cu1KhC9oTwr9GLlOiPashuVElIeP1a+EW1dP5 ycDWe6us3vMsHkZOW0IdX9CmU23Py7h33omaeLef6aspzLBO1CcQDusjDSzTseFB 64yPy1G4CjZmOc6hG5eZ0UaguhmZctJnTfhlThTaexVRsIdwNrCbmd4jeOrMMNZp oU03uFpLkl78z7OsT0X+JvF+iZa0MPNFIzpiFkZB3rTbvbdPItUc0LuvOPkQnKKO Txcwtut0hiAZO4iRjm88KZZIR3sM2L5AON8EHUcIVQmt3p2O04ScpiOptjSo3Fvw ar1nHv5mTdGyQQvW0tlZkQlQ+HS+a17kFD/jD+8yly/gAQ0xQIOyg5gvyIVEo/WG KPQHOtdE6itacLQJg5LVTz+8FL/c5swoNdc8KlJSPI0=; X-AuditID: a2962c47-fbdff7000001abb1-cb-5c93aa23d2b6 Received: from COPDCEXC37.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 78.F4.43953.32AA39C5; Thu, 21 Mar 2019 09:13:39 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC37.cable.comcast.com (147.191.125.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Thu, 21 Mar 2019 11:13:37 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Thu, 21 Mar 2019 11:13:37 -0400 From: "Livingood, Jason" To: Vittorio Bertola , Stephane Bortzmeyer , "doh@ietf.org" , "dprive@ietf.org" , "dnsop@ietf.org" , "hrpc@irtf.org" Thread-Topic: [DNSOP] [Doh] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague Thread-Index: AQHU372YLgZ5aLHChEydQ8CdLT4r1KYWMdQA Date: Thu, 21 Mar 2019 15:13:37 +0000 Message-ID: <8D957B5B-6A6F-441C-BD9E-52A367753F95@cable.comcast.com> References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <20190320072921.GA20969@laperouse.bortzmeyer.org> <664389125.5470.1553155786949@appsuite.open-xchange.com> In-Reply-To: <664389125.5470.1553155786949@appsuite.open-xchange.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [96.114.156.7] Content-Type: text/plain; charset="utf-8" Content-ID: <4FC2C0D04271C34BA019934397BD233D@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrJKsWRmVeSWpSXmKPExsWSUDRnsq7yqskxBkvX6FlMWPiS0eLum8ss FtfuXmSzuHl3F5vFvM+PGC1+3f3B5MDmcWLZFVaPJUt+MnlM3niYzWPivw1MASxRDYw2JRlF qYklLqlpqXnFqXZcChjAJik1Lb8o1TWxKKcyKDUnNRG7MpDKlNSczLLUIn2sxuhjNSehiylj +d3TjAWfhCq2bnzE3sC4RaiLkYNDQsBEonmxaxcjF4eQwC4miTfTT7N1MXICOS1MEkt6IyES pxklJm/qYgRJsAmYSdxdeIUZJCEi0MAk8eLJTUaQScICuRJnOvlBakQE8iTOvVjDCmEbSbzY dh7MZhFQldg+ez4LiM0r4CJxaPNWJogFixkleroXgRVxCrhKHFh0D+wKRgExie+n1jCB2MwC 4hK3nswHsyUEBCSW7DnPDGGLSrx8/A+sV1RAX2LjpqNsEHEFiZ4J05lBbmMW0JRYv0sfYoyV xIcf86BGKkpM6X7IDnGPoMTJmU9YIFrFJQ4f2cE6gVFiFpLNsxAmzUIyaRaSSbOQTFrAyLqK kdfQzEjP0NRAz8REz9xwEyMwQS2apuO+g/HD+dhDjAIcjEo8vKHTJscIsSaWFVfmHmKU4GBW EuHdFQ0U4k1JrKxKLcqPLyrNSS0+xCjNwaIkzuviMylGSCA9sSQ1OzW1ILUIJsvEwSnVwCg1 /9T/mZGTGrl13lV5T/ThUFDd+niShe6EKypnX8pPXSq9bl9/aqH7xmKGtTZVfD9fmXjP0vO6 UWZatFreOsdyRb2sK8dl60ky1lnrL93wXf7qnofzL6XnwhfFAmznTVt6JnRy+5fpZ33/3Cqx DXtTmGoWH8zPXZ+zwF3rJt+rDy+6xUpqM5VYijMSDbWYi4oTAQsOpq1MAwAA Archived-At: Subject: Re: [Doh] [DNSOP] [hrpc] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 15:13:55 -0000 TGFzdCB3ZWVrIEkgZGlkIGEgZHJhZnQgYWdlbmRhIGF0IGh0dHBzOi8vZ2l0aHViLmNvbS9qbGl2 aW5nb29kL0lFVEYtMTA0LVNpZGVNdGcvYmxvYi9tYXN0ZXIvZHJhZnQtYWdlbmRhLnR4dCBidXQg dG8gc29tZSBleHRlbnQgbGFyZ2UgcGFydHMgbWF5IGhhdmUgYmVlbiBvdmVyY29tZSBieSBldmVu dHMgYW5kIG5lZWQgbWFqb3IgY2hhbmdlcy4gTWF5YmUgaXQgaXMgc3VmZmljaWVudCB0byBoYXZl IHRoZSB2YXJpb3VzIGRyYWZ0cyBwcmVzZW50ZWQgYW5kIGxldCBkaXNjdXNzaW9uIGZsb3cgZnJv bSB0aGF0PyBJdCBjb3VsZCBiZSBoZWxwZnVsIHRvIGhhdmUgYW4gSUFCIG9yIElFU0cgbWVtYmVy IGFzIGEgbW9kZXJhdG9yIG9mIHNvcnRzIHRvIGZhY2lsaXRhdGUuDQoNClBsZWFzZSBzdWdnZXN0 cyBjaGFuZ2VzIChvciBiZXR0ZXIgc3RpbGwsIGRvIHNvIHZpYSBHaXRIaWIpIC0gYW5kIG5vdGUg dGhpcyBpcyBub3QgYSBiaW5kaW5nIGFnZW5kYSAtIGp1c3QgYSBzdWdnZXN0aW9uIGZvciBvbmUg dG8gdHJ5IHRvIGhlbHAgYnJpbmcgdG9nZXRoZXIgYW4gaW50ZXJlc3RpbmcgZGlzY3Vzc2lvbi4N Cg0KSkwNCg0K77u/T24gMy8yMS8xOSwgNDoxMCBBTSwgIkROU09QIG9uIGJlaGFsZiBvZiBWaXR0 b3JpbyBCZXJ0b2xhIiA8ZG5zb3AtYm91bmNlc0BpZXRmLm9yZyBvbiBiZWhhbGYgb2Ygdml0dG9y aW8uYmVydG9sYT00MG9wZW4teGNoYW5nZS5jb21AZG1hcmMuaWV0Zi5vcmc+IHdyb3RlOg0KDQog ICAgPiBJbCAyMCBtYXJ6byAyMDE5IGFsbGUgOC4yOSBTdGVwaGFuZSBCb3J0em1leWVyIDxib3J0 em1leWVyQG5pYy5mcj4gaGEgc2NyaXR0bzoNCiAgICA+IA0KICAgID4gSSBtb2RpZmllZCB0aGUg dGl0bGUgb2YgdGhlIG1lZXRpbmcNCiAgICA+IDxodHRwczovL3RyYWMuaWV0Zi5vcmcvdHJhYy9p ZXRmL21lZXRpbmcvd2lraS8xMDRzaWRlbWVldGluZ3M+IGJlY2F1c2UNCiAgICA+IHRoZXJlIGlz IG9idmlvdXNseSBubyBjb25zZW5zdXMgb24gdGhlIHByb2JsZW0gb3Igb24gdGhlDQogICAgPiBh Z2VuZGEuIEFueXdheSwgYSByb29tIGlzIHJlc2VydmVkIGlmIHBlb3BsZSB3YW50IHRvIG1lZXQg b24NCiAgICA+IHdlZG5lc2RheS4NCiAgICANCiAgICBHaXZlbiB0aGF0IHRoaXMgaXMgbm90IGdv aW5nIHRvIGhhcHBlbiBpbiB0aGUgZG9oIHNlc3Npb24gb24gVHVlc2RheSwgcGVyaGFwcyB0aGUg bWVldGluZyBvbiBXZWRuZXNkYXkgY291bGQgc3RhcnQgd2l0aCB0aGUgcHJlc2VudGF0aW9uIG9m IHRoZSB0aHJlZSBkcmFmdHMuIElmIHRoZSBtZWV0aW5nIG9uIFR1ZXNkYXkgZ2V0cyB0byBzb21l IHByZWxpbWluYXJ5IGlkZWFzIG9uIHdvcmsgdG8gZG8sIHdlIGNvdWxkIHRoZW4gd29yayBvdXQg c29tZSBwbGFucyBhbW9uZyB0aG9zZSB0aGF0IHdhbnQgdG8gY29udHJpYnV0ZS4NCiAgICANCiAg ICBSZWdhcmRzLA0KICAgIC0tIA0KICAgIA0KICAgIFZpdHRvcmlvIEJlcnRvbGEgfCBIZWFkIG9m IFBvbGljeSAmIElubm92YXRpb24sIE9wZW4tWGNoYW5nZQ0KICAgIHZpdHRvcmlvLmJlcnRvbGFA b3Blbi14Y2hhbmdlLmNvbQ0KICAgIE9mZmljZSBAIFZpYSBUcmV2aXNvIDEyLCAxMDE0NCBUb3Jp bm8sIEl0YWx5DQogICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCiAgICBETlNPUCBtYWlsaW5nIGxpc3QNCiAgICBETlNPUEBpZXRmLm9yZw0K ICAgIGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZG5zb3ANCiAgICANCg0K From nobody Thu Mar 21 15:02:55 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9084C131235; Thu, 21 Mar 2019 15:02:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d8wIC0n0ZIAe; Thu, 21 Mar 2019 15:02:43 -0700 (PDT) Received: from mx2.cira.ca (mx2.cira.ca [192.228.22.117]) by ietfa.amsl.com (Postfix) with ESMTP id 97412131215; Thu, 21 Mar 2019 15:02:43 -0700 (PDT) X-Virus-Scanned: by SpamTitan at cira.ca Received: from CRP-EX16-02.CORP.CIRA.CA (10.2.36.121) by CRP-EX16-01.CORP.CIRA.CA (10.2.36.120) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.1531.3; Thu, 21 Mar 2019 18:02:42 -0400 Received: from CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7]) by CRP-EX16-02.CORP.CIRA.CA ([fe80::15c6:1482:4083:e9f7%13]) with mapi id 15.01.1531.010; Thu, 21 Mar 2019 18:02:42 -0400 From: Jacques Latour To: Ralf Weber , Ted Hardie CC: dnsop , DoH WG , Paul Vixie Thread-Topic: [DNSOP] [Doh] New I-D: draft-reid-doh-operator Thread-Index: AQHU2/tchOAebL7fmUqbjaqsfD9WBqYWqMgQ Date: Thu, 21 Mar 2019 22:02:42 +0000 Message-ID: <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> In-Reply-To: <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> Accept-Language: en-CA, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.16.4.56] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 22:02:46 -0000 UGx1cyEgDQpJcyBhbnlvbmUgbG9va2luZyBhdCBhZGRpbmcgRG9IIGFuZCBEb1Qgc2VydmVycyBh cyBwYXJ0IG9mIERIQ1AvU0xBQUM/ICBTbyB0aGUgbG9jYWwgcmVzb2x2ZXIgYW5kIGFwcHMgYW5k IGJyb3dzZXJzIGNhbiBnbyB0aGUgX2FwcHJvcHJpYXRlXyBuYW1lIHJlc29sdXRpb24gcmVzb3Vy Y2UocykgdXNpbmcgdGhlIHByb3RvY29sIG9mIGNob2ljZS4gVGhhdCB3b3VsZCBiZSBtdWNoIHNp bXBsZXIgZm9yIGRlZmF1bHQgY29uZmlndXJhdGlvbiBpbiBlbnRlcnByaXNlIGFuZCBJU1AuDQoN Cj5Gcm9tOiBETlNPUCA8ZG5zb3AtYm91bmNlc0BpZXRmLm9yZz4gT24gQmVoYWxmIE9mIFJhbGYg V2ViZXINCg0KPllvdSBjYW4gbm90IGdldCBvbiBhIG5ldHdvcmsgd2l0aCBhdCBsZWFzdCB0cnVz dGluZyBzb21lIG9mIGl0cyBpbmZyYXN0cnVjdHVyZSwgYmUNCj5pdCBTTEFBQyBvciBESENQICh3 aGljaCBCVFcgYm90aCBjYXJyeSBpbmZvcm1hdGlvbiBmb3IgRE5TIHJlc29sdmluZykuIFRoZQ0K PnF1ZXN0aW9uIGlzIHdoZXJlIHlvdSBkcmF3IHRoZSBsaW5lIGFuZCBJTUhPIEROUyBvciBuYW1l IHJlc29sdXRpb24gaXMgYSBiYXNpYw0KPm5ldHdvcmsgZnVuY3Rpb24gYW5kIG5vdCBhbiBhcHBs aWNhdGlvbiBzZXR0aW5nLg0KPg0K From nobody Thu Mar 21 15:29:29 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B1D2124BAA; Thu, 21 Mar 2019 15:29:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jjVRm5zHLCPL; Thu, 21 Mar 2019 15:29:25 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F84C124B16; Thu, 21 Mar 2019 15:29:24 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id k2so506041qtm.1; Thu, 21 Mar 2019 15:29:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AGPZD6eh8W23qH5JFcBXcsEPFu/xlURzHeTMV8SMZns=; b=oJeEJFHcq/3gkLt/xFKipsyBDscb0eFT7iuhiJwrHlqofnw8SikGp+MD10BM7LOJo0 mPAuDNMlrjUjhrW3GBdFsHcKJPF5/m7hOYvDZJI+KWYKKWlT21xX5Sce9wnAxxUOgQwM hD6jcwpGa2E6tjvn3LCZHOcN/7D65fGm2dTwb8natpRI683UOkoz8AG2oosOJ0cele+4 98Xdv2mdz7O4Qm7gbYA/mUBAR3UoQQozKdicTCzbNTvUCKEHpbUJOFqRS5WAKv7+3qij Sr9Fmy+R6jpla7To8MDE9mS0KapJUKr5Ma6Sfg+36sIpcD2ZIlGwhqPjSJud3GyVYzfk ypjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AGPZD6eh8W23qH5JFcBXcsEPFu/xlURzHeTMV8SMZns=; b=PzoEzP2BmsQlIKxfye5Ve+5ASP2ZoLCx+9HtlCFZ9ePV7bQ3TlFvf5hixzkj+mjeLk DADdqHnojP/7Y4VY2DsF983p6ZrRn6+/OCVECOnCgZvjty/YSJ/71SH/0KuOZPBemO/j w2nv+/CVUxSwzSjQaTQp2VJnk5EDEVt+FUUFCfZluzqrZKXc2p76xqT2uwPrRLyL0ygm EBgdke0twfxsoj3w0+v0KDJ7aYSQ8x/FCI20hgLFp1DMTfrhqBrDiPNELXNNTLYIR/Bz uqkEtaTZsAKp/0Cdq+bNb6ZDHj/KzPas59x9Hj437/YJRZry0jKl6+kXuDlaBHET0r92 doKg== X-Gm-Message-State: APjAAAXNJ/x1y+7bFeYnRiz6MRPQCTMZkOhjlRsf8ZHh8lrUr/TtMssT ObF/l6PwkSGu479YS7pu4F5H+zw46eNCtq/7mdg= X-Google-Smtp-Source: APXvYqxrt6G5OvoJK+uH1cSw0UQnDmcMb+WrJu0HpO1jGxFzx73XnglN93W1Wiqgg/YaFW4rt70OgOiAMKsBgmToEtE= X-Received: by 2002:ac8:1707:: with SMTP id w7mr5194975qtj.324.1553207364165; Thu, 21 Mar 2019 15:29:24 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> In-Reply-To: <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> From: Brian Dickson Date: Thu, 21 Mar 2019 15:29:12 -0700 Message-ID: To: Jacques Latour Cc: Ralf Weber , Ted Hardie , dnsop , DoH WG , Paul Vixie Content-Type: multipart/alternative; boundary="0000000000003425570584a24546" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 22:29:27 -0000 --0000000000003425570584a24546 Content-Type: text/plain; charset="UTF-8" On Thu, Mar 21, 2019 at 3:03 PM Jacques Latour wrote: > Plus! > Is anyone looking at adding DoH and DoT servers as part of DHCP/SLAAC? So > the local resolver and apps and browsers can go the _appropriate_ name > resolution resource(s) using the protocol of choice. That would be much > simpler for default configuration in enterprise and ISP. > > I think that is a good starting place for the side meeting discussion. However, I think a more expressive configuration might be needed, to actually provide information to clients for them to configure themselves and/or make decisions. E.g.: In DHCP, provide one or more of the following kinds of announcements or assertions: - ISP does not allow use of DoH to off-net providers (aka DoH:NONE) - ISP allows use of DoT to off-net providers (aka DoT:ANY) - ISP provides a DoT server which inspects DNS queries and/or answers, but does not record or export any information (aka DoT:,PRIVACY:YES) - ISP provides a DoH server which inspects DNS queries and/or answers, and records and exports per user data, keeping data for N days (aka DoH:, PRIVACY:NO, RECORD:N) - ISP provides validating DNSSEC UDP only (aka DNSUDP:, DNSSEC:VALIDATE) - ISP provides non-validating DNSSEC UDP, allows TSIG (aka DNSUDP:, DNSSEC:NOVALIDATE, TSIG:YES) - any other relevant stuff (DNS cookies, TCP stateful, all the newest and shiniest stuff.) - Then, a client could pick and choose among available options, based on some kind of pre-configured preferences, like REQUIRE:PRIVACY, PREFERENCE:DoT,DoH,DNSSEC,DNS, USE:TSIG, BLOCK:RECORD. I realize, expressiveness adds complexity. However, it does avoid assumptions and overloading. The main criteria is agreement on client vs server (i.e. standardize this stuff), and possibly also add the network as another party involved (for upstream transit ISP vs local ISP), if they have differing policies for allowing offsite/third-party DoH or DoT. Brian > >From: DNSOP On Behalf Of Ralf Weber > > >You can not get on a network with at least trusting some of its > infrastructure, be > >it SLAAC or DHCP (which BTW both carry information for DNS resolving). The > >question is where you draw the line and IMHO DNS or name resolution is a > basic > >network function and not an application setting. > > > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop > --0000000000003425570584a24546 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Thu, Mar 21, 2019 at 3:03 PM Jacqu= es Latour <Jacques.Latour@cira= .ca> wrote:
Plus!
Is anyone looking at adding DoH and DoT servers as part of DHCP/SLAAC?=C2= =A0 So the local resolver and apps and browsers can go the _appropriate_ na= me resolution resource(s) using the protocol of choice. That would be much = simpler for default configuration in enterprise and ISP.


I think that is a good starting place = for the side meeting discussion.

However, I think = a more expressive configuration might be needed, to actually provide inform= ation to clients for them to configure themselves and/or make decisions.
E.g.: In DHCP, provide one or more of the following kinds of announ= cements or assertions:
- ISP does not allow use of DoH to off-net= providers (aka DoH:NONE)
- ISP allows use of DoT to off-net prov= iders (aka DoT:ANY)
- ISP provides a DoT server which inspects DN= S queries and/or answers, but does not record or export any information (ak= a DoT:<IP>,PRIVACY:YES)
- ISP provides a DoH server which i= nspects DNS queries and/or answers, and records and exports per user data, = keeping data for N days (aka DoH:<IP>, PRIVACY:NO, RECORD:N)
- ISP provides validating DNSSEC UDP only (aka DNSUDP:<IP>, DNSSEC:= VALIDATE)
- ISP provides non-validating DNSSEC UDP, allows TSIG (= aka DNSUDP:<IP>, DNSSEC:NOVALIDATE, TSIG:YES)
- any other r= elevant stuff (DNS cookies, TCP stateful, all the newest and shiniest stuff= .)

- Then, a client could pick and choose among av= ailable options, based on some kind of pre-configured preferences, like REQ= UIRE:PRIVACY, PREFERENCE:DoT,DoH,DNSSEC,DNS, USE:TSIG, BLOCK:RECORD.
<= div>
I realize, expressiveness adds complexity. However, it d= oes avoid assumptions and overloading.

The main cr= iteria is agreement on client vs server (i.e. standardize this stuff), and = possibly also add the network as another party involved (for upstream trans= it ISP vs local ISP), if they have differing policies for allowing offsite/= third-party DoH or DoT.

Brian

=
=C2=A0
>From: DNSOP <dnsop-bounces@ietf.org> On Behalf Of Ralf Weber

>You can not get on a network with at least trusting some of its infrast= ructure, be
>it SLAAC or DHCP (which BTW both carry information for DNS resolving). = The
>question is where you draw the line and IMHO DNS or name resolution is = a basic
>network function and not an application setting.
>
_______________________________________________
DNSOP mailing list
DNSOP@ietf.org
https://www.ietf.org/mailman/listinfo/dnsop
--0000000000003425570584a24546-- From nobody Thu Mar 21 16:05:04 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8477C13125C; Thu, 21 Mar 2019 16:04:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N0JgPr05fAxO; Thu, 21 Mar 2019 16:04:52 -0700 (PDT) Received: from shaun.rfc1035.com (smtp.v6.rfc1035.com [IPv6:2001:4b10:100:7::25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3BC2213124A; Thu, 21 Mar 2019 16:04:52 -0700 (PDT) Received: from gromit.rfc1035.com (gromit.rfc1035.com [195.54.233.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by shaun.rfc1035.com (Postfix) with ESMTPSA id BCDC4242109D; Thu, 21 Mar 2019 23:04:49 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Jim Reid In-Reply-To: Date: Thu, 21 Mar 2019 23:04:49 +0000 Cc: DoH WG , dnsop WG Content-Transfer-Encoding: quoted-printable Message-Id: <0B61AFCD-00D1-4831-881E-FDA232AFC305@rfc1035.com> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> To: Brian Dickson X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 23:04:54 -0000 > On 21 Mar 2019, at 22:29, Brian Dickson = wrote: >=20 >> On Thu, Mar 21, 2019 at 3:03 PM Jacques Latour = wrote: >> Plus!=20 >> Is anyone looking at adding DoH and DoT servers as part of = DHCP/SLAAC? So the local resolver and apps and browsers can go the = _appropriate_ name resolution resource(s) using the protocol of choice. = That would be much simpler for default configuration in enterprise and = ISP. >=20 > I think that is a good starting place for the side meeting discussion. Nope. It could be a topic for *another* side meeting. But not the one that=E2=80= =99s under consideration here. That side discussion is supposed to be = about the contents of draft-reid-doh-operator, = draft-livingood-doh-implementation-risks-issues and maybe = draft-bertola-bcp-doh-clients. And what to do about those drafts. I=E2=80=99m not so sure a side meeting on DHCP/SLAAC for DoT/DoH = discovery is needed -- at least, not yet -- because there is a live = discovery draft and work item already in progress in the DoH WG. That = would seem to be the most appropriate place to first raise those issues.= From nobody Thu Mar 21 16:21:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C068F131284; Thu, 21 Mar 2019 16:21:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zKHBSC9303PC; Thu, 21 Mar 2019 16:21:32 -0700 (PDT) Received: from mail.hardakers.net (mail.hardakers.net [168.150.192.181]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8CD5913124A; Thu, 21 Mar 2019 16:21:32 -0700 (PDT) Received: from localhost (unknown [10.0.0.3]) by mail.hardakers.net (Postfix) with ESMTPA id E65E125ABF; Thu, 21 Mar 2019 16:21:31 -0700 (PDT) From: Wes Hardaker To: Vittorio Bertola Cc: Joe Abley , dnsop , DoH WG References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> Date: Thu, 21 Mar 2019 16:21:31 -0700 In-Reply-To: <2145465817.5147.1553119548565@appsuite.open-xchange.com> (Vittorio Bertola's message of "Wed, 20 Mar 2019 23:05:48 +0100 (CET)") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Mar 2019 23:21:35 -0000 Vittorio Bertola writes: > This is actually the recommendation in section 4.6 of my draft :-) And > I agree, it looks like the only possible and reasonable compromise > between the two viewpoints. Another way of stating the preference ordering: If DNS privacy is a goal, systems and applications SHOULD use DNS over TLS to encrypt traffic to their local resolver if possible (unless the system and application distrusts the local resolver infrastructure). Failing that, they MAY next use a DNS over TLS connection to a remote, potentially public, DNS resolver. Failing that, they MAY send DNS traffic over an HTTPS connection. This preserves privacy as desired while still optimizing local caching, round trip speeds, and falling back to the must tunneling only as needed. What no one has convinced me of (personally) is why applications should default to a single resolver over HTTPS at all times, regardless of where I am on the planet. -- Wes Hardaker USC/ISI From nobody Thu Mar 21 20:43:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 500E0130DC2 for ; Thu, 21 Mar 2019 20:43:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BmpHBR_0zpK1 for ; Thu, 21 Mar 2019 20:43:50 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 52755130E64 for ; Thu, 21 Mar 2019 20:43:50 -0700 (PDT) Received: from xsmtp31.mail2web.com ([168.144.250.234] helo=xsmtp11.mail2web.com) by mx128.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h7B5w-0011Vc-QT for doh@ietf.org; Fri, 22 Mar 2019 04:43:49 +0100 Received: from [10.5.2.17] (helo=xmail07.myhosting.com) by xsmtp11.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h7B2w-00043X-FO for doh@ietf.org; Thu, 21 Mar 2019 23:43:47 -0400 Received: (qmail 27108 invoked from network); 22 Mar 2019 03:40:36 -0000 Received: from unknown (HELO [26.250.239.147]) (Authenticated-user:_huitema@huitema.net@[172.56.30.8]) (envelope-sender ) by xmail07.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 22 Mar 2019 03:40:36 -0000 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Christian Huitema X-Mailer: iPhone Mail (16D57) In-Reply-To: Date: Fri, 22 Mar 2019 04:40:31 +0100 Cc: Vittorio Bertola , dnsop , DoH WG , Joe Abley Content-Transfer-Encoding: quoted-printable Message-Id: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> To: Wes Hardaker X-Originating-IP: 168.144.250.234 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.17) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5haVFYBcslj+yaxjmg2gcfx602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxQ6T5rHcDXTNHEfrrCXMGtkh5 mNm/WjPqhYqCeBiCKwwnRtk/d5gNfEtjtud5V8jpiaCVHNB1k1ihcHciE5ixJx/TBCf6oYXAWGet lavcAjD9ytQxIHf9lN5jjLJaPK8l4YBmPrqPoeRXD34azf1rYZv5uZUEePrXZkexHL9EC3AAJAfA 9MMVcQ9WVjD1q+Rbd9IPG/DQ2p+GU04sTuYFs91jhnM/Mbva2XLV/LIEzaKyLm0zESXAkIAT8ZKA DvsGI5uh86ZVnyOrYkLMWyEaRt9fxN2oReTDHAyOynaY0CmHJLVH4DfVNbPXJmiLfub/IRFsicyJ MEhQFtD8PLoiniWmsFByBoXAuCZEyg59LM/9rUJrEbVA84BZVscMTXpbpuxXJTL417vaJWq5kk+j cuidX4Ts4xdG+C13IyWeZaJu1FKs5TGF0HQNGKdqWSmvPwUimsNGvJJilSn4u6QSZPjekIloWmwS rmYcRUiwoI4s95DGoDQyh90npG6wuAU16Y3oZJdQ0WXQEIKhyt8GANo5bn0tFTz4SVUdCy2MVE6+ P+NMWgh0hdHFCOgNkMJ392PNDpgLsd6Ddd/s7VM53qJ/6IMS6dQ3kd+UR7sHsZfAMgFPp7+h3kLe NmBV53UGhP4LU6IC9lJiuxW4FU9fkezM77XYWrKxEfrWjonGLqxRXxKF5tPxTxfD0dMN+t5ZP6zO upSxHMPsAHfGhZAC/H/F9n7vBiJVyH1aslqSF4coR+PypV5Z5Sfz/IlJBgJ68rMgFGxC0xSok+fi i+Mknt40eTXlWiUAYdLmsJdAoPJHNvQfAjIDptXbNSradnS0Zqm0mOdPl1LeUTNmkYtBTuxv0/1e /nzlq13wYTxncOSJHdsd+cwIgRT6euCWiMrA+4FHNKsiy9wMVtQ6ai8zTQ== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 03:43:51 -0000 =20 > On Mar 22, 2019, at 12:21 AM, Wes Hardaker wrote: >=20 > If DNS privacy is a goal, systems and applications SHOULD use DNS over > TLS to encrypt traffic to their local resolver if possible (unless the > system and application distrusts the local resolver infrastructure). Maybe we should start by defining DNS Privacy. There are two issues: using a= n encrypted transport; and, using a DNS resolver trusted to respect the priv= acy of queries. Both are necessary. One without the other makes little sense= . Much of the debate is on the second point. One position is that users should= be forced to trust the DNS resolver provided by the local infrastructure. A= nother position is that users have the right to apply their own policy and d= ecide which server they will trust, based on some configuration. -- Christian Huitema=20= From nobody Thu Mar 21 20:47:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5755A130E74 for ; Thu, 21 Mar 2019 20:47:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2vvNh4o4tOe6 for ; Thu, 21 Mar 2019 20:47:24 -0700 (PDT) Received: from mx36-out10.antispamcloud.com (mx36-out10.antispamcloud.com [209.126.121.30]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3512E130E68 for ; Thu, 21 Mar 2019 20:47:24 -0700 (PDT) Received: from xsmtp06.mail2web.com ([168.144.250.232]) by mx120.antispamcloud.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.89) (envelope-from ) id 1h7B9O-00028d-7n for doh@ietf.org; Fri, 22 Mar 2019 04:47:23 +0100 Received: from [10.5.2.17] (helo=xmail07.myhosting.com) by xsmtp06.mail2web.com with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.63) (envelope-from ) id 1h7B9J-0001Jq-8q for doh@ietf.org; Thu, 21 Mar 2019 23:47:21 -0400 Received: (qmail 27108 invoked from network); 22 Mar 2019 03:40:36 -0000 Received: from unknown (HELO [26.250.239.147]) (Authenticated-user:_huitema@huitema.net@[172.56.30.8]) (envelope-sender ) by xmail07.myhosting.com (qmail-ldap-1.03) with ESMTPA for ; 22 Mar 2019 03:40:36 -0000 Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Christian Huitema X-Mailer: iPhone Mail (16D57) In-Reply-To: Date: Fri, 22 Mar 2019 04:40:31 +0100 Cc: Vittorio Bertola , dnsop , DoH WG , Joe Abley Content-Transfer-Encoding: quoted-printable Message-Id: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> To: Wes Hardaker X-Originating-IP: 168.144.250.232 X-Spampanel-Domain: xsmtpout.mail2web.com X-Spampanel-Username: 168.144.250.0/24 Authentication-Results: antispamcloud.com; auth=pass smtp.auth=168.144.250.0/24@xsmtpout.mail2web.com X-Spampanel-Outgoing-Class: unsure X-Spampanel-Outgoing-Evidence: Combined (0.17) X-Recommended-Action: accept X-Filter-ID: EX5BVjFpneJeBchSMxfU5haVFYBcslj+yaxjmg2gcfx602E9L7XzfQH6nu9C/Fh9KJzpNe6xgvOx q3u0UDjvO25BUjnzxeaqnrPDaA78u19VMZsRZacTbJPGp/MBC6BxKDbtKTycwpIyjTfj7DGo7Uh5 mNm/WjPqhYqCeBiCKwwnRtk/d5gNfEtjtud5V8jptWkCYvS5BDUmAxJakvbOoB/TBCf6oYXAWGet lavcAjD9ytQxIHf9lN5jjLJaPK8l4YBmPrqPoeRXD34azf1rYZv5uZUEePrXZkexHL9EC3AAJAfA 9MMVcQ9WVjD1q+Rbd9IPG/DQ2p+GU04sTuYFs91jhnM/Mbva2XLV/LIEzaKyLm0zESXAkIAT8ZKA DvsGI5uh86ZVnyOrYkLMWyEaRt9fxN2oReTDHAyOynaY0CmHJLVH4DfVNbPXJmiLfub/IRFsicyJ MEhQFtD8PLoiniWmsFByBoXAuCZEyg59LM/9rUJrEbVA84BZVscMTXpbpuxXJTL417vaJWq5kk+j cuidX4Ts4xdG+C13IyWeZaKWYsYFmUMMMXHueDlyb1p7PwUimsNGvJJilSn4u6QSZCMttaJigLaj HMdJe2xkYMos95DGoDQyh90npG6wuAU16Y3oZJdQ0WXQEIKhyt8GANo5bn0tFTz4SVUdCy2MVE6+ P+NMWgh0hdHFCOgNkMJ392PNDpgLsd6Ddd/s7VM53uY0TTxj2gGBZlqXYSmNS2/AMgFPp7+h3kLe NmBV53UGs9LBtWnbQQCqug66SzLS1O2DWhrCiTdXSO1TurwJQ8hRXxKF5tPxTxfD0dMN+t5ZP6zO upSxHMPsAHfGhZAC/ELfT40IeeXtXsko+FU3ueL7G3ch6MdB0XuALpEgtIRS9gE9qVUwhDs/Gbvv EKtxst40eTXlWiUAYdLmsJdAoPJHNvQfAjIDptXbNSradnS0Zqm0mOdPl1LeUTNmkYtBTuxv0/1e /nzlq13wYTxncOSJHdsd+cwIgRT6euCWiMrA+4FHNKsiy9wMVtQ6ai8zTQ== X-Report-Abuse-To: spam@quarantine9.antispamcloud.com Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 03:47:25 -0000 =20 > On Mar 22, 2019, at 12:21 AM, Wes Hardaker wrote: >=20 > If DNS privacy is a goal, systems and applications SHOULD use DNS over > TLS to encrypt traffic to their local resolver if possible (unless the > system and application distrusts the local resolver infrastructure). Maybe we should start by defining DNS Privacy. There are two issues: using a= n encrypted transport; and, using a DNS resolver trusted to respect the priv= acy of queries. Both are necessary. One without the other makes little sense= . Much of the debate is on the second point. One position is that users should= be forced to trust the DNS resolver provided by the local infrastructure. A= nother position is that users have the right to apply their own policy and d= ecide which server they will trust, based on some configuration. -- Christian Huitema=20= From nobody Fri Mar 22 00:53:27 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D84C4130EC0; Fri, 22 Mar 2019 00:53:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yXDGpJ8lv2Fg; Fri, 22 Mar 2019 00:53:24 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB9DE130EBF; Fri, 22 Mar 2019 00:53:23 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 507A56A31A; Fri, 22 Mar 2019 08:53:21 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1553241201; bh=BdbWdzpFsSxLv0hag4+1eqFybJyNuT/B12tdDJimlys=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=f+OD/v2HO9CHRE9LtpR9VwvkCPLHufhQZWDz9oiWyrHAwzoKMHz4Y/3jVoRq4vMMm QuhOgFzT4oUgonhVtupY+kxnfnY8KiACPtqoA1EYklGFcwSrmmnLXxFP7KYd10uiHY 2qEJAnx8x2Z8l0Qb+Ga+LGzzFOpXx2dXm45ykB5sypkR1jU9g7XI0o8b5i8KyVImXK k/Din/Ivlb6/vBhr6uow6uVm1MWTLQMJbSER0y3fKuvGFGP7Vbj6/aQ+J8QS68oZe3 73yB2lq7AzJJvt5UTvm1bqCLv1e9Wvn0EW0OnzvOIMvIjhemhNDSstgmX4KjDJFxkz 5e+pTpQoChWmw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 43DA73C0019; Fri, 22 Mar 2019 08:53:21 +0100 (CET) Date: Fri, 22 Mar 2019 08:53:20 +0100 (CET) From: Vittorio Bertola To: Christian Huitema , Wes Hardaker Cc: DoH WG , dnsop Message-ID: <1878722055.8877.1553241201213@appsuite.open-xchange.com> In-Reply-To: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 07:53:26 -0000 > Il 22 marzo 2019 alle 4.40 Christian Huitema ha scritto: > > Much of the debate is on the second point. One position is that users should be forced to trust the DNS resolver provided by the local infrastructure. Another position is that users have the right to apply their own policy and decide which server they will trust, based on some configuration. I think this is a mischaracterization of the debate, which actually started because of a third position that you don't mention: Mozilla's public statement that in the future they will force (or, at least, make as a default - clarification requests haven't solved the doubt yet) Firefox users to use a remote resolver chosen within a shortlist that they will manage. There are some people advocating that in some cases people should have to use the local resolver so that the local network can monitor them and apply policies, but that's always been limited to private / corporate / high security networks. I don't think anyone has ever proposed that all users be always required to use a local resolver, full stop; though, if DoH deployment continues this way, I do see some governments - even in Europe - trying to go in that direction, either by mandating the use of in-country resolvers or by passing GDPR-style legislation that requires any global operator to apply national DNS policies when serving their citizen, or be fined for 4% of their revenues. In the end, I think that everyone should agree on the principle of user choice (which is actually the first recommendation in my draft). There will then be some discussion on whether the local resolver should continue being the silent default or not; though I note that the opposite policy, i.e. letting each application pick its own default resolver, creates a fragmented mess of a network and makes it much harder for the user to implement any practical choice. But anything different than "users are fully in charge as far as they want" is IMHO dangerous and unmanageable. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy From nobody Fri Mar 22 01:34:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EAD54130EC0 for ; Fri, 22 Mar 2019 01:34:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZwR-npqUfV6y for ; Fri, 22 Mar 2019 01:34:34 -0700 (PDT) Received: from mail-lj1-x22c.google.com (mail-lj1-x22c.google.com [IPv6:2a00:1450:4864:20::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9CE7E130E8F for ; Fri, 22 Mar 2019 01:34:33 -0700 (PDT) Received: by mail-lj1-x22c.google.com with SMTP id z26so1266470lja.13 for ; Fri, 22 Mar 2019 01:34:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=17Ugb29d1M2xFYMYOcTR5g9cJVOPQBjOkkf26NvyOlM=; b=MrfCqEVzqDWFYROL5kB9P09rex7sU8erxNdLCUh/J3J0B/dB1dmysRnQ2zhG6bnYgC T47zl0MYVyqFUyhoCoj2SQOvIbD71NE9CNm27rGmHBCu34cd9woWjnIoP8bsWZG7TzG2 RUbBmVgy7qXlO1fqE97ado48PI2PEFgu2sUGTN2G+76gGn3Mp33y2Rbp+gv9w3AGoUDv pdVf4+eplIvsoucjjDst1utaFLr8syx69Hkz0BkSlzFo9PPaE7hTIck4+higsxyWair2 O+yXsaUY020pRC1xkixQptSGtNCLR9bbl94TPGNCLFw+ArgsbF/dxN6bkzdznoc94P9F I5tw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=17Ugb29d1M2xFYMYOcTR5g9cJVOPQBjOkkf26NvyOlM=; b=De9b8L6bExZLUVMS+NuD2hUk+cbfTVhcHB8O9RCnxc6IbV4Y5SZ1vN5oTtd32v1VTS kyy6IFcHJ56arWr2Na3cp5D17bX71HUATsFW7pm8T4hfgCB/tcCtPuV5QbQRWTSjxPdA Rqo5gc2igePA76zUb/+7D42PolJd7SNNEfwvanvoUjDKPSIpoOn77b1bOOS5rqwpUdr+ 47dty+zcTalIWQKPkDAGfOzq2aRa9MlkVji+ncDFZR7bKZBs10lPdy3GlBvfLMvXdXGm vdfHXfFFo74BnuZucKsJf9lg5FOwQlGloLcQyIXAgEydBwnETEBWbihAERnwliu4PQUV WoRQ== X-Gm-Message-State: APjAAAWR14NUTclicb4PQtCbSwwoGpaMyQmYOt3UK013OoB9VCSI3MhI VQwLXgI7b1taljsv1YXKKPc187R02EadHyj8yW6X+g== X-Google-Smtp-Source: APXvYqxtWj0IxmwPC3U4p5fmd9/lLbY1JRmRKoZ02m2OhDk30VuU1UWyVKwtWqW+Wl8CqdVjG1MuOX86ZOqtmmXbtU8= X-Received: by 2002:a2e:8e8e:: with SMTP id z14mr4437759ljk.86.1553243671780; Fri, 22 Mar 2019 01:34:31 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> In-Reply-To: <1878722055.8877.1553241201213@appsuite.open-xchange.com> From: Eric Rescorla Date: Fri, 22 Mar 2019 01:33:42 -0700 Message-ID: To: Vittorio Bertola Cc: Christian Huitema , Wes Hardaker , dnsop , DoH WG Content-Type: multipart/alternative; boundary="0000000000004e76ae0584aab92f" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 08:34:37 -0000 --0000000000004e76ae0584aab92f Content-Type: text/plain; charset="UTF-8" On Fri, Mar 22, 2019 at 12:53 AM Vittorio Bertola wrote: > > > > Il 22 marzo 2019 alle 4.40 Christian Huitema ha > scritto: > > > > Much of the debate is on the second point. One position is that users > should be forced to trust the DNS resolver provided by the local > infrastructure. Another position is that users have the right to apply > their own policy and decide which server they will trust, based on some > configuration. > > I think this is a mischaracterization of the debate, which actually > started because of a third position that you don't mention: Mozilla's > public statement that in the future they will force (or, at least, make as > a default - clarification requests haven't solved the doubt yet) Firefox > users to use a remote resolver chosen within a shortlist that they will > manage. > I'm not sure where you have attempted to clarify this point (I think we've been clear on this point at https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/) Regardless of what the default is, users will be able to disable DoH. -Ekr --0000000000004e76ae0584aab92f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Fri, Mar 22, 2019 at 12:53 AM Vittorio Be= rtola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:


> Il 22 marzo 2019 alle 4.40 Christian Huitema <huitema@huitema.net> ha scritto:=
>
> Much of the debate is on the second point. One position is that users = should be forced to trust the DNS resolver provided by the local infrastruc= ture. Another position is that users have the right to apply their own poli= cy and decide which server they will trust, based on some configuration.
I think this is a mischaracterization of the debate, which actually started= because of a third position that you don't mention: Mozilla's publ= ic statement that in the future they will force (or, at least, make as a de= fault - clarification requests haven't solved the doubt yet) Firefox us= ers to use a remote resolver chosen within a shortlist that they will manag= e.

I'm not sure where you have atte= mpted to clarify this point (I think we've been clear on this point at<= br>

Regardless of what the default = is, users will be able to disable DoH.

-Ekr
<= div>



--0000000000004e76ae0584aab92f-- From nobody Fri Mar 22 01:48:39 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1D615130EB2; Fri, 22 Mar 2019 01:48:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.011 X-Spam-Level: X-Spam-Status: No, score=-0.011 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=1.989, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsLyew_VII3y; Fri, 22 Mar 2019 01:48:26 -0700 (PDT) Received: from EUR02-HE1-obe.outbound.protection.outlook.com (mail-eopbgr10049.outbound.protection.outlook.com [40.107.1.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DAF52130EA7; Fri, 22 Mar 2019 01:48:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=VE/J6AxBwxnEk2JWddAF3YsQv5EbiOeBQzj7Q7H+XNE=; b=oN5ExT1t1WOFjzhrNzHnrOfO+d4cyqs8kKyIXey0dJFC5yiX6a4IbO6IWTaraJxJhwSugkGX4t0sFs35xYmmttWAM2tOMwAobTpzBPs7/FuDsn6OcmIZTOcFsp4zDbVIqsBL05ZwJVY/dCH19OxbDXUEhsl/pPzWx8wMh4Gky6k= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2597.eurprd06.prod.outlook.com (10.168.82.17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.15; Fri, 22 Mar 2019 08:48:20 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93%9]) with mapi id 15.20.1709.015; Fri, 22 Mar 2019 08:48:20 +0000 From: "Winfield, Alister" To: Eric Rescorla , Vittorio Bertola CC: dnsop , DoH WG , Christian Huitema , Wes Hardaker Thread-Topic: [EXTERNAL] Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator Thread-Index: AQHU4IRg+Zji0SyE5Eu6wgblhrZKkaYXUuAAgAAA+U8= Date: Fri, 22 Mar 2019 08:48:20 +0000 Message-ID: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com>, In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [40.67.250.1] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5bbfe9fb-dadc-4eb0-461c-08d6aea322f6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2597; x-ms-traffictypediagnostic: DB6PR0601MB2597: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-forefront-prvs: 09840A4839 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(366004)(39860400002)(136003)(376002)(346002)(199004)(189003)(106356001)(6436002)(74316002)(110136005)(7736002)(54906003)(105586002)(81166006)(81156014)(486006)(93886005)(8676002)(25786009)(71200400001)(6246003)(8936002)(316002)(5660300002)(52536014)(14444005)(5024004)(256004)(66066001)(606006)(236005)(71190400001)(54896002)(6306002)(9686003)(53936002)(55016002)(229853002)(4326008)(68736007)(97736004)(99286004)(33656002)(76176011)(7696005)(102836004)(74482002)(6506007)(53546011)(446003)(966005)(72206003)(476003)(478600001)(14454004)(26005)(3846002)(6116002)(11346002)(186003)(86362001)(2906002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2597; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: WQZfvOu0GV+3b1w/5H2NhaesZpRaoxHcJwPApDtBaho6q8TDbPGhS3QwuZOlLbdVfq/7pDm1cl6VAz0kkSxEjDogVDX3u5EKBkX/SqDo8wvpU4JIk5Q1UJYOp0UB7Ab1g/eiCIpE4qvQnw5FF1/o27NhYZ4YCufe+auHHc3YSpfezkoEsIVNwvnlkkAZ5EO4rceul2GGCQGirCMEqLDLUlNAyxMfzc0gd4uF1nh/NgPcPKzxoL/KEpq7pCafUsfPhNQyoyhmCd8nQpl2kxg+MsG4ANIztJfuRM1bsv7dm6X3bQxs3itBGBHD1L1Whzw74v/82wbA8UztJtdFqinf4yXNv20EtxjTsjyDaNTlAZIhEbMgp4B8t0SASfa3mYZkYMfwHB1Z2lQR+E1s8wWoOSc3kqsZMUQVNaFfIwMao1Q= Content-Type: multipart/alternative; boundary="_000_DB6PR0601MB2184191A75F8E5BF0E8DD346E3430DB6PR0601MB2184_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 5bbfe9fb-dadc-4eb0-461c-08d6aea322f6 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Mar 2019 08:48:20.8330 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2597 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 08:48:31 -0000 --_000_DB6PR0601MB2184191A75F8E5BF0E8DD346E3430DB6PR0601MB2184_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I have to say it but almost certainly Ill stop using any software that chos= es at any point to silently choose what I mean by the word privacy. (using = a large scale American provider fior doh example). This is simple you allow= choice but that choice MUST be both visible and explicit on what the choic= e means in terms of how it affects privacy. No lies and half truths and no = defaults changing the risks I know about. Note, I guarantee certain US organisations are loving the idea that large p= ercentages of worldwide DNS might go to a small number of American companie= s. Those companies will be receiving little letters and they WILL be forced= to silently comply. Oh and in the general case did anyone weigh up total privacy. That is does = this decrease security by removing visibility of bad things such that the l= ikelihood of data breaches and thus privacy invasion is in total far worse = than it was before creating the DoH protocol? Alister ________________________________ From: Doh on behalf of Eric Rescorla Sent: Friday, March 22, 2019 8:35 am To: Vittorio Bertola Cc: dnsop; DoH WG; Christian Huitema; Wes Hardaker Subject: [EXTERNAL] Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator On Fri, Mar 22, 2019 at 12:53 AM Vittorio Bertola > wro= te: > Il 22 marzo 2019 alle 4.40 Christian Huitema > ha scritto: > > Much of the debate is on the second point. One position is that users sho= uld be forced to trust the DNS resolver provided by the local infrastructur= e. Another position is that users have the right to apply their own policy = and decide which server they will trust, based on some configuration. I think this is a mischaracterization of the debate, which actually started= because of a third position that you don't mention: Mozilla's public state= ment that in the future they will force (or, at least, make as a default - = clarification requests haven't solved the doubt yet) Firefox users to use a= remote resolver chosen within a shortlist that they will manage. I'm not sure where you have attempted to clarify this point (I think we've = been clear on this point at https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/) Regardless of what the default is, users will be able to disable DoH. -Ekr -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or cl= ick links from an unknown or suspicious origin. Phishing attempts can be re= ported by sending them to phishing@sky.uk as attachments. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, conf= idential and is intended exclusively for the addressee. The views expressed= may not be official policy, but the personal views of the originator. If y= ou have received it in error, please notify the sender by return e-mail and= delete it from your system. You should not reproduce, distribute, store, r= etransmit, use or disclose its contents to anyone. Please note we reserve t= he right to monitor all e-mail communication through our internal and exter= nal networks. SKY and the SKY marks are trademarks of Sky Limited and Sky I= nternational AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Reg= istration No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indire= ct subsidiaries of Sky Limited (Registration No. 2247735). All of the compa= nies mentioned in this paragraph are incorporated in England and Wales and = share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD --_000_DB6PR0601MB2184191A75F8E5BF0E8DD346E3430DB6PR0601MB2184_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable
I have to say it but almost certainly Ill st= op using any software that choses at any point to silently choose what I me= an by the word privacy. (using a large scale American provider fior doh exa= mple). This is simple you allow choice but that choice MUST be both visible and explicit on what the choice means= in terms of how it affects privacy. No lies and half truths and no default= s changing the risks I know about.

Note, I guarantee certain US organisations a= re loving the idea that large percentages of worldwide DNS might go to a sm= all number of American companies. Those companies will be receiving little = letters and they WILL be forced to silently comply.

Oh and in the general case did anyone weigh = up total privacy. That is does this decrease security by removing visibilit= y of bad things such that the likelihood of data breaches and thus privacy = invasion is in total far worse than it was before creating the DoH protocol?

Alister

 
From: Doh= <doh-bounces@ietf.org> on behalf of Eric Rescorla <ekr@rtfm.com&g= t;
Sent: Friday, March 22, 2019 8:35 am
To: Vittorio Bertola
Cc: dnsop; DoH WG; Christian Huitema; Wes Hardaker
Subject: [EXTERNAL] Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operat= or
 


On Fri, Mar 22, 2019 at 12:53 AM Vitt= orio Bertola <vittorio.bertola=3D40open-xchange.com@dmarc.ietf.org> wrote:


> Il 22 marzo 2019 alle 4.40 Christian Huitema <huitema@huitema.net> ha scritto:=
>
> Much of the debate is on the second point. One position is that users = should be forced to trust the DNS resolver provided by the local infrastruc= ture. Another position is that users have the right to apply their own poli= cy and decide which server they will trust, based on some configuration.

I think this is a mischaracterization of the debate, which actually started= because of a third position that you don't mention: Mozilla's public state= ment that in the future they will force (or, at least, make as a default - = clarification requests haven't solved the doubt yet) Firefox users to use a remote resolver chosen within a shor= tlist that they will manage.

I'm not sure where you have attempted to clarify this point (I think w= e've been clear on this point at

Regardless of what the default is, users will be able to disable DoH.<= /div>

-Ekr




-------------------------------= -------------------------------------

This email is from an external = source. Please do not open attachments or click links from an unknown or su= spicious origin. Phishing attempts can be reported by sending them to phishing@sky.uk as attachments. Thank you

-------------------------------= -------------------------------------

 

Information in this email including any attachments may be privileged, conf= idential and is intended exclusively for the addressee. The views expressed= may not be official policy, but the personal views of the originator. If y= ou have received it in error, please notify the sender by return e-mail and delete it from your system. You sho= uld not reproduce, distribute, store, retransmit, use or disclose its conte= nts to anyone. Please note we reserve the right to monitor all e-mail commu= nication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and= Sky International AG and are used under licence.

Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Reg= istration No. 2067075), Sky Subscribers Services Limited (Registration No. = 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indire= ct subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorpo= rated in England and Wales and share the same registered office at Grant Wa= y, Isleworth, Middlesex TW7 5QD --_000_DB6PR0601MB2184191A75F8E5BF0E8DD346E3430DB6PR0601MB2184_-- From nobody Fri Mar 22 02:14:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 12FD8130EC9; Fri, 22 Mar 2019 02:14:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R-7mROWWPv53; Fri, 22 Mar 2019 02:14:37 -0700 (PDT) Received: from bizet.nethelp.no (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by ietfa.amsl.com (Postfix) with ESMTP id 42A95130EC1; Fri, 22 Mar 2019 02:14:37 -0700 (PDT) Received: from localhost (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by bizet.nethelp.no (Postfix) with ESMTP id AD2DBE607B; Fri, 22 Mar 2019 10:14:34 +0100 (CET) Date: Fri, 22 Mar 2019 10:14:34 +0100 (CET) Message-Id: <20190322.101434.307385973.sthaug@nethelp.no> To: Eric Rescorla Cc: vittorio.bertola=40open-xchange.com@dmarc.ietf.org, dnsop@ietf.org, doh@ietf.org, huitema@huitema.net, wjhns1@hardakers.net From: sthaug@nethelp.no In-Reply-To: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> X-Mailer: Mew version 6.7 on Emacs 26 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 09:14:40 -0000 >> I think this is a mischaracterization of the debate, which actually >> started because of a third position that you don't mention: Mozilla's >> public statement that in the future they will force (or, at least, make as >> a default - clarification requests haven't solved the doubt yet) Firefox >> users to use a remote resolver chosen within a shortlist that they will >> manage. >> > > I'm not sure where you have attempted to clarify this point (I think we've > been clear on this point at > https://hacks.mozilla.org/2018/05/a-cartoon-intro-to-dns-over-https/) Unfortunately this is not clear at all. The web page at the link above says: "We'd like to turn this on as the default for all of our users.". Combined with the remaining text on the web page, the only conclusions I can draw is that - Mozilla would like to turn on DoH by default, invisible to the user (the user gets this configuration without making a choice). - When DoH is turned on, by default Cloudflare will be used as the DoH provider. If these conclusions are correct they are precisely why some of us find the Mozilla/Firefox stance completely unacceptable. If these are *not* the conclusions we should draw about Firefox and Mozilla's plans, you badly need to update the web page on the link above. You could also at the same time clarify whether Firefox will use DoH resolvers that are on the same IP addresses as other non-DoH content. Steinar Haug, AS2116 From nobody Fri Mar 22 02:15:18 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D90F8130F1D for ; Fri, 22 Mar 2019 02:15:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nsYF7i1O8FPX for ; Fri, 22 Mar 2019 02:15:01 -0700 (PDT) Received: from mail-lj1-x231.google.com (mail-lj1-x231.google.com [IPv6:2a00:1450:4864:20::231]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1453130EE4 for ; Fri, 22 Mar 2019 02:14:59 -0700 (PDT) Received: by mail-lj1-x231.google.com with SMTP id v22so1382859lje.9 for ; Fri, 22 Mar 2019 02:14:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=GD2lkNM99MujQzmkJAfJNfmhva4zrEXjIQBRnbP4DXI=; b=QYnOqNjpTm8Unh9lDtoit6nC/AhFgRz/ieUb0Q5esGNWB5c26msNJnfh8h4lqrhNC/ Rq0r9zX1GwTUKfMQl4EuKct60CJ5usx8Rwt0o1XNBLGGiWGmj1nwvIyWRcxhNDUWdU5/ 3z6MwKjJpRX8I+xcxwwo3b+XHqZXl6w1RRgHY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=GD2lkNM99MujQzmkJAfJNfmhva4zrEXjIQBRnbP4DXI=; b=TbC4qTPiFo4GrbxsGLtF1CzplmI9du9VwuYO/mB3zfZGkh7pyQ4wAtyfPUidQ6dfiS h+xdx3dyLZ3iqoCFnBFCHcidKS3jY9i9WlBUBIyHLX//CRb48YcC4jf+Q+f+1POMTegx jWZ6BFK+FCIj8SIafnD3P6ca6toNIY655an/20CTwX1weiPQnP8375Q+1yg0nmSESo7H /kURmK8pUgc5srUtezuD7vGlVNnd1+fA3yKAHZwe6iesKgnvfDsPR5O+fVu3Q0XlREv7 tWHNK/JpREyczcbU45WaqFpBZqu5u/RRV2aoNbfu5mCqoZ4WGU3D0YB/Y8kh57txTaEe 9agA== X-Gm-Message-State: APjAAAXZ071wdf90nXc70zD9OhMnn8RPXC6pHcotxpZpfyjQ6sXlh/1r 43CtVVKqZ6ZHnLR7zGaoWx9DVrggZ2/R3jImkO0oEg== X-Google-Smtp-Source: APXvYqy5UmMNu6YTT/KxosjkXdTydp7NVmmBzU6YDamghrlJgROMy746sX3rCYQSQ/7dV/QXdxWrebbWMf9rfU+PJvw= X-Received: by 2002:a2e:9a91:: with SMTP id p17mr4345471lji.127.1553246097869; Fri, 22 Mar 2019 02:14:57 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Fri, 22 Mar 2019 02:14:56 -0700 From: Joe Abley Mime-Version: 1.0 (1.0) References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> In-Reply-To: Date: Fri, 22 Mar 2019 02:14:56 -0700 Message-ID: To: "Winfield, Alister" Cc: Eric Rescorla , Vittorio Bertola , dnsop , DoH WG , Christian Huitema , Wes Hardaker Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 09:15:11 -0000 On Mar 22, 2019, at 09:48, Winfield, Alister wrote: > Note, I guarantee certain US organisations are loving the idea that large percentages of worldwide DNS might go to a small number of American companies. I hate to break it to you, but between a tenth and a fifth of worldwide DNS resolver traffic already goes to a small number of American companies. There are countries where the proportion is closer to 100%. I think we should try to take the geopolitics out of the discussions in this venue. None of us live in or identify with a country whose government is perfect. By all means let's consider the merits of informed choice by sophisticated end users who have concerns about privacy jurisdictions, but attaching national identity to sides of the discussion is just a path to jingoism. Joe From nobody Fri Mar 22 03:15:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE485130DE7; Fri, 22 Mar 2019 03:15:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NZ-f59Pcdyjx; Fri, 22 Mar 2019 03:15:27 -0700 (PDT) Received: from EUR02-AM5-obe.outbound.protection.outlook.com (mail-eopbgr00052.outbound.protection.outlook.com [40.107.0.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A80E1277CE; Fri, 22 Mar 2019 03:15:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=HxVBawOSphV6gw0FQy193+CJyd9FujnQxLyeUxQaA0M=; b=YmfQbXNZpPSZmWBoKXs80T6zIZjMz6NC2LU/uszqYw9p4MSyAz/8sO8DPMBjfdRgeP1HQr69F0Y/CbeI1ujqK7geDF9oVnXVFJzcHcGRfHNR8DDPI+LDsKcH/5z70FkN4yOjTAnyEUJfnLIv5ozfQlEdWceLvcaJa2IbjwfpMiE= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2600.eurprd06.prod.outlook.com (10.168.81.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.18; Fri, 22 Mar 2019 10:15:24 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93%9]) with mapi id 15.20.1709.015; Fri, 22 Mar 2019 10:15:24 +0000 From: "Winfield, Alister" To: "sthaug@nethelp.no" , Eric Rescorla CC: "wjhns1@hardakers.net" , "dnsop@ietf.org" , "doh@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Thread-Topic: [EXTERNAL] Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator Thread-Index: AQHU4I/VE8PoA/cXcUq2YgtFmtL6X6YXbzKA Date: Fri, 22 Mar 2019 10:15:23 +0000 Message-ID: <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> In-Reply-To: <20190322.101434.307385973.sthaug@nethelp.no> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [90.216.150.239] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9fda620d-dcdf-4e41-d2d2-08d6aeaf4c38 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2600; x-ms-traffictypediagnostic: DB6PR0601MB2600: x-microsoft-antispam-prvs: x-forefront-prvs: 09840A4839 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(396003)(136003)(366004)(376002)(346002)(199004)(189003)(8936002)(6506007)(81166006)(229853002)(81156014)(8676002)(74482002)(305945005)(33656002)(97736004)(106356001)(14444005)(5024004)(105586002)(256004)(3846002)(4326008)(72206003)(6116002)(14454004)(7736002)(102836004)(478600001)(5660300002)(53936002)(476003)(26005)(2906002)(6512007)(76176011)(68736007)(486006)(316002)(99286004)(25786009)(36756003)(66066001)(82746002)(186003)(2501003)(71190400001)(54906003)(71200400001)(6246003)(6486002)(93886005)(11346002)(86362001)(446003)(83716004)(2616005)(58126008)(6436002)(110136005); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2600; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 01Fd8tZLF4VI9EEIaoBnGWqIu0KCpJXA8yGWRxZegC3cEbWu9YEsHajNcTp4pRIfl02NQx3Pp/QTTDoMNwTk9I83RVDnUPS/uYv0CnuWKUyNRO74RDYKdIyUv1Yt1s/PQm7oCqi40ZoNgk0+6SbFXNCaA+plscH/14d5PBJGgfWNLcukFwf4+QT7WXIB+uqIL2/MknHadS/hDsPpBhMIOi8e+LXWTm2eQedr8b9iPKukErk4FlZdMCazvgAcLgxzZxW6hFn8sNlVX4UvRQ5bai8IhS6Axs4sAk8kEE1sxGPZHgWwW2Xvco2K0FvyeEgx2ZCFHWUsxA+Z2o3oYnVYfrAvZWJyo4zfBGOjzz2bzoANfbVb9S+0Dq23ZgBIp5oPC/iTORZGXuY81E9bOTPd5xgdUGcrCipg/6wq/mxdyNY= Content-Type: text/plain; charset="utf-8" Content-ID: <57CC57CEE3C5894DB698F350C089EE8C@eurprd06.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 9fda620d-dcdf-4e41-d2d2-08d6aeaf4c38 X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Mar 2019 10:15:23.9815 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2600 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 10:15:30 -0000 T2theSBzb3JyeSBwZXJoYXBzIEkgc2hvdWxkIHB1dCBpdCBkaWZmZXJlbnRseS4uLg0KDQpEb24n dCBvdmVycGxheSB0aGUgcHJpdmFjeSBwcm92aWRlZCBieSBEb0ggaXQgaGFzIG5vIGVmZmVjdCBv biB0aGUgRE5TIHByb3ZpZGVyIHNvIGFueSBoaW50IG9mICdwcml2YWN5JyBzaG91bGQgYmUgY2F2 ZWF0ZWQgYnkgc3RhdGluZyBpdHMgb25seSBhcyBwcml2YXRlIGFzIHRoZSBjb21wYW55IGFuZCBj b3VudHJ5IGluIHdoaWNoIHRoYXQgY29tcGFueSBpcyBmb3VuZGVkLCBhbmQgd2hlcmUgaXQgb3Bl cmF0ZXMgc2VydmVycy4gVGhpcyBpcyB3aGVyZSB0aGUgY2xpZW50cyBiZWhhdmlvdXIgaXMgb2Yg aW50ZXJlc3QuIElmIGl0IGNob29zZXMgYSBjb21wYW55J3Mgc2VydmljZSB3aXRob3V0IGdpdmlu ZyB0aGUgdXNlciBhbiBleHBsaWNpdCBjaG9pY2UgaXRzIHBvdGVudGlhbGx5IHNldHRpbmcgaXQg dG8gYmUgbGVzcyAncHJpdmF0ZScgdGhhbiB0aGUgbG9jYWwgcHJvdmlkZXJzIEROUy4gIFRoaXMg aXMgcGFydGljdWxhcmx5IHRydWUgaW4gdGhlIEVVIGFuZCBjb3VudHJpZXMgdGhhdCBoYXZlIHN0 cm9uZyBkYXRhIHByb3RlY3Rpb24gbGF3cy4NCg0KTm90ZSwgSSdtIG5vdCBhY3R1YWxseSBhbnRp LURvSC4gSSwgaG93ZXZlciwgIGRvbid0IHdhbnQgaXQgb3ZlcnNvbGQsIG5vciBkbyBJIHdhbnQg dGhlIGltcGxlbWVudGF0aW9uIHRvIGlnbm9yZSByZWFsIGltcGFjdHMgYW5kIHJpc2tzLiBJIGlu Y2x1ZGUgaGVyZSB0aGUgcmlzayBvZiB1bmludGVuZGVkIGNvbnNlcXVlbmNlcyBtYW55IG9mIHdo aWNoIHdpbGwgZW5kIHVwIG1ha2luZyB0aGUgJ2JhZCcgeW91IGFyZSB0cnlpbmcgdG8gZml4IHdv cnNlIHRoYW4gaXQgaXMgbm93Lg0KDQpBbGlzdGVyDQoNClBTOiBJIGtub3cgdGhhdCBwZW9wbGUg dXNlIGdvb2dsZSBldCBhbCBhbHJlYWR5IGZvciBETlMuIFRoaXMsIGhvd2V2ZXIsIGlzIGEgcHJv dG9jb2wgdGhhdCBwbGFjZXMgcHJpdmFjeSBmcm9udCBhbmQgY2VudHJlLCBzbyBpdCdzIG11Y2gg bW9yZSBpbXBvcnRhbnQgdGhhdCBjbGllbnRzIGFyZSBjbGVhciBhYm91dCB3aGF0IHByaXZhY3kg aXRzIHByb3ZpZGluZyBhbmQgd2hhdCBwcml2YWN5IGl0IGNhbid0IHByb3ZpZGUuDQoNCkluZm9y bWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFueSBhdHRhY2htZW50cyBtYXkgYmUgcHJp dmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRlbmRlZCBleGNsdXNpdmVseSBmb3IgdGhl IGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBtYXkgbm90IGJlIG9mZmljaWFsIHBvbGlj eSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUgb3JpZ2luYXRvci4gSWYgeW91IGhhdmUg cmVjZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZSBub3RpZnkgdGhlIHNlbmRlciBieSByZXR1cm4g ZS1tYWlsIGFuZCBkZWxldGUgaXQgZnJvbSB5b3VyIHN5c3RlbS4gWW91IHNob3VsZCBub3QgcmVw cm9kdWNlLCBkaXN0cmlidXRlLCBzdG9yZSwgcmV0cmFuc21pdCwgdXNlIG9yIGRpc2Nsb3NlIGl0 cyBjb250ZW50cyB0byBhbnlvbmUuIFBsZWFzZSBub3RlIHdlIHJlc2VydmUgdGhlIHJpZ2h0IHRv IG1vbml0b3IgYWxsIGUtbWFpbCBjb21tdW5pY2F0aW9uIHRocm91Z2ggb3VyIGludGVybmFsIGFu ZCBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0cmFkZW1hcmtz IG9mIFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJlIHVzZWQgdW5k ZXIgbGljZW5jZS4NCg0KU2t5IFVLIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjkwNjk5MSks IFNreS1Jbi1Ib21lIFNlcnZpY2UgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMDY3MDc1KSwg U2t5IFN1YnNjcmliZXJzIFNlcnZpY2VzIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gMjM0MDE1 MCkgYW5kIFNreSBDUCBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDk1MTMyNTkpIGFyZSBkaXJl Y3Qgb3IgaW5kaXJlY3Qgc3Vic2lkaWFyaWVzIG9mIFNreSBMaW1pdGVkIChSZWdpc3RyYXRpb24g Tm8uIDIyNDc3MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBtZW50aW9uZWQgaW4gdGhpcyBwYXJh Z3JhcGggYXJlIGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFuZCBXYWxlcyBhbmQgc2hhcmUgdGhl IHNhbWUgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5LCBJc2xld29ydGgsIE1pZGRsZXNl eCBUVzcgNVFEDQo= From nobody Fri Mar 22 03:20:42 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FED1130DE7 for ; Fri, 22 Mar 2019 03:20:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ksu6b9y07UJ4 for ; Fri, 22 Mar 2019 03:20:33 -0700 (PDT) Received: from mail-ot1-x341.google.com (mail-ot1-x341.google.com [IPv6:2607:f8b0:4864:20::341]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A43011277CE for ; Fri, 22 Mar 2019 03:20:32 -0700 (PDT) Received: by mail-ot1-x341.google.com with SMTP id 64so1440833otb.8 for ; Fri, 22 Mar 2019 03:20:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=jVemUzsEzhgZBwmYNJSTetTq3fXcpvg+78JV2RDl1hg=; b=DGE3M60rjaqnHIhKw3/3mDk2lfw4iKaoKtOF0G7L5LKFz+5Q3XGthSp8pyIqwew4MG 9zrblYRw0T+O2PNO+iuV9SOEXQU6scK3FPXlwmovDvuB8rd84SihWB5LdWvNstTWatvV YexFJj8RqO00dd6kfERQnhKVNckZwh3Xxfgkc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=jVemUzsEzhgZBwmYNJSTetTq3fXcpvg+78JV2RDl1hg=; b=acbhZS3tHafcZtJP8oYrCZ2pEtcvPs9RFJpGAWATTlJt4yzenF+/kTolFcvp/mymYN QJH3bdqcFwbftTf7oABGgbtXX3QuYRd9vaPaoAa5U9t7CksZrJ5CLguJSUkOk/gcicGh hr1dqCYs/y1EJMKVM/d69UIc8/4WjZOzKsPI5bYUkpir3a89Zm4AUreNLnxnoQcqeW0S 9+Wluie3u2EwIW1kXT2oQvS9N0rB5EHM7fKKbtKVf4jOZkv5kQVTykc305oyPCAFGTNd S4k7CWmzjJeDOcg9/jQFyX4TBUwm0NM00gnvf3ghPpigDfJlnCtLSVFfAwV0+r9wXWXv S/VQ== X-Gm-Message-State: APjAAAXwpDKVfIB6bH2H6JWQpiqw8EQ4VHD5lIM5Acq3O9wyBmqrZ1WX mJPSll8V/sk9vUfw2StPeRA7HA== X-Google-Smtp-Source: APXvYqy4eRtVHcB41TcIZa9OAGvrEmObZhffgqLrzF10U6ZXlnxpi6EO28pzJCqcbI1mNrs6rgnk0w== X-Received: by 2002:a9d:368:: with SMTP id 95mr6180459otv.49.1553250031909; Fri, 22 Mar 2019 03:20:31 -0700 (PDT) Received: from [192.168.122.171] ([41.216.172.202]) by smtp.gmail.com with ESMTPSA id i17sm1849017otr.36.2019.03.22.03.20.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 22 Mar 2019 03:20:30 -0700 (PDT) From: Joe Abley Message-Id: Content-Type: multipart/signed; boundary="Apple-Mail=_4C4F30ED-A0ED-452C-A88F-57F9B131CA4C"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Fri, 22 Mar 2019 11:20:23 +0100 In-Reply-To: <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> Cc: "sthaug@nethelp.no" , Eric Rescorla , "dnsop@ietf.org" , "doh@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" , "wjhns1@hardakers.net" To: "Winfield, Alister" References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 10:20:35 -0000 --Apple-Mail=_4C4F30ED-A0ED-452C-A88F-57F9B131CA4C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii On 22 Mar 2019, at 11:15, Winfield, Alister = wrote: > Okay sorry perhaps I should put it differently... >=20 > Don't overplay the privacy provided by DoH it has no effect on the DNS = provider so any hint of 'privacy' should be caveated by stating its only = as private as the company and country in which that company is founded, = and where it operates servers. 100% agree that any choice by a sophisticated user would be less than = full-informed if the endpoint wasn't considered along with the transport = between the user and that endpoint. Joe --Apple-Mail=_4C4F30ED-A0ED-452C-A88F-57F9B131CA4C Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXJS25wAKCRA0jwy9hlI6 LGL4AJ9aY7RdiQgJpa4IXeu++5k03akElgCfVlTD46oKHdnqeehV/cLrU4pmwNM= =P7wQ -----END PGP SIGNATURE----- --Apple-Mail=_4C4F30ED-A0ED-452C-A88F-57F9B131CA4C-- From nobody Fri Mar 22 04:01:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B86F712426E; Fri, 22 Mar 2019 04:01:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.5 X-Spam-Level: X-Spam-Status: No, score=-14.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IKEsL1ZSCIL2; Fri, 22 Mar 2019 04:01:56 -0700 (PDT) Received: from aer-iport-1.cisco.com (aer-iport-1.cisco.com [173.38.203.51]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 751AD130EC0; Fri, 22 Mar 2019 04:01:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1890; q=dns/txt; s=iport; t=1553252512; x=1554462112; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=/QjK8wY9HCABdH0BMSd3v7vdkPCgmwGb++pKE1/n4GQ=; b=XTEU4NTOyK3gonYwlYw7blzzcf8XhXhIdKlZPhonDA4zU0IG1yB9sYO5 2h9YHWH4z+eKfMbHZquJBs/eTr6pa2O8HSgJdWm3/nSEQ6cwy8+L61vZ3 AgvmnuZP4AgnIh1dat9xEr1TKZEYw+ykYY6qp7Kh6BVpnBLgC9H1eWPAj U=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BUAABfv5Rc/xbLJq1jGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBZYEPgm0nhA6Ie4xNkkGHcg0BAYRsAoUdOBIBAQMBAQkBAwJ?= =?us-ascii?q?tKIVLAQUjVhALBAEJCioCAlcGE4MigXapHYEvhUaEboEvi0mBf4E4H4JMPod?= =?us-ascii?q?OMYImA6ULCZM4GYsiiFmbSYJyAgQGBQIVgWQhgVYzGggbFWUBgkE+gVgXjh8?= =?us-ascii?q?+AzCOPQEB?= X-IronPort-AV: E=Sophos; i="5.60,256,1549929600"; d="scan'208,217"; a="10904159" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-1.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 22 Mar 2019 11:01:50 +0000 Received: from [10.61.213.175] ([10.61.213.175]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x2MB1ntZ004393 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Fri, 22 Mar 2019 11:01:49 GMT From: Eliot Lear Message-Id: <95B7A5F4-9A31-4B07-AEE5-2CB74F879A43@cisco.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_BA0535BA-2779-4364-82E6-4E66509C665C" Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Fri, 22 Mar 2019 12:01:48 +0100 In-Reply-To: Cc: Vittorio Bertola , dnsop , DoH WG , Joe Abley To: Wes Hardaker References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.213.175, [10.61.213.175] X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 11:01:58 -0000 --Apple-Mail=_BA0535BA-2779-4364-82E6-4E66509C665C Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi Wes, On 22 Mar 2019, at 00:21, Wes Hardaker wrote: >=20 > If DNS privacy is a goal,=20 It is a goal. It is not the only goal. There is a tussle here. Let=E2=80= =99s recognize that. Eliot= --Apple-Mail=_BA0535BA-2779-4364-82E6-4E66509C665C Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi = Wes,

On 22 Mar 2019, at = 00:21, Wes Hardaker <wjhns1@hardakers.net> wrote:

If DNS = privacy is a goal, 


It = is a goal. It is not the only goal.  There = is a tussle here.  Let=E2=80=99s recognize that.

Eliot
= --Apple-Mail=_BA0535BA-2779-4364-82E6-4E66509C665C-- From nobody Fri Mar 22 10:14:30 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CCCB813130E; Fri, 22 Mar 2019 10:14:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 08dlW7DhHAd7; Fri, 22 Mar 2019 10:14:25 -0700 (PDT) Received: from mail.pch.net (keriomail.pch.net [206.220.231.84]) (using TLSv1.1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D1DB013130C; Fri, 22 Mar 2019 10:14:24 -0700 (PDT) X-Footer: cGNoLm5ldA== Received: from [10.19.48.67] ([69.166.14.2]) (authenticated user woody@pch.net) by mail.pch.net (Kerio Connect 9.2.7 patch 3) with ESMTPSA (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256 bits)); Fri, 22 Mar 2019 10:14:11 -0700 Content-Type: multipart/signed; boundary="Apple-Mail=_B27EBE4C-E07D-4075-9F91-9755087AEAD1"; protocol="application/pgp-signature"; micalg=pgp-sha256 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Bill Woodcock X-Priority: 3 In-Reply-To: <1878722055.8877.1553241201213@appsuite.open-xchange.com> Date: Fri, 22 Mar 2019 10:13:58 -0700 Cc: Christian Huitema , Wes Hardaker , dnsop , DoH WG Message-Id: <74AC9916-41B8-4E54-8649-B32B02845988@pch.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> To: Vittorio Bertola X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 17:14:29 -0000 --Apple-Mail=_B27EBE4C-E07D-4075-9F91-9755087AEAD1 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 > On Mar 22, 2019, at 12:53 AM, Vittorio Bertola = wrote: > If DoH deployment continues this way, I do see some governments - even = in Europe - trying to go in that direction, either by mandating the use = of in-country resolvers=E2=80=A6 India has already started down that path, and it looks like the UK may = not be all that far behind. -Bill --Apple-Mail=_B27EBE4C-E07D-4075-9F91-9755087AEAD1 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEm6XJ0FdpKWJHso4lb6RwSyiLf4cFAlyVF9YACgkQb6RwSyiL f4dtFBAAtUXrGx5WtSEsvSSrfiA3xdkSyAQThSFLOODsP4dvPquK7U+4yHxv9tPZ YsyyS2xt19jWb3mtOgTv1/ecfbttw4MnSUrKZ3SHzywnm7zoHF7sAjxHRvgQX8uG 0Ftrhyl2EfoA+bjhMM8/5cSd7oIlf8GGKhvrM5Zz7ZLIujK6LPAm43t2b6fNNM6b MGj0lbuNiSMTR8tOhrwnJEMRxzpOSllbF/2SvYkrdw1BEgMvluZqefL/FDVQKcay vaNWAbjIFE26Lu5giq8DVelqLOLiYAJqcqvRniBLIegHR1QEKU7oRCqqZz8ditsT q61cxf5urtE7T2fWIQM8446R4D+ai89NqSHGixcwcNM4q5oBbviLkisHVgr1Mb0C 3beMmMEtxHBaRqOxRmiypnDE+ONsZNKME+zp6JDosFsVczb9iOKMlu1zQVJlmSqP Ug7oz9+F40Tr8AYHfIyqkQtxi2GSnEfiEvVt5z/tryf4611X6zCgLL3UoZghh9Ut xy6gaeUmLLekpwCOGg28zJrHp4avtuzNKX/UtzD7MZIG3rEAWwP/WNCV7XjHesxZ JUjxwF3q073mAps/C57NdIwPRSwzQQrQHwKJCjgeBhBDx3l6JkEDPojn+bfuP6cM ls3BdDYfvByRPC9m0qPwS7LGIWexT7Yy+siLBaonZgD8G4UdtQw= =Yb4f -----END PGP SIGNATURE----- --Apple-Mail=_B27EBE4C-E07D-4075-9F91-9755087AEAD1-- From nobody Fri Mar 22 10:35:45 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 953EF131381; Fri, 22 Mar 2019 10:35:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PMkIynI_HjdY; Fri, 22 Mar 2019 10:35:36 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 135CC131377; Fri, 22 Mar 2019 10:35:36 -0700 (PDT) Received: from [IPv6:2001:559:8000:c9:f831:b59c:1675:ff93] (unknown [IPv6:2001:559:8000:c9:f831:b59c:1675:ff93]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id D609A892C6; Fri, 22 Mar 2019 17:35:35 +0000 (UTC) To: Bill Woodcock Cc: Vittorio Bertola , dnsop , DoH WG , Christian Huitema , Wes Hardaker References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <74AC9916-41B8-4E54-8649-B32B02845988@pch.net> From: Paul Vixie Message-ID: <9ee04824-4cb5-8d6c-eb6c-546f01455eda@redbarn.org> Date: Fri, 22 Mar 2019 10:35:34 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.12 MIME-Version: 1.0 In-Reply-To: <74AC9916-41B8-4E54-8649-B32B02845988@pch.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 17:35:38 -0000 Bill Woodcock wrote on 2019-03-22 10:13: > > >> On Mar 22, 2019, at 12:53 AM, Vittorio Bertola >> wrote: If DoH >> deployment continues this way, I do see some governments - even in >> Europe - trying to go in that direction, either by mandating the >> use of in-country resolvers… > > India has already started down that path, and it looks like the UK > may not be all that far behind. all statements made to date by the india and united kingdom governments have indicated that their plans to support in-country RDNS will not be mandatory, just as canada's (operated by CIRA) is not mandatory. i think if some country is intelligent enough to realize that america's tech companies are seeing an advantageous flow of in-country PII (that being the combination of end-user IP addresses and third-party intents such as DNS lookups), and that this puts their economy at some risk, they should (or perhaps SHOULD or even MUST) compete against ibm, cisco, google, and cloudflare in order to keep this PII in-country and subject to local law. it's the only rational defense against this data grab, and i applaud it. -- P Vixie From nobody Fri Mar 22 11:26:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 806BD13143D for ; Fri, 22 Mar 2019 11:26:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id s_A1VCCHvDEs for ; Fri, 22 Mar 2019 11:26:37 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBBD213143C for ; Fri, 22 Mar 2019 11:26:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1553279196; x=2417192796; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:CC:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=5drThY0gm9iCBqCXkM3ZW2LwLL3Wy7RtyczmP8buYzI=; b=y0UFJsz3fie50b9iEdgloLljkSI7Cv7/q9CwQ3lZ2mbInqFmkPg6R3CBcrNjiDDj GtBtjQF6CIPyW6lA/iFooIaoDRTBDCLEwqj5MUf8aUbfa28nu2sAs1ZHveNqEyFl qzJHPN9ZgT7SlORVVrqQMotzTc9xBi5NcphVkpAQFYAtQ/gwtgnP1b0ThPKOiyPg 7swOoTinaY4C464pUdpp3Wuir8d48TSs0pvtCw6PSGX3aXlSWEu2XluoZLxpwy5u O74FtljrJ2Do42iCkrhtooIHB4y1ltDLORzbM+7yTM/74GvbVLglISLRW1ZkconT YLkO35ZVWGjqzSlkSSj0FRwlMr2nI8pVYNigfJLIqXEIRJ7piqPDJfsXeobWvXZ3 ogVQeDoAAmIhBxQFs5mJ3fI9eoRm/ys621OROx9krebTAps9nu0RwGBEytEr2G8v XjqPdc8SHylqA4ry7h7NRpG2+hBZBpQVXn4U99GQ5tkNR7CGcauuEVe41DCylnMC gc139YtoEgoiShzFdIXXqil38Odl3nsaB+hqBHphbeTzGC7hMw1n5Pzdjtmc6kUi afCYeAfM0t1KtvTqlyzz1N1TRnN9tBPeYGPSpoN0u6k7FZogukSg0NNKRC5PTQaV aOA+eP8vqpM+XtKcgmkLAuC1HH+2v6hCLCE1T36xlBM=; X-AuditID: 60729ed4-2e5ff700000044dc-c4-5c9528db91db Received: from COPDCEXC35.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 4E.FF.17628.BD8259C5; Fri, 22 Mar 2019 12:26:35 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC35.cable.comcast.com (147.191.125.134) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 22 Mar 2019 14:26:34 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Fri, 22 Mar 2019 14:26:35 -0400 From: "Livingood, Jason" To: Vittorio Bertola , Christian Huitema , Wes Hardaker CC: dnsop , DoH WG Thread-Topic: [Doh] [DNSOP] New I-D: draft-reid-doh-operator Thread-Index: AQHU4IRdbBwwPC5oi0aDB6mfXD+g+aYX+IUA Date: Fri, 22 Mar 2019 18:26:34 +0000 Message-ID: References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> In-Reply-To: <1878722055.8877.1553241201213@appsuite.open-xchange.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [96.114.156.9] Content-Type: text/plain; charset="utf-8" Content-ID: <6131E0ACE717FD44A889D480E13F0D44@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFjrMKsWRmVeSWpSXmKPExsWSUDRnsu5tjakxBgu+W1jcfXOZxeLa3Yts FpMbZ7Nb/Lr7g8liyoONzA6sHieWXWH1uL1mKovHrRmnWDyWLPnJFMAS1cBoU5JRlJpY4pKa lppXnGrHpYABbJJS0/KLUl0Ti3Iqg1JzUhOxKwOpTEnNySxLLdLHaow+VnMSupgyFv1exl5w jqNi2p09rA2MGzi6GDk5JARMJM7dW8PexcjFISSwi0li1bl9jBBOC5NEX1sXG4RzmlHi+Nrf jCAtbAJmEncXXmEGsUUEZjJK9J7QBLGZBQwlHq6/zQpiCwtYS3yY/ZkdosZGYu36X1C2kcTJ 5kdMIDaLgKrE6TkfwGbyCrhIvJv7hAVi2Uk2ifdrz7OBJDgF3CRm3X0IVsQoICbx/dQaJohl 4hK3nsxngvhBQGLJnvPMELaoxMvH/8COEBXQl9i46SgbRFxB4v2/U0A2B1CvpsT6XfoQY6wk Fh08zwphK0pM6X7IDnGPoMTJmSD3gLSKSxw+soN1AqPkLCSbZyFMmoVk0iwkk2YhmbSAkXUV I5+lmZ6hoYmeoamFnpGh0SZGcNKad2UH4+XpHocYBTgYlXh4PaWmxgixJpYVV+YeYpTgYFYS 4d0VPTlGiDclsbIqtSg/vqg0J7X4EKM0B4uSOG+kz6QYIYH0xJLU7NTUgtQimCwTB6dUAyPL Nab3Bw3EeK8H7L8VyH1HRyXBYpro7Bu+T/5G51/ayMlg+TlZP933Sl2cXPpJ1vhjoVY+imqH RE0FjUuyGJonnLVc8Upzju+dzrlHfE6d093ZYNbb9/+h8ezrD9ea6rgZMjBFBJXd0RTp9Cq9 rNvQ+NxcbFrxVca55fP28oTNTDgaunD9YSWW4oxEQy3mouJEAE2HFAtWAwAA Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 18:26:40 -0000 T24gMy8yMi8xOSwgMzo1MyBBTSwgIkRvaCBvbiBiZWhhbGYgb2YgVml0dG9yaW8gQmVydG9sYSIg PGRvaC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiB2aXR0b3Jpby5iZXJ0b2xhPTQwb3Bl bi14Y2hhbmdlLmNvbUBkbWFyYy5pZXRmLm9yZz4gd3JvdGU6DQoNCj4gbGV0dGluZyBlYWNoIGFw cGxpY2F0aW9uIHBpY2sgaXRzIG93biBkZWZhdWx0IHJlc29sdmVyLCBjcmVhdGVzIGEgZnJhZ21l bnRlZCBtZXNzIG9mIGEgbmV0d29yayANCg0KW0pMXSBUcm91Ymxlc2hvb3RpbmcgYWxzbyBiZWNv bWVzIHBvdGVudGlhbGx5IG1vcmUgY29tcGxpY2F0ZWQuIEkgY2FuJ3QgYXNrIGEgdXNlciB0byBy dW4gZGlnIG9yIG5zbG9va3VwIGFuZCB0ZWxsIG1lIHdoYXQgaXQgc2F5cywgaW4gb3JkZXIgdG8g c2VlIHdoYXQgRE5TIHJlc3BvbnNlIHRoZXkgZ290LCBhbmQgZnJvbSB3aGF0IHNlcnZlci4gSSBt YXkgaGF2ZSB0byBhc2sgd2hpY2ggYXBwIHRoZXkgdXNlZCBpZiB0aGUgYXBwIHZhcmllcyBmcm9t IHRoZSBPUywgYW5kIHRoZW4gdGhhdCBhcHAgd291bGQgbmVlZCB0byBoYXZlIGEgcmVsYXRpdmVs eSBlYXN5IHdheSB0byBydW4gYSB0ZXN0IHF1ZXJ5IGFuZCBzaG93IHRoZSByZXN1bHRzLiBUbyB0 aGUgZXh0ZW50IHRoYXQgdGhpcyBpcyBhbiBJb1QgZGV2aWNlLCBVU0ItcG93ZXJlZCBoYXJkd2Fy ZSAndGhpbmcnLCBvciBzb21lIG90aGVyIG5vbi1QQy9tb2JpbGUvdGFibGV0IHdpdGggYSBzb21l d2hhdCBsaW1pdGVkIEdVSSBvciBubyBHVUksIHRoZW4gaXQgYmVjb21lcyBtb3JlIGRpZmZpY3Vs dC4NCg0K From nobody Fri Mar 22 11:52:09 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5381213148D for ; Fri, 22 Mar 2019 11:52:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cx9Q68Uouu1Q for ; Fri, 22 Mar 2019 11:52:05 -0700 (PDT) Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9DE8E131495 for ; Fri, 22 Mar 2019 11:51:59 -0700 (PDT) Received: by mail-lf1-x133.google.com with SMTP id r25so2066639lfn.13 for ; Fri, 22 Mar 2019 11:51:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=ezst+uPNGxbTwfPuz0yHFz4Wn8Z/mWGAWteaGQLb56o=; b=QpJ7BMY/XurrfwKOKHbzFXFtSA8d6phSzaOAIVR3fDdmMuoDDAxJhxHYwZJ3Ehwqtt RjhsQ6mqn8VSodZnZvPFdzrz5NWyq1k/ZNJzfrBj6lycYSNB4is9YozJsnZaN2pz1DYf Ugy7dwUlsW80A7ZEoqSP0EwMQw1tL8wJckT68= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=ezst+uPNGxbTwfPuz0yHFz4Wn8Z/mWGAWteaGQLb56o=; b=bTnYjizMF5A1RNx1nPpDu9ZXzijDNIKvBN229rSdS9/ucIfhoCDRNEDBu4fUMcY22F Ifao+eltHAIRLB3JhYUGtWf1BZCLRVBY8s6ypL6JSwc/DKwkEyu3MwLQ1MtWUyQ/KIJF Rrzoy2ZInWvl/l0dxLJSr/lSHXbO1ZmEOrf7vDebSz6sB42KIN0ocnGhc7+1uDSPjrBm edYGUozvzR9Fh9OJMDgT+KAteh+fMEyuQRFLFGK4u20c9RRcoHAi6V4umGZuRk+hzTYl hYlLo001zkbkuT3gZtng/hqGI6om34IxAgp/fNzacywqIipPnZrInfuYfxZt3hpFInD4 MAWg== X-Gm-Message-State: APjAAAWKyGpo9zVb4uGFqXk9CEffnVsOZWuQC2uCZLkvXNldHR69Ok9S +rceMzalD90m1bfEJXIxhu79W461DfBMDdsOUFbcpg== X-Google-Smtp-Source: APXvYqyXUTdJt2SJcWq0ybOutMIxhf/2lCWD5mBGzTfN8vIpsfdUFQ7t/4ogX6u+y11hDNHJDgnPxAYGNyLlzmNhymw= X-Received: by 2002:a19:8c1e:: with SMTP id o30mr5659987lfd.137.1553280717783; Fri, 22 Mar 2019 11:51:57 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Fri, 22 Mar 2019 11:51:56 -0700 From: Joe Abley Mime-Version: 1.0 (1.0) References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <74AC9916-41B8-4E54-8649-B32B02845988@pch.net> <9ee04824-4cb5-8d6c-eb6c-546f01455eda@redbarn.org> In-Reply-To: <9ee04824-4cb5-8d6c-eb6c-546f01455eda@redbarn.org> Date: Fri, 22 Mar 2019 11:51:56 -0700 Message-ID: To: Paul Vixie Cc: Bill Woodcock , Wes Hardaker , dnsop , DoH WG , Christian Huitema , Vittorio Bertola Content-Type: multipart/alternative; boundary="0000000000006b98ec0584b359e4" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 18:52:07 -0000 --0000000000006b98ec0584b359e4 Content-Type: text/plain; charset="UTF-8" On Mar 22, 2019, at 18:35, Paul Vixie wrote: all statements made to date by the india and united kingdom governments have indicated that their plans to support in-country RDNS will not be mandatory, just as canada's (operated by CIRA) is not mandatory. Others here can speak more authoritatively than me, e.g. because they work for CIRA and I don't, but as far as I know the recursive DNS service that CIRA runs is a commercial product that they sell. https://cira.ca/cybersecurity/firewall While I am aware CIRA has taken steps to educate people about the privacy implications of sending traffic across the border, and no doubt follow their own advice in the way they build and operate their own infrastructure, I don't believe this product is related to any kind of government aspiration to constrain or encourage resolver traffic to stay local. Joe --0000000000006b98ec0584b359e4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mar 22, 2019, at 18:35, Paul Vixie <paul@redbarn.org> wrote:

all statements made to date by the india and united kingdom gover= nments have indicated that their plans to support in-country RDNS will not = be mandatory, just as canada's (operated by CIRA) is not mandatory.
=
Others here can speak more authoritatively than me, = e.g. because they work for CIRA and I don't, but as far as I know the r= ecursive DNS service that CIRA runs is a commercial product that they sell.=

<= div dir=3D"ltr">
While I am aware CIRA has taken = steps to educate people about the privacy implications of sending traffic a= cross the border, and no doubt follow their own advice in the way they buil= d and operate their own infrastructure, I don't believe this product is= related to any kind of government aspiration to constrain or encourage res= olver traffic to stay local.


Joe
--0000000000006b98ec0584b359e4-- From nobody Fri Mar 22 11:59:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA43D1314CC; Fri, 22 Mar 2019 11:59:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z_G2iJ9Bql4E; Fri, 22 Mar 2019 11:59:37 -0700 (PDT) Received: from puck.nether.net (puck.nether.net [IPv6:2001:418:3f4::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C3B81314C7; Fri, 22 Mar 2019 11:59:37 -0700 (PDT) Received: from [100.170.95.150] (unknown [172.56.7.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by puck.nether.net (Postfix) with ESMTPSA id EFFB9541209; Fri, 22 Mar 2019 14:59:34 -0400 (EDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) From: Jared Mauch X-Mailer: iPhone Mail (16D57) In-Reply-To: Date: Fri, 22 Mar 2019 19:59:29 +0100 Cc: Jacques Latour , Ted Hardie , DoH WG , Paul Vixie , dnsop , Ralf Weber Content-Transfer-Encoding: quoted-printable Message-Id: <2D770C50-FDF8-481F-AFE8-642020A77694@puck.nether.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> To: Brian Dickson Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 18:59:39 -0000 > On Mar 21, 2019, at 11:29 PM, Brian Dickson wrote: >=20 > I realize, expressiveness adds complexity. However, it does avoid assumpti= ons and overloading. >=20 > The main criteria is agreement on client vs server (i.e. standardize this s= tuff), and possibly also add the network as another party involved (for upst= ream transit ISP vs local ISP), if they have differing policies for allowing= offsite/third-party DoH or DoT. So my thoughts on this real quick: one of the reasons many people are using c= entralized services like 8.8.8.8 (for example) is its complex to run these s= ervers properly.=20 I=E2=80=99m worried about this additional complexity breaking the camels bac= k, or deployment being relegated to those of us that may have overly complex= home networks.=20 The options and matrix add in complexity when a simple approach is likely de= sired or needed.=20 The small networks that do not run their own servers won=E2=80=99t change. T= he medium where it=E2=80=99s on the bubble will further centralize. Is this w= hat is needed in the community? - Jared=20 From nobody Fri Mar 22 12:26:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39C30131514; Fri, 22 Mar 2019 12:26:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B6y3FG7a6BoW; Fri, 22 Mar 2019 12:26:49 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [24.104.150.213]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 45184131511; Fri, 22 Mar 2019 12:26:49 -0700 (PDT) Received: from [IPv6:2001:559:8000:c9:f831:b59c:1675:ff93] (unknown [IPv6:2001:559:8000:c9:f831:b59c:1675:ff93]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 1A777892C6; Fri, 22 Mar 2019 19:26:49 +0000 (UTC) To: Jared Mauch Cc: Brian Dickson , Jacques Latour , Ted Hardie , DoH WG , dnsop , Ralf Weber References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> <2D770C50-FDF8-481F-AFE8-642020A77694@puck.nether.net> From: Paul Vixie Message-ID: Date: Fri, 22 Mar 2019 12:26:47 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.12 MIME-Version: 1.0 In-Reply-To: <2D770C50-FDF8-481F-AFE8-642020A77694@puck.nether.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 19:26:51 -0000 Jared Mauch wrote on 2019-03-22 11:59: > So my thoughts on this real quick: one of the reasons many people are > using centralized services like 8.8.8.8 (for example) is its complex > to run these servers properly. i think those optics are the motive, as you say. however, it is not complex, as you also say. the optics have been encouraged. they are misleading. -- P Vixie From nobody Fri Mar 22 15:36:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 873C6131058; Fri, 22 Mar 2019 15:36:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r6MLPc3Y_R-K; Fri, 22 Mar 2019 15:36:24 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 96289130EDB; Fri, 22 Mar 2019 15:36:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id DA264BE8A; Fri, 22 Mar 2019 22:36:21 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xQpI2Y2VJ0It; Fri, 22 Mar 2019 22:36:20 +0000 (GMT) Received: from [10.244.2.138] (95-45-153-252-dynamic.agg2.phb.bdt-fng.eircom.net [95.45.153.252]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id D4D69BE2E; Fri, 22 Mar 2019 22:36:19 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553294180; bh=kwIo/GDiLK1x2Q8SnH0DdfW2QcJCfvl8T+dZp8PbbJ4=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=YkUKKxoeErzxRDzTdx6o3S1Ravo3c4KYPyqfFwKTCBZIihY4xH3A7Q5EYhf7a7A0T rI3Afx0rlckqZgutrmtaCjRuWQ+ma0G+mxN6LW0NC2PwNbne0F8tOLfZjKauEY0zY/ he65t92wHCeir60o6tgEyR/Z75XkdkZ4vm1A8xMQ= To: Puneet Sood Cc: DoH WG , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <17f3c244-7403-d64b-b826-cc76310e0908@cs.tcd.ie> Date: Fri, 22 Mar 2019 22:36:18 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="J1NUXjhCDSrSi9StWhrmbjNQNXKBH7x87" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 22:36:28 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --J1NUXjhCDSrSi9StWhrmbjNQNXKBH7x87 Content-Type: multipart/mixed; boundary="fzxb53aonYadlYe6i8DaiOsXxqKgLvjPk"; protected-headers="v1" From: Stephen Farrell To: Puneet Sood Cc: DoH WG , dnsop Message-ID: <17f3c244-7403-d64b-b826-cc76310e0908@cs.tcd.ie> Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> In-Reply-To: --fzxb53aonYadlYe6i8DaiOsXxqKgLvjPk Content-Type: multipart/mixed; boundary="------------AD6252BF81793E924EF144B2" Content-Language: en-GB This is a multi-part message in MIME format. --------------AD6252BF81793E924EF144B2 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 22/03/2019 22:08, Puneet Sood wrote: > As a core principle, Google Public DNS aims to provide a DNS resolver > that respects our users=E2=80=99 privacy. Towards that goal, we aim to = provide > high quality implementations of various DNS transport mechanisms that > our users can use to reach the service. This includes the traditional > UDP and TCP transports as well as DNS-over-TLS and DNS-over-HTTPS that > provide privacy for the user=E2=80=99s communication with a DNS resolve= r. That's good to hear. As I'm sure you know well, in addition to transport security, things like logging etc. also affect folks' privacy. Not sure if you're aware of it, but there's an effort to craft BCP-like text on that broader topic in a draft [1] in the dprive WG. It'd be great to get your and other public recursive operators' take on that draft, as some of those issues have also been a cause of some of the much discussion here;-) Cheers, S. [1] https://tools.ietf.org/html/draft-ietf-dprive-bcp-op-02 --------------AD6252BF81793E924EF144B2 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------AD6252BF81793E924EF144B2-- --fzxb53aonYadlYe6i8DaiOsXxqKgLvjPk-- --J1NUXjhCDSrSi9StWhrmbjNQNXKBH7x87 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyVY2IACgkQWrL68XsX K+oqmw/+Nu6KjCCiINs/KFl+OpbOrTj8yGooJVvXd24Ev+rVgLjxMCwsibA7G9+o rgSXDa6KQ2dYA5JLCqJdw6g0082pes1yMqWFAZTYJFtqNO8IECjijTsVj1Hrbwkt 7jRpNimOEsAzy3xhJI1JsHaKc4AIpmL0rKRtdV+pz75w76waap9odIiSN/Laz7jD s+LyB7qKlDtMwCgnLJi48z4AtujMxd8PY/UJwj5j1oALeQfcjgj99+fRP4wk9qYg 1omFzqvOeP3Wr+snQ0rXNgq61dm0oHDw/WxhG4j9UaEvr+XG+HXFEOt/zAq0FFVW K8OTms20LDeY4+KERQPoWWAVHlf/xLxgy9dm9UkuVZA0E2dzj0UAdCx9TO/b1Rji eQfKG64qS+ukCqlj+TNIJ9IMRj0zqCvHtk6dJM+rgF7WZ/3CPFnGHSNn0iG6/hRw 3kekH9u+kbzEu5dr4NCrImwIw1vouE+pwa60IJH32ljz0g94c+p3aHa6Oxbwberl GtpsJXqVIRjLCpzfdTREVvesr/J4++tsKZ+sJn7FVjpUTboxrgw/ukqpktv9FI2D T4Xze7+PO/jDPsuCk2z3pIQM6Yk8WPw+pDON0XBypUADEHzc/2ItSyHTVqyRa+gC xhuVlp25JWtPRlUVG58wE5im4oCG1kekctvG4SkYnOGcHu6cX9c= =m/IE -----END PGP SIGNATURE----- --J1NUXjhCDSrSi9StWhrmbjNQNXKBH7x87-- From nobody Fri Mar 22 18:20:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2D20C131589 for ; Fri, 22 Mar 2019 15:09:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VY5QpYKxEZ15 for ; Fri, 22 Mar 2019 15:08:59 -0700 (PDT) Received: from mail-yw1-xc35.google.com (mail-yw1-xc35.google.com [IPv6:2607:f8b0:4864:20::c35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF1DD12762F for ; Fri, 22 Mar 2019 15:08:58 -0700 (PDT) Received: by mail-yw1-xc35.google.com with SMTP id j128so2918405ywg.12 for ; Fri, 22 Mar 2019 15:08:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=BBgHaxCTxjfEZlRuABV6w65bb+fKt31xyTSKufVCrxw=; b=km/ixRhGOL49p98O/a/CbS/ITaHMkPK63YNJjLz0fceQd7Or9rPJvvi3SZYkZPwM5I yJm5yX3YEWHBWmJRhYCPEYphhWYU7T7sXqElxLEn0+Ckqo2Bv6FNDaxIZ38xSSpDg96I vXNj/uy0+7zJLTZPP6cHWOfC7HZeVb5jvq/NHAuFWw45/ANk0RsLewXBPE/AC8feVODK J1DT9DB5Ckw51Qq6lyCED9Jy5BA0Iv2BvHfJWHC6PByJSPOSK4lnu3WemfRWRrxC+Es2 wP7g6HLE0/SH5Wft8xm50QouWBv2KvCmlFnh8X8rH71sgDmmYNu4STINkO/x8PSU7iAH W3pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=BBgHaxCTxjfEZlRuABV6w65bb+fKt31xyTSKufVCrxw=; b=nIS/vXIqHGfmB7JqOwB8kQTU/rJN3XS9vaWdvqeO2MTGiJ+w8sFgTrMgkhDAEMKDsZ wg7WmyU03CLbgn1rSl6r8JieiByPuruCJVJbsqWQcg/k4CV+kfQcYqxMUa+WRWxlW5Pr LxpE6mlj6xyP/ycYrvI1CrMm5+bEhIv5BK8vJWWqpeRFa6OuDRUIunXRvLpet0W/dULT fCS5/qdA7isU9zhb2b5BIeELU5bPiTqkK0SpdisOFPZHP+UYEpchYvZ2n6QedXK6gKp+ XoupwJOn1bxhy6Whszq7w1w1KZTyCflB/epSKypoXiFd3pl9+Jkl9vQQVtXX9rJgTB7L mIjQ== X-Gm-Message-State: APjAAAUaCnMU058qjt/ZOy/sRN9lZvgaUU8Bk2MD7oNUcelQVdMqO2gG gkdo5x8KxyCBbhdFbXC1wG8BC77yuJzOkF8G2OvI4w== X-Google-Smtp-Source: APXvYqwIsYedSOJlGUjHj9Toj+ACruI6tzGv4kQwtZ08KBVJN60VNvxenKxiBCDS1dPs0sHjWxg6isI9ZtgbhWAzv+M= X-Received: by 2002:a25:4643:: with SMTP id t64mr10435697yba.462.1553292537751; Fri, 22 Mar 2019 15:08:57 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> In-Reply-To: From: Puneet Sood Date: Fri, 22 Mar 2019 18:08:45 -0400 Message-ID: To: =?UTF-8?B?56We5piO6YGU5ZOJ?= Cc: Joe Abley , Ted Hardie , DoH WG , Brian Dickson , Jared Mauch , dnsop , paul vixie , Michael Sinatra , Stephen Farrell Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: X-Mailman-Approved-At: Fri, 22 Mar 2019 18:20:57 -0700 Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 22 Mar 2019 22:09:01 -0000 Hello, There has been much discussion in the IETF lists over the impact of using DNS-over-HTTPS (DoH) in a network. We would like to clarify the Google Public DNS position on this topic. The post I am replying to is particularly relevant since it makes some assumptions about the plans of the Google Public DNS service. For future support of a RFC 8484 compliant service, we plan to do the follo= wing: * Serve RFC 8484 compliant DoH from the well known Google Public DNS anycast IP addresses (e.g. 8.8.8.8) on the standard HTTPS port 443. * Migrate our existing DoH services to the well known Google Public DNS anycast IP addresses, including the beta version (at https://dns.google.com/resolve) and IETF draft version (at https://dns.google.com/experimental). The Google Public DNS anycast IP addresses are distinct from the IP addresses used to host web content for Google properties. This will allow operators to control access to the Google Public DNS DoH service on their networks without impeding access to other Google services. For DoH implementers we want to ensure the same access to our implementation whether it is a Google product (like the Chrome browser) or a third-party product. To this end we aim to track IETF work on standardized ways to detect DoH support by the system-selected DNS resolver service (like https://tools.ietf.org/html/draft-ietf-doh-resolver-associated-doh-02 or https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-01). As a core principle, Google Public DNS aims to provide a DNS resolver that respects our users=E2=80=99 privacy. Towards that goal, we aim to prov= ide high quality implementations of various DNS transport mechanisms that our users can use to reach the service. This includes the traditional UDP and TCP transports as well as DNS-over-TLS and DNS-over-HTTPS that provide privacy for the user=E2=80=99s communication with a DNS resolver. -Puneet Sood TL/Manager for the Google Public DNS team. PS: I am attending IETF 104 and will be available for face-to-face discussi= on. On Wed, Mar 20, 2019 at 2:40 PM =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 wrote: > > At Wed, 20 Mar 2019 12:38:05 +0100, > Joe Abley wrote: > > > > Often as an industry we may discuss various solutions that are great = for oneself but don=E2=80=99t scale when looking at the big picture. > > > > I think what we are seeing is the fundamental tension between privacy a= nd control. You need to give up some privacy in order to make the control p= ossible; you need to give up some control in order to afford privacy. > > > Some in this thread want certainty that they are able to exercise contr= ol, e.g. for devices in their network. > > > Some in this thread want certainty that they can obtain privacy, e.g. f= or for their device in any network. > > [...] > > Thank you for the nice, concise summary. I think it's well-balanced > observation of where we are. (I'm so glad I can finally see a > constructive post after seeing a common pattern of boring IETF > discussion, where people with different opinions just keep stating > their views without making any real progress:). > > > Seems to me that there's a middle ground within sight here. > > > > Standardise this privacy mechanism, and specify (with reasoning) that i= t should be implemented such that the existence of the channel (but not the= content) can be identified as distinct from other traffic by third parties= . Maybe specify use of a different port number, as was done with DoT. > > I see that those who want to exercise control can live with this (or > at least using a different set of IP addresses for DoH servers than > those for other ordinary web services). But I'm not so sure if that's > acceptable for the other group.. In that sense I'm curious whether > some big possible DoH providers are now willing to accept this middle > ground. If my memory is correct the longer term plan at Google (and > maybe also Clouldflare?) is to provide DoH service on the same IP > addresses as those for other ordinary and popular web services (and on > port 443, of course), so that an intermediate operator cannot easily > block access to their DoH services. > > > Those who choose to ignore that direction and create a covert channel u= sing port 443 instead will do so. Nothing much we can do to stop that today= (I guarantee it is already happening). The future is not really different. > > True. But I think giant providers tend to respect a community > consensus. Niche or really malicious players may/will still ignore > it, but it would be very difficult for them to collocate their DoH > services with other important web services that can hardly be blocked, > so it shouldn't be a big problem for "those who want certainty of > control". So if we can really agree on the above "middle ground" and > publish a BCP or something that describes the consensus, I guess we > can now really work on technical issues. But I'm not sure if we can > reach that consensus. > > -- > JINMEI, Tatuya > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Fri Mar 22 19:56:43 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E185D130F08 for ; Fri, 22 Mar 2019 19:56:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=bennett-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GTXsQqQs15BZ for ; Fri, 22 Mar 2019 19:56:28 -0700 (PDT) Received: from mail-it1-x143.google.com (mail-it1-x143.google.com [IPv6:2607:f8b0:4864:20::143]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3C116131036 for ; Fri, 22 Mar 2019 19:56:28 -0700 (PDT) Received: by mail-it1-x143.google.com with SMTP id z124so6422861itc.2 for ; Fri, 22 Mar 2019 19:56:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bennett-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=3rNb25cqSzYs5Sc19QimEueMrH8Tmg3Cp/OwaAVoFys=; b=RSKietUztsNHHmviSHxtvYiud0PJuwRknbReTiL9VssYoyaKkN3N/+TJUMB8b+IU+K qlhjBpUFMFPmBPS5tKGgSPeFMnKdr1pb/s4zqZFwvtOBeWggw3h3N4z7FFT/OwPyZvB9 11/gDSyAzCsAeLiO5KvxWW3icPY/JRyWrUJ3nXh8qm7OSXw9m1FYfBY5u2XbPpEJxN4Q N2nNccrNvl+OwTqYlq7brxtWC07CeMWGmMP7gP6Z1sjCiFuYNQh+XtxrHRFYsbzbSEG3 UZBsu5epZfyXRVE8ox30l6UPNrvzlVP4jO7wh3nD3GYg5DJlWIxFfrb/iuWjpuu+Unvv C4rw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=3rNb25cqSzYs5Sc19QimEueMrH8Tmg3Cp/OwaAVoFys=; b=i1Dt01Oixg19QBwYiknpCDsDhDz3evfFfRIdggRLl2WqIEtjJc9wD+lHe23FLiWqKA aIxAaUr11T3C2X3FuCl0XQ4tzpjckurOij3TnORaX3HJLgObjh3YzIbsLCzjsF955llz O4hWZ9Qo5N3SaBGIjIy9FIXYlIJjeUq6wxbPWa0D+vaPiZBgZQRX3Wcu5zHVjA9AYTaQ HMLeoU6StnUhl0X02cB+zBMNO5AxMl8vkjKCHU5yi8yurd1sqQgjcj979eS4tSQTjJce 9/M3BJLxtYl6WfanRApe7j7z4eZat3VsTcNPbFNK/zWmji3nrc7SU3cT9yRaVf/36eit SNrw== X-Gm-Message-State: APjAAAW6CkhUL/jvRYCXw2MwfMo72g4+xYjAhI7IMP2o+b+kxSKFLRKs zDl9hoUZqCnOAE3G1E2gG397tg== X-Google-Smtp-Source: APXvYqwG9aug4kkC0yx6HVuLfD/K+BPOKavOt7+DnBIUX/wEEOat51smXMbEzhVu76KUBLgDnXesTA== X-Received: by 2002:a02:f8b:: with SMTP id 11mr9901627jao.53.1553309787282; Fri, 22 Mar 2019 19:56:27 -0700 (PDT) Received: from ?IPv6:2601:285:1:d1ab:49a0:b1c3:e34f:ae47? ([2601:285:1:d1ab:49a0:b1c3:e34f:ae47]) by smtp.gmail.com with ESMTPSA id h78sm2019194ita.30.2019.03.22.19.56.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 22 Mar 2019 19:56:26 -0700 (PDT) From: Richard Bennett Message-Id: <119443DF-7435-4495-A202-B446C6CB31C0@bennett.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_18A736E7-B3B6-470D-AC5C-718FE6C9B9DC" Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Fri, 22 Mar 2019 20:56:25 -0600 In-Reply-To: Cc: DoH WG , dnsop To: Puneet Sood References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 02:56:32 -0000 --Apple-Mail=_18A736E7-B3B6-470D-AC5C-718FE6C9B9DC Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I like it if you would kindly define =E2=80=9Cprivacy=E2=80=9D in the = context of =E2=80=9Ca DNS resolver that protects our users=E2=80=99 = privacy.=E2=80=9D Does that mean hiding their lookups from ISPs who = might want to enter the market for targeted ads while using them for = your company=E2=80=99s own purposes, or just protecting user queries = made over insecure public Wi-Fi networks from easy snooping? Because = there are better ways to do the latter than with a system that opts = users into a centralized resolver. RB > On Mar 22, 2019, at 4:08 PM, Puneet Sood = wrote: >=20 > Hello, >=20 > There has been much discussion in the IETF lists over the impact of > using DNS-over-HTTPS (DoH) in a network. We would like to clarify the > Google Public DNS position on this topic. The post I am replying to is > particularly relevant since it makes some assumptions about the plans > of the Google Public DNS service. >=20 > For future support of a RFC 8484 compliant service, we plan to do the = following: > * Serve RFC 8484 compliant DoH from the well known Google Public DNS > anycast IP addresses (e.g. 8.8.8.8) on the standard HTTPS port 443. > * Migrate our existing DoH services to the well known Google Public > DNS anycast IP addresses, including the beta version (at > https://dns.google.com/resolve) and IETF draft version (at > https://dns.google.com/experimental). >=20 > The Google Public DNS anycast IP addresses are distinct from the IP > addresses used to host web content for Google properties. This will > allow operators to control access to the Google Public DNS DoH service > on their networks without impeding access to other Google services. >=20 > For DoH implementers we want to ensure the same access to our > implementation whether it is a Google product (like the Chrome > browser) or a third-party product. To this end we aim to track IETF > work on standardized ways to detect DoH support by the system-selected > DNS resolver service (like > https://tools.ietf.org/html/draft-ietf-doh-resolver-associated-doh-02 > or = https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-01). >=20 > As a core principle, Google Public DNS aims to provide a DNS resolver > that respects our users=E2=80=99 privacy. Towards that goal, we aim to = provide > high quality implementations of various DNS transport mechanisms that > our users can use to reach the service. This includes the traditional > UDP and TCP transports as well as DNS-over-TLS and DNS-over-HTTPS that > provide privacy for the user=E2=80=99s communication with a DNS = resolver. >=20 > -Puneet Sood > TL/Manager for the Google Public DNS team. >=20 > PS: I am attending IETF 104 and will be available for face-to-face = discussion. >=20 > On Wed, Mar 20, 2019 at 2:40 PM =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 = wrote: >>=20 >> At Wed, 20 Mar 2019 12:38:05 +0100, >> Joe Abley wrote: >>=20 >>>> Often as an industry we may discuss various solutions that are = great for oneself but don=E2=80=99t scale when looking at the big = picture. >>>=20 >>> I think what we are seeing is the fundamental tension between = privacy and control. You need to give up some privacy in order to make = the control possible; you need to give up some control in order to = afford privacy. >>=20 >>> Some in this thread want certainty that they are able to exercise = control, e.g. for devices in their network. >>=20 >>> Some in this thread want certainty that they can obtain privacy, = e.g. for for their device in any network. >>=20 >> [...] >>=20 >> Thank you for the nice, concise summary. I think it's well-balanced >> observation of where we are. (I'm so glad I can finally see a >> constructive post after seeing a common pattern of boring IETF >> discussion, where people with different opinions just keep stating >> their views without making any real progress:). >>=20 >>> Seems to me that there's a middle ground within sight here. >>>=20 >>> Standardise this privacy mechanism, and specify (with reasoning) = that it should be implemented such that the existence of the channel = (but not the content) can be identified as distinct from other traffic = by third parties. Maybe specify use of a different port number, as was = done with DoT. >>=20 >> I see that those who want to exercise control can live with this (or >> at least using a different set of IP addresses for DoH servers than >> those for other ordinary web services). But I'm not so sure if = that's >> acceptable for the other group.. In that sense I'm curious whether >> some big possible DoH providers are now willing to accept this middle >> ground. If my memory is correct the longer term plan at Google (and >> maybe also Clouldflare?) is to provide DoH service on the same IP >> addresses as those for other ordinary and popular web services (and = on >> port 443, of course), so that an intermediate operator cannot easily >> block access to their DoH services. >>=20 >>> Those who choose to ignore that direction and create a covert = channel using port 443 instead will do so. Nothing much we can do to = stop that today (I guarantee it is already happening). The future is not = really different. >>=20 >> True. But I think giant providers tend to respect a community >> consensus. Niche or really malicious players may/will still ignore >> it, but it would be very difficult for them to collocate their DoH >> services with other important web services that can hardly be = blocked, >> so it shouldn't be a big problem for "those who want certainty of >> control". So if we can really agree on the above "middle ground" and >> publish a BCP or something that describes the consensus, I guess we >> can now really work on technical issues. But I'm not sure if we can >> reach that consensus. >>=20 >> -- >> JINMEI, Tatuya >> _______________________________________________ >> Doh mailing list >> Doh@ietf.org >> https://www.ietf.org/mailman/listinfo/doh >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh =E2=80=94 Richard Bennett High Tech Forum Founder Ethernet & Wi-Fi standards co-creator Internet Policy Consultant --Apple-Mail=_18A736E7-B3B6-470D-AC5C-718FE6C9B9DC Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = like it if you would kindly define =E2=80=9Cprivacy=E2=80=9D in the = context of =E2=80=9Ca DNS resolver that protects our users=E2=80=99 = privacy.=E2=80=9D Does that mean hiding their lookups from ISPs who = might want to enter the market for targeted ads while using them for = your company=E2=80=99s own purposes, or just protecting user queries = made over insecure public Wi-Fi networks from easy snooping? Because = there are better ways to do the latter than with a system that opts = users into a centralized resolver.

RB

On Mar 22, 2019, at 4:08 PM, = Puneet Sood <puneets=3D40google.com@dmarc.ietf.org> wrote:

Hello,

There has been much = discussion in the IETF lists over the impact of
using = DNS-over-HTTPS (DoH) in a network. We would like to clarify the
Google Public DNS position on this topic. The post I am = replying to is
particularly relevant since it makes some = assumptions about the plans
of the Google Public DNS = service.

For future support of a RFC 8484 = compliant service, we plan to do the following:
* Serve = RFC 8484 compliant DoH from the well known Google Public DNS
anycast IP addresses (e.g. 8.8.8.8) on the standard HTTPS = port 443.
* Migrate our existing DoH services to the well = known Google Public
DNS anycast IP addresses, including = the beta version (at
https://dns.google.com/resolve) and IETF draft version = (at
https://dns.google.com/experimental).

The Google Public DNS anycast IP addresses are distinct from = the IP
addresses used to host web content for Google = properties. This will
allow operators to control access to = the Google Public DNS DoH service
on their networks = without impeding access to other Google services.

For DoH implementers we want to ensure the same access to = our
implementation whether it is a Google product (like = the Chrome
browser) or a third-party product. To this end = we aim to track IETF
work on standardized ways to detect = DoH support by the system-selected
DNS resolver service = (like
https://tools.ietf.org/html/draft-ietf-doh-resolver-associated-= doh-02
or = https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-01).
As a core principle, Google Public DNS aims = to provide a DNS resolver
that respects our users=E2=80=99 = privacy. Towards that goal, we aim to provide
high quality = implementations of various DNS transport mechanisms that
our= users can use to reach the service. This includes the traditional
UDP and TCP transports as well as DNS-over-TLS and = DNS-over-HTTPS that
provide privacy for the user=E2=80=99s = communication with a DNS resolver.

-Puneet = Sood
TL/Manager for the Google Public DNS team.

PS: I am attending IETF 104 and will be = available for face-to-face discussion.

On = Wed, Mar 20, 2019 at 2:40 PM =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 = <jinmei@wide.ad.jp> wrote:

At Wed, 20 Mar 2019 12:38:05 +0100,
Joe Abley <jabley@hopcount.ca> wrote:

Often as an industry we may discuss various solutions that = are great for oneself but don=E2=80=99t scale when looking at the big = picture.

I think what we are = seeing is the fundamental tension between privacy and control. You need = to give up some privacy in order to make the control possible; you need = to give up some control in order to afford privacy.

Some in this thread want certainty that they are able to = exercise control, e.g. for devices in their network.

Some in this thread want certainty that they can obtain = privacy, e.g. for for their device in any network.

[...]

Thank you for the nice, concise summary.  I think it's = well-balanced
observation of where we are.  (I'm so = glad I can finally see a
constructive post after seeing a = common pattern of boring IETF
discussion, where people = with different opinions just keep stating
their views = without making any real progress:).

Seems to me that there's = a middle ground within sight here.

Standardise this privacy mechanism, and specify (with = reasoning) that it should be implemented such that the existence of the = channel (but not the content) can be identified as distinct from other = traffic by third parties. Maybe specify use of a different port number, = as was done with DoT.

I see = that those who want to exercise control can live with this (or
at least using a different set of IP addresses for DoH = servers than
those for other ordinary web services). =  But I'm not so sure if that's
acceptable for the = other group..  In that sense I'm curious whether
some = big possible DoH providers are now willing to accept this middle
ground.  If my memory is correct the longer term plan at = Google (and
maybe also Clouldflare?) is to provide DoH = service on the same IP
addresses as those for other = ordinary and popular web services (and on
port 443, of = course), so that an intermediate operator cannot easily
block access to their DoH services.

Those who choose to = ignore that direction and create a covert channel using port 443 instead = will do so. Nothing much we can do to stop that today (I guarantee it is = already happening). The future is not really different.

True.  But I think giant = providers tend to respect a community
consensus. =  Niche or really malicious players may/will still ignore
it, but it would be very difficult for them to collocate = their DoH
services with other important web services that = can hardly be blocked,
so it shouldn't be a big problem = for "those who want certainty of
control".  So if we = can really agree on the above "middle ground" and
publish = a BCP or something that describes the consensus, I guess we
can now really work on technical issues.  But I'm not = sure if we can
reach that consensus.

--
JINMEI, Tatuya
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh

=E2=80=94
Richard Bennett
High Tech = Forum Founder
Ethernet & Wi-Fi standards co-creator

Internet = Policy Consultant

= --Apple-Mail=_18A736E7-B3B6-470D-AC5C-718FE6C9B9DC-- From nobody Fri Mar 22 20:11:23 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D31A9130E98; Fri, 22 Mar 2019 20:11:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NDSui6YgxkEQ; Fri, 22 Mar 2019 20:11:12 -0700 (PDT) Received: from mail.hardakers.net (mail.hardakers.net [168.150.192.181]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 97A811279A3; Fri, 22 Mar 2019 20:11:12 -0700 (PDT) Received: from localhost (unknown [76.14.1.154]) by mail.hardakers.net (Postfix) with ESMTPA id D33B0259CE; Fri, 22 Mar 2019 20:11:07 -0700 (PDT) From: Wes Hardaker To: Eliot Lear Cc: Wes Hardaker , Vittorio Bertola , dnsop , DoH WG , Joe Abley References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <2145465817.5147.1553119548565@appsuite.open-xchange.com> <95B7A5F4-9A31-4B07-AEE5-2CB74F879A43@cisco.com> Date: Fri, 22 Mar 2019 20:11:06 -0700 In-Reply-To: <95B7A5F4-9A31-4B07-AEE5-2CB74F879A43@cisco.com> (Eliot Lear's message of "Fri, 22 Mar 2019 12:01:48 +0100") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 03:11:14 -0000 Eliot Lear writes: > Hi Wes, >=20 > On 22 Mar 2019, at 00:21, Wes Hardaker wrote: >=20 > If DNS privacy is a goal,=20 >=20 > It is a goal. It is not the only goal. There is a tussle here. Let=E2= =80=99s > recognize that. Sorry, I knew it was a goal... Just inserted wording to draw attention to it. The whole point of this discussion is DNS privacy related. --=20 Wes Hardaker USC/ISI From nobody Sat Mar 23 04:39:06 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7721E130EAA; Sat, 23 Mar 2019 04:38:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C3mX5zBV5urN; Sat, 23 Mar 2019 04:38:54 -0700 (PDT) Received: from puck.nether.net (puck.nether.net [IPv6:2001:418:3f4::5]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CE2DF130DE7; Sat, 23 Mar 2019 04:38:54 -0700 (PDT) Received: by puck.nether.net (Postfix, from userid 162) id 387C8541195; Sat, 23 Mar 2019 07:38:49 -0400 (EDT) Date: Sat, 23 Mar 2019 07:38:49 -0400 From: Jared Mauch To: Paul Vixie Cc: Jared Mauch , Brian Dickson , Jacques Latour , Ted Hardie , DoH WG , dnsop , Ralf Weber Message-ID: <20190323113849.GB12400@puck.nether.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> <2D770C50-FDF8-481F-AFE8-642020A77694@puck.nether.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.3 (2019-02-01) Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 11:38:57 -0000 On Fri, Mar 22, 2019 at 12:26:47PM -0700, Paul Vixie wrote: > > > Jared Mauch wrote on 2019-03-22 11:59: > > So my thoughts on this real quick: one of the reasons many people are > > using centralized services like 8.8.8.8 (for example) is its complex > > to run these servers properly. > > i think those optics are the motive, as you say. > > however, it is not complex, as you also say. > > the optics have been encouraged. > > they are misleading. I think for you and I it's less complex. When I discuss things with smaller ISPs running DNS isn't even on their list of things anymore, similar to e-mail and other things where to run the service requires some scale. I've seen some quite large providers be unable to configure some simple DNS settings properly. You have to also look no further than the research that Mark Andrews and others have done about standards compliance. I don't think it's as hard as it could be, but it's not as easy either. - Jared -- Jared Mauch | pgp key available via finger from jared@puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine. From nobody Sat Mar 23 06:08:00 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C8D2412426E; Sat, 23 Mar 2019 06:07:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RS7ax7mQnfTh; Sat, 23 Mar 2019 06:07:56 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C19D412008A; Sat, 23 Mar 2019 06:07:56 -0700 (PDT) Received: from [10.55.45.227] (unknown [88.128.80.115]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id EAE38892C6; Sat, 23 Mar 2019 13:07:53 +0000 (UTC) In-Reply-To: <20190323113849.GB12400@puck.nether.net> References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> <2D770C50-FDF8-481F-AFE8-642020A77694@puck.nether.net> <20190323113849.GB12400@puck.nether.net> X-Referenced-Uid: 738010 Thread-Topic: Re: [DNSOP] [Doh] New I-D: draft-reid-doh-operator User-Agent: Android X-Is-Generated-Message-Id: true MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----Q8D79WF91NG8AX6TVYBX1GZZXX7LJT" Content-Transfer-Encoding: 7bit From: Paul Vixie Date: Sat, 23 Mar 2019 14:07:50 +0100 To: Jared Mauch CC: Brian Dickson , Jacques Latour , Ted Hardie ,DoH WG , dnsop ,Ralf Weber Message-ID: <88e50a18-698c-4627-8a4a-adfd97a4e17e@redbarn.org> Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 13:07:59 -0000 ------Q8D79WF91NG8AX6TVYBX1GZZXX7LJT Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=UTF-8 Bind9 with no config file now does the right recursive thing, including dns= sec=2E Knot and unbound and powerdns will not be far behind=2E We just need= to get the word out, to ISPs, Enterprise, SOHO, and end users of Windows, = macosx, Linux, and BSD=2E The hard part will be iOS and Android, due to the= permission model and app stores=2E Those can be last=2E =E2=81=A3Get Blue= Mail for Android =E2=80=8B On Mar 23, 2019, 12:39, at 12:39, Jared Mauch <= jared@puck=2Enether=2Enet> wrote: >On Fri, Mar 22, 2019 at 12:26:47PM -0700= , Paul Vixie wrote: >> >> >> Jared Mauch wrote on 2019-03-22 11:59: >> > = So my thoughts on this real quick: one of the reasons many people >are >> >= using centralized services like 8=2E8=2E8=2E8 (for example) is its >comple= x >> > to run these servers properly=2E >> >> i think those optics are the= motive, as you say=2E >> >> however, it is not complex, as you also say= =2E >> >> the optics have been encouraged=2E >> >> they are misleading=2E= > >I think for you and I it's less complex=2E When I discuss things with = >smaller ISPs running DNS isn't even on their list of things anymore, >simi= lar >to e-mail and other things where to run the service requires some >sca= le=2E > >I've seen some quite large providers be unable to configure some s= imple >DNS settings properly=2E You have to also look no further than the = >research that Mark Andrews and others have done about standards >complianc= e=2E > >I don't think it's as hard as it could be, but it's not as easy eit= her=2E > >- Jared > >-- >Jared Mauch | pgp key available via finger from = jared@puck=2Enether=2Enet >clue++; | http://puck=2Enether=2Enet/~jared= / My statements are only >mine=2E ------Q8D79WF91NG8AX6TVYBX1GZZXX7LJT Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable
Bind9 with no config file now do= es the right recursive thing, including dnssec=2E Knot and unbound and powe= rdns will not be far behind=2E We just need to get the word out, to ISPs, E= nterprise, SOHO, and end users of Windows, macosx, Linux, and BSD=2E The ha= rd part will be iOS and Android, due to the permission model and app stores= =2E Those can be last=2E

Get BlueMail for Android<= !-- tmjah_g_1299s -->
On Mar 23, 2019, at 12:39, Jared Mauch <jared@puck=2Enether=2Enet> wrote:= 
On Fri, Mar 22, 2019 at 12:26:47PM -0700, Paul Vixie wrote:
 
 
 Jared Mauch wrote on =
2019-03-22 11:59:
 So m=
y thoughts on this real quick: one of the reasons many people are
 using=
 centralized services like 8=2E8=2E8=2E8 (for example) is its complex
 to run these servers properly=2E
 
 i think those optics are the motive, as you say=2E
 
=
 however, it is not complex, as you also say=2E
 
 the optics have be=
en encouraged=2E
 
 they are misleading=2E

I thin=
k for you and I it's less complex=2E  When I discuss things with
smaller=
 ISPs running DNS isn't even on their list of things anymore, similar
to=
 e-mail and other things where to run the service requires some scale=2E
I've seen some quite large providers be unable to configure some simpl=
e
DNS settings properly=2E  You have to also look no further than theresearch that Mark Andrews and others have done about standards compliance=
=2E

I don't think it's as hard as it could be, but it's not as easy =
either=2E

- Jared
------Q8D79WF91NG8AX6TVYBX1GZZXX7LJT-- From nobody Sat Mar 23 10:42:17 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D482D127963 for ; Sat, 23 Mar 2019 10:42:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OUCUkoX94cUt for ; Sat, 23 Mar 2019 10:42:12 -0700 (PDT) Received: from mail-io1-xd35.google.com (mail-io1-xd35.google.com [IPv6:2607:f8b0:4864:20::d35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AB2651277CE for ; Sat, 23 Mar 2019 10:42:12 -0700 (PDT) Received: by mail-io1-xd35.google.com with SMTP id n11so4332432ioh.1 for ; Sat, 23 Mar 2019 10:42:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sWW4Q7N65VTaYQg7iVPFceuIi3acsjRQ0NfzNjjzhz4=; b=gwZewW9GFjf334MM417bvGfeHKq1sBbdeNVS+Psw33T0+rVX7sNf06UdPTC9M+7jsl UOVWfqJxLFbvkw6w/BQtM5YqqjC4+ELRhlP6i8D8zvfRFf1LkX7mm1NYxWTErj/t+gAf mVuz3JTC1ib1CreMSQH6pB0JhYu/Q4rAgDeomA0PxljnyTZ605bcIwPkAkiqSkU1wyYV Wj29ATPsTAWYx5GSNZb+YZNQVdBmCRyssqq0CBzEL9IVNAs+fKs3u3em7AqckMforN5i Rw+0WP/k0VR5GaYsBgLxbOcNMfHMGIwnj7JkzGKpj9KedssparZL9skUDMuf6SlV/tMT iNKw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sWW4Q7N65VTaYQg7iVPFceuIi3acsjRQ0NfzNjjzhz4=; b=pziJskX5N3CRDv2Rje8dFy+nWhj6V/q0MrO7qulizghuEU/AWqGAx0t16e429p9HgE u7Kr3diz/Sfot0omDPse8x148tzSVbD/XHx5Cb6ATySDzGhxCT47KkqE6uR8ICzHWXQ8 r15WUBRFtH0n0IxoYP/HQHzW4TG6jnObQizTfWgjHtEULglsngmkaPfBpsc7dt6X9gQg Zx92LUlcG9o9us7EAecaiVlHT/7dZHDz9O7okwCCNEwhHoAaZ1u48BmnT0CJqWJfsxda 1P+o8wexZd5lxtVikGL4aIjGcJ6Yeh1emv3VsYi//A/so0ljQtiqSXoyzsyRYsqyO92P myTQ== X-Gm-Message-State: APjAAAW5UWigQ/kzzJLO32d5qL0sSIDk9e+CJEK1d3I+eY/apIamq9HF qY+DXQ4EimVZo6XVKdXQ/vakQ9JW6VKlpOMDVs+xZQ== X-Google-Smtp-Source: APXvYqyBH6N8W90vBkpV0jZp4OxxgdGwRd7M8J/aU3ZvutSnp1elARk7ksUOgn4Jai6E10h3uEJmissoFyslORWvOmw= X-Received: by 2002:a6b:ec15:: with SMTP id c21mr12065290ioh.152.1553362931895; Sat, 23 Mar 2019 10:42:11 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <1914607.BasjITR8KA@linux-9daj> <1900056.F7IrilhNgi@linux-9daj> <5F768C24-4ECF-4369-9D51-B90C4426409B@fl1ger.de> <428d5ff2b5704cdf956a5919e330e4dc@cira.ca> <2D770C50-FDF8-481F-AFE8-642020A77694@puck.nether.net> <20190323113849.GB12400@puck.nether.net> <88e50a18-698c-4627-8a4a-adfd97a4e17e@redbarn.org> In-Reply-To: <88e50a18-698c-4627-8a4a-adfd97a4e17e@redbarn.org> From: Matthew Pounsett Date: Sat, 23 Mar 2019 18:42:00 +0100 Message-ID: To: Paul Vixie Cc: Jared Mauch , Ted Hardie , DoH WG , Jacques Latour , Brian Dickson , dnsop , Ralf Weber Content-Type: multipart/alternative; boundary="000000000000c36c9a0584c67d19" Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 17:42:15 -0000 --000000000000c36c9a0584c67d19 Content-Type: text/plain; charset="UTF-8" On Sat, 23 Mar 2019 at 14:08, Paul Vixie wrote: > Bind9 with no config file now does the right recursive thing, including > dnssec. Knot and unbound and powerdns will not be far behind. We just need > to get the word out, to ISPs, Enterprise, SOHO, and end users of Windows, > macosx, Linux, and BSD. The hard part will be iOS and Android, due to the > permission model and app stores. Those can be last. > There are rumours that Apple is at least considering DANE implementations[0] for their mobile and desktop browsers. If that comes to pass you'll see DNSSEC validation on iOS a lot sooner than you think. Anyone who has any customer influence with Apple could possibly push them in that direction... enough large customers pushing might inch them toward that ledge. [0]: < https://lists.dns-oarc.net/pipermail/dns-operations/2019-January/018298.html > --000000000000c36c9a0584c67d19 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Sat, 23 Mar 2019 = at 14:08, Paul Vixie <paul@redbarn.o= rg> wrote:
Bind9 with no config file now does the right recur= sive thing, including dnssec. Knot and unbound and powerdns will not be far= behind. We just need to get the word out, to ISPs, Enterprise, SOHO, and e= nd users of Windows, macosx, Linux, and BSD. The hard part will be iOS and = Android, due to the permission model and app stores. Those can be last.
=

There are rumours that Apple i= s at least considering DANE implementations[0] for their mobile and desktop= browsers.=C2=A0 If that comes to pass you'll see DNSSEC validation on = iOS a lot sooner than you think.=C2=A0 Anyone who has any customer influenc= e with Apple could possibly push them in that direction... enough large cus= tomers pushing might inch them toward that ledge.

--000000000000c36c9a0584c67d19-- From nobody Sat Mar 23 13:30:30 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F00B91277D9; Sat, 23 Mar 2019 13:30:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GYBx2HZgrd1T; Sat, 23 Mar 2019 13:30:20 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B58B1200B3; Sat, 23 Mar 2019 13:30:20 -0700 (PDT) Received: from [192.168.1.19] (unknown [88.103.122.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id D7086892C6; Sat, 23 Mar 2019 20:30:17 +0000 (UTC) To: Stephen Farrell Cc: Puneet Sood , dnsop , DoH WG References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <17f3c244-7403-d64b-b826-cc76310e0908@cs.tcd.ie> From: Paul Vixie Message-ID: Date: Sat, 23 Mar 2019 13:30:14 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.12 MIME-Version: 1.0 In-Reply-To: <17f3c244-7403-d64b-b826-cc76310e0908@cs.tcd.ie> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 20:30:22 -0000 Stephen Farrell wrote on 2019-03-22 15:36: > ... in addition to transport security, > things like logging etc. also affect folks' privacy. Not sure > if you're aware of it, but there's an effort to craft BCP-like > text on that broader topic in a draft [1] in the dprive WG. It'd > be great to get your and other public recursive operators' take > on that draft, as some of those issues have also been a cause of > some of the much discussion here;-) > > [1] https://tools.ietf.org/html/draft-ietf-dprive-bcp-op-02 a quick look did not show any treatment of logging above-the-recursive (cache miss traffic) with anonymization, as being qualitatively (and perhaps legally) different from logging below-the-recursive. is there room for this kind of thinking to be expressed? see also: https://www.farsightsecurity.com/assets/media/download/passive-dns-privacy.pdf -- P Vixie From nobody Sat Mar 23 14:41:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8B8E212AF7A for ; Sat, 23 Mar 2019 14:41:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.648 X-Spam-Level: X-Spam-Status: No, score=-1.648 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rzTpGdoqloJ2 for ; Sat, 23 Mar 2019 14:41:33 -0700 (PDT) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C819E128B36 for ; Sat, 23 Mar 2019 14:41:32 -0700 (PDT) Received: by mail-wm1-f43.google.com with SMTP id t124so5317171wma.4 for ; Sat, 23 Mar 2019 14:41:32 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=m2isSoq6n6ZCdyV4vVvebZrBRH0i5RFhJl3QpHS+M3A=; b=ip4WDqUmGW0FxvYkONmAgMMn71gFjW924LQfgAgrCdI33/L1VB2IjdQNUuQy2ozZ5m ISFHDhbFLC7bptTueUz3DvMsGQM0j0bi8JMzOsNOlvXuUMfnPLFJhCCJ+Yqj6IocAuDT owYHDfxn6j4zqEvRhPRuKWFFHUDa056fyU+gPczjP33a8bDJUWe58udDTqoY5Xj6jYMX 9+n1FnOJBYigWPTJfFrDLQTe0cDLL5z4QIni3DGhHsvJOOAOBm9j2G4L06UI0m0iTFMn JnR9PLKVYeIHhrNh2LRijOtg3MJX73jaRD91+dxHiEd2q8py2S9e23hyKhh5v9N87mEX jI+g== X-Gm-Message-State: APjAAAX3H49BHitaf/oPHHXVFZxKas7rl1Hi134P/4GameEFXVCEVJyA /04wWJWqDfUOHFr8d8CYvKe34GVB277KPrd9Ta8= X-Google-Smtp-Source: APXvYqyEVjLajI1yZIr6lSkll3gmn+0AOlz9/zjVWxEHs6IxVIqBgkG8QiSe9EOBv+mk+Lr3eOFSQcIg4CW8sDD03Ww= X-Received: by 2002:a1c:eb14:: with SMTP id j20mr1002885wmh.32.1553377291168; Sat, 23 Mar 2019 14:41:31 -0700 (PDT) MIME-Version: 1.0 References: <02C39DFD-9550-447D-B00E-702B441A88BE@icann.org> <2695a0e8-8373-8d33-7951-cfc5555ed254@nostrum.com> In-Reply-To: <2695a0e8-8373-8d33-7951-cfc5555ed254@nostrum.com> From: Erik Nygren Date: Sat, 23 Mar 2019 17:41:19 -0400 Message-ID: To: Adam Roach Cc: Eric Rescorla , Martin Thomson , Paul Hoffman , DoH WG Content-Type: multipart/alternative; boundary="000000000000a471960584c9d51f" Archived-At: Subject: Re: [Doh] [Ext] Re: Associating a DoH server with a resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 21:41:35 -0000 --000000000000a471960584c9d51f Content-Type: text/plain; charset="UTF-8" On Tue, Oct 23, 2018 at 11:40 PM Adam Roach wrote: > > So, e.g., interested clients would query for a URI record of type > _doh._tcp.resolvers.arpa, and get back a full HTTPS URL as a response. > Reviving this suggestion after reading some recent threads, this approach (query your local OS-configured resolver for a URI record with a well-known name) seems like a reasonably cleanish way to opportunitistically get a DoH server URI associated with the currently configured resolver. It's arguably less of a hack than cramming things into a TXT record on a reverse DNS IP. (Martin asked on a more recent thread something along the lines of "why don't we just do a .well-known lookup against the network-configured resolver, and something like this seemed like the best equivalent.) For better or worse it would also work when a caching forwarding resolver is present in passing through the record from whatever the caching forwarding resolver (eg, dnsmasq in a home gateway) was pointing to. It also has the benefit that clients don't need to know the IP address of their resolver, they just need to be able to do a URI record lookup against a well-known name. Especially of the OS helps mediate DoH server selection (which would be beneficial long-term regardless) the exact OS APIs that exist today are somewhat less interesting. Erik (Purely for enterrainment value: this well-known name could be in some other class like CHAOS rather than IN, like some other recursive-resolver-synthesized names like "version.bind txt chaos". This is not meant to be a serious suggestion.) --000000000000a471960584c9d51f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Oct 23, 2018 at 11:40 PM Adam Roach <adam@nostrum.com> wrote:

So, e.g., interested clients would query for a URI record of type
_doh._tcp.resolvers.arpa, and get back a full HTTPS URL as a response.
<= /blockquote>

Reviving this suggestion after reading some recen= t threads, this approach
(query your local OS-configured resolver for a= URI record with a well-known name)
seems like a reasonably cleanish way to = opportunitistically get a DoH server URI
associated with the currently confi= gured resolver.=C2=A0=C2=A0 It's arguably less of a hack
than cramming t= hings into a TXT record on a reverse DNS IP.=C2=A0

(Martin asked on= a more recent thread something along the lines of "why don't
we ju= st do a .well-known lookup against the network-configured resolver, and som= ething
like this seemed like the best equivalent.)

For better or wo= rse it would also work when a caching forwarding resolver is present
<= div style=3D"font-family:tahoma,sans-serif" class=3D"gmail_default">in pass= ing through the record from whatever the caching forwarding resolver (eg, <= br>
dnsmasq in a home gateway) was pointing to.=C2=A0 It also has the benefi= t that clients don't
need to know the IP address of their resolver, they= just need to be able to do a URI record
lookup against a well-known name.

Especially of the OS helps mediate DoH server selection (which would = be beneficial
long-term regardless) the exact OS APIs that exist today are s= omewhat less interesting.

=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Erik
<= div style=3D"font-family:tahoma,sans-serif" class=3D"gmail_default">

(Purely for enterrainment value: this well-known name co= uld be in some other class
like CHAOS rather than IN, like some other recurs= ive-resolver-synthesized names
like "version.bind txt chaos".=C2= =A0 This is not meant to be a serious suggestion.)
--000000000000a471960584c9d51f-- From nobody Sat Mar 23 15:37:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E26FC130E71 for ; Sat, 23 Mar 2019 15:37:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vEHS6T_4Mu2N for ; Sat, 23 Mar 2019 15:37:43 -0700 (PDT) Received: from mail-ua1-x934.google.com (mail-ua1-x934.google.com [IPv6:2607:f8b0:4864:20::934]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72B9012D7F8 for ; Sat, 23 Mar 2019 15:37:41 -0700 (PDT) Received: by mail-ua1-x934.google.com with SMTP id r21so1848795uan.11 for ; Sat, 23 Mar 2019 15:37:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6M7Hcc06xb6nNlRXg1KYr+1mbxvjE9YWpwTz4jnDZ00=; b=ldvu5t98MO+BgMDtcSHCH9/bifK8MfV6cHDKuVLEP1LtvW13k1Zl/yjF30sONT8qYg UteH+T2iM0zzZpQfBJa1ytfHgQP+jPn+czYM8dkZrVZF1I1ENRs7XZsHLStPvLGPqcFl 795SB8+Hn4w9FUoBHkoiQAoWeDNN+Pm+6l5TbSpv8pcOAvXW+oD8oN0f/S9z/UD+dh+1 AtT0EC8OYLGuKiGppiRk64DH9M15x1rz0rFufP9x/xPZc12y7wW6W93zcEytJvprWDNZ VknB42G26CkrkZtnjUswlTEYk42plJe2cCuMxXbBc3KQkac02o9diGHyK3acxszyzc2i 3cog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6M7Hcc06xb6nNlRXg1KYr+1mbxvjE9YWpwTz4jnDZ00=; b=pJwlBt3dXI6H+DZGrs0AcDbVeMkQ/TKJPhMU/+IDHUzxZAPQA3k7mCPAls0H7tNX72 38syCHCao0nRkXfG5XXGfqFkYAfb6JXg6RkzlBlKLs3QKdUKG8FBfgnKJBwBSyRvQMp0 rN/4RlyLh5+9PTbiv4AvSET0hwquBfVttvUqyAkkZjylChFDo4eDX/KC1G6Jxq1NfS+b eNswIVtutJ1LyiIHIcj+f6nn3Ey0NsKNFhRjoZSIjTw05UYbY6CsOTg3PUimYmpIQqN3 +LYGoaWYorbv1P4t4pLGRJH6p4D9IAV+THRmuUicKi5MjMlIPszCu7qSw+MSNHHoZ5Ry B08g== X-Gm-Message-State: APjAAAWCbU4lx/vCRuVSF+uP9sPI/gPhQe5Z/2xS+9nwu3utIvlgceUH 7Gyvy1f4SvHdbBw/0J8yP9ofnoJudLhvBOK+HQtQAA== X-Google-Smtp-Source: APXvYqymrka/Du8lOcgCN6MuVcrdlO72S1u2LkLCNaLKJJoJf6QVpjSnpgOp91PHjVpEk3S2W00FdRjICwDve4qjSo4= X-Received: by 2002:ab0:2248:: with SMTP id z8mr9839425uan.12.1553380660332; Sat, 23 Mar 2019 15:37:40 -0700 (PDT) MIME-Version: 1.0 References: <02C39DFD-9550-447D-B00E-702B441A88BE@icann.org> <2695a0e8-8373-8d33-7951-cfc5555ed254@nostrum.com> In-Reply-To: From: Ben Schwartz Date: Sat, 23 Mar 2019 18:37:29 -0400 Message-ID: To: Erik Nygren Cc: Adam Roach , Eric Rescorla , DoH WG , Martin Thomson , Paul Hoffman Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000007c307d0584ca9e5d" Archived-At: Subject: Re: [Doh] [Ext] Re: Associating a DoH server with a resolver X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 23 Mar 2019 22:37:46 -0000 --0000000000007c307d0584ca9e5d Content-Type: multipart/alternative; boundary="0000000000007658830584ca9e28" --0000000000007658830584ca9e28 Content-Type: text/plain; charset="UTF-8" On Sat, Mar 23, 2019 at 5:41 PM Erik Nygren wrote: > On Tue, Oct 23, 2018 at 11:40 PM Adam Roach wrote: > >> >> So, e.g., interested clients would query for a URI record of type >> _doh._tcp.resolvers.arpa, and get back a full HTTPS URL as a response. >> > > Reviving this suggestion after reading some recent threads, this approach > (query your local OS-configured resolver for a URI record with a > well-known name) > seems like a reasonably cleanish way to opportunitistically get a DoH > server URI > associated with the currently configured resolver. It's arguably less of > a hack > than cramming things into a TXT record on a reverse DNS IP. > Technically, a DoH configuration is a "URI template", not a URI. (Typically, this means it contains a substring like "{dns}".) Do you consider this similar enough to be good use of the URI RRtype? > (Martin asked on a more recent thread something along the lines of "why > don't > we just do a .well-known lookup against the network-configured resolver, > and something > like this seemed like the best equivalent.) > > For better or worse it would also work when a caching forwarding resolver > is present > in passing through the record from whatever the caching forwarding > resolver (eg, > dnsmasq in a home gateway) was pointing to. It also has the benefit that > clients don't > need to know the IP address of their resolver, they just need to be able > to do a URI record > lookup against a well-known name. > > Especially of the OS helps mediate DoH server selection (which would be > beneficial > long-term regardless) the exact OS APIs that exist today are somewhat less > interesting. > > Erik > > > (Purely for enterrainment value: this well-known name could be in some > other class > like CHAOS rather than IN, like some other recursive-resolver-synthesized > names > like "version.bind txt chaos". This is not meant to be a serious > suggestion.) > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000007658830584ca9e28 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Sat, Mar 23, 2019 at 5:41 PM Erik Nygr= en <erik+ietf@nygren.org&g= t; wrote:

=

Especially of the OS helps mediate DoH server sele= ction (which would be beneficial
long-term regardless) the exact OS APIs that exist today are somewh= at less interesting.
=
=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0 Erik


(Purel= y for enterrainment value: this well-known name could be in some other clas= s
like CHAOS rather than = IN, like some other recursive-resolver-synthesized names
like "version.bind txt chaos".=C2= =A0 This is not meant to be a serious suggestion.)
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--0000000000007658830584ca9e28-- --0000000000007c307d0584ca9e5d Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCBpaHR3O9D2rdmlB0em7n3 hJLV7jf1AkjaLu5M8GQHQTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMjMyMjM3NDBaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEABaZVi6BngtdRhIywDi0Zj3Tr0m1AwRdCrg8wh/sV lgjt4AfteaKkzDWpYY8FFaWTJWS1eY072stpluXHeaaRaidNypZ9fy/0FrwP0ywCmGUYejrprpN6 HKuPzcKVd/KBbeWghnj/Tkdw+UW3NkEniXEDhQfHPpKwfs5yDdraZzllygJrsdAXytlqBsCWNvI6 BHwcLYTywfSDaiHAOyL1wAieERPqTdWmnlKAVTLzmK97+cndN77azpmFRlp0omR3xIYCkd5sKv9k ul+IhsbJEqsTZ6Q1LRfOqV2jPHMzetfsBsZMhVecUAl6y3peet3vSdsYkWlnx3dsSc2opR/aRA== --0000000000007c307d0584ca9e5d-- From nobody Sun Mar 24 01:14:57 2019 Return-Path: X-Original-To: doh@ietf.org Delivered-To: doh@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 298281224E8; Sun, 24 Mar 2019 01:14:54 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: doh@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.94.1 Auto-Submitted: auto-generated Precedence: bulk Reply-To: doh@ietf.org Message-ID: <155341529409.18062.10657099011172813446@ietfa.amsl.com> Date: Sun, 24 Mar 2019 01:14:54 -0700 Archived-At: Subject: [Doh] I-D Action: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 08:14:54 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the DNS Over HTTPS WG of the IETF. Title : Associating a DoH Server with a Resolver Author : Paul Hoffman Filename : draft-ietf-doh-resolver-associated-doh-03.txt Pages : 10 Date : 2019-03-24 Abstract: Browsers and web applications may want to know if there are one or more DoH servers associated with the DNS recursive resolver that the operating system is already using. This would allow them to get DNS responses from a resolver that the user (or, more likely, the user's network administrator) has already chosen. This document describes two protocols for a resolver to tell a client what its associated DoH servers are. It also describes a protocol for a client to find out the address of the resolver it is using, if it cannot find that address by an operating system API or some other means. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-doh-resolver-associated-doh/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-doh-resolver-associated-doh-03 https://datatracker.ietf.org/doc/html/draft-ietf-doh-resolver-associated-doh-03 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-doh-resolver-associated-doh-03 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sun Mar 24 01:20:28 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FCCA127980 for ; Sun, 24 Mar 2019 01:20:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6z1ANOyONT-k for ; Sun, 24 Mar 2019 01:20:25 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 017F2127979 for ; Sun, 24 Mar 2019 01:20:25 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Sun, 24 Mar 2019 01:20:22 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Sun, 24 Mar 2019 01:20:22 -0700 From: Paul Hoffman To: DoH WG Thread-Topic: New version: draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU4hptKMSagvBEkUuc0O0xN2knaA== Date: Sun, 24 Mar 2019 08:20:22 +0000 Message-ID: <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> In-Reply-To: <155341529409.18062.10657099011172813446@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <720868E8BBBF624FA2EE7BC4D9B3AF36@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 08:20:26 -0000 The diffs here are what I think have general agreement from the discussion = about this draft so far, but I may have missed things. Comments are still q= uite welcome. As for the late discussion of using the URI RRtype instead of TXT, I would = not know what to put in the "priority" and "weight" values. That alone seem= s enough reason to leave this as a TXT record, but others might disagree. I= t's not a lot of effort to change the text to the URI RRtype, but I don't w= ant to do so unless it is actually better than TXT. --Paul Hoffman= From nobody Sun Mar 24 02:12:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 124A7127984 for ; Sun, 24 Mar 2019 02:12:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jfbuZUSOTdiC for ; Sun, 24 Mar 2019 02:12:33 -0700 (PDT) Received: from mail-ot1-x331.google.com (mail-ot1-x331.google.com [IPv6:2607:f8b0:4864:20::331]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64C65127971 for ; Sun, 24 Mar 2019 02:12:33 -0700 (PDT) Received: by mail-ot1-x331.google.com with SMTP id t8so225784otp.7 for ; Sun, 24 Mar 2019 02:12:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ESFvFH0+N6SYsBUInrd2NdKv57VXVQpnsesq9FevAlw=; b=L7/6INd2Rwljittf/IrV2gWQUaNeNSH8lHhMmx3Sqs9M+4rovS4qaWtBZrJ7Fla29f JGX872CiKCgISNs1ZZxej6mdMWdXwjy+kSZnAZ9wF5Ure1VOfKv1sug4C9Zdunxo3lxu EwBbGG9+lj6g3FNXOxu+awtkPjT8XrZloH408= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ESFvFH0+N6SYsBUInrd2NdKv57VXVQpnsesq9FevAlw=; b=ioBgZh0B6eetRNwLY7T02XGLUoh9trx/EPXiRtMz/kS4nsetptUKumHzEdKCiJWeDw l7zpz3cYF4KLlyOw56aNNIcf4BaSu185xVeRzIOVrO+lbNSg5WrXwbFlUHkSXcHbDFky JVUjnCXvhYl8zPvE4dWBoZstN2AILJHbkogLAog9sVjrQVyLI8Bh2Y95DwInFSVOj1jv KNYNYZs8qsPxJc0Rk2NoIcV4wyhYM2DHqbNnCkLNnWa95vkFJsoUcu2XB+EgFr4l1DDw nY2fgeaKez+0OyhbC4iwYGxgRzqMLTkJRl0iu+g3wUEJp10u6ZU0EEARrzmye4gu2fup POTg== X-Gm-Message-State: APjAAAVAskRkWfoDo5pVM8ousR400ghDbF6cSwrBhDGM123mZo1KsGIe t40EObvXgmJezWclhDq09VxgNLFCSOGHCaxMoNuWV9wuki8= X-Google-Smtp-Source: APXvYqzWb/biu0Aa041QdPf83l1mx/44QzYnpQsQewZCRHmeO4t2XP7pEvxdFthZEqctQOAz9vFPQ3G5W69E7D+mdC4= X-Received: by 2002:a9d:368:: with SMTP id 95mr13648279otv.49.1553418752398; Sun, 24 Mar 2019 02:12:32 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> In-Reply-To: <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> From: Joseph Lorenzo Hall Date: Sun, 24 Mar 2019 10:12:20 +0100 Message-ID: To: Paul Hoffman Cc: DoH WG Content-Type: multipart/alternative; boundary="000000000000ecab0b0584d37cc8" Archived-At: Subject: Re: [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 09:12:36 -0000 --000000000000ecab0b0584d37cc8 Content-Type: text/plain; charset="UTF-8" Couple of small things: typo, Intro: "Users typically configure their DNS recursive resolvers with through automatic configuration" I don't get the "Do53" abbreviation, but I'll grab you and maybe you can help me make sense of it (a very small thing considering you could have said DoPotatoes or whatever). Are there any outcomes you can see where IANA is compelled to delegate the SUDNs here? Or where an authoritarian government might require resolvers to collide, if that makes sense? In privacy considerations the draft says, "can increase communication privacy because of the TLS protection." I'm wondering if it makes sense to say explicitly "confidentiality and integrity" in a parenthetical near privacy? Thanks for this work, feel free to respond on-list if helpful! On Sun, Mar 24, 2019 at 09:20 Paul Hoffman wrote: > The diffs here are what I think have general agreement from the discussion > about this draft so far, but I may have missed things. Comments are still > quite welcome. > > As for the late discussion of using the URI RRtype instead of TXT, I would > not know what to put in the "priority" and "weight" values. That alone > seems enough reason to leave this as a TXT record, but others might > disagree. It's not a lot of effort to change the text to the URI RRtype, > but I don't want to do so unless it is actually better than TXT. > > --Paul Hoffman > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > -- Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --000000000000ecab0b0584d37cc8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Couple of small things:

typo, Intro: "Us= ers typically configure their DNS recursive resolvers with through automati= c configuration"

I don't get the "Do53" abbreviation, but I'll g= rab you and maybe you can help me make sense of it (a very small thing cons= idering you could have said DoPotatoes or whatever).
=

Are there any outcomes y= ou can see where IANA is compelled to delegate the SUDNs here? Or where an = authoritarian government might require resolvers to collide, if that makes = sense?

In privacy considerations the draft says, "can increase communication privacy be= cause of the TLS protection." I'm wondering if it makes sense to s= ay explicitly "confidentiality and integrity" in a parenthetical = near privacy?

Thanks for this work, feel free to respon= d on-list if helpful!

On Sun, Mar 24, 2019 at 09:20 Paul Hoffman <paul.hoffman@ican= n.org> wrote:
The diffs here= are what I think have general agreement from the discussion about this dra= ft so far, but I may have missed things. Comments are still quite welcome.<= br>
As for the late discussion of using the URI RRtype instead of TXT, I would = not know what to put in the "priority" and "weight" val= ues. That alone seems enough reason to leave this as a TXT record, but othe= rs might disagree. It's not a lot of effort to change the text to the U= RI RRtype, but I don't want to do so unless it is actually better than = TXT.

--Paul Hoffman
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--
Joseph Lorenzo Hall
Chief Technologist, Center for Democ= racy & Technology [https://www.cdt.org<= /a>]
1401 K ST NW STE 200, Washington DC 20005-3497
e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key
Fingerprint: = 3CA2 8D7B 9F6D DBD3 4B10=C2=A0 1607 5F86 6987 40A9 A871
--000000000000ecab0b0584d37cc8-- From nobody Sun Mar 24 02:46:40 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4C1D127979 for ; Sun, 24 Mar 2019 02:46:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.7 X-Spam-Level: X-Spam-Status: No, score=-2.7 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bmQcFYaHvgLk for ; Sun, 24 Mar 2019 02:46:36 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4A7C12785F for ; Sun, 24 Mar 2019 02:46:36 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 2E2021A026D for ; Sun, 24 Mar 2019 02:46:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1553420796; bh=q8RaY1HYbZZmpbuiQymqmZxMcoR2UvmPoJY3wBNQQNU=; h=To:References:From:Subject:Date:In-Reply-To:From; b=KQNHTpxw7VtzsZi9tnDk2o3DjUXct3vkyAloqh28kkTn7gk2Fa/v/BiuuGAFJqZx5 6IzkO4EUE+weZcgb4L/odySPmf0uzCPusUq2GIrhAwJn7KX5OtogBfy7arBYbTGOao ZORv08RVXXR/zNd/LuFxxBWeSQGPgwsefIgqNNpQ= X-Riseup-User-ID: C8FE24A327E2350F7A059D7B3CC8B1215BAC64F78A85C587005EFF8A182AB783 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 09B7812130B for ; Sun, 24 Mar 2019 02:46:34 -0700 (PDT) To: doh@ietf.org References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: Date: Sun, 24 Mar 2019 09:46:00 +0000 MIME-Version: 1.0 In-Reply-To: <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="QNbX8wkdCyC8Q6639KpG4uvHNGrxgjIhb" Archived-At: Subject: Re: [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 09:46:39 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --QNbX8wkdCyC8Q6639KpG4uvHNGrxgjIhb Content-Type: multipart/mixed; boundary="ZqYYOoIkyMgDvwgaRWWXGd3SLXu1ElOsb"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: Subject: Re: [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> In-Reply-To: <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> --ZqYYOoIkyMgDvwgaRWWXGd3SLXu1ElOsb Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Paul Hoffman wrote: > The diffs here are what I think have general agreement from the > discussion about this draft so far, but I may have missed things. > Comments are still quite welcome. Thanks for the update, I had a look at the diff: draft-ietf-doh-resolver-associated-doh-03.txt: > If DNS queries sent from stub resolvers to recursive resolvers are= =09 > not sent over transports that assure data integrity and server=09 > authentication, the "DoH servers from DNS" and "Resolver address= es=09 > from DNS" protocols are susceptible to on-path attackers directi= ng a=09 > user to a DoH server that is not actually associated with their = > resolver. Do53 is not a secure transport, and neither is DoT us= ing=09 > the opportunistic profile.=09 > =09 > The DNS responses used in "DoH servers from DNS" and "Resolver=09 > addresses from DNS" cannot be validated with DNSSEC [RFC4033], a= nd=09 > thus even a validating stub resolver would treat them the same a= s any=09 > other DNS responses in unsigned zones. Thanks for adding this to the security section.=20 Maybe also add a sentence about the downgrade attack weakness of the prot= ocol? I'm wondering about the reasoning for not adding additional safeguards=20 to reduce the window of opportunity for attackers exploiting the weakness= es in the DoH server discovery mechanism as suggested in [1]? > "If the DoH client has a DoH URI configured already,=20 > it MUST NOT override the DoH URI learned through the discovery > mechanisms in this document." [...] > extend:=20 >=20 >> A client MUST re-issue the queries in "DoH Servers from DNS" and >> "Resolver Addresses from DNS" every time the configured resolver in >> the operating system changes=20 >=20 > with: >=20 > or whenever the client's IP address changes > (even if the resolver does not change).=20 [...] > "The mechanism in section 2 is the safest and MUST be attempted first."= >=20 >=20 > You could also consider some downgrade attack protections where the att= acker > simply blocks 443 to force the unauthenticated mechanism in section 3. >=20 > Such a protection could be implemented via an additional field in the J= SON file > by borrowing max-age from HSTS. > https://tools.ietf.org/html/rfc6797#section-6.1.1 kind regards, nusenu [1] https://mailarchive.ietf.org/arch/msg/doh/295yrI72xt0eSnYueiOuqVpSj4s= --=20 https://twitter.com/nusenu_ https://mastodon.social/@nusenu --ZqYYOoIkyMgDvwgaRWWXGd3SLXu1ElOsb-- --QNbX8wkdCyC8Q6639KpG4uvHNGrxgjIhb Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyXUfQACgkQrWE4wkXN Qn4yZA//YEu+8EdS/yFlWVx/7DJl8JvYGe+KKBlkc/kqZ8skGsygFbzo7pJogxz5 32u3t4YdH9VFgsectwEPZekzLAA+by5ZCRhesfEgi6ovsiHJcMgmxChw7haZ+UIa hP6ueyzn2oCxhWCLUSKVy36+v34euW6Xcnry7TlXwEsJVrz2cPtQbjIIOMnnamm7 aS9l4Ne+SFIympgcJxQ7WtUUBngH+EzOvlqy+6BKwAHslfRs+h0zMp1UOaAtDA5A 5sxDUJTBHUgB4dwffDOq7/53T2ygZS6GfY/Pxcw4nWAxma2zNYISH1lrFOjx9Ti3 zgqtdRDq9lp8GTy7NeHb9NzTWmg5TyoMtF78RzDyQ3j3j5oRvsKUMc/BJYaFo0kA 9HwRn8KHu+S2ZvX6/iEVqcs33HnAko9f/AEsB2P+k/ACzEQnu7ADgIa6f9uTuP98 sDh0fA25HvmgtIJDQjC6EwPgMPFQIqfZwjxPBw5CKZedBU0ZClC4NHjpZoCLTu0k /QJfooT0v9/F/M05Chx8BuBcPQJ/1kLN15/3iVlejEhjMreO7tUJk0kQNISGMuWF sqQ0UhtASn0GIqJ4oq/o6OH3Cr8VT005qW5GKU70IFao0YhhhY+YX9ZzuKuym0Ed XraQeBiWdKXiIctsCrkzb8X0BCXSkwArA8lkeqdO3CmjQY9xFQ8= =CMsD -----END PGP SIGNATURE----- --QNbX8wkdCyC8Q6639KpG4uvHNGrxgjIhb-- From nobody Sun Mar 24 02:58:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DABD127979 for ; Sun, 24 Mar 2019 02:58:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gLTUQdhYg1zY for ; Sun, 24 Mar 2019 02:58:32 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D393012785F for ; Sun, 24 Mar 2019 02:58:32 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Sun, 24 Mar 2019 02:58:30 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Sun, 24 Mar 2019 02:58:30 -0700 From: Paul Hoffman To: Joseph Lorenzo Hall CC: DoH WG Thread-Topic: [Ext] Re: [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU4hptyKjcm1FcoU67W4LREZZQWKYa9IIAgAAM5IA= Date: Sun, 24 Mar 2019 09:58:29 +0000 Message-ID: <09A84CEA-2228-4DF0-93DB-7512F6FA755F@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] Re: New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 09:58:34 -0000 Thanks for the quick read! On Mar 24, 2019, at 10:12 AM, Joseph Lorenzo Hall wrote: >=20 > Couple of small things: >=20 > typo, Intro: "Users typically configure their DNS recursive resolvers wit= h through automatic configuration" Fixed. > I don't get the "Do53" abbreviation, but I'll grab you and maybe you can = help me make sense of it (a very small thing considering you could have sai= d DoPotatoes or whatever). I thought it was clearer than than "DoU/T". It is short for "DNS over port = 53". > Are there any outcomes you can see where IANA is compelled to delegate th= e SUDNs here? No, very definitely not. That's why the "IANA Considerations" say explicitl= y MUST NOT. IANA follows the rules from the RFCs defining new entries. > Or where an authoritarian government might require resolvers to collide, = if that makes sense? Governments, authoritarian or not, can intercede in the DNS in many ways. > In privacy considerations the draft says, "can increase communication pri= vacy because of the TLS protection." I'm wondering if it makes sense to say= explicitly "confidentiality and integrity" in a parenthetical near privacy= ? Sure. --Paul Hoffman= From nobody Sun Mar 24 05:21:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 71F371275F3 for ; Sun, 24 Mar 2019 05:21:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=UaXtjQSO; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=UYwhYF9S Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j5nMMY0DExQX for ; Sun, 24 Mar 2019 05:21:40 -0700 (PDT) Received: from outbound1g.eu.mailhop.org (outbound1g.eu.mailhop.org [52.28.6.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D16DF126C01 for ; Sun, 24 Mar 2019 05:21:39 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553430098; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=FjWeXbAo9WveuakZmlrmCpaohLtZd8zgcRMLmixjVm2CeoOGXvVRN5bq2G9NlJlFrDCskVRYu1ec7 XzCD2c5ewu1c2oSZpEYY2nmuCtEZTtIEo2onxiSSlU5/qRzBP3lfMzxOx+SxILQRncYBh8/1XUOoCi ufxtuXTrmpCRhRjaYfbKsQlmCLBrk6rRJZCI1Y9WlQopC2UephMC7VirINW1jHs3uALtpFYlkaE/R1 Jgt2HM/K5ChSWs3fGWGmuzP9tMhJwGhtpvTXBlFiMj2qEl7X8PYbizdEbFbTN7BkqEfdgSnNg33P+2 kOmbhiEvsERu8kQpTEW9GQBsSi4ve1A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=1K86N9HdeBJw+sg9Ok7CL1q9+Vb1N+GZ4RDhZRM0DmE=; b=ROgBkXfZd0xbnrEE8HEVAzCcyAJECTjbzIqfOx0VgkXDXAdoFmWO5yp7TjIM4g0XzRXsQ4vY1lRIS eBXzW+9zmXQwfMwPDWrocrNYYDH1dxFTNNJA+aXIS51h5Zb6Tw3UNhDWpTLKxXrQD/BTELhg6cAkap B5iP854cYzclChvhR9cJPX5FenH91MamwmbzaPgdKvHcgReEiMLXoyY0WtGLTzotoWZEKwZqYMfz8J zOvi5idHJHDEwDn24OOS2p2vt6MPQ4Lk4LrIqRCo6nc4kNyqvBceSh5fzHbUNND2jBadhCs//ts1bL s/XANx2UNO05hrugWM0xUbSY40lZCSA== ARC-Authentication-Results: i=1; outbound3.eu.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.167.177; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=1K86N9HdeBJw+sg9Ok7CL1q9+Vb1N+GZ4RDhZRM0DmE=; b=UaXtjQSO4/3mlztpR1zebPM8SZu/VkWHfOP9xD/y/agKJmu7XwE2opwcF1ok8bmoXCy7PP6/VSPBE EiO6WCUEYUexNo6rYRAhLDsGVkVOwXdypmXGQhhDJrLSjvJ/vRtCauzR5T2q5J27JHPbzq43aTB4GS 0L+6VH8hAHRVQIeQ= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=1K86N9HdeBJw+sg9Ok7CL1q9+Vb1N+GZ4RDhZRM0DmE=; b=UYwhYF9Si2MGcFzR1+LjLn4Oj6fqVqt5cAjXr9TXATNXeRbgaz0eMMf02MhNA6e17Kp6drNKGs8iC LdHFmfC8va+okdSC02CvzQVo6YIrnM5qnXFz6eHXZgwugG8FQH/zLuibEb54gsOHa2hcaOaqkAZ/GV LBpsBcilMCaMA3lu4j+/CrABI7qmpBlCU8cBreEDsz3SKm08SWjS1tqeTMPiMQ31Q4gFoyQjYeKDN7 /vQvUw9X4W7SYrgDNrbennsv2TS4GvOJImY2mU8TE2hXo/dlgvNLHIRBbqLKNLpllZLZORIzYohlne fQ7fvnrjV7BP9JgoyvYlvnW4M9WGfRg== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: 5d9d208a-4e2f-11e9-908b-352056dbf2de X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.167.177 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-oi1-f177.google.com (unknown [209.85.167.177]) by outbound3.eu.mailhop.org (Halon) with ESMTPSA id 5d9d208a-4e2f-11e9-908b-352056dbf2de; Sun, 24 Mar 2019 12:21:36 +0000 (UTC) Received: by mail-oi1-f177.google.com with SMTP id v10so586060oib.1 for ; Sun, 24 Mar 2019 05:21:35 -0700 (PDT) X-Gm-Message-State: APjAAAXid45ZigdG5WSNi1S2Yl8Pl/ewJWLg2aqay3fl+8BZLC5O3CdK xUWd8U9WHkHXkk0KdXKgOIRFl0kqZhhbLPAkW8A= X-Google-Smtp-Source: APXvYqzKw4t71eV71AOeWnYd/QuNrdAHiJwa7JdLN6Jqv9Hglt99WpjKnbZ+qNNxXr+W8dm/31hrqU/eSAkJFaioJ4M= X-Received: by 2002:aca:c0c2:: with SMTP id q185mr7822332oif.118.1553430095032; Sun, 24 Mar 2019 05:21:35 -0700 (PDT) MIME-Version: 1.0 References: <6980a503-bbe2-ffa1-351e-0d2005221bf2@cs.tcd.ie> In-Reply-To: From: Patrick McManus Date: Sun, 24 Mar 2019 13:21:24 +0100 X-Gmail-Original-Message-ID: Message-ID: To: Paul Hoffman Cc: Stephen Farrell , "doh@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ff79860584d620a6" Archived-At: Subject: Re: [Doh] [Ext] draft-ietf-doh-resolver-associated-doh-02 comments X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 12:21:42 -0000 --000000000000ff79860584d620a6 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 20, 2019 at 2:03 AM Paul Hoffman wrote: > > > - Section 2: "the normal rules for HTTP" - does that mean > > all re-directs MUST be HTTPS too? And can those URLs use > > DNS names or must they be IP address certs too? > > The term "normal HTTP" was used in the DoH spec (RFC 8484), and here > "normal rules for HTTP" were assumed to be the same. > > There is a (emerging) definition that I believe is being referred to as normal http (or version independent http) - but it doesn't govern this question of the scheme of the target redirect. This draft would need to limit cross scheme redirects explicitly if that was what was wanted. (which makes sense to me). The definition I am referring to is the http-core work in the 3 active drafts here: https://github.com/httpwg/http-core -Patrick --000000000000ff79860584d620a6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Mar 20, 2019 at 2:03 AM Paul = Hoffman <paul.hoffman@icann.or= g> wrote:

> - Section 2: "the normal rules for HTTP" - does that mean > all re-directs MUST be HTTPS too? And can those URLs use
> DNS names or must they be IP address certs too?

The term "normal HTTP" was used in the DoH spec (RFC 8484), and h= ere "normal rules for HTTP" were assumed to be the same.

<= /blockquote>

There is a (emerging) definition that I bel= ieve is being referred to as normal http (or version independent http) - bu= t it doesn't govern this question of the scheme of the target redirect.= This draft would need to limit cross scheme redirects explicitly if that w= as what was wanted. (which makes sense to me).

The= definition I am referring to is the http-core work in the 3 active drafts = here:=C2=A0https://github.c= om/httpwg/http-core

-Patrick

=C2=A0
--000000000000ff79860584d620a6-- From nobody Sun Mar 24 07:02:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B318412788C; Sun, 24 Mar 2019 07:02:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dCONkWte26kn; Sun, 24 Mar 2019 07:02:33 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 382151277C9; Sun, 24 Mar 2019 07:02:33 -0700 (PDT) Received: from [10.0.5.192] (unknown [62.168.35.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 30248892C8; Sun, 24 Mar 2019 14:02:32 +0000 (UTC) To: Puneet Sood , kenjibaheux@google.com Cc: DoH WG , dnsop References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> From: Paul Vixie Message-ID: <6d83039c-6d8d-9f9b-95ba-b853425362eb@redbarn.org> Date: Sun, 24 Mar 2019 07:02:30 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.12 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 14:02:35 -0000 first, thank you for this statement, and for the policies it describes. Puneet Sood wrote on 2019-03-22 15:08: > ... > > As a core principle, Google Public DNS aims to provide a DNS resolver > that respects our users’ privacy. Towards that goal, we aim to provide > high quality implementations of various DNS transport mechanisms that > our users can use to reach the service. This includes the traditional > UDP and TCP transports as well as DNS-over-TLS and DNS-over-HTTPS that > provide privacy for the user’s communication with a DNS resolver. > > -Puneet Sood > TL/Manager for the Google Public DNS team. this position (for google public dns) is inconsistent with the google chrome design description here: Kenji Baheux wrote on 2019-03-23 22:43: >> 2) What other reasons are you considering when doing DOH instead of DOT >> to protect privacy. > > We are not considering DOT, just DOH. this disparity is concerning. for reasons amply described here... > From: Brian Dickson > Date: Sun, 24 Mar 2019 04:48:27 -0700 > Message-ID: > Archived-At: ...i remain hopeful that google will adopt a DoT support policy for all services (such as Public DNS) _and all products_ (such as Chrome). -- P Vixie From nobody Sun Mar 24 11:10:16 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3B56120013 for ; Sun, 24 Mar 2019 11:10:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5c8J9vg3Ntmk for ; Sun, 24 Mar 2019 11:10:13 -0700 (PDT) Received: from gro.dd.org (host2.dlawren-3-gw.cust.sover.net [207.136.201.30]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0CD77120005 for ; Sun, 24 Mar 2019 11:10:13 -0700 (PDT) Received: by gro.dd.org (Postfix, from userid 102) id 638BC8DFC2; Sun, 24 Mar 2019 14:10:11 -0400 (EDT) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Message-ID: <23703.51203.390475.832777@gro.dd.org> Date: Sun, 24 Mar 2019 14:10:11 -0400 From: Dave Lawrence To: doh@ietf.org Archived-At: Subject: [Doh] Notetaker(s) for working group meeting X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 18:10:15 -0000 So we don't have to waste time doing the begging and pleading exercise at the start of the meeting, could I please have at least one and preferably two volunteers for notetakers? Dan York has generously agreed to be the Jabber scribe. Thank you! From nobody Sun Mar 24 13:44:33 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BE5F212006B for ; Sun, 24 Mar 2019 13:44:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=V5FxgDEY; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=mos9Lnb0 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id awqiHUkT8qu4 for ; Sun, 24 Mar 2019 13:44:18 -0700 (PDT) Received: from outbound1g.eu.mailhop.org (outbound1g.eu.mailhop.org [52.28.6.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 34AC81200C4 for ; Sun, 24 Mar 2019 13:44:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553460255; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=EXD/TYRroHaUTr9YsxEKu+6s3CT+OAv0cPimVFMS8QoLpkDLyizyX+9HDT3eyOsFFltDL5Gkimc0g 9kDO8t0erQcHoJd2Gu8SWhyjquDByix4xnwfNo5ht+t17H2ZSfnq7gY/WQB5cfn32iZZ3eltiI0Hp6 LvWkWHV29FH0WvOc/iqH25hnfAyecrzzqHg9ILCrYfo7oAKddlscUuv53aU7aRI67uyKQX5c7xhn4J nBD5saNBQti9t58OT9N2cZJ1+RqzNiVEBevKkeXdbTZZyT49SPmY2QCGc7ncOAreKnmwpQ6IU0ZNAY K4F+yvw5W2zMfjJ3/6ywK3gKZQ5P4Nw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=KL7bmRSIX3lKgoCc7LyASVFMpIpMFxu/SVDG29pJ5oY=; b=uHIRACjJw8nTkPWxD/jBEGoQDiZftEJZXzx754zRN0Qcmn1hClTUBjBDqLO60ysv1onJ05XD+VQ/9 HpSStBCmiyBYbYUZ25fV0Y+vb8qsvVtr0WahknkkmlVEQu3VGPh6lzom6BO/UT6ilY38IcJMsAqTyX RmQyAizJqzPPiEHYuNTuhAAQs621XuuZJVajoquDxnannohRZ8Ty8aBmPpHTWg8Cdnzz+A41KYy4jO vsiG120cbHvBjw/q2bGzuzQAgyT2ZP3M6hSOiYQMD7f6Ufoq3Fqd+BigdrsOKpAvlzduYyljJ3JEMy ksg90SiqcNE0VIcuOePYzJz/VLu2mrQ== ARC-Authentication-Results: i=1; outbound3.eu.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.167.174; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=KL7bmRSIX3lKgoCc7LyASVFMpIpMFxu/SVDG29pJ5oY=; b=V5FxgDEYoLJskMR4esVttfNl5P2EDPdtp/CL3tU3sM78nXyjKdBpydytiQ0IAQ51dyvaS1Lyyt3cy ZjgqJFQuIWO9++yuR6+YJB39skqnzmwzahG80jhjGFM5VUC+qMikt/C43H+aFahzF3EXhTBPFlOW92 5m3sysbr7M8gYWz4= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=KL7bmRSIX3lKgoCc7LyASVFMpIpMFxu/SVDG29pJ5oY=; b=mos9Lnb0mMXFO84grNVPNViSxuw6E8X/M7f+RK19+aUEEKSyXMlO3g0RFbBrxzX5D5ExnxByw5NAA dTip7lNzyXRFI1g0RcX0WEKNfkhd5rfvde4pfnIvmbDJ70WYe8AZekZROK6Jib/8P8lPtRpopdVRSU Z8hOBuHfhnwl0MqD4uko9scu4ZeoZog+eZoJ/Co2Fj/vYxycPggxLuUljPumcPIB39BWHDWg5zeyzC eLV8Pn0/6X6F30tUzrk6ikLIoc4xpBHJS2OVlsC9ujWzmB/kTF4M8EU0Sw58buB4QHUobNvEUWQluR +r3HROyjJ710X8xllgGCuHxQoLP1KqQ== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: 941a59f6-4e75-11e9-908b-352056dbf2de X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.167.174 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-oi1-f174.google.com (unknown [209.85.167.174]) by outbound3.eu.mailhop.org (Halon) with ESMTPSA id 941a59f6-4e75-11e9-908b-352056dbf2de; Sun, 24 Mar 2019 20:44:13 +0000 (UTC) Received: by mail-oi1-f174.google.com with SMTP id x188so5385783oia.13; Sun, 24 Mar 2019 13:44:11 -0700 (PDT) X-Gm-Message-State: APjAAAVMJWKh1roAuuK8WmI8jyjD5x52J7lPbxiEeiaF1I5RYs3hNoFP Ihtgu/Kz9j+KLmuu8TBSJztYBrhwi6n/ft60WX4= X-Google-Smtp-Source: APXvYqzOL1WVwmgFT0dmHnlPqu6BUv+lgWaca2nyrqEtq9cU0G7mxxs94SstOwG5oCJtaDoqhyaH5YR3HKaR4h/kvBw= X-Received: by 2002:aca:e350:: with SMTP id a77mr9684247oih.82.1553460251111; Sun, 24 Mar 2019 13:44:11 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> In-Reply-To: <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> From: Patrick McManus Date: Sun, 24 Mar 2019 21:43:59 +0100 X-Gmail-Original-Message-ID: Message-ID: To: "Winfield, Alister" Cc: "sthaug@nethelp.no" , Eric Rescorla , "dnsop@ietf.org" , "doh@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" , "wjhns1@hardakers.net" Content-Type: multipart/alternative; boundary="00000000000070b8eb0584dd26ba" Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 20:44:20 -0000 --00000000000070b8eb0584dd26ba Content-Type: text/plain; charset="UTF-8" On Fri, Mar 22, 2019 at 11:15 AM Winfield, Alister wrote: > > Don't overplay the privacy provided by DoH it has no effect on the DNS > provider The major effect of the transport security on the privacy practices of the provider is that it allows the client to authenticate the provider. Trust in their privacy practices needs to be establish some other way (and the best way we have right now is 'out of band' - hopefully that gets better) - but with DoH you can be confident that you're having a private conversation with the entity you've decided to trust. That's a pretty big distinction from port 53. Without that assurance its reasonable to be concerned about what names you lookup. This of course applies to local and enterprise configs as well as the cloud configs contemplated by most of this thread. An enterprise DoH server expresses and enforces a policy - if an application needs to use that policy it should be comforted in transport security providing confirmation that it is doing so rather than reading in whatever might be showing up on port 53. --00000000000070b8eb0584dd26ba Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Fri, Mar 22, 2019 at 11:15 AM Winfield= , Alister <Alister.Winfield=3D40sky.uk@dmarc.ietf.org> wrote:

Don't overplay the privacy provided by DoH it has no effect on the DNS = provider

The major effect of the transport = security on the privacy practices of the provider is that it allows the cli= ent to authenticate the provider. Trust in their privacy practices needs to= be establish some other way (and the best way we have right now is 'ou= t of band' - hopefully that gets better) - but with DoH you can be conf= ident that you're having a private conversation with the entity you'= ;ve decided to trust. That's a pretty big distinction from port 53. Wit= hout that assurance its reasonable to be concerned about what names you loo= kup.

This of course applies to local and enterpris= e configs as well as the cloud configs contemplated by most of this thread.= An enterprise DoH server expresses and enforces a policy - if an applicati= on needs to use that policy it should be comforted in transport security pr= oviding confirmation that it is doing so rather than reading in whatever mi= ght be showing up on port 53.


--00000000000070b8eb0584dd26ba-- From nobody Sun Mar 24 14:04:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 287D5120110 for ; Sun, 24 Mar 2019 14:04:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, NORMAL_HTTP_TO_IP=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, WEIRD_PORT=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=i3FRKsTu; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=XkbbF0OY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pYo4WC93mXNg for ; Sun, 24 Mar 2019 14:04:21 -0700 (PDT) Received: from outbound1g.eu.mailhop.org (outbound1g.eu.mailhop.org [52.28.6.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4B0E0120106 for ; Sun, 24 Mar 2019 14:04:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553461459; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=p6nSeAU9LVbGQ5asxSZCm5AmTadMdEzxm4i3toII+XYoU1jMBRK0ssOdbYte9q/KDVQlADJS5dAiK sVMN6IPMuRmAr5/TEE2MwgR8sfAo087okGtAYExgVVVA3cb3k1pNH6PD9gwSFUZPpYYSpMuHxv3EG2 75dFC1dIiHNUydjB6bLCPB86ofWChn0d/M2udbeiugVAIX0JhcZz8ZMg/rzRMxpH448KfaGNpkCDOm DRhBxdRgPsl4//8LqluAI1W1LCyDP5bbeWOq7apD47rOiaKLTfNgU3eQ5Wyb6DWNC3BPoXVykjsYJj wW+mR6fXrmkH4iwUWDMdlm0RrPyAvCw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=357iTNs36rTGE4FAdb1limkEs0KPXKwV8LOZCXvJWgw=; b=GJkxZG/5c/CsckdelSQ9oM3bPr/dd/Gr4X3/Gky+GfAcPS+7KnSxmwVZMVSi/Sg2cqMix/V7eZrdL XJ8QuknOP+imRGQSn+zbYaB/lBlEo3RtXcz0z3dAFzm1I/xQKaUnxFaJdFDFZioojWaRbPCgC6rQyU 6hPiODfPbmGmRRV6pcrhM6B7mRXVHC3to+MaqHCrTrf8STkFsXh8PWPLN6mk9ITx4OJ5+8PSOXTWXQ a7mHVJ1A4RO5lB4v71trFfEhgFWC4wM0ZcZIeCVYc5L/LyJjzrEfDvmDwX3tgkT6mGPEsePu9ae/c3 0kxNWqFTVv+PAi/eEBKGzCrAetqcXYA== ARC-Authentication-Results: i=1; outbound3.eu.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.167.173; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=357iTNs36rTGE4FAdb1limkEs0KPXKwV8LOZCXvJWgw=; b=i3FRKsTuF/NZddtbqUDN2jQtSiu6wQZ4pBQr0yy9WEDUzSGJKHrRu0IGcGeCmxbxmuehmSXqX0mRf lshxw4/3kU89obg5DjhI1duQouRpr8dk0eIKQiymE1L2LRlxZuZ8bVqxXEXc/z+MiC7DQ4RGU9Zk8z NMtJ2ATkEi4odXMA= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=357iTNs36rTGE4FAdb1limkEs0KPXKwV8LOZCXvJWgw=; b=XkbbF0OYQJG1sAybniLPoaBzr+O6BA6WhTYKCad3+cQvvcTYP3R/qQw+QckbGz82NqoctW/LevnBP bDLYAw7Eb72GgCUBolgJzmL6YopJDEfjPU6Dn4vJ9XIrNrmDMy2DGV8Qj9VhYU5JE2RuVMk4vYjeFK ZkGPP4PYXhNdcOwSDJxVZCn/1qLvKkgA52Qo876wc6C3HyyVe554EQ+iBeF28FPmDors+FCyC9peeO fj7a0pLPzAJHoNG55zBidPHx3RRh1z6FytXFHQwf1cLLbvAyd5k1zFPDJLGVTMvmp8SNGXUcm5GIU+ 1qoZSZVXYjm0tjdkkQ0fUhQoNBND6gg== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: 62007c33-4e78-11e9-908b-352056dbf2de X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.167.173 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-oi1-f173.google.com (unknown [209.85.167.173]) by outbound3.eu.mailhop.org (Halon) with ESMTPSA id 62007c33-4e78-11e9-908b-352056dbf2de; Sun, 24 Mar 2019 21:04:16 +0000 (UTC) Received: by mail-oi1-f173.google.com with SMTP id t206so5434814oib.3; Sun, 24 Mar 2019 14:04:16 -0700 (PDT) X-Gm-Message-State: APjAAAXLve2G2PxPCFoebBhseFZfsyaOh0e+ZsJAzpwcnqj+03IIH71f T1fAOivtC+6SFWjliQwBYSkqHcZ/aQXXJycNJdM= X-Google-Smtp-Source: APXvYqy8x7aKxA2VK/QNAV4XdhOFRkMKY0Z6SpVgYJ7mle8tt01S7e6tiQ/EiZRsnCzp8L7crtvDsWMNwovQK7OmaPo= X-Received: by 2002:aca:4142:: with SMTP id o63mr9573899oia.58.1553461455595; Sun, 24 Mar 2019 14:04:15 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> In-Reply-To: From: Patrick McManus Date: Sun, 24 Mar 2019 22:04:04 +0100 X-Gmail-Original-Message-ID: Message-ID: To: Patrick McManus Cc: "Winfield, Alister" , "sthaug@nethelp.no" , Eric Rescorla , "dnsop@ietf.org" , "doh@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" , "wjhns1@hardakers.net" Content-Type: multipart/alternative; boundary="0000000000003baeca0584dd6ed2" Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 21:04:24 -0000 --0000000000003baeca0584dd6ed2 Content-Type: text/plain; charset="UTF-8" I want to add one thought to the general argument that goes along the lines of "I need to enforce a policy on my network, and doh will just encourage more https interception - we have gotten nowhere." This argument assumes a scenario where the network is trusted by the application and can require/achieve host or application configuration. Indeed - deploying trust anchors to these clients is the only way you're going to intercept https as the notion of network defined configuration of "trusted proxies" and the like is consistently rejected by clients. That seems like the right standard for DNS as well - go ahead and configure a different policy but do it via an existing authenticated configuration mechanism like you would use for adding a trust root. However, rather than adding a root I would suggest that if you're doing client configuration for network-local DNS policy, that you deploy a DoH server that enforces that policy and point DoH clients at it through the various enterprise config mechanisms. It doesn't require any kind of access that adding a trust root does not. This has the desirable property that the application can reliably know what server is providing DNS service in a fully authenticated way. Perhaps in a "my way or the highway" scenario it will choose the highway. That's fair enough - that should be a real choice. When you just intercept 8.8.8.8:53 an informed decision cannot be made. Use of non-default trust roots is also a property generally visible to applications. Most allow it as a matter of user configuration. -Patrick --0000000000003baeca0584dd6ed2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I want to add one thought to the general argument that goe= s along the lines of "I need to enforce a policy on my network, and do= h will just encourage more https interception - we have gotten nowhere.&quo= t;

This argument assumes a scenario where the network is= trusted by the application and can require/achieve host or application con= figuration. Indeed - deploying trust anchors to these clients is the only w= ay you're going to intercept https as the notion of network defined con= figuration of "trusted proxies" and the like is consistently reje= cted by clients. That seems like the right standard for DNS as well - go ah= ead and configure a different policy but do it via an existing authenticate= d configuration mechanism like you would use for adding a trust root.
=

However, rather than adding a root I would suggest that= if you're doing client configuration for network-local DNS policy, tha= t you deploy a DoH server that enforces that policy and point DoH clients a= t it through the various enterprise config mechanisms. It doesn't requi= re any kind of access that adding a trust root does not. This has the desir= able property that the application can reliably know what server is providi= ng DNS service in a fully authenticated way. Perhaps in a "my way or t= he highway" scenario it will choose the highway. That's fair enoug= h - that should be a real choice.=C2=A0 When you just intercept 8.8.8.8:53 an informed decision cannot be made.

Use of non-default trust roots is also a property gene= rally visible to applications. Most allow it as a matter of user configurat= ion.

-Patrick


<= div>
--0000000000003baeca0584dd6ed2-- From nobody Sun Mar 24 14:32:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 885F112012B; Sun, 24 Mar 2019 14:31:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xPWAzbe85ZKh; Sun, 24 Mar 2019 14:31:55 -0700 (PDT) Received: from mail-wr1-x42c.google.com (mail-wr1-x42c.google.com [IPv6:2a00:1450:4864:20::42c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5148112012F; Sun, 24 Mar 2019 14:31:55 -0700 (PDT) Received: by mail-wr1-x42c.google.com with SMTP id w10so7917107wrm.4; Sun, 24 Mar 2019 14:31:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PW4TwbPSuqXeHJxCfOIizjbYCIfGUJ66gDdsbv7wr1M=; b=VhFpud1YbwhMCK8BiH6sr7zp4l3MO0qLzqVk4TU2YQdr9G684t5J32NPS4PnYAOwOt TSh4K0/R4BFFXPLgE8/TH8JUjFCBny6J1l90clvJlPG8oGHOdOU3BARRhiS4bgH8Y1vX +n7lhEzReBgoH7nN0i4KB1fPqdSVjtOy3jqJR4QguzjG81NRIlTrCpqRCHjN3witTux3 yWXqcRyZrg6tdOPh66jGB/77fv1yfC3KHexNZuAoRqwWimr0W6NqnFkiLiDmGYHQFIPN D9Yc7sXJKZ8ib1KSb6FkpI70rN1qilEaEJdjCgXb7sGDjHA/o4amxFjjBfmXPFf+P7U5 W4WA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=PW4TwbPSuqXeHJxCfOIizjbYCIfGUJ66gDdsbv7wr1M=; b=cA6ybR7CFnJNp8fzQ4jtXsVS8zejUsdYmj6EbJakYsSwvyEqSjaIyqwlAmpi/BOMJP XCVg8T6IMDZ74g/YjVPtUTEXLMFxsrH+nb1NtpVYsT44ltpCKnTWQjcvAhmW0KyX6y4/ c60rkg5m2A2tRIaLc0Afq695nJMrnOJ3W7uGXOOGMPXUax3l5M9XNyDekAvnCvqLR7b3 kQxR2XAKOi4iNrfqDyR+qXjEgyP9ybBBpV9+xzaQ8gDCM8eNJTrrurnsL1d3qiYXe0tL EgJt/HS7psLYOz2zYP0aw1eaFIhyZwSxA6pHEHQu/WWCAdTlURR9IXA9jT9eyf4+jxNq UJlA== X-Gm-Message-State: APjAAAVDhYyYVHu44b9KrXveu6qPsNsV40DjAXZqjb6JwfvEOQwS5oCv XNUUGWkLQ1BMZo2MOxPak0RX074wFoWiTw== X-Google-Smtp-Source: APXvYqyj4PvfbObqzPiCoZRq6DW/+foZnTSoWNyCDsAFbYkj9+AhRNJ/JKJyYcaDumm9Han8VibcZg== X-Received: by 2002:a5d:698b:: with SMTP id g11mr10605651wru.65.1553463113556; Sun, 24 Mar 2019 14:31:53 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:edb7:d3e6:fffe:6c7a? ([2001:67c:1232:144:edb7:d3e6:fffe:6c7a]) by smtp.gmail.com with ESMTPSA id k4sm5181799wro.33.2019.03.24.14.31.52 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 24 Mar 2019 14:31:52 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-4CFAF010-C3B3-437D-840A-8C7902E8D592 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16D57) In-Reply-To: Date: Sun, 24 Mar 2019 22:31:52 +0100 Cc: "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> To: Patrick McManus Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 21:31:58 -0000 --Apple-Mail-4CFAF010-C3B3-437D-840A-8C7902E8D592 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Sent from my iPhone >> On Mar 24, 2019, at 9:43 PM, Patrick McManus wrote= : >>=20 >>=20 >=20 >> On Fri, Mar 22, 2019 at 11:15 AM Winfield, Alister wrote: >>=20 >> Don't overplay the privacy provided by DoH it has no effect on the DNS pr= ovider >=20 > The major effect of the transport security on the privacy practices of the= provider is that it allows the client to authenticate the provider. Trust i= n their privacy practices needs to be establish some other way (and the best= way we have right now is 'out of band' - hopefully that gets better) - but w= ith DoH Minor correction: with DoH or DoT ... > you can be confident that you're having a private conversation with the en= tity you've decided to trust. That's a pretty big distinction from port 53. W= ithout that assurance its reasonable to be concerned about what names you lo= okup. >=20 > This of course applies to local and enterprise configs as well as the clou= d configs contemplated by most of this thread. An enterprise DoH server Minor correction: An enterprise DoH and/or DoT server... > expresses and enforces a policy - if an application needs to use that poli= cy it should be comforted in transport security providing confirmation that i= t is doing so rather than reading in whatever might be showing up on port 53= . The only point I=E2=80=99m making in the above is there is no meaningful dis= tinction in the privacy, security, or server validation between DoH vs DoT. There is one important difference, which is that DoT uses a unique port numb= er. This is important for network operators in identifying encrypted DNS tra= ffic, in order to ensure that implementation of security policies for DNS do= n=E2=80=99t conflict with any other network policies (regardless of what tho= se policies are.) IMNSHO, if both ports are reachable for a given provider of Do*, the DoT por= t MUST be used. DoH should only be used with explicit informed user consent,= and only when DoT is unavailable. This supports the =E2=80=9Cdissident=E2=80= =9D use case, without impacting any other aspects of privacy provided by DoT= . The blocking of DoT to a given provider should be interpreted as an explicit= policy. Users should be informed that they may, and very likely will, be vi= olating someone=E2=80=99s policy, if they choose to use DoH in that circumst= ance, and that they may be violating laws by doing so, and should only do so= if they are willing to accept that risk. There is no reason DoH should be used if DoT works (towards the same DNS pro= vider). Brian=20 --Apple-Mail-4CFAF010-C3B3-437D-840A-8C7902E8D592 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable


Sent from my iP= hone

On Mar 24, 2019, at 9:43 PM, Patrick McManus &= lt;mcmanus@ducksong.com> wrot= e:

=

On Fri, Mar 22, 2019 at 11:15 AM Winfield, Alister <Alist= er.Winfield=3D40sky.uk@dmarc.ietf= .org> wrote:

Don't overplay the privacy provided by DoH it has no effect on the DNS provi= der

The major effect of the transport securi= ty on the privacy practices of the provider is that it allows the client to a= uthenticate the provider. Trust in their privacy practices needs to be estab= lish some other way (and the best way we have right now is 'out of band' - h= opefully that gets better) - but with DoH

Minor correction: with DoH or DoT ...

you= can be confident that you're having a private conversation with the entity y= ou've decided to trust. That's a pretty big distinction from port 53. Withou= t that assurance its reasonable to be concerned about what names you lookup.=

This of course applies to local and enterprise con= figs as well as the cloud configs contemplated by most of this thread. An en= terprise DoH server

Minor correction:= An enterprise DoH and/or DoT server...

expr= esses and enforces a policy - if an application needs to use that policy it s= hould be comforted in transport security providing confirmation that it is d= oing so rather than reading in whatever might be showing up on port 53.


The only point I=E2=80= =99m making in the above is there is no meaningful distinction in the privac= y, security, or server validation between DoH vs DoT.

There is one important difference, which is that DoT uses a unique port n= umber. This is important for network operators in identifying encrypted DNS t= raffic, in order to ensure that implementation of security policies for DNS d= on=E2=80=99t conflict with any other network policies (regardless of what th= ose policies are.)

IMNSHO, if both ports are reacha= ble for a given provider of Do*, the DoT port MUST be used. DoH should only b= e used with explicit informed user consent, and only when DoT is unavailable= . This supports the =E2=80=9Cdissident=E2=80=9D use case, without impacting a= ny other aspects of privacy provided by DoT.

The bl= ocking of DoT to a given provider should be interpreted as an explicit polic= y. Users should be informed that they may, and very likely will, be violatin= g someone=E2=80=99s policy, if they choose to use DoH in that circumstance, a= nd that they may be violating laws by doing so, and should only do so if the= y are willing to accept that risk.

There is no reas= on DoH should be used if DoT works (towards the same DNS provider).

Brian 

= --Apple-Mail-4CFAF010-C3B3-437D-840A-8C7902E8D592-- From nobody Sun Mar 24 14:42:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1DCD9120074 for ; Sun, 24 Mar 2019 14:42:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=CDBG5INb; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=bjSU25bw Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KALi68YLsUGK for ; Sun, 24 Mar 2019 14:42:24 -0700 (PDT) Received: from outbound1f.eu.mailhop.org (outbound1f.eu.mailhop.org [52.28.59.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A08F4120135 for ; Sun, 24 Mar 2019 14:42:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553463741; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=Vptmz0Ts5egGmk31GwM6vGyJOjZspifYj6ELXlV3FPK3RyXQ/GaEQ9BqHPfIRPtokVTCVogSn3Xk9 gwX1BOU7cE1VxNx5jBOh531yEs3hzY30NbHZWfcf7eTyA9x8gw5TUOIpX+xt0o8PdfchnAVof/UKp8 yHIeSN4atw6GrFX95duZg5LmVfOqCifxUtH2TgFsjDioCAthLMwRNJjfEeeJt2FzNkQDwrLzDymUc8 qVGaVcFS4h4AipgU+2nki+JZbNjizVuh1gupWxO+NTNOKQj0moxzPw+SQOticy0N7s88GRbzvoldNQ 3rCQ+7xnsOr5WerdJAMzNZ8ZLViAWkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=0BvISl7zrY7tPc9i36BRxkkYz5uDVSQYNcM83yf7QeU=; b=KfOSGHOPtQI/PzMUk7uHRy3tyXc1YfUMVbezlVIndOxR3oVSk2J9Iksd/sa+Krf/xQMD3YRl8BzHb p1U6CBrEfOx24WbOyozUTjaa54DHi9zsboGK+pdCFQGSBxXyGB7i+3MzXtCJDphDzpgOZqebypgV+F wRQO9IibVBuJpnHpJgKIQ6nDVziTCgFd20reKIpkyDZzlsXfiIRYrd0T6/myiZVEfNlw/4v1Rg48LG MOUQaF48fcUtbreNR0p+UI541K36vWNjszS7j6B4Hb6xvmEp4x2Muyin0EjxRyMjH0E2u6wUmVXdEx ijq9IyPrDdOVuXguWoU1zaYBKZAYRww== ARC-Authentication-Results: i=1; outbound2.eu.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.167.175; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=0BvISl7zrY7tPc9i36BRxkkYz5uDVSQYNcM83yf7QeU=; b=CDBG5INbKW+ykNnvYWsPdOSnBfrY+YFxlwlB/Q19xzYgKNGJn4Bs0WqIdbMDnneUyhu1Vt+tO0tJ0 XmgGLgUzfkdVsmev9rOVwZWNTtAifz2NI5LR2roX5HDwhcnrXgvL7FPnGalsWoeK5iy8LJuCY9i+tk qJiYMDOjEILpkxe4= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=0BvISl7zrY7tPc9i36BRxkkYz5uDVSQYNcM83yf7QeU=; b=bjSU25bwkeXhS0ecU+/rtHnEuz10rbnyPGD/W/XRnMiA+Ze/xubFiAHrYnya5j7vq0kChyJgC6XnH d5wu9v1h+09Xfw1GZ+O63qfCNR1Utfyr9YNjwy8cVKV5Hw1DDUfBtuZif8THfmC+RBcDgSkKCebXBm hqxeofv4naIILjGT6zsnzrchYbTTUCCdhVJkmm0mq+TZyEFgcH9WgJNgzZRsM6/cWoX0xMm7g8Ao0p OTYWzxfhzPzb9TEXwV2sNZHGqKnJoYCi1I/HFRZRvjubjvU/bITlBTp970d++GG9TUdf/RIgN4WTQu SrOV2A1hQPts6n9ckcseQb5DO4b2Z2Q== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: b290781d-4e7d-11e9-803b-31925da7267c X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.167.175 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-oi1-f175.google.com (unknown [209.85.167.175]) by outbound2.eu.mailhop.org (Halon) with ESMTPSA id b290781d-4e7d-11e9-803b-31925da7267c; Sun, 24 Mar 2019 21:42:19 +0000 (UTC) Received: by mail-oi1-f175.google.com with SMTP id v84so5481357oif.4; Sun, 24 Mar 2019 14:42:18 -0700 (PDT) X-Gm-Message-State: APjAAAUEHHcrBYUTIxZhAk+k6YrEU2iGKDfpgaSZqcw79CcVz6Fup9Mv ZfmZZE3884ybD8oobSgJybdWn/VcjYWEBlTeQBg= X-Google-Smtp-Source: APXvYqz5eZtYx6dxl1WFmS39VM/Apca3IHAGArcAd0KlGzHAGZOnh3jHrXT4gVXm5ONzbZX3yFS4Sg1RBjQw4XlFg+c= X-Received: by 2002:aca:4142:: with SMTP id o63mr9654696oia.58.1553463738259; Sun, 24 Mar 2019 14:42:18 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> From: Patrick McManus Date: Sun, 24 Mar 2019 22:42:07 +0100 X-Gmail-Original-Message-ID: Message-ID: To: Brian Dickson Cc: Patrick McManus , "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="0000000000004a603a0584ddf652" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 21:42:26 -0000 --0000000000004a603a0584ddf652 Content-Type: text/plain; charset="UTF-8" On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < brian.peter.dickson@gmail.com> wrote: > > This is important for network operators in identifying encrypted DNS > traffic, > not all clients acknowledge a network's right to do such things at all times. And of course it would be useful to tell the difference between policy and a RST injection attack. If the client does acknowledge the network has the right to set policy - then the policy can be set on the client using existing configuration mechanisms that allow the client to differentiate between authorized configuration and perhaps less-authorized folks identifying their DNS traffic. This is well worn ground in the HTTP space. > --0000000000004a603a0584ddf652 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Sun, Mar 24, 2019 at 10:31 PM Brian Di= ckson <brian.peter.dick= son@gmail.com> wrote:

This is important for network operators in identifying en= crypted DNS traffic,

not= all clients acknowledge a network's right to do such things at all tim= es. And of course it would be useful to tell the difference between policy = and a RST injection attack.

If the client does ack= nowledge the network has the right to set policy - then the policy can be s= et on the client using existing configuration mechanisms that allow the cli= ent to differentiate between authorized configuration and perhaps less-auth= orized folks identifying their DNS traffic. This is well worn ground in the= HTTP space.




--0000000000004a603a0584ddf652-- From nobody Sun Mar 24 15:14:06 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5F0E12015E; Sun, 24 Mar 2019 15:14:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xgzR64k56keN; Sun, 24 Mar 2019 15:14:03 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0D26012015F; Sun, 24 Mar 2019 15:14:02 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 952F96A277; Sun, 24 Mar 2019 23:13:59 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1553465639; bh=joWe2EVIVvMfA6N/oVQ1N1QyZjeuPKNHHiufPO0akB4=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=li9L8FMYsbvO3JgOSdoSUpuTjoLH5QOZVQ+sMvfL4ONukFa4I3AFipqdR9lk2BT3w cHwb+NjMa5+YoU58kP49iERUUs3sWgj95CJ99b7lbTVBDyCiPy1fZFybblwHKec2bY 7YxE9OllZ3ZFhI1NCFhK3EOJZyYaf/8TiqjODAb7gVTKRH33rD45QhiigN8zu1CFwY AI71vazvJgrvaTiwdb6v1hCK/LVWS9ATpJc4wr7QmZR5GrgZPylGIJDzCTGQesZrTY eiZTaVvTcmm7ZZhYU+NUXyUJ/Uh5d2aLCVf3t7GPlHJO66I+24dWH+w0U0lDtfGllX icQyRpdqyo9Jw== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 7BC6C3C0019; Sun, 24 Mar 2019 23:13:59 +0100 (CET) Date: Sun, 24 Mar 2019 23:13:58 +0100 (CET) From: Vittorio Bertola To: Patrick McManus Cc: dnsop@ietf.org, doh@ietf.org Message-ID: <128237212.13389.1553465639438@appsuite.open-xchange.com> In-Reply-To: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_13388_1300451080.1553465639431" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 22:14:06 -0000 ------=_Part_13388_1300451080.1553465639431 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 24 marzo 2019 alle 22.42 Patrick McManus ha scritto: > > > On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < brian.peter.dickson@gmail.com mailto:brian.peter.dickson@gmail.com > wrote: > > > > > > > > This is important for network operators in identifying encrypted DNS traffic, > > > > > > not all clients acknowledge a network's right to do such things at all times. And of course it would be useful to tell the difference between policy and a RST injection attack. > > If the client does acknowledge the network has the right to set policy - then the policy can be set on the client using existing configuration mechanisms that allow the client to differentiate between authorized configuration and perhaps less-authorized folks identifying their DNS traffic. This is well worn ground in the HTTP space. > Let's say I just bought a new smart TV that can browse the Internet, but I don't want my kids to be able to access inappropriate websites from it. Or, let's say I actually like the fact that my operator filters out malware destinations at the DNS level and I want my new TV to have that protection as well. In today's "plain DNS" world, I choose a DNS resolver that provides that kind of filters for me, I set it up on my router, and my router pushes it to my smart TV via DHCP. What is the "existing configuration mechanism" that allows me to set this policy in the DoH world, i.e. if the TV came equipped with applications preconfigured to use their own remote resolver via DoH? As a minimum, I would have to open all the applications and configure them one by one to use my desired resolver, and repeat this for every device connected to my network - while in the current situation this is all automated after I configure the resolver once on my router. But applications like Firefox might completely refuse to use the resolver I want, advertised by my router on my behalf, because it does not support DoH, or it does but is not on their list of "trusted resolvers". And Javascript bits in the pages I visit might use DoH to pre-encoded servers without even offering me any configuration. Regards, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_13388_1300451080.1553465639431 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Il 24 marzo 2019 alle 22.42 Patrick McManus <mcmanus@ducksong.com> ha scritto:


On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < brian.peter.dickson@gmail.com> wrote:


This is important for network operators in identifying encrypted DNS traffic,

not all clients acknowledge a network's right to do such things at all times. And of course it would be useful to tell the difference between policy and a RST injection attack.

If the client does acknowledge the network has the right to set policy - then the policy can be set on the client using existing configuration mechanisms that allow the client to differentiate between authorized configuration and perhaps less-authorized folks identifying their DNS traffic. This is well worn ground in the HTTP space.
Let's say I just bought a new smart TV that can browse the Internet, but I don't want my kids to be able to access inappropriate websites from it. Or, let's say I actually like the fact that my operator filters out malware destinations at the DNS level and I want my new TV to have that protection as well.

In today's "plain DNS" world, I choose a DNS resolver that provides that kind of filters for me, I set it up on my router, and my router pushes it to my smart TV via DHCP. What is the "existing configuration mechanism" that allows me to set this policy in the DoH world, i.e. if the TV came equipped with applications preconfigured to use their own remote resolver via DoH?

As a minimum, I would have to open all the applications and configure them one by one to use my desired resolver, and repeat this for every device connected to my network - while in the current situation this is all automated after I configure the resolver once on my router. But applications like Firefox might completely refuse to use the resolver I want, advertised by my router on my behalf, because it does not support DoH, or it does but is not on their list of "trusted resolvers". And Javascript bits in the pages I visit might use DoH to pre-encoded servers without even offering me any configuration.

Regards,

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
------=_Part_13388_1300451080.1553465639431-- From nobody Sun Mar 24 15:25:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CC77120161; Sun, 24 Mar 2019 15:25:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nohats.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aruJIySc27zT; Sun, 24 Mar 2019 15:25:07 -0700 (PDT) Received: from mx.nohats.ca (mx.nohats.ca [IPv6:2a03:6000:1004:1::68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A5E81120163; Sun, 24 Mar 2019 15:25:06 -0700 (PDT) Received: from localhost (localhost [IPv6:::1]) by mx.nohats.ca (Postfix) with ESMTP id 44SBm054s0zHVd; Sun, 24 Mar 2019 23:25:04 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=nohats.ca; s=default; t=1553466304; bh=ISB3fFIpn2eXyYDoNgZRV3H4Di3+NlOWfKVu5u6BZ6Y=; h=Date:From:To:cc:Subject:In-Reply-To:References; b=EsoyFWOynFO7h9Ixhb014gKjfGdGCX4v4QwkFcBniwgxIK+/C4/WMOpk64c1Grr4C bsD3rKDzhZO13tc67Kjs8m7rkCPWlrVsVNAV8KAsfeo/Wul1QtbJX2kpzRiVr3sx08 TYJ3bgEX/r3lutMowHN37/DOdRcroZMpIbQWQi94= X-Virus-Scanned: amavisd-new at mx.nohats.ca Received: from mx.nohats.ca ([IPv6:::1]) by localhost (mx.nohats.ca [IPv6:::1]) (amavisd-new, port 10024) with ESMTP id Ht107-_iqfrf; Sun, 24 Mar 2019 23:25:03 +0100 (CET) Received: from bofh.nohats.ca (bofh.nohats.ca [76.10.157.69]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx.nohats.ca (Postfix) with ESMTPS; Sun, 24 Mar 2019 23:25:02 +0100 (CET) Received: by bofh.nohats.ca (Postfix, from userid 1000) id 83E422FCD9; Sun, 24 Mar 2019 18:25:01 -0400 (EDT) DKIM-Filter: OpenDKIM Filter v2.11.0 bofh.nohats.ca 83E422FCD9 Received: from localhost (localhost [127.0.0.1]) by bofh.nohats.ca (Postfix) with ESMTP id 790D240D358A; Sun, 24 Mar 2019 18:25:01 -0400 (EDT) Date: Sun, 24 Mar 2019 18:25:01 -0400 (EDT) From: Paul Wouters To: Brian Dickson cc: "doh@ietf.org" , "dnsop@ietf.org" In-Reply-To: <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> Message-ID: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> User-Agent: Alpine 2.21 (LRH 202 2017-01-01) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8BIT Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 22:25:09 -0000 On Sun, 24 Mar 2019, Brian Dickson wrote: > There is one important difference, which is that DoT uses a unique port number. This is important for network > operators in identifying encrypted DNS traffic, in order to ensure that implementation of security policies for > DNS don’t conflict with any other network policies (regardless of what those policies are.) The network cannot "ensure" this based on DNS. I can come on to the network with a DNS cache already, which is the functional equivalent of me refreshing my personal cache using a sneaky HTTPS connection. The network can never control my DNS cache. I won't let it. So while it was perhaps nice that network operators _could_ help in such a case, it was never a real defense against a smart network "abuser". > IMNSHO, if both ports are reachable for a given provider of Do*, the DoT port MUST be used. DoH should only be > used with explicit informed user consent, and only when DoT is unavailable.. This supports the “dissident” use > case, without impacting any other aspects of privacy provided by DoT. If the network allows DoT, clearly it does not care about DoH being used? Since it will also not be able to read DoT to a remote server like the Quads. So I do not understand what is gained by such a policy. Unless you meant "must use a local DoT server first", in which case we are again shifting the discussion towards when can or should you trust a network for anything but relaying IP packets. Because then you basically demand access to my decrypted DNS stream. Why should I ever use a starbucks DNS server, regardless of whether I use DoT or DoH or plain 53? On almost every network I connect to, I only want one service: "relay my (encrypted) IP packets". The rest of the services I obtain from trusted sources elsewhere, using this ephemeral network as an insecure transport only. So your policy above that you propose really assumes a lot about the network, namely that you are considered hostile to the network and that you trust that network more than your own device. That's a very specific application. It basically never applies to me unless I join an enterprise network with an enterprise device, and then we have other ways for the enterprise to enforce things on their device. > The blocking of DoT to a given provider should be interpreted as an explicit policy. Users should be informed > that they may, and very likely will, be violating someone’s policy, if they choose to use DoH in that > circumstance, and that they may be violating laws by doing so, and should only do so if they are willing to > accept that risk. Again, this is the network operator centric view. There are many hostile networks that would block DoT just so that they could monetize (legally or illegally!) from my harvested DNS data. I can assure you the warning you want to write to users would be very different from the warning I would want to give those users. Which is why the IETF doesn't do banners towards endusers. Besides, why should the network operator have a say about when I want my device to connect to my remote servers? Do you want my VPN client to throw the same warning around that it might be against the network operator's wishes to inspect all my traffic and it might be against the law to circumvent it? Then you also have to do that for _all_ TLS connections, and make the internet go back to port 80. Why is there a different expectation of website content monitoring versus dns content monitoring? You shouldn't have access to either. > There is no reason DoH should be used if DoT works (towards the same DNS provider). If DoT works to dot.nohats.ca, which you cannot decrypt, why do you care whether I use DoH to that server or not? Paul From nobody Sun Mar 24 16:19:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0D5311201E7 for ; Sun, 24 Mar 2019 16:19:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.235 X-Spam-Level: X-Spam-Status: No, score=-1.235 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_SOFTFAIL=0.665, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=zeit-co.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O0SNF8g9t6Y8 for ; Sun, 24 Mar 2019 16:19:12 -0700 (PDT) Received: from mail-lj1-x244.google.com (mail-lj1-x244.google.com [IPv6:2a00:1450:4864:20::244]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C318D1201E5 for ; Sun, 24 Mar 2019 16:19:11 -0700 (PDT) Received: by mail-lj1-x244.google.com with SMTP id t13so6165844lji.2 for ; Sun, 24 Mar 2019 16:19:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=zeit-co.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=2UsgL5LxolIDwz9iTIPHJEHjSjIe04bciK9cJH1ESag=; b=1pDNzNJky+z0k77dMyZQlyJZggVcub8BdrfggeCrLPS2h/TC/65nmHW2QsRlRXFsM2 4l9Ps6dMATcy5qMCJAkQwrRHxRZl6H85OFTNvM+aUEfw2cJbh+7iqSBQcHbG00T0XFFK Hj4xAhu1K07s3+mnh1Ntgz+LEim2CeTGiaHn8UAn2LsWzS8MggKdfv8HyMZeEGCKRmx/ Ynrv3ifGYeXRGDBHTeg6sEqJbTP+GlaMIkH0l2TZeicq+885km8CPCivRaN4DIYSS3U3 35Y75t4WdQvh4hcOTzPuG6XLzBpZK5Imj72Fn56sx4u/3+1iCTfQGMJbBTa+VwaDqCRh NsQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=2UsgL5LxolIDwz9iTIPHJEHjSjIe04bciK9cJH1ESag=; b=iXxG9Ci18pV88oXYHaCBteITUNaKF6pgOn1jY/sDAWUUA0sOX7g2WLy3o+8ey1VEQx NECsWh3SULU8opbFaK61bugx8tnSPe4kZaq81A86OIupyAEkIuOkB5Di1mAftipmybgU 1oisY7fu9KnLzfeA0cR99JOAOo/Kh4I7TzH48LOMWIAIOMec4GEYLf8zE5C3f9cGKfHZ saNtABjJVdRG4iTUtLaX1UjVB26keZjRi+M99fdZpeMDjkxxoGy0Lx28BN7jo1ZE74KN PVnI+Y3KwEVBWorpvKN0siMICKR6Tjf2OdoMOzdzQjTDOmGJ9MBm/Pymwovce7vLZhE3 SIRw== X-Gm-Message-State: APjAAAV3do5DwZWRtjSEhyAd+RpmRUfojqRIAoIbJ+Z6X6UcviFXoX3v /LcO9Yf9QK5m1jjj3EqxmHw9kgCFtzcLfNltJX2t1Q== X-Google-Smtp-Source: APXvYqxIL+OpS71EnM8t+TdXUYbiwwtfN9kOWW+v3RfVk8rsaQZFw37LT417AkEIzh39c4yRDRHOUy/SQk6xVY4jI4I= X-Received: by 2002:a2e:1245:: with SMTP id t66mr11639254lje.18.1553469549841; Sun, 24 Mar 2019 16:19:09 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <128237212.13389.1553465639438@appsuite.open-xchange.com> In-Reply-To: <128237212.13389.1553465639438@appsuite.open-xchange.com> From: Olli Vanhoja Date: Mon, 25 Mar 2019 00:18:58 +0100 Message-ID: To: Vittorio Bertola Cc: Patrick McManus , dnsop , doh@ietf.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Mar 2019 23:19:13 -0000 On Sun, Mar 24, 2019 at 11:14 PM Vittorio Bertola wrote: > > In today's "plain DNS" world, I choose a DNS resolver that provides that = kind of filters for me, I set it up on my router, and my router pushes it t= o my smart TV via DHCP. What is the "existing configuration mechanism" that= allows me to set this policy in the DoH world, i.e. if the TV came equippe= d with applications preconfigured to use their own remote resolver via DoH? > > As a minimum, I would have to open all the applications and configure the= m one by one to use my desired resolver, and repeat this for every device c= onnected to my network - while in the current situation this is all automat= ed after I configure the resolver once on my router. But applications like = Firefox might completely refuse to use the resolver I want, advertised by m= y router on my behalf, because it does not support DoH, or it does but is n= ot on their list of "trusted resolvers". And Javascript bits in the pages I= visit might use DoH to pre-encoded servers without even offering me any co= nfiguration. > I think configuring every application, operating system, or platform to do the filtering is the right way regardless of the existence of DoH. I wouldn't trust that the opinion given by a DHCP server is what will be really used by all clients. If you need to check that's what is really happening, wouldn't it require about the same effort to configure the parental control features that are already provided by many vendors. I also believe that's a lot easier thing to do for the average user. If you really want a DIY solution, why don't you look into the actual HTTP(S) traffic and SNIs? From nobody Sun Mar 24 17:10:40 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4822612022E; Sun, 24 Mar 2019 17:10:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id suWIYYxcAZvZ; Sun, 24 Mar 2019 17:10:27 -0700 (PDT) Received: from mail-qt1-x82a.google.com (mail-qt1-x82a.google.com [IPv6:2607:f8b0:4864:20::82a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B9AE12022B; Sun, 24 Mar 2019 17:10:27 -0700 (PDT) Received: by mail-qt1-x82a.google.com with SMTP id z16so8434725qtn.4; Sun, 24 Mar 2019 17:10:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=psNm504avbhSBDSUuFa+kC8Bnsssf70B2UyAO5GY/XE=; b=V5jX6cag0n4rWkR2CACcO/gRB/BSu1DZKc1cDOfy+4npYVaXzmaSn3GwOJePPiKXaB SEeGsAO1kSIgnN+8rHzmAkYFnyX7+6EGNS1bLwQBJUpe3IzrxKm6EQ4YsawqKBeXxH2r EmRK15IWcfBNrqIxpN9lcwuLUEfgC6Owwp++iUq4IcNS3wc2FzYS2Or+G/RbEKnS3V25 K3M8Lx7jjVcl+StSebUAB/6D7umU+gU4ESpyxbni0fZvSa641WBnzZa0aEFjNNO7+0g9 5HGlGDp86BiOJfJ04v3wmt2kngVaZ3QYujO9nDUFl/EgQcX/YZ6fIY8YEd9HOft1CYhU d7Pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=psNm504avbhSBDSUuFa+kC8Bnsssf70B2UyAO5GY/XE=; b=LjYSbtDvwI0X76i+1N5jhQiUTNAT79h5byGe4aPFptmNIY52bskPVsQI21iGjinMCf 3u7do5yzP/eU/655lSD6WQvppdg87cXQM2u1CwYB9VbUoZ374j21J0nyPcTbH8zbGYN1 6VxZJApn9aObeQKE+flYaT39MwB92ZGSNuqtvM/iPfXaxRiDECsicx99obKfiAc2hLfi 2W57SOlJbqt/zn92ooVuqzSiXrJt+X5IWqJJ683ploJ8NIHa6jieHH3g08VU+ovWjj0k puu3yNod7URDA6QueJy61VR1Kftcfu2ZLC6cCzVVoAIk6NRRlGGtIODgvro0mLKLg3XH vhoA== X-Gm-Message-State: APjAAAWfZ/jMF0Ujq3Q6hPVqmrAD417jIiIHM6hg8ICsAMM/CbMMpp55 GYI1McI48mceZcFZgMAUjP/IWb8rWQpm3w27Im73aFv7R+Y= X-Google-Smtp-Source: APXvYqwyHOpw7CXdHgMk/etpuA5AOeknwJyRPR6ewE7dEq5uD8MwHyZX23uKsCyKhL0MQ1bGHz56Z48o0vrXaOAoAWU= X-Received: by 2002:ac8:30ea:: with SMTP id w39mr18683955qta.351.1553472626549; Sun, 24 Mar 2019 17:10:26 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Brian Dickson Date: Mon, 25 Mar 2019 01:10:10 +0100 Message-ID: To: Paul Wouters Cc: "doh@ietf.org" , "dnsop@ietf.org" Content-Type: multipart/alternative; boundary="00000000000012e9770584e0088e" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 00:10:33 -0000 --00000000000012e9770584e0088e Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Sun, Mar 24, 2019 at 11:25 PM Paul Wouters wrote: > On Sun, 24 Mar 2019, Brian Dickson wrote: > > > There is one important difference, which is that DoT uses a unique port > number. This is important for network > > operators in identifying encrypted DNS traffic, in order to ensure that > implementation of security policies for > > DNS don=E2=80=99t conflict with any other network policies (regardless = of what > those policies are.) > > The network cannot "ensure" this based on DNS. I can come on to the > network with a DNS cache already, which is the functional equivalent > of me refreshing my personal cache using a sneaky HTTPS connection. > The network can never control my DNS cache. I won't let it. > > So while it was perhaps nice that network operators _could_ help in such > a case, it was never a real defense against a smart network "abuser". > > I am trying to keep conversation sub-threads specific to single variables. In this case, I am interested in policy enforcement mechanisms, not what the policy is or who it applies to. The assumption in the above is that the network operator has some policy (regardless of what it is) that it would like to enforce between some (or possibly all) hosts, towards encrypted DNS services. If the operator blocks all DoH, but does something less restrictive for DoT, then the policies applied on DoT are the ones that have the desired effect. Yes, this is network-centric, or more specific, network-security-centric. >From the perspective of the network policy enforcement, the applicable rules involve 3-tuples of source, destination, and port 853 (plus TCP but not UDP). Any such rules, when explicitly applied only to port 853, by definition have no direct bearing on any destinations for port 443 (HTTPS). These rules only need to be updated if/when new "permit" rules for new DoT servers are added. This is a white-list model, which scales very nicely. However, the blocking of specific DoH servers becomes an absolute nightmare, in that the network operator needs continuously monitor information from any number of sources (of various degrees of completeness, trustworthiness, timeliness, etc), for new DoH servers, along with an ongoing policy maintenance on (allow vs deny). This is, by its very nature, a black-list model, which does not scale nicely, and consequently reduces the overall security, from the perspective of the network operator (or network security department of the enterprise network). (See my previous message detailing *why* networks NEED to do this, at least in the large enterprise.) Chances are, the network segment you are on does not care one whit about the DNS cache you have, and probably is happy to let you access whoever you want for your encrypted DNS service. I'm willing to wager, in the enterprise environment, they do have an opinion on what transport they prefer you use for that: DoT. This is mostly about scalability, and about the ability to detect abnormal behavior distinct from regular user activity (malware, phishing, and other use cases.) > > IMNSHO, if both ports are reachable for a given provider of Do*, the Do= T > port MUST be used. DoH should only be > > used with explicit informed user consent, and only when DoT is > unavailable.. This supports the =E2=80=9Cdissident=E2=80=9D use > > case, without impacting any other aspects of privacy provided by DoT. > > If the network allows DoT, clearly it does not care about DoH being > used? Since it will also not be able to read DoT to a remote server > like the Quads. So I do not understand what is gained by such a > policy. > It is about scale. If large numbers of users, across a variety of platforms, all use only DoT, then restrictions about which DoT servers are permitted can be applied. Or, alternatively, access to new DoT servers can potentially alert the appropriate security team(s) to investigate which machines have started this new behavior, and get an early jump on things if this happens to be a malware-infected device (for example). Blocking specific DoT servers (or more typically, blocking all DoT servers except those white-listed) allows end users to know that this blockage is deliberate. Users can then make informed decisions about whether to accept that blockage (e.g. due to enterprise policies, or perhaps ISP policies where those are allowed according to contract and jurisdictional legal frameworks), or to take unilateral action to bypass the blockage. What is gained by preferring DoT over DoH, is scaling on the network operator side, and clear indication of policy via DoT blocking. Scaling for network operators is always an indirect win for users -- users have to pay, directly or indirectly, for situations where technology does not (and cannot) scale. > > Unless you meant "must use a local DoT server first", in which case we > are again shifting the discussion towards when can or should you trust > a network for anything but relaying IP packets. Because then you > basically demand access to my decrypted DNS stream. > This is orthogonal to the network operators' policy. However, in the enterprise environment, it may be the case that the local DoT server is the only one not blocked. I would expect that the existence of that server would be advertised (through whatever mechanism ends up being standardized, such as DHCP). You are correct, that is what the operator of any DoT (or DoH) gets: access to your decrypted DNS stream. If DoT access to all other servers is blocked, the choice then becomes, use the local DoT server, or don't use their network (or perhaps don't use DNS)= . This is the exact same situation as when port 53 is restricted, intercepted, or content-tampered, except it adds DNS-to-client encryption. Whether the DNS results can be trusted is one question. Whether the privacy practices of the DNS operator is a separate question. Both are important. BTW - the trustworthiness of the responses is something that can be, to a limited degree, mitigated by client DNSSEC validation, when the DNS zones the client is interested are DNSSEC signed. I would argue the lack of client DNSSEC validation is one factor in the slow uptake of DNSSEC on the part of DNS registrants. Adding DNSSEC client validation would eliminate that as a factor. > > Why should I ever use a starbucks DNS server, regardless of whether > I use DoT or DoH or plain 53? On almost every network I connect to, > I only want one service: "relay my (encrypted) IP packets". The rest > of the services I obtain from trusted sources elsewhere, using this > ephemeral network as an insecure transport only. > I don't see why everyone presumes that using Starbucks' networks is a right, or the only option available. I know they operate a lot of wifi networks, but how they do so isn't really anything users of their networks have a direct say in. Your argument says a lot more about use of encrypted data transport (e.g. over VPNs), than it does about DNS. Can't you just run your DNS queries over your VPNs as well? I don't see a problem with doing so, at all. > > So your policy above that you propose really assumes a lot about the > network, namely that you are considered hostile to the network and > that you trust that network more than your own device. That's a very > specific application. It basically never applies to me unless I join > an enterprise network with an enterprise device, and then we have > other ways for the enterprise to enforce things on their device. > I'm making an "IF THEN" argument, without specifically taking any position on the conditional being evaluated. Even if there are other ways, the position you are taking is making a decision on their behalf. You are expressing the opinion that because there is a specific way available, that that way is reasonable to propose as the only mechanism permitted. I am arguing a position that enterprises are free to choose the mechanisms they use for enforcing policies. It should be noted (strongly) that device-side enforcement somehow assumes the device itself is reasonably trust-worthy. If the device-side enforcement is the only mechanism, then the scope of device compromise events is much greater than the device itself. If the network enforces (with or without device-side enforcement, i.e. it does not preclude doing both in a belt+suspenders approach) policies, more control over the impact of device compromise is achieved. (This is particularly important in the case where data exfiltration over DNS is attempted by malware using the local device's own available DNS mechanisms. If DoH is available and not blocked, data exfiltration is nearly trivial. If DoH is not available, and DoT is only possible to the enterprise DNS servers, the enterprise is in a position to contain the situation.) > > > The blocking of DoT to a given provider should be interpreted as an > explicit policy. Users should be informed > > that they may, and very likely will, be violating someone=E2=80=99s pol= icy, if > they choose to use DoH in that > > circumstance, and that they may be violating laws by doing so, and > should only do so if they are willing to > > accept that risk. > > Again, this is the network operator centric view. There are many hostile > networks that would block DoT just so that they could monetize (legally > or illegally!) from my harvested DNS data. I can assure you the warning > you want to write to users would be very different from the warning I > would want to give those users. Which is why the IETF doesn't do > banners towards endusers. > So, yes, I actually agree with you in this section. I'm not saying that bypassing blocks should not be supported by software. I am saying that bypassing blocks requires a lot of user information, user consent, and should never be the shipped default for software. I'm also saying that use of DoH should be the exception, used only when there is no alternative, in a given scenario. I'm saying DoH needs to be at least opt-in, never opt-out. And I believe user preferences should never assume the user is willing to accept degraded privacy options; the user should be able to provide a list of acceptable DNS privacy operators, and if none are reachable, have two options: don't use any other DNS services (and basically, don't use the network), or explicitly attempt to bypass the mechanisms preventing access to one of the acceptable DNS operators. Placing DoT ahead of DoH, does not in any way degrade the connection privacy if the DoT provider is accessible. It does, however, improve the network operator's security posture. Thus, for the user it is "a wash", and for the network operator "a huge win". I do not understand why advocating for DoT preference is a contentious issue, if DoT is available. > > Besides, why should the network operator have a say about when I want my > device to connect to my remote servers? Do you want my VPN client to > throw the same warning around that it might be against the network > operator's wishes to inspect all my traffic and it might be against the > law to circumvent it? Then you also have to do that for _all_ TLS > connections, and make the internet go back to port 80. Why is there a > different expectation of website content monitoring versus dns content > monitoring? You shouldn't have access to either. > That is an issue for network operators' policies, which is really orthogonal to the mechanisms. There are legitimate reasons that network operators would want to inspect (via automated threat mitigation systems) all DNS traffic. I would find it objectionable if any network operator did anything other than the above, to DNS traffic. DNSSEC is one way to keep DNS operators relatively honest, at least on the "dns lies" front (monetizing NXDOMAIN by replacing NXDOMAIN responses with forged answers). Limitations on what network operators are allowed to do is a layer-8 or layer-9 problem, not directly tied to the mechanisms, and should be treated as such. (And yes, I realize VPNs are also problematic from the enterprise perspective, as they could also be used for data exfiltration -- but that is why reasonable trade-offs in differentiated restrictions based on security zones are, or should be, best practices for enterprises.) On non-enterprise networks, I am pretty sure I don't want to see any of your traffic, VPN or DNS or anything else. IMHO, monitoring of dns queries should be divorced from PII, and should not be routinely logged (especially not with PII), except perhaps on an aggregate basis. Security monitoring, alerting, and logging, should itself be restricted access, and safeguards should be put in place to prevent abuse. This doesn't change my position on the mechanisms required to permit scalable security operations at the network level. > > > There is no reason DoH should be used if DoT works (towards the same DN= S > provider). > > If DoT works to dot.nohats.ca, which you cannot decrypt, why do you care > whether I use DoH to that server or not? > > The reason I care, is that I want to observe all the DoT connections on a longitudinal basis. I want to see if/when new DoT servers show up, especially on names that do not indicate peaceful operation. And if I see a new DoT server show up with some really random name, in a place I don't expect my networks' users to be using (like Asia somewhere), with a very recently obtained free LetsEncrypt certificate, I might want to block the DoT port toward that server, and possibly block all DoT servers except for my local DoT server, for that client, so I can inspect the DNS traffic itself. Having the ability to limit the inspection of DNS traffic to incident responses, is not only good for the general user population, but also for the incident responders. If there is one DNS query flow showing up, it makes analysis a heckuvalot easier, than sifting through a fire hose of DNS traffic. I also expect DoT traffic to be several orders of magnitude lower than HTTPS traffic, where attempting to distinguish DoH from HTTPS traffic would have immediate cost implications in flow volume and destination variety. I care about you using DoT, not because I don't trust you, but because I do trust you. Brian --00000000000012e9770584e0088e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Sun, Mar 24, 2019 at 11:25 PM Paul= Wouters <paul@nohats.ca> wrote= :
On Sun, 24 Mar= 2019, Brian Dickson wrote:

> There is one important difference, which is that DoT uses a unique por= t number. This is important for network
> operators in identifying encrypted DNS traffic, in order to ensure tha= t implementation of security policies for
> DNS don=E2=80=99t conflict with any other network policies (regardless= of what those policies are.)

The network cannot "ensure" this based on DNS. I can come on to t= he
network with a DNS cache already, which is the functional equivalent
of me refreshing my personal cache using a sneaky HTTPS connection.
The network can never control my DNS cache. I won't let it.

So while it was perhaps nice that network operators _could_ help in such a case, it was never a real defense against a smart network "abuser&qu= ot;.


I am trying to keep conversation sub-t= hreads specific to single variables. In this case, I am interested in polic= y enforcement mechanisms, not what the policy is or who it applies to.

The assumption in the above is that the network operat= or has some policy (regardless of what it is) that it would like to enforce= between some (or possibly all) hosts, towards encrypted DNS services.
If the operator blocks all DoH, but does something less restrictive f= or DoT, then the policies applied on DoT are the ones that have the desired= effect.

Yes, this is network-centric, or more spe= cific, network-security-centric.

From the perspect= ive of the network policy enforcement, the applicable rules involve 3-tuple= s of source, destination, and port 853 (plus TCP but not UDP). Any such rul= es, when explicitly applied only to port 853, by definition have no direct = bearing on any destinations for port 443 (HTTPS). These rules only need to = be updated if/when new "permit" rules for new DoT servers are add= ed. This is a white-list model, which scales very nicely.

However, the blocking of specific DoH servers becomes an absolute n= ightmare, in that the network operator needs continuously monitor informati= on from any number of sources (of various degrees of completeness, trustwor= thiness, timeliness, etc), for new DoH servers, along with an ongoing polic= y maintenance on (allow vs deny). This is, by its very nature, a black-list= model, which does not scale nicely, and consequently reduces the overall s= ecurity, from the perspective of the network operator (or network security = department of the enterprise network).

(See my pre= vious message detailing *why* networks NEED to do this, at least in the lar= ge enterprise.)

Chances are, the network segment y= ou are on does not care one whit about the DNS cache you have, and probably= is happy to let you access whoever you want for your encrypted DNS service= .

I'm willing to wager, in the enterprise envi= ronment, they do have an opinion on what transport they prefer you use for = that: DoT.

This is mostly about scalability, and a= bout the ability to detect abnormal behavior distinct from regular user act= ivity (malware, phishing, and other use cases.)
=C2=A0
> IMNSHO, if both ports are reachable for a given provider of Do*, the D= oT port MUST be used. DoH should only be
> used with explicit informed user consent, and only when DoT is unavail= able.. This supports the =E2=80=9Cdissident=E2=80=9D use
> case, without impacting any other aspects of privacy provided by DoT.<= br>
If the network allows DoT, clearly it does not care about DoH being
used? Since it will also not be able to read DoT to a remote server
like the Quads. So I do not understand what is gained by such a
policy.

It is about scale. If large num= bers of users, across a variety of platforms, all use only DoT, then restri= ctions about which DoT servers are permitted can be applied.
Or, = alternatively, access to new DoT servers can potentially alert the appropri= ate security team(s) to investigate which machines have started this new be= havior, and get an early jump on things if this happens to be a malware-inf= ected device (for example).

Blocking specific DoT = servers (or more typically, blocking all DoT servers except those white-lis= ted) allows end users to know that this blockage is deliberate. Users can t= hen make informed decisions about whether to accept that blockage (e.g. due= to enterprise policies, or perhaps ISP policies where those are allowed ac= cording to contract and jurisdictional legal frameworks), or to take unilat= eral action to bypass the blockage.

What is gained= by preferring DoT over DoH, is scaling on the network operator side, and c= lear indication of policy via DoT blocking.

Scalin= g for network operators is always an indirect win for users -- users have t= o pay, directly or indirectly, for situations where technology does not (an= d cannot) scale.
=C2=A0

Unless you meant "must use a local DoT server first", in which ca= se we
are again shifting the discussion towards when can or should you trust
a network for anything but relaying IP packets. Because then you
basically demand access to my decrypted DNS stream.
This is orthogonal to the network operators' policy. Howev= er, in the enterprise environment, it may be the case that the local DoT se= rver is the only one not blocked. I would expect that the existence of that= server would be advertised (through whatever mechanism ends up being stand= ardized, such as DHCP).

You are correct, that is w= hat the operator of any DoT (or DoH) gets: access to your decrypted DNS str= eam.
If DoT access to all other servers is blocked, the choice th= en becomes, use the local DoT server, or don't use their network (or pe= rhaps don't use DNS).
This is the exact same situation as whe= n port 53 is restricted, intercepted, or content-tampered, except it adds D= NS-to-client encryption.
Whether the DNS results can be trusted i= s one question.
Whether the privacy practices of the DNS operator= is a separate question.
Both are important.

=
BTW - the trustworthiness of the responses is something that can be, t= o a limited degree, mitigated by client DNSSEC validation, when the DNS zon= es the client is interested are DNSSEC signed.=C2=A0

I would argue the lack of client DNSSEC validation is one factor in the = slow uptake of DNSSEC on the part of DNS registrants. Adding DNSSEC client = validation would eliminate that as a factor.
=C2=A0

Why should I ever use a starbucks DNS server, regardless of whether
I use DoT or DoH or plain 53? On almost every network I connect to,
I only want one service: "relay my (encrypted) IP packets". The r= est
of the services I obtain from trusted sources elsewhere, using this
ephemeral network as an insecure transport only.

<= /div>
I don't see why everyone presumes that using Starbucks' n= etworks is a right, or the only option available.
I know they ope= rate a lot of wifi networks, but how they do so isn't really anything u= sers of their networks have a direct say in.
Your argument says a= lot more about use of encrypted data transport (e.g. over VPNs), than it d= oes about DNS.
Can't you just run your DNS queries over your = VPNs as well? I don't see a problem with doing so, at all.
= =C2=A0

So your policy above that you propose really assumes a lot about the
network, namely that you are considered hostile to the network and
that you trust that network more than your own device. That's a very specific application. It basically never applies to me unless I join
an enterprise network with an enterprise device, and then we have
other ways for the enterprise to enforce things on their device.

I'm making an "IF THEN" argument, w= ithout specifically taking any position on the conditional being evaluated.=

Even if there are other ways, the position you ar= e taking is making a decision on their behalf.=C2=A0
You are expr= essing the opinion that because there is a specific way available, that tha= t way is reasonable to propose as the only mechanism permitted.
I= am arguing a position that enterprises are free to choose the mechanisms t= hey use for enforcing policies.

It should be noted= (strongly) that device-side enforcement somehow assumes the device itself = is reasonably trust-worthy.
If the device-side enforcement is the= only mechanism, then the scope of device compromise events is much greater= than the device itself.
If the network enforces (with or without= device-side enforcement, i.e. it does not preclude doing both in a belt+su= spenders approach) policies, more control over the impact of device comprom= ise is achieved.
(This is particularly important in the case wher= e data exfiltration over DNS is attempted by malware using the local device= 's own available DNS mechanisms. If DoH is available and not blocked, d= ata exfiltration is nearly trivial. If DoH is not available, and DoT is onl= y possible to the enterprise DNS servers, the enterprise is in a position t= o contain the situation.)
=C2=A0

> The blocking of DoT to a given provider should be interpreted as an ex= plicit policy. Users should be informed
> that they may, and very likely will, be violating someone=E2=80=99s po= licy, if they choose to use DoH in that
> circumstance, and that they may be violating laws by doing so, and sho= uld only do so if they are willing to
> accept that risk.

Again, this is the network operator centric view. There are many hostile networks that would block DoT just so that they could monetize (legally
or illegally!) from my harvested DNS data. I can assure you the warning
you want to write to users would be very different from the warning I
would want to give those users. Which is why the IETF doesn't do
banners towards endusers.

So, yes, I ac= tually agree with you in this section.

I'm not= saying that bypassing blocks should not be supported by software.
I am saying that bypassing blocks requires a lot of user information, use= r consent, and should never be the shipped default for software.
= I'm also saying that use of DoH should be the exception, used only when= there is no alternative, in a given scenario.
I'm saying DoH= needs to be at least opt-in, never opt-out.

And I= believe user preferences should never assume the user is willing to accept= degraded privacy options; the user should be able to provide a list of acc= eptable DNS privacy operators, and if none are reachable, have two options:= don't use any other DNS services (and basically, don't use the net= work), or explicitly attempt to bypass the mechanisms preventing access to = one of the acceptable DNS operators.

Placing DoT a= head of DoH, does not in any way degrade the connection privacy if the DoT = provider is accessible. It does, however, improve the network operator'= s security posture.
Thus, for the user it is "a wash", = and for the network operator "a huge win".
I do not und= erstand why advocating for DoT preference is a contentious issue, if DoT is= available.
=C2=A0

Besides, why should the network operator have a say about when I want my device to connect to my remote servers? Do you want my VPN client to
throw the same warning around that it might be against the network
operator's wishes to inspect all my traffic and it might be against the=
law to circumvent it? Then you also have to do that for _all_ TLS
connections, and make the internet go back to port 80. Why is there a
different expectation of website content monitoring versus dns content
monitoring? You shouldn't have access to either.
<= br>
That is an issue for network operators' policies, which i= s really orthogonal to the mechanisms.

There are l= egitimate reasons that network operators would want to inspect (via automat= ed threat mitigation systems) all DNS traffic.
I would find it ob= jectionable if any network operator did anything other than the above, to D= NS traffic.
DNSSEC is one way to keep DNS operators relatively ho= nest, at least on the "dns lies" front (monetizing NXDOMAIN by re= placing NXDOMAIN responses with forged answers).
Limitations on w= hat network operators are allowed to do is a layer-8 or layer-9 problem, no= t directly tied to the mechanisms, and should be treated as such.

(And yes, I realize VPNs are also problematic from the ente= rprise perspective, as they could also be used for data exfiltration -- but= that is why reasonable trade-offs in differentiated restrictions based on = security zones are, or should be, best practices for enterprises.)

On non-enterprise networks, I am pretty sure I don't w= ant to see any of your traffic, VPN or DNS or anything else.

=
IMHO, monitoring of dns queries should be divorced from PII, and= should not be routinely logged (especially not with PII), except perhaps o= n an aggregate basis. Security monitoring, alerting, and logging, should it= self be restricted access, and safeguards should be put in place to prevent= abuse.

This doesn't change my position on the= mechanisms required to permit scalable security operations at the network = level.
=C2=A0

> There is no reason DoH should be used if DoT works (towards the same D= NS provider).

If DoT works to dot.nohats.ca, which you cannot decrypt, why do you care whether I use DoH to that server or not?


The reason I care, is that I want to o= bserve all the DoT connections on a longitudinal basis. I want to see if/wh= en new DoT servers show up, especially on names that do not indicate peacef= ul operation.
And if I see a new DoT server show up with some rea= lly random name, in a place I don't expect my networks' users to be= using (like Asia somewhere), with a very recently obtained free LetsEncryp= t certificate, I might want to block the DoT port toward that server, and p= ossibly block all DoT servers except for my local DoT server, for that clie= nt, so I can inspect the DNS traffic itself.

Havin= g the ability to limit the inspection of DNS traffic to incident responses,= is not only good for the general user population, but also for the inciden= t responders. If there is one DNS query flow showing up, it makes analysis = a heckuvalot easier, than sifting through a fire hose of DNS traffic.
=

I also expect DoT traffic to be several orders of magni= tude lower than HTTPS traffic, where attempting to distinguish DoH from HTT= PS traffic would have immediate cost implications in flow volume and destin= ation variety.

I care about you using DoT, not bec= ause I don't trust you, but because I do trust you.

Brian=C2=A0
--00000000000012e9770584e0088e-- From nobody Sun Mar 24 22:35:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E77AB12034E; Sun, 24 Mar 2019 22:35:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b7cuvrgnDgQE; Sun, 24 Mar 2019 22:35:23 -0700 (PDT) Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DBD93120350; Sun, 24 Mar 2019 22:35:22 -0700 (PDT) Received: by mail-wm1-x335.google.com with SMTP id t124so7553868wma.4; Sun, 24 Mar 2019 22:35:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=BUPIEXg+5nhj+QIMj9BzVZeVkYeefumojbWAvs03ru8=; b=ZTrk+rnbjwU+n7Un+7+CfaF+kwaFuy/T/jrgEuiVKH6bg/vsZmwxfu75zE89atKh9c 7DYA8ehgwva4Nzkn/qlsHi5ljDjDy87uXrIi6WNfu2InX4mH164Bsci1kaJSdPLk0j4D ifD7waH7f4IN2taKzhN/K6KIF8FBFlwA3TW24PXzk4O3MYddIS8B/daxvgeNpVzSGP+S Q8hx25ACR8NOySSa/57zPE4TJK6UI33OdMn5ptUM4MbTJTjLRBhXvW+Zky9L5zEdjBpz giC9EJHiezjxoY4vgoeeD8lm6LGwkAZTEDkPYsjpIAraPkBw7F7DxKZXg6ajvkGXLYxK zGCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=BUPIEXg+5nhj+QIMj9BzVZeVkYeefumojbWAvs03ru8=; b=ssP08ysfa1QjVmwDX6OC8iowvAbZ+fLbf8WI9VSn2BSiHT6oZL34wQ7Ac+ZJG0SZR5 4iD6zYC+LSQZGlZOVesW04XgvQQzbdEYtBDq3f5YU6EoaTDls9WOGwKrEoQkkskyUub9 0MuxQGlAbXKS/3D3URlSu58+Ua0UsZD4qMZ/OtvCp5gQ16Wb5rOjY8uxU1q+UxctvdHg F2WwvmisIjatELYhY6nGeiBgdOeWbKFq21u+nO666yW6v/ADlR1+ZdCgpCY5/pmYx//A n+HvmFU+QtKXhnBvSmqxRlB8TPPdgJLCjkwp46AGXP/2NEsPe2is4Xe1NOHd+TmkLK5Z 4tvA== X-Gm-Message-State: APjAAAWvnLPC6IEz7EhLnzMOmTDfke8k8jC3ZzlUt633+ZvOIAGl8h9a KF6mPECsTrZlDrUsuUu42SpNmpbDU/k26Q== X-Google-Smtp-Source: APXvYqxIQLrGtf1rHG30MkgvSuTf9vtM5UT0QmRuC4qkZLoLqwi5HBW53UFM1I4BVh2TbLEz7SHf7w== X-Received: by 2002:a1c:f011:: with SMTP id a17mr3992745wmb.89.1553492121133; Sun, 24 Mar 2019 22:35:21 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:9903:4fff:804d:3681? ([2001:67c:1232:144:9903:4fff:804d:3681]) by smtp.gmail.com with ESMTPSA id h7sm17655636wmb.41.2019.03.24.22.35.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 24 Mar 2019 22:35:20 -0700 (PDT) Content-Type: multipart/alternative; boundary=Apple-Mail-DB37894E-25C2-44A5-A851-862DA1FFC661 Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16D57) In-Reply-To: Date: Mon, 25 Mar 2019 06:35:19 +0100 Cc: "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Transfer-Encoding: 7bit Message-Id: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> To: Patrick McManus Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 05:35:26 -0000 --Apple-Mail-DB37894E-25C2-44A5-A851-862DA1FFC661 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Sent from my iPhone > On Mar 24, 2019, at 10:42 PM, Patrick McManus wrote= : >=20 >=20 >> On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson wrote: >>=20 >> This is important for network operators in identifying encrypted DNS traf= fic, >=20 > not all clients acknowledge a network's right to do such things at all tim= es. And of course it would be useful to tell the difference between policy a= nd a RST injection attack. >=20 > If the client does acknowledge the network has the right to set policy - t= hen the policy can be set on the client using existing configuration mechani= sms that allow the client to differentiate between authorized configuration a= nd perhaps less-authorized folks identifying their DNS traffic. This is well= worn ground in the HTTP space. What I find interesting, is that as far as I can tell, everything you wrote a= pplies equally to DoH and DoT, if the transport is the only difference. E.g.= Same client browser, same DNS service, accessed via DoH or DoT. Are you suggesting (or claiming) otherwise, and if so, please elaborate? Brian=20= --Apple-Mail-DB37894E-25C2-44A5-A851-862DA1FFC661 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

Sent from my iPhone

On Mar 24, 2019, at 10:4= 2 PM, Patrick McManus <mcmanus@du= cksong.com> wrote:


On Sun, Mar 24, 2019 at 10:31 PM Bria= n Dickson <brian.peter.d= ickson@gmail.com> wrote:

This is important for network operators in identifying enc= rypted DNS traffic,

not a= ll clients acknowledge a network's right to do such things at all times. And= of course it would be useful to tell the difference between policy and a RS= T injection attack.

If the client does acknowledge t= he network has the right to set policy - then the policy can be set on the c= lient using existing configuration mechanisms that allow the client to diffe= rentiate between authorized configuration and perhaps less-authorized folks i= dentifying their DNS traffic. This is well worn ground in the HTTP space.

What I find interesting, is that as far as I can= tell, everything you wrote applies equally to DoH and DoT, if the transport= is the only difference. E.g. Same client browser, same DNS service, accesse= d via DoH or DoT.

Are you suggesting (or claiming) o= therwise, and if so, please elaborate?

Brian <= /div>= --Apple-Mail-DB37894E-25C2-44A5-A851-862DA1FFC661-- From nobody Mon Mar 25 00:07:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44BEC120365; Mon, 25 Mar 2019 00:07:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vzTiAQ1b8mOg; Mon, 25 Mar 2019 00:07:03 -0700 (PDT) Received: from giant.haxx.se (www.haxx.se [IPv6:2a00:1a28:1200:9::2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 261C7120353; Mon, 25 Mar 2019 00:07:02 -0700 (PDT) Received: from giant.haxx.se (mail [127.0.0.1]) by giant.haxx.se (8.15.2/8.15.2/Debian-4) with ESMTPS id x2P76sMw001019 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 25 Mar 2019 08:06:54 +0100 Received: from localhost (dast@localhost) by giant.haxx.se (8.15.2/8.15.2/Submit) with ESMTP id x2P76rGS000999; Mon, 25 Mar 2019 08:06:53 +0100 X-Authentication-Warning: giant.haxx.se: dast owned process doing -bs Date: Mon, 25 Mar 2019 08:06:53 +0100 (CET) From: Daniel Stenberg X-X-Sender: dast@giant.haxx.se To: Vittorio Bertola cc: Patrick McManus , dnsop@ietf.org, doh@ietf.org In-Reply-To: <128237212.13389.1553465639438@appsuite.open-xchange.com> Message-ID: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <128237212.13389.1553465639438@appsuite.open-xchange.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) X-fromdanielhimself: yes MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 07:07:04 -0000 On Sun, 24 Mar 2019, Vittorio Bertola wrote: > In today's "plain DNS" world, I choose a DNS resolver that provides that > kind of filters for me, I set it up on my router, and my router pushes it to > my smart TV via DHCP. What is the "existing configuration mechanism" that > allows me to set this policy in the DoH world, i.e. if the TV came equipped > with applications preconfigured to use their own remote resolver via DoH? We can easily turn this example the other way around. With Do53 in your TV, your kids can easily fool your TV with their own DHCP responses or by intercepting and intefering with the DNS traffic while you're at work. With DoH used in the TV, set to use a trusted server, they can't. -- / daniel.haxx.se From nobody Mon Mar 25 00:25:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D5866120368; Mon, 25 Mar 2019 00:25:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.901 X-Spam-Level: X-Spam-Status: No, score=-6.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9bCCjOnK5uev; Mon, 25 Mar 2019 00:25:41 -0700 (PDT) Received: from mx.pao1.isc.org (mx.pao1.isc.org [IPv6:2001:4f8:0:2::2b]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id AEFB712036D; Mon, 25 Mar 2019 00:25:41 -0700 (PDT) Received: from zmx1.isc.org (zmx1.isc.org [149.20.0.20]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx.pao1.isc.org (Postfix) with ESMTPS id 64EF73AB03E; Mon, 25 Mar 2019 07:25:41 +0000 (UTC) Received: from zmx1.isc.org (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTPS id 00F02160046; Mon, 25 Mar 2019 07:25:41 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by zmx1.isc.org (Postfix) with ESMTP id C74CC16005C; Mon, 25 Mar 2019 07:25:40 +0000 (UTC) Received: from zmx1.isc.org ([127.0.0.1]) by localhost (zmx1.isc.org [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id MUDO4uIrwAVU; Mon, 25 Mar 2019 07:25:40 +0000 (UTC) Received: from surfer-172-30-2-241-hotspot.internet-for-guests.com (107.223.broadband2.iol.cz [83.208.223.107]) by zmx1.isc.org (Postfix) with ESMTPSA id 780C3160046; Mon, 25 Mar 2019 07:25:39 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 11.5 \(3445.9.1\)) From: Mark Andrews In-Reply-To: Date: Mon, 25 Mar 2019 18:25:36 +1100 Cc: Vittorio Bertola , Patrick McManus , dnsop@ietf.org, doh@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <78F0DF8D-74FB-461E-87B8-02FE2582047E@isc.org> References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <128237212.13389.1553465639438@appsuite.open-xchange.com> To: Daniel Stenberg X-Mailer: Apple Mail (2.3445.9.1) Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 07:25:45 -0000 > On 25 Mar 2019, at 6:06 pm, Daniel Stenberg wrote: >=20 > On Sun, 24 Mar 2019, Vittorio Bertola wrote: >=20 >> In today's "plain DNS" world, I choose a DNS resolver that provides = that kind of filters for me, I set it up on my router, and my router = pushes it to my smart TV via DHCP. What is the "existing configuration = mechanism" that allows me to set this policy in the DoH world, i.e. if = the TV came equipped with applications preconfigured to use their own = remote resolver via DoH? >=20 > We can easily turn this example the other way around. >=20 > With Do53 in your TV, your kids can easily fool your TV with their own = DHCP responses or by intercepting and intefering with the DNS traffic = while you're at work. >=20 > With DoH used in the TV, set to use a trusted server, they can=E2=80=99t= . Which won=E2=80=99t work if the network is filtering Do53 traffic to non = approved servers or if the TV is manually configured with Do53 or DoT servers and the = TV=E2=80=99s configuration is locked down. Yes, TV=E2=80=99s do have the ability to lock this part = of the configuration down same as filters on program ratings can be enforced provided the = data stream includes the rating information. The problem with DoH is that it makes filtering difficult. That is both = a good and a bad thing depending on your perspective and responsibilities. It=E2=80=99= s a pandora=E2=80=99s box. > --=20 >=20 > / daniel.haxx.se >=20 > _______________________________________________ > DNSOP mailing list > DNSOP@ietf.org > https://www.ietf.org/mailman/listinfo/dnsop --=20 Mark Andrews, ISC 1 Seymour St., Dundas Valley, NSW 2117, Australia PHONE: +61 2 9871 4742 INTERNET: marka@isc.org From nobody Mon Mar 25 00:53:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8DD7812037B for ; Mon, 25 Mar 2019 00:52:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=lgvH7Hfp; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=Vd5hmFdY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1H9rJJOSbH91 for ; Mon, 25 Mar 2019 00:52:52 -0700 (PDT) Received: from outbound2r.ore.mailhop.org (outbound2r.ore.mailhop.org [54.200.129.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0398120371 for ; Mon, 25 Mar 2019 00:52:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553500372; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=FfQob3LFjOgXCL0z6SmaCC3M05ZrPM5+ZUuIHLV/x5EbAYTpJqIzNsD/O5hJ1iQQWmLjE539vLuaN 468bhrSboyR6ur31T+Sgjsh0yWdTmG7vsK9H7D/kmrgpzP8k/KMa66KBY8JZMXQXxSUdjKHqzx3tOr VR5NkKKsb/shoa8HRqohngv6kQUrS/tACvnpS3oSD+6DGUycQqtGIj0aAqMAHgSmTxWoEcPpYB3eVW cWujKsprmz78shnpbe7Sv0k/X4zcAay2KWRvUbbsnno4rLlvRoadlkfMk0rF+Ts+EIl+aNRMGu+dON 3L4WqFm79QYqDmQuMGIpz8bVdJvYHTA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=FcjAaMS1DO8NqnRTYL/6KHEij6zFnlm/6ka43/c4WB4=; b=shk2PW3t4At8kDlg4vHB04xeWTJps1mLROHG0t/HCoX8d/VAM1DH/Br1qQoWZe9S0dMyKRyITANXE khPYU0UnTopc0zEbD+4YkrK57qUlx7f/MSzPGG5UCjgvxpngWNNvi9O80YyPNNG6hcDjdcEh3iLOJJ C3pyViSuF89dS09//73d7XAwDgo7aHyq/V5E8lteZ0HGGqYFRNX2tpws3NF3oS3HbbE+QJgIJgxbga nxJH1xyP+CeNhMgwGtPLBqvH148173xyjSbfE91W1+DFxpNy3nQYbe5atmnZqCXH3Q0hkutMwRWOAT 3k2ET2Ls5Od0xN4bd3Rwwo/YyAfPqrg== ARC-Authentication-Results: i=1; outbound4.ore.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.167.173; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=FcjAaMS1DO8NqnRTYL/6KHEij6zFnlm/6ka43/c4WB4=; b=lgvH7Hfp1xlzpRXYPLiRchERACVUjDmTfA6PolHH6CUSH8tpnGzBTrOwEMZP9d2TVjtANCre8sqh1 lBdyLF0Y2eHwsxQCiBzVUEojCB66h8kabUZFmonDTgxdyyUzCAL+WnMH3nk4UXjTRt8p6U1jjrtpoP 2EF93s/ErAOhiw8I= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=FcjAaMS1DO8NqnRTYL/6KHEij6zFnlm/6ka43/c4WB4=; b=Vd5hmFdYo8SYcsvFGOIFawyKfjxaSzEEQhIBIBlLAGBodB6Oz6fQO3B3kyqILbU8FTRt2SZkJfK32 W8KbOmWvSa/w8zKpI3aTJCZQwexJHq+eZHyRAnnreANQe0jCw1c4jxOGDKSdeoAPtserk+rYmGoqW2 Nb4nIqKCuqS8SgsIDG8eNMHVZ3mVncNe3nsYqxIvFpbDD/OP0q7R/xOa6/3wqu7laFlMRL+tey4gwk 1LC9CIVIenUq/rhPOJ9gpS9YTJE3M/Z0tDEbaT9CUHxS3LKoBiLAWErUlZZiai8Jk5Y+nKhxeekrKK uT12FUjgMI+Edtzw0XBcTbbtCVM8DUA== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: fca4ac56-4ed2-11e9-befd-af03bedce89f X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.167.173 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-oi1-f173.google.com (unknown [209.85.167.173]) by outbound4.ore.mailhop.org (Halon) with ESMTPSA id fca4ac56-4ed2-11e9-befd-af03bedce89f; Mon, 25 Mar 2019 07:52:50 +0000 (UTC) Received: by mail-oi1-f173.google.com with SMTP id 3so6192991oir.7; Mon, 25 Mar 2019 00:52:50 -0700 (PDT) X-Gm-Message-State: APjAAAW2Ixhy6fdEP9NRry+RtqHvYsEjfZNbDQJ9AXnwECyCpixSCjoP gcs3cm81KsHtQ0D4+9V6gj9iGzk2TcR2yCZiSkA= X-Google-Smtp-Source: APXvYqwAXHuzDh3jkCsVxOnPhqoIsbMQSeuQtabHXsnbyuTD7yZZyR+YHpPcZhoay4Ab4zv0SBnvxEtY6kNXvEdyPMk= X-Received: by 2002:aca:e350:: with SMTP id a77mr11028180oih.82.1553500369787; Mon, 25 Mar 2019 00:52:49 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Patrick McManus Date: Mon, 25 Mar 2019 08:52:38 +0100 X-Gmail-Original-Message-ID: Message-ID: To: Brian Dickson Cc: Patrick McManus , "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="000000000000b321540584e67de5" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 07:53:00 -0000 --000000000000b321540584e67de5 Content-Type: text/plain; charset="UTF-8" I'm not pushing against DoT per se in this thread, I am pushing against the notion that a client has an obligation to the network to provide a clear channel for traffic analysis and downgrade triggers. One of the notions presented here is that unauthenticated RST injection forgery is an acceptable, perhaps in the minds of some even desirable, signal for DoT to trigger downgrades and, further, that clients are obligated to create a clear signal to the network to enable this approach. One issue is that you cannot differentiate this signal between a party you may want to cooperate with (e.g. your enterprise controller) and an attacker - that's the nature of an unauthenticated injection. But there are authenticated enterprise configuration methods available for expressing policy directly to the client in a trusted way. Indeed my post centered around the notion of https interception being a necessary outcome of DoH in the enterprise - my point is basically if you can do https interception then you are doing enterprise config - consider a config to still do secured DNS with a server that implements the enterprise policy rather than doing interception. And if you do that an enterprise client can, by using its own do{th} server, also enjoy the benefits of transport security and be confident that the policy server it intends to use is actually the one in use. fwiw - there are lots of reasons an http client is going to be interested in an http substrate beyond just traffic analysis defense. It has the potential for better overall application responsiveness - by sharing connections and handshakes with other http data. I don't think that particular discussion is important to this thread. On Mon, Mar 25, 2019 at 6:35 AM Brian Dickson wrote: > > > Sent from my iPhone > > On Mar 24, 2019, at 10:42 PM, Patrick McManus > wrote: > > > On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> This is important for network operators in identifying encrypted DNS >> traffic, >> > > not all clients acknowledge a network's right to do such things at all > times. And of course it would be useful to tell the difference between > policy and a RST injection attack. > > If the client does acknowledge the network has the right to set policy - > then the policy can be set on the client using existing configuration > mechanisms that allow the client to differentiate between authorized > configuration and perhaps less-authorized folks identifying their DNS > traffic. This is well worn ground in the HTTP space. > > > What I find interesting, is that as far as I can tell, everything you > wrote applies equally to DoH and DoT, if the transport is the only > difference. E.g. Same client browser, same DNS service, accessed via DoH or > DoT. > > Are you suggesting (or claiming) otherwise, and if so, please elaborate? > > Brian > --000000000000b321540584e67de5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'm not pushing against DoT per se in this thread= , I am pushing against the notion that a client has an obligation to the ne= twork to provide a clear channel for traffic analysis and downgrade trigger= s.

One of the notions presented here is that unauthenti= cated RST injection forgery is an acceptable, perhaps in the minds of some = even desirable, signal for DoT to trigger downgrades and, further, that cli= ents are obligated to create a clear signal to the network to enable this a= pproach. One issue is that you cannot differentiate this signal between a p= arty you may want to cooperate with (e.g. your enterprise controller) and a= n attacker - that's the nature of an unauthenticated injection. But the= re are authenticated enterprise configuration methods available for express= ing policy directly to the client in a trusted way. Indeed my post centered= around the notion of https interception being a necessary outcome of DoH i= n the enterprise - my point is basically if you can do https interception t= hen you are doing enterprise config - consider a config to still do secured= DNS with a server that implements the enterprise policy rather than doing = interception.

And if you do that an enterprise client ca= n, by using its own do{th} server, also enjoy the benefits of transport sec= urity and be confident that the policy server it intends to use is actually= the one in use.

fwiw - there are lots of reaso= ns an http client is going to be interested in an http substrate beyond jus= t traffic analysis defense. It has the potential for better overall applica= tion responsiveness - by sharing connections and handshakes with other http= data. I don't think that particular discussion is important to this th= read.

On Mon, Mar 25, 2019 at 6:35 AM Brian Dickson <brian.peter.dickson@gmail.co= m> wrote:


Sent from my iPhone

On Mar = 24, 2019, at 10:42 PM, Patrick McManus <mcmanus@ducksong.com> wrote:

=



What I find interesting, is that as far as I ca= n tell, everything you wrote applies equally to DoH and DoT, if the transpo= rt is the only difference. E.g. Same client browser, same DNS service, acce= ssed via DoH or DoT.

Are you suggesting (or claimi= ng) otherwise, and if so, please elaborate?

Brian= =C2=A0
--000000000000b321540584e67de5-- From nobody Mon Mar 25 01:15:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7483D120365; Mon, 25 Mar 2019 01:15:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.001 X-Spam-Level: *** X-Spam-Status: No, score=3.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, GB_SUMOF=5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id veLOkNFIu_fs; Mon, 25 Mar 2019 01:15:02 -0700 (PDT) Received: from mail-qk1-x744.google.com (mail-qk1-x744.google.com [IPv6:2607:f8b0:4864:20::744]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 08256120368; Mon, 25 Mar 2019 01:15:02 -0700 (PDT) Received: by mail-qk1-x744.google.com with SMTP id w20so4753521qka.7; Mon, 25 Mar 2019 01:15:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fSYb+edvJcgmgtcaDcDWxsHZTfMTt+/G+ZtMsKLzXxQ=; b=JSkPdWgpJYaWLzCE4o0H3Vy3hojqJ9FltcJrlLPHuZOsUqAmvMXtYW8OWJ4f+9aQmN DIwSAPxVyweOaHD9rTCTXUZJecbuhh3asuOkR+0S7xyEoGqEbqh0YQbkGCjJWENTzlwP kJY/uggskV/BZXyhBpGoai67Bp7/9gu2g7877V83NpwpMWguHlqjle2Zq1pbTqCGL8E1 lUOk6AB6Gfb5Uca9r08mpkr1rHkpNwVuzdnBf382H0P+cEnkLnjRSn7x6ZPBmrMzlAyr w4WR4IYXws2B5YKg8ko2IlkKQl590dD80ODENb4S2C9zd2llNoLkyYVm9CPsX0p8uvok vs6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fSYb+edvJcgmgtcaDcDWxsHZTfMTt+/G+ZtMsKLzXxQ=; b=mowLAaFhSkYzFZwyHmLpTzzGtAZzACh4cfTMBOiOfaFYFW4kKEAi8n90Dfm6rZRDjK LQkkrCOlkR/c+xx8k3dnYFgt3Ntvb4ZAhnqUylcN4DRw2+8xxqTjnprZfkVMszhmpMOe d4weHZgBqt9ODcoD5GbbDm0+XWdSSMIuv5NcagP689CeciRNW8vTZ6FdhBSp4tJ5J71G 9LOGsuh4S7X21Y/yQvW/gqet8iquDNilwGs8YQq/5JAMCvBGNkKBGURY0UFlsnZn+yKY +Fo2/nV8bmLTwiRh5BKN5nlgPMEjCv6lOMTnQBrF67VVc+pKFPkpHaR38zldXFzs9/YG EDdg== X-Gm-Message-State: APjAAAVc76he4DfNrZsn67WCdQ7FliGiA/Fhp+X+nClxqJKBddua6b50 4fnQw5letjdyxevUpGt1IDViEu2C7wAV5nxXh9A= X-Google-Smtp-Source: APXvYqz6rmoyMIhy5Bnc9Qa6SS4ta9SXn8B8l7MXyhKq4jjMvf8whPOt3VNYlf26BxgiXLzLx1GImtcLFAiHqmu/4X4= X-Received: by 2002:a37:2c82:: with SMTP id s124mr12376539qkh.286.1553501701202; Mon, 25 Mar 2019 01:15:01 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Brian Dickson Date: Mon, 25 Mar 2019 09:14:44 +0100 Message-ID: To: Patrick McManus Cc: "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="0000000000000ee5b20584e6cd51" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 08:15:03 -0000 --0000000000000ee5b20584e6cd51 Content-Type: text/plain; charset="UTF-8" On Mon, Mar 25, 2019 at 8:52 AM Patrick McManus wrote: > I'm not pushing against DoT per se in this thread, I am pushing against > the notion that a client has an obligation to the network to provide a > clear channel for traffic analysis and downgrade triggers. > > fwiw - there are lots of reasons an http client is going to be interested > in an http substrate beyond just traffic analysis defense. It has the > potential for better overall application responsiveness - by sharing > connections and handshakes with other http data. I don't think that > particular discussion is important to this thread. > Actually, it really is. At a minimum it needs to be treated as an assertion that is subject to validation or refutation. This is a refutation: The DoH operators who have made public statements (google and cloudflare are two I am aware of), have specifically indicated that NO OTHER HTTPS TRAFFIC will be shared on the IPv{46} addresses serving Do{HT}. So, the handshakes and sharing argument is specious at best, and bogus at worst. The ONLY difference in browsers doing DoH vs DoT, under the hood, is that DoT does not require the encoding/decoding of the DNS messages (plus all the other HTTP overhead). Both DoT and DoH require DNS messages in wire format be constructed first, and after whatever decoding, wire format responses processed by the client. A cursory analysis of the logic -- extra encoding vs no extra encoding -- essentially proves by "the triangle inequality"* that DoH cannot be faster than DoT when comparing same-client to same-server. Brian *(the sum of lengths of two sides is greater or equal to the length of the third side) In this case two sides are the same length (processing of TLS and DNS) and the other side is extra processing of HTTP encoding, headers, etc., and the sum is (HTTP + common path) , compared with (common path). HTTP is not a zero-cost flow, so HTTP + x > x. QED. > > On Mon, Mar 25, 2019 at 6:35 AM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >> Sent from my iPhone >> >> On Mar 24, 2019, at 10:42 PM, Patrick McManus >> wrote: >> >> >> On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> This is important for network operators in identifying encrypted DNS >>> traffic, >>> >> >> not all clients acknowledge a network's right to do such things at all >> times. And of course it would be useful to tell the difference between >> policy and a RST injection attack. >> >> If the client does acknowledge the network has the right to set policy - >> then the policy can be set on the client using existing configuration >> mechanisms that allow the client to differentiate between authorized >> configuration and perhaps less-authorized folks identifying their DNS >> traffic. This is well worn ground in the HTTP space. >> >> >> What I find interesting, is that as far as I can tell, everything you >> wrote applies equally to DoH and DoT, if the transport is the only >> difference. E.g. Same client browser, same DNS service, accessed via DoH or >> DoT. >> >> Are you suggesting (or claiming) otherwise, and if so, please elaborate? >> >> Brian >> > --0000000000000ee5b20584e6cd51 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Mar 25, 2019 at 8:52 AM Patri= ck McManus <mcmanus@ducksong.com= > wrote:
=
I'm not pushing against DoT per se in this thread= , I am pushing against the notion that a client has an obligation to the ne= twork to provide a clear channel for traffic analysis and downgrade trigger= s.

fwiw - there are lots of reasons an h= ttp client is going to be interested in an http substrate beyond just traff= ic analysis defense. It has the potential for better overall application re= sponsiveness - by sharing connections and handshakes with other http data. = I don't think that particular discussion is important to this thread.

Actually, it really = is.

At a minimum it needs to be treated as an asse= rtion that is subject to validation or refutation.

This is a refutation:

The DoH operators who have = made public statements (google and cloudflare are two I am aware of), have = specifically indicated that NO OTHER HTTPS TRAFFIC will be shared on the IP= v{46} addresses serving Do{HT}.

So, the handshakes= and sharing argument is specious at best, and bogus at worst.
The ONLY difference in browsers doing DoH vs DoT, under the ho= od, is that DoT does not require the encoding/decoding of the DNS messages = (plus all the other HTTP overhead).
Both DoT and DoH require DNS = messages in wire format be constructed first, and after whatever decoding, = wire format responses processed by the client.

A c= ursory analysis of the logic -- extra encoding vs no extra encoding -- esse= ntially proves by "the triangle inequality"* that DoH cannot be f= aster than DoT when comparing same-client to same-server.

Brian

*(the sum of lengths of two sides is= greater or equal to the length of the third side) In this case two sides a= re the same length (processing of TLS and DNS) and the other side is extra = processing of HTTP encoding, headers, etc., and the sum is (HTTP=C2=A0+ com= mon path) , compared with (common path). HTTP is not a zero-cost flow, so H= TTP=C2=A0+ x > x. QED.

=C2=A0

On Mon, Mar 25, 2019 at 6:35 AM Brian Dicks= on <b= rian.peter.dickson@gmail.com> wrote:


Sent from my iPhone

On Mar 24, 2019, at 10:42 P= M, Patrick McManus <mcmanus@ducksong.com> wrote:


On Sun, Mar 24, 20= 19 at 10:31 PM Brian Dickson <brian.peter.dickson@gmail.com> wrote:

This is importan= t for network operators in identifying encrypted DNS traffic,
<= /div>

not all clients acknowledge a network= 's right to do such things at all times. And of course it would be usef= ul to tell the difference between policy and a RST injection attack.
<= div>
If the client does acknowledge the network has the right= to set policy - then the policy can be set on the client using existing co= nfiguration mechanisms that allow the client to differentiate between autho= rized configuration and perhaps less-authorized folks identifying their DNS= traffic. This is well worn ground in the HTTP space.

What I find interesting, is that as far as I ca= n tell, everything you wrote applies equally to DoH and DoT, if the transpo= rt is the only difference. E.g. Same client browser, same DNS service, acce= ssed via DoH or DoT.

Are you suggesting (or claimi= ng) otherwise, and if so, please elaborate?

Brian= =C2=A0
--0000000000000ee5b20584e6cd51-- From nobody Mon Mar 25 01:28:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32C21120373 for ; Mon, 25 Mar 2019 01:28:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -12.501 X-Spam-Level: X-Spam-Status: No, score=-12.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, GB_SUMOF=5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V83e2EMGrRFZ for ; Mon, 25 Mar 2019 01:28:39 -0700 (PDT) Received: from mail-wm1-x335.google.com (mail-wm1-x335.google.com [IPv6:2a00:1450:4864:20::335]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8FFCF120379 for ; Mon, 25 Mar 2019 01:28:35 -0700 (PDT) Received: by mail-wm1-x335.google.com with SMTP id v14so7999817wmf.2 for ; Mon, 25 Mar 2019 01:28:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=U2DwHRbWY1As9zGVJsy0R1Uw3WPDleACy9pcQqC0Rrk=; b=V8qK4pvIGdmJU+9wjkAwRZvlDK2cG4b3urAfmmsem0OGmoJw3OLNKq+m2L571XijYk ySlxZESxUVA0mkRzBzWA+Q9iD/sVA0Qur2ZALWclMoQSsBwDI/70N8gZEN7mzmogo5il FkBJQ0l6PG+tdBea8XJsqkui3nkwrqCazNQTfwCVXiyz7ulmp+Kn+fNhCmI1BxWPKH4B qyQ9sSVcxpBdJ8funqmg3zCWAYij/DMTaJx05qRQb/zTIqIfGmzrlI8ueSWJtnn9uzzA 83n6LlqZk9k1iiWtdZy1GRr63aZsg+zbeBkO/0JIoBzRqYjxKUT/ZABIXqNlJ1UX7jNZ sTkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=U2DwHRbWY1As9zGVJsy0R1Uw3WPDleACy9pcQqC0Rrk=; b=kOAmWGjgXsrpe4AELzeNm/GC3+EQO0H58t2F2Jw0HxhwNE8OdfcKPwF54EIP8GKOKC GBxsKvNzIuJRcQcDQxmiOCH/DAhPYiSaEiq4W0H8KiHaMMHIUbYujnN+s0F4e1qKlKse n6pFBIEDfcmOq/i5ZkTCvPnahfTn+l12v66oGdR12gtk1XKQZYwaeYle7/vBUiSMIzNi CKZ9lGLf1k3oXk7sUHcneLMGREE4hIoiWrEuPco95q3iUcD6R4VjzZW9aqOxvGtEAgAk 3F9DkImX3DX38pY1ZoGAn1oG/tv5QLaKu/qRUHlcbSeQKwozAPnh5HB33lbMlxr7v7IH sEBw== X-Gm-Message-State: APjAAAXPUdVfubsQDj1tmdTS0oKT85HZdX2LaTlw2I8n1kNnwUjQPma1 P5v4EP8vT3Dvd/LDh1ijdR2ehj/SjFrXjGShcRseag== X-Google-Smtp-Source: APXvYqzE0EQsJhR2eNp7OwgiA7NOkbRPefgcpZYGHdgvZ2ONTYJl+j6vmvyQVa5X2YdXHP6TwclVogTaBo8U/ZMZwmY= X-Received: by 2002:a1c:9c0e:: with SMTP id f14mr11050652wme.78.1553502513842; Mon, 25 Mar 2019 01:28:33 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Ian Swett Date: Mon, 25 Mar 2019 04:28:21 -0400 Message-ID: To: Brian Dickson Cc: Patrick McManus , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "Winfield, Alister" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="0000000000007f34570584e6fd15" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 08:28:41 -0000 --0000000000007f34570584e6fd15 Content-Type: text/plain; charset="UTF-8" One way DoH may be faster than DoT in the near future is that DoH can go over HTTP/3 via QUIC and avoid head of line blocking like Do53. On Mon, Mar 25, 2019 at 4:15 AM Brian Dickson wrote: > > > On Mon, Mar 25, 2019 at 8:52 AM Patrick McManus > wrote: > >> I'm not pushing against DoT per se in this thread, I am pushing against >> the notion that a client has an obligation to the network to provide a >> clear channel for traffic analysis and downgrade triggers. >> >> fwiw - there are lots of reasons an http client is going to be interested >> in an http substrate beyond just traffic analysis defense. It has the >> potential for better overall application responsiveness - by sharing >> connections and handshakes with other http data. I don't think that >> particular discussion is important to this thread. >> > > Actually, it really is. > > At a minimum it needs to be treated as an assertion that is subject to > validation or refutation. > > This is a refutation: > > The DoH operators who have made public statements (google and cloudflare > are two I am aware of), have specifically indicated that NO OTHER HTTPS > TRAFFIC will be shared on the IPv{46} addresses serving Do{HT}. > > So, the handshakes and sharing argument is specious at best, and bogus at > worst. > > The ONLY difference in browsers doing DoH vs DoT, under the hood, is that > DoT does not require the encoding/decoding of the DNS messages (plus all > the other HTTP overhead). > Both DoT and DoH require DNS messages in wire format be constructed first, > and after whatever decoding, wire format responses processed by the client. > > A cursory analysis of the logic -- extra encoding vs no extra encoding -- > essentially proves by "the triangle inequality"* that DoH cannot be faster > than DoT when comparing same-client to same-server. > > Brian > > *(the sum of lengths of two sides is greater or equal to the length of the > third side) In this case two sides are the same length (processing of TLS > and DNS) and the other side is extra processing of HTTP encoding, headers, > etc., and the sum is (HTTP + common path) , compared with (common path). > HTTP is not a zero-cost flow, so HTTP + x > x. QED. > > > >> >> On Mon, Mar 25, 2019 at 6:35 AM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> >>> Sent from my iPhone >>> >>> On Mar 24, 2019, at 10:42 PM, Patrick McManus >>> wrote: >>> >>> >>> On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < >>> brian.peter.dickson@gmail.com> wrote: >>> >>>> >>>> This is important for network operators in identifying encrypted DNS >>>> traffic, >>>> >>> >>> not all clients acknowledge a network's right to do such things at all >>> times. And of course it would be useful to tell the difference between >>> policy and a RST injection attack. >>> >>> If the client does acknowledge the network has the right to set policy - >>> then the policy can be set on the client using existing configuration >>> mechanisms that allow the client to differentiate between authorized >>> configuration and perhaps less-authorized folks identifying their DNS >>> traffic. This is well worn ground in the HTTP space. >>> >>> >>> What I find interesting, is that as far as I can tell, everything you >>> wrote applies equally to DoH and DoT, if the transport is the only >>> difference. E.g. Same client browser, same DNS service, accessed via DoH or >>> DoT. >>> >>> Are you suggesting (or claiming) otherwise, and if so, please elaborate? >>> >>> Brian >>> >> _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000007f34570584e6fd15 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
One way DoH may be faster than DoT in the near future is t= hat DoH can go over HTTP/3 via QUIC and avoid head of line blocking like Do= 53.

On Mon, Mar 25, 2019 at 4:15 AM Brian Dickson <brian.peter.dickson@gmail.com> wrote:
=


On Mon, Mar 25, 2019 at 8:52 AM Patrick McManus <mcmanus@ducksong.com<= /a>> wrote:
<= div dir=3D"ltr">
I'm not pushing against DoT per se in this thread,= I am pushing against the notion that a client has an obligation to the net= work to provide a clear channel for traffic analysis and downgrade triggers= .

fwiw - there are lots of reasons an ht= tp client is going to be interested in an http substrate beyond just traffi= c analysis defense. It has the potential for better overall application res= ponsiveness - by sharing connections and handshakes with other http data. I= don't think that particular discussion is important to this thread.







Brian

*(the sum of lengths of two sides is = greater or equal to the length of the third side) In this case two sides ar= e the same length (processing of TLS and DNS) and the other side is extra p= rocessing of HTTP encoding, headers, etc., and the sum is (HTTP=C2=A0+ comm= on path) , compared with (common path). HTTP is not a zero-cost flow, so HT= TP=C2=A0+ x > x. QED.

=C2=A0

On Mon, Mar 25, 2019 at 6:35 AM Brian Dickso= n <br= ian.peter.dickson@gmail.com> wrote:


Sent from my iPhone

= On Mar 24, 2019, at 10:42 PM, Patrick McManus <mcmanus@ducksong.com> wrote:

On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson <brian.peter.dickson@gma= il.com> wrote:

This is important for network operators in identifying encrypted= DNS traffic,

not all cl= ients acknowledge a network's right to do such things at all times. And= of course it would be useful to tell the difference between policy and a R= ST injection attack.

If the client does acknowledg= e the network has the right to set policy - then the policy can be set on t= he client using existing configuration mechanisms that allow the client to = differentiate between authorized configuration and perhaps less-authorized = folks identifying their DNS traffic. This is well worn ground in the HTTP s= pace.

What I find interesting, is that as far as I ca= n tell, everything you wrote applies equally to DoH and DoT, if the transpo= rt is the only difference. E.g. Same client browser, same DNS service, acce= ssed via DoH or DoT.

Are you suggesting (or claimi= ng) otherwise, and if so, please elaborate?

Brian= =C2=A0
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--0000000000007f34570584e6fd15-- From nobody Mon Mar 25 01:37:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C64AC12039C; Mon, 25 Mar 2019 01:37:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HE6BFvgDkaLC; Mon, 25 Mar 2019 01:37:27 -0700 (PDT) Received: from mail-qt1-x844.google.com (mail-qt1-x844.google.com [IPv6:2607:f8b0:4864:20::844]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A13101203DA; Mon, 25 Mar 2019 01:37:26 -0700 (PDT) Received: by mail-qt1-x844.google.com with SMTP id v32so9256728qtc.10; Mon, 25 Mar 2019 01:37:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AgNys2Wdd1WJWXlQAdpxG46a3/Key+isNH1AUXV32hI=; b=KPcxu6FetOT1fB5HoCeGv9LxIfga2/G+AOgSa6PF5z377R3QAXVXpFFASvd35Bbqdu M6aAs5TCVHYL642PNWZ3Tq+Sx/QVCqJLnO2SJUCIlhMtL/HqkDj17oS8UwFroyV++Fue mn7PsRPDQpgrbwLzDc3vS27Ifw1LohsvkUU4lSiYeo5al+w9AmkDJfCcdO+6DyK+7thE pxNDopm5IpRYZovVh5iLKdjXQq/t6Z8qOyQNzKgCOb1r8GfiGP2ImDk+frmrScn1Nsrj UnXMwK1yjjK44aiGpkuhfkkZqueol9Hs5kWPdAW3DapftbZzni1aKkySZ3oS3nm3NZED mb2g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AgNys2Wdd1WJWXlQAdpxG46a3/Key+isNH1AUXV32hI=; b=uMhWmB3M/oPmBj2lgBS+Kb+5LQfWo9RIV4COqAtpKc1dsKGV0aqNZkjizXO0wktTk6 my4P6E9f+hTzg7F31OXt5HrvVi57pHWpZlpU+iEPOZV/+tfIBS43iBaPmh86OqxDWF73 jvC+L6SaN+VOO2gvSiXLzWK6jOZL6Y7YFlYXGv0KfnermN/Vm4GyTRDo1t47XbQRUs1R 9P9uipksu0z2k+e2x/AyvfxVOT+lex85mInhNgrrs+qpmbfqYJ4sEmHvIf60RoWqNIis er6N7oN/KTGdte3JgGUJFyZr+dUnVmvZDVFmOTN0RYqSad0HRtvHWkN1OLrvjOlbB0Tf zZQQ== X-Gm-Message-State: APjAAAXESy24dmjCscz9JFPQpmg4B5EBq6B+l7WEwtEjPXvg7O3aiiD9 eNM5dXtkUjI7e75DtbCJZl8AeV304YNY/frsn0gqjSwgdVcT8A== X-Google-Smtp-Source: APXvYqzaB2EFdMSvgtUVUcgIIUgzQJbjGluKI37QmOmJtf9UKdTrWuWVqQnTm8597NlKEr2AyxlFVMNmVGXjiQXReBc= X-Received: by 2002:ac8:2d62:: with SMTP id o31mr20121295qta.370.1553503045812; Mon, 25 Mar 2019 01:37:25 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Brian Dickson Date: Mon, 25 Mar 2019 09:37:09 +0100 Message-ID: To: Patrick McManus Cc: "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="0000000000003407eb0584e71d5b" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 08:37:34 -0000 --0000000000003407eb0584e71d5b Content-Type: text/plain; charset="UTF-8" On Mon, Mar 25, 2019 at 8:52 AM Patrick McManus wrote: > I'm not pushing against DoT per se in this thread, I am pushing against > the notion that a client has an obligation to the network to provide a > clear channel for traffic analysis and downgrade triggers. > I think it would be better to not combine (and conflate) two or more issues (which may not be directly related). Plus, this is approaching a "straw man" argument: the notion of "obligation". I might not have been clear enough previously. I am arguing against obligating client applications to take actions that users have not explicitly given permission to do. In this case, the action is: "Use Do{HT} service X". If X is not on the user's list of Do{HT} providers the user has selected/configured, then my position is the user MUST be prompted prior to using X, or absent a user interaction mechanism (UI), then X MUST NOT be used. This includes the case where X is Do53 (regular DNS), if the user has selected/configured that Do{HT} is required. In other words, I am proposing that clients not be built so as to be susceptible to downgrade attacks (whether by the network operator, or by an attacker). This is directly analogous to attacks on TLS itself for downgrading TLS versions or cipher selections. In fact, IMHO, Do{TH} should take a page from the whole TLS state machine, where the client selects among the servers' offered parameters, possibly deciding to not complete the handshake if any of a host of issues are discovered (cert validation, among others). > > One of the notions presented here is that unauthenticated RST injection > forgery is an acceptable, perhaps in the minds of some even desirable, > signal for DoT to trigger downgrades and, further, that clients are > obligated to create a clear signal to the network to enable this approach. > This is a separate issue. Other than blocking all-but-a-few (or all, or a few) DoT servers, I do not believe anyone has proposed explicit downgrade triggers. Or do you mean, when a DoT connection is blocked by e.g. a firewall (or other network enforcement device), that an RST is generated? I believe the RST requires sequence number validation before it can be processed by the TCP stack, which means the entity doing the RST generally needs to be in the data path. Other than "lucky guess" or "high volume attempts", I don't believe RST to be a serious threat. > One issue is that you cannot differentiate this signal between a party you > may want to cooperate with (e.g. your enterprise controller) and an > attacker - that's the nature of an unauthenticated injection. But there are > authenticated enterprise configuration methods available for expressing > policy directly to the client in a trusted way. Indeed my post centered > around the notion of https interception being a necessary outcome of DoH in > the enterprise - my point is basically if you can do https interception > then you are doing enterprise config - consider a config to still do > secured DNS with a server that implements the enterprise policy rather than > doing interception. > I agree that there is a need for both service discovery (local and pre-selected Do{TH} providers), and service *policy* discovery, ideally authenticated and secured (subject to provider implementations adhering to mechanisms to provide secure authenticity proofs). > > And if you do that an enterprise client can, by using its own do{th} > server, also enjoy the benefits of transport security and be confident that > the policy server it intends to use is actually the one in use. > I agree with this. I believe there is widespread interest in solving this problem. However, I believe there is a need for the solution to this problem being coordinated between the DoH and DoT groups, seeing as the DNS operators have a significant interest in both DoT and DoH being served on their servers, and thus a strong interest in any relevant components (discovery, validation, etc.) being uniformly specified across both protocols. It might be worth having an AD/WG discussion on where these should be developed; it might be better to do in DNSOP, rather than DPRIVE or DOH, or alternatively spinning up a new, very focused WG for this work (I would not be in favor of the latter). Brian > On Mon, Mar 25, 2019 at 6:35 AM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >> Sent from my iPhone >> >> On Mar 24, 2019, at 10:42 PM, Patrick McManus >> wrote: >> >> >> On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> This is important for network operators in identifying encrypted DNS >>> traffic, >>> >> >> not all clients acknowledge a network's right to do such things at all >> times. And of course it would be useful to tell the difference between >> policy and a RST injection attack. >> >> If the client does acknowledge the network has the right to set policy - >> then the policy can be set on the client using existing configuration >> mechanisms that allow the client to differentiate between authorized >> configuration and perhaps less-authorized folks identifying their DNS >> traffic. This is well worn ground in the HTTP space. >> >> >> What I find interesting, is that as far as I can tell, everything you >> wrote applies equally to DoH and DoT, if the transport is the only >> difference. E.g. Same client browser, same DNS service, accessed via DoH or >> DoT. >> >> Are you suggesting (or claiming) otherwise, and if so, please elaborate? >> >> Brian >> > --0000000000003407eb0584e71d5b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Mar 25, 2019 at 8:52 AM Patri= ck McManus <mcmanus@ducksong.com= > wrote:
=
I'm not pushing against DoT per se in this thread= , I am pushing against the notion that a client has an obligation to the ne= twork to provide a clear channel for traffic analysis and downgrade trigger= s.

I think it would be better t= o not combine (and conflate) two or more issues (which may not be directly = related).

Plus, this is approaching a "straw = man" argument: the notion of "obligation".

I might not have been clear enough previously. I am arguing against= obligating client applications to take actions that users have not explici= tly given permission to do.
In this case, the action is: "Us= e Do{HT} service X".
If X is not on the user's list of D= o{HT} providers the user has selected/configured, then my position is the u= ser MUST be prompted prior to using X, or absent a user interaction mechani= sm (UI), then X MUST NOT be used. This includes the case where X is Do53 (r= egular DNS), if the user has selected/configured that Do{HT} is required.

In other words, I am proposing that clients not be = built so as to be susceptible to downgrade attacks (whether by the network = operator, or by an attacker). This is directly analogous to attacks on TLS = itself for downgrading TLS versions or cipher selections. In fact, IMHO, Do= {TH} should take a page from the whole TLS state machine, where the client = selects among the servers' offered parameters, possibly deciding to not= complete the handshake if any of a host of issues are discovered (cert val= idation, among others).



<= div>=C2=A0

One of the notions presented here is that unauthent= icated RST injection forgery is an acceptable, perhaps in the minds of some= even desirable, signal for DoT to trigger downgrades and, further, that cl= ients are obligated to create a clear signal to the network to enable this = approach.

This is a separate issue.<= /div>
Other than blocking all-but-a-few (or all, or a few) DoT servers,= I do not believe anyone has proposed explicit downgrade triggers. Or do yo= u mean, when a DoT connection is blocked by e.g. a firewall (or other netwo= rk enforcement device), that an RST is generated? I believe the RST require= s sequence number validation before it can be processed by the TCP stack, w= hich means the entity doing the RST generally needs to be in the data path.= Other than "lucky guess" or "high volume attempts", I = don't believe RST to be a serious threat.

= =C2=A0
One issue is that you cannot differentiate this signal between a party = you may want to cooperate with (e.g. your enterprise controller) and an att= acker - that's the nature of an unauthenticated injection. But there ar= e authenticated enterprise configuration methods available for expressing p= olicy directly to the client in a trusted way. Indeed my post centered arou= nd the notion of https interception being a necessary outcome of DoH in the= enterprise - my point is basically if you can do https interception then y= ou are doing enterprise config - consider a config to still do secured DNS = with a server that implements the enterprise policy rather than doing inter= ception.

I agree that there is a need= for both service discovery (local and pre-selected Do{TH} providers), and = service policy=C2=A0discovery, ideally authenticated and secured (su= bject to provider implementations adhering to mechanisms to provide secure = authenticity proofs).
=C2=A0

And if you do that = an enterprise client can, by using its own do{th} server, also enjoy the be= nefits of transport security and be confident that the policy server it int= ends to use is actually the one in use.
I agree with this.
=C2=A0
I believe there = is widespread interest in solving this problem.

Ho= wever, I believe there is a need for the solution to this problem being coo= rdinated between the DoH and DoT groups, seeing as the DNS operators have a= significant interest in both DoT and DoH being served on their servers, an= d thus a strong interest in any relevant components (discovery, validation,= etc.) being uniformly specified across both protocols.

It might be worth having an AD/WG discussion on where these should be= developed; it might be better to do in DNSOP, rather than DPRIVE or DOH, o= r alternatively spinning up a new, very focused WG for this work (I would n= ot be in favor of the latter).

Brian

On Mon, Mar 25, 2019 at = 6:35 AM Brian Dickson <brian.peter.dickson@gmail.com> wrote:


Sent from my iPhone

On Mar 2= 4, 2019, at 10:42 PM, Patrick McManus <mcmanus@ducksong.com> wrote:

<= blockquote type=3D"cite">



What I find interesting, is that as far as I ca= n tell, everything you wrote applies equally to DoH and DoT, if the transpo= rt is the only difference. E.g. Same client browser, same DNS service, acce= ssed via DoH or DoT.

Are you suggesting (or claimi= ng) otherwise, and if so, please elaborate?

Brian= =C2=A0
--0000000000003407eb0584e71d5b-- From nobody Mon Mar 25 01:40:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF44C120381; Mon, 25 Mar 2019 01:40:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DxduP42ymF8X; Mon, 25 Mar 2019 01:40:08 -0700 (PDT) Received: from bizet.nethelp.no (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by ietfa.amsl.com (Postfix) with ESMTP id B42BE120365; Mon, 25 Mar 2019 01:40:07 -0700 (PDT) Received: from localhost (bizet.nethelp.no [IPv6:2001:8c0:9e04:500::1]) by bizet.nethelp.no (Postfix) with ESMTP id 8CC0CE607B; Mon, 25 Mar 2019 09:40:05 +0100 (CET) Date: Mon, 25 Mar 2019 09:40:05 +0100 (CET) Message-Id: <20190325.094005.471912184.sthaug@nethelp.no> To: brian.peter.dickson@gmail.com Cc: mcmanus@ducksong.com, ekr@rtfm.com, doh@ietf.org, wjhns1@hardakers.net, dnsop@ietf.org, Alister.Winfield=40sky.uk@dmarc.ietf.org, huitema@huitema.net, vittorio.bertola=40open-xchange.com@dmarc.ietf.org From: sthaug@nethelp.no In-Reply-To: References: X-Mailer: Mew version 6.7 on Emacs 26 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 08:40:11 -0000 > The DoH operators who have made public statements (google and cloudflare > are two I am aware of), have specifically indicated that NO OTHER HTTPS > TRAFFIC will be shared on the IPv{46} addresses serving Do{HT}. I have seen such a public statement from Google. Where have you seen a similar statement from Mozilla/Cloudflare? I asked for such a statement from Mozilla recently (on this mailing list). No answer yet. Steinar Haug, AS2116 From nobody Mon Mar 25 01:52:29 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8F18D1203EF; Mon, 25 Mar 2019 01:52:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.001 X-Spam-Level: *** X-Spam-Status: No, score=3.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, GB_SUMOF=5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id e6pcNM4QHQ78; Mon, 25 Mar 2019 01:52:15 -0700 (PDT) Received: from mail-it1-x135.google.com (mail-it1-x135.google.com [IPv6:2607:f8b0:4864:20::135]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0419C1203CD; Mon, 25 Mar 2019 01:52:14 -0700 (PDT) Received: by mail-it1-x135.google.com with SMTP id y63so1024805itb.5; Mon, 25 Mar 2019 01:52:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=a8+ctBOkEF6JUuPyF694pOmMlluB+1FwDEEIfOExWTg=; b=s+8zVM+OKhlNEB9R4VYyRptUoogidunChkFxgOqlqOLLYRwffxXq83uyEAJmBdz+AR LnKrdx5W+zbDC/X5NcY0TApu3Pe6VrjMZfnpYkcGZr8766W83ynY2nLGQV6YCnW4T/P0 YVZ9szNDm+VBERFOvCwrV58t8qOeyDgcd5xfQTb52vB6S+hXPT3XSQ/RgZhLdtQ4uPKK 8VlzdLB5Eh19KufZ1yGtKVGSbPZSykHc7DbhM4hJsyCJPoW4h2hCxLN+/snuQoixJpFB k620q3aIZAvPs5b++WCkVuVBUNwyOJtG7GQ3BW8CUeYbcCQXKNpdGA6ePKdyFHDMCj33 1/tA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=a8+ctBOkEF6JUuPyF694pOmMlluB+1FwDEEIfOExWTg=; b=hoYv8gbMwTbr/JhX0y6y8t2XYFkxVlXodXyOfmxtAMduowPYMYnuTmyqxUgoteCYt3 NhFegz6K/jPKW8yPT+Nvx+4Yibb/r643+Db5oVvIv3HXhK83FdwcX5yIvxORVvK/H19A Y2skysTBBiKsHb3+fzWVBlCsBYpBH6pRgaI9LgVszJKm5wEbgKDl12S+4f2Y6nS63Nos hEjG2hPi46jMGrleXWbXV6QUb9q0Zv3NnY4+rWhLEEFLo7R2vIoKKGJ4B3+U9K3VqBus lUQ+XyhOH6SPRspC+updbDXE6RLNZOYJodnZzlhuDUToxFp4FoeDNvv2jF5D3jk+at2C UZ6w== X-Gm-Message-State: APjAAAV+ONLCgLYFA95ULDqFQXi6TkszKLd2MtdIm5ZpO8eeEmk7d0KH SQ6jSBryQNVVnEvyEbDnyn2uuaawgFIPmUBf9WQ= X-Google-Smtp-Source: APXvYqynO15yvlIcjauV2wjdPZLNLjIgZt9k4cPoOZzOdC40SLjbUHlvLFBxQppTLSl7u3eBqFwNDMSBVwo4sLTiq8Q= X-Received: by 2002:a24:d245:: with SMTP id z66mr11400557itf.47.1553503933223; Mon, 25 Mar 2019 01:52:13 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Valentin Gosu Date: Mon, 25 Mar 2019 09:52:01 +0100 Message-ID: To: Brian Dickson Cc: Patrick McManus , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "Winfield, Alister" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="00000000000018d7970584e75208" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 08:52:22 -0000 --00000000000018d7970584e75208 Content-Type: text/plain; charset="UTF-8" On Mon, 25 Mar 2019 at 09:15, Brian Dickson wrote: > > > On Mon, Mar 25, 2019 at 8:52 AM Patrick McManus > wrote: > >> I'm not pushing against DoT per se in this thread, I am pushing against >> the notion that a client has an obligation to the network to provide a >> clear channel for traffic analysis and downgrade triggers. >> >> fwiw - there are lots of reasons an http client is going to be interested >> in an http substrate beyond just traffic analysis defense. It has the >> potential for better overall application responsiveness - by sharing >> connections and handshakes with other http data. I don't think that >> particular discussion is important to this thread. >> > > Actually, it really is. > > At a minimum it needs to be treated as an assertion that is subject to > validation or refutation. > > This is a refutation: > > The DoH operators who have made public statements (google and cloudflare > are two I am aware of), have specifically indicated that NO OTHER HTTPS > TRAFFIC will be shared on the IPv{46} addresses serving Do{HT}. > > So, the handshakes and sharing argument is specious at best, and bogus at > worst. > That may be true for Google and Cloudflare right now. But if I will be running my own DoH server it would probably be on AWS or compute engine along with any other website I'm currently running, so the connection sharing WILL happen. > The ONLY difference in browsers doing DoH vs DoT, under the hood, is that > DoT does not require the encoding/decoding of the DNS messages (plus all > the other HTTP overhead). > Both DoT and DoH require DNS messages in wire format be constructed first, > and after whatever decoding, wire format responses processed by the client. > > A cursory analysis of the logic -- extra encoding vs no extra encoding -- > essentially proves by "the triangle inequality"* that DoH cannot be faster > than DoT when comparing same-client to same-server. > > Brian > > *(the sum of lengths of two sides is greater or equal to the length of the > third side) In this case two sides are the same length (processing of TLS > and DNS) and the other side is extra processing of HTTP encoding, headers, > etc., and the sum is (HTTP + common path) , compared with (common path). > HTTP is not a zero-cost flow, so HTTP + x > x. QED. > > > >> >> On Mon, Mar 25, 2019 at 6:35 AM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> >>> Sent from my iPhone >>> >>> On Mar 24, 2019, at 10:42 PM, Patrick McManus >>> wrote: >>> >>> >>> On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson < >>> brian.peter.dickson@gmail.com> wrote: >>> >>>> >>>> This is important for network operators in identifying encrypted DNS >>>> traffic, >>>> >>> >>> not all clients acknowledge a network's right to do such things at all >>> times. And of course it would be useful to tell the difference between >>> policy and a RST injection attack. >>> >>> If the client does acknowledge the network has the right to set policy - >>> then the policy can be set on the client using existing configuration >>> mechanisms that allow the client to differentiate between authorized >>> configuration and perhaps less-authorized folks identifying their DNS >>> traffic. This is well worn ground in the HTTP space. >>> >>> >>> What I find interesting, is that as far as I can tell, everything you >>> wrote applies equally to DoH and DoT, if the transport is the only >>> difference. E.g. Same client browser, same DNS service, accessed via DoH or >>> DoT. >>> >>> Are you suggesting (or claiming) otherwise, and if so, please elaborate? >>> >>> Brian >>> >> _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000018d7970584e75208 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 25 Mar 2019 at 09:15, Brian Dickson <brian.peter.dickson@gmail.com> wrote:
=


On Mon, Mar 25, 2019 at 8:52 AM Patrick McManus <mcmanus@ducksong.co= m> wrote:
I'm not pushing against DoT per se in this threa= d, I am pushing against the notion that a client has an obligation to the n= etwork to provide a clear channel for traffic analysis and downgrade trigge= rs.

fwiw - there are lots of reasons an = http client is going to be interested in an http substrate beyond just traf= fic analysis defense. It has the potential for better overall application r= esponsiveness - by sharing connections and handshakes with other http data.= I don't think that particular discussion is important to this thread.<= /div>

Actually, it really= is.

At a minimum it needs to be treated as an ass= ertion that is subject to validation or refutation.

This is a refutation:

The DoH operators who have= made public statements (google and cloudflare are two I am aware of), have= specifically indicated that NO OTHER HTTPS TRAFFIC will be shared on the I= Pv{46} addresses serving Do{HT}.

So, the handshake= s and sharing argument is specious at best, and bogus at worst.
=

That may be true for Google and Clou= dflare right now. But if I will be running my own DoH server it would proba= bly be on AWS or compute engine along with any other website I'm curren= tly running, so the connection sharing WILL happen.
=C2=A0
The ONLY difference in browsers doing DoH vs DoT= , under the hood, is that DoT does not require the encoding/decoding of the= DNS messages (plus all the other HTTP overhead).
Both DoT and Do= H require DNS messages in wire format be constructed first, and after whate= ver decoding, wire format responses processed by the client.

=
A cursory analysis of the logic -- extra encoding vs no extra en= coding -- essentially proves by "the triangle inequality"* that D= oH cannot be faster than DoT when comparing same-client to same-server.

Brian

*(the sum of lengths o= f two sides is greater or equal to the length of the third side) In this ca= se two sides are the same length (processing of TLS and DNS) and the other = side is extra processing of HTTP encoding, headers, etc., and the sum is (H= TTP=C2=A0+ common path) , compared with (common path). HTTP is not a zero-c= ost flow, so HTTP=C2=A0+ x > x. QED.

=C2=A0

On Mon, Mar 25, 2019 at 6:35 = AM Brian Dickson <brian.peter.dickson@gmail.com> wrote:


Sent from my iPhone

On Mar 24, 2019, at 10:42 PM, Patrick McManus <mcmanus@ducksong.com>= ; wrote:


On Sun, Mar 24, 2019 at 10:31 PM Brian Dickson &l= t;brian.= peter.dickson@gmail.com> wrote:

This is important for network operators in iden= tifying encrypted DNS traffic,

not all clients acknowledge a network's right to do such things = at all times. And of course it would be useful to tell the difference betwe= en policy and a RST injection attack.

If the clien= t does acknowledge the network has the right to set policy - then the polic= y can be set on the client using existing configuration mechanisms that all= ow the client to differentiate between authorized configuration and perhaps= less-authorized folks identifying their DNS traffic. This is well worn gro= und in the HTTP space.

What I find interesting, is that as far as I ca= n tell, everything you wrote applies equally to DoH and DoT, if the transpo= rt is the only difference. E.g. Same client browser, same DNS service, acce= ssed via DoH or DoT.

Are you suggesting (or claimi= ng) otherwise, and if so, please elaborate?

Brian= =C2=A0
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000018d7970584e75208-- From nobody Mon Mar 25 02:01:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C5AE512037E; Mon, 25 Mar 2019 02:01:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8tGMB3e37ECq; Mon, 25 Mar 2019 02:01:44 -0700 (PDT) Received: from mail-qt1-x842.google.com (mail-qt1-x842.google.com [IPv6:2607:f8b0:4864:20::842]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 29BEB12037A; Mon, 25 Mar 2019 02:01:44 -0700 (PDT) Received: by mail-qt1-x842.google.com with SMTP id z16so9365439qtn.4; Mon, 25 Mar 2019 02:01:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=kQyYc58rtKJj0MSMFujeBlb9FM7G3kiQGcQ34tV/ooI=; b=RdYxc5k3ora5j9a/D2KxKvNrEtG4hVo2lbFY0a/y7wlhutptcZx6Y+Z5QOU+YTOTwR D/rBsqIejQxEkmgo7cYQ4ZRmi6QiJNcn+PAqh+fM3tRdJiO8pduSO/Qi+yEMXaiNwY/A N4J68HcSWlnFZpGAB1j+DqWxuha0OgMFPBWCohK4riI5xAxlnHDE1zsI2946oVTZGdP9 Qqp7DPdlFD4uLH2KmN55KjSPxMDrZ52Bf7ZHJXeh3qFjzJt5BTovN77cv540E3smQmg7 6OncDXI5gxl69Q2+Gi6fIjfoslFv6vyx2ahVbW6ShmdrEMm0ljMhRM0PEl6kwImNbqQT 2J5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=kQyYc58rtKJj0MSMFujeBlb9FM7G3kiQGcQ34tV/ooI=; b=EwNW48iburjZ1q27ebn8nEV0UqR2PGDz6FtDGqlJPuKw3yGeR8x2U/9kWhwnSnD9/Q Jvek6Qf1jSZZ3h11EZlBg0e/CNPYqFwVqwHKnhWKtpWH5JcH4MB9C5239ZueFCsE0Lno 1WlMYCAl6F3YLzSVwcfCS72j1yLxI646g/bi9PFUDWibNrypIAz5JRoaTtQwVYnqvFGp fp1nytymU17rxsaEuJHUY0PesrxvyXAIidegRE3h51F9k6z7LhR4MxIF/Wi9wWKRnLcU iR7ENTYeP/exMBgiLsms4mRWW6tq/Avsxb/M56uDOWy9+CwzpR5anwv+t8ggac4fAuA+ lmeQ== X-Gm-Message-State: APjAAAVX0SO6KVVt4EXdZ3vlh2k4WcfVeXHmMaRqrHcxMs1OPYqZzMt+ Ad9rckP3qVJqdRWB9YhAwfB++Q1rFORtwaviyek= X-Google-Smtp-Source: APXvYqyGN5v32lep66ovfIYgsHDEvq4IbV9gHMIiZzdP5B2ucuMtM/RNipKD/LthezHrtVElTHiYgjFyJZiS7ffTVbw= X-Received: by 2002:ac8:1707:: with SMTP id w7mr18927312qtj.324.1553504503281; Mon, 25 Mar 2019 02:01:43 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Brian Dickson Date: Mon, 25 Mar 2019 10:01:26 +0100 Message-ID: To: Valentin Gosu Cc: Patrick McManus , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "Winfield, Alister" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="000000000000133def0584e774bc" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:01:47 -0000 --000000000000133def0584e774bc Content-Type: text/plain; charset="UTF-8" On Mon, Mar 25, 2019 at 9:52 AM Valentin Gosu wrote: > On Mon, 25 Mar 2019 at 09:15, Brian Dickson > wrote: > >> >> >> On Mon, Mar 25, 2019 at 8:52 AM Patrick McManus >> wrote: >> >>> I'm not pushing against DoT per se in this thread, I am pushing against >>> the notion that a client has an obligation to the network to provide a >>> clear channel for traffic analysis and downgrade triggers. >>> >>> fwiw - there are lots of reasons an http client is going to be >>> interested in an http substrate beyond just traffic analysis defense. It >>> has the potential for better overall application responsiveness - by >>> sharing connections and handshakes with other http data. I don't think that >>> particular discussion is important to this thread. >>> >> >> >> The DoH operators who have made public statements (google and cloudflare >> are two I am aware of), have specifically indicated that NO OTHER HTTPS >> TRAFFIC will be shared on the IPv{46} addresses serving Do{HT}. >> >> So, the handshakes and sharing argument is specious at best, and bogus at >> worst. >> > > That may be true for Google and Cloudflare right now. But if I will be > running my own DoH server it would probably be on AWS or compute engine > along with any other website I'm currently running, so the connection > sharing WILL happen. > Okay, that's a useful anecdote/datapoint. Have you considered whether you will need to operate DoT as well, in case DoH is blocked from some networks that do not also block DoT? I.e. fallback from DoH to DoT rather than fall all the way back to Do53? Brian --000000000000133def0584e774bc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Mar 25, 2019 at 9:52 AM Valen= tin Gosu <valentin.gosu@gmail= .com> wrote:
On Mon, 25 Mar 2019 at 09:15, Brian Dickson <brian.peter.dickson@gmai= l.com> wrote:


On Mon, Mar 25, 2019 at 8:52 AM = Patrick McManus <mcmanus@ducksong.com> wrote:
I'm not pushing against Do= T per se in this thread, I am pushing against the notion that a client has = an obligation to the network to provide a clear channel for traffic analysi= s and downgrade triggers.

fwiw - there a= re lots of reasons an http client is going to be interested in an http subs= trate beyond just traffic analysis defense. It has the potential for better= overall application responsiveness - by sharing connections and handshakes= with other http data. I don't think that particular discussion is impo= rtant to this thread.


The DoH operators who have made public statements (google= and cloudflare are two I am aware of), have specifically indicated that NO= OTHER HTTPS TRAFFIC will be shared on the IPv{46} addresses serving Do{HT}= .

So, the handshakes and sharing argument is speci= ous at best, and bogus at worst.

That may be true for Google and Cloudflare right now. But if I will= be running my own DoH server it would probably be on AWS or compute engine= along with any other website I'm currently running, so the connection = sharing WILL happen.

Okay= , that's a useful anecdote/datapoint.

Have you= considered whether you will need to operate DoT as well, in case DoH is bl= ocked from some networks that do not also block DoT?

I.e. fallback from DoH to DoT rather than fall all the way back to Do53?=

Brian=C2=A0
--000000000000133def0584e774bc-- From nobody Mon Mar 25 02:13:41 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 927B212037A; Mon, 25 Mar 2019 02:13:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VT3LwfdyDkdb; Mon, 25 Mar 2019 02:13:32 -0700 (PDT) Received: from aer-iport-2.cisco.com (aer-iport-2.cisco.com [173.38.203.52]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 87D92120373; Mon, 25 Mar 2019 02:13:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=8296; q=dns/txt; s=iport; t=1553505211; x=1554714811; h=from:message-id:mime-version:subject:date:in-reply-to:cc: to:references; bh=a5qltXFEsDR0GCudOaGKTeQ4R+g8tE94uwwkzqs/vEg=; b=VC/n2gi6VRNKn/zgjKyD2RPtYS5dS+eCzlDN20p6xwgrs8KL9/AcgYZD u6ukqi3YK1ayVoiYMhtETxHhFBGpDCwZogzlfe+aAcQggubM/BvBwhYVK dgd3HNF+PoAHOl6huRC06iCVCL1tmZYfJ0I7owAI/4FPK0tCIuVisWX3F k=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AUAAA+m5hc/xbLJq1jGgEBAQEBAgE?= =?us-ascii?q?BAQEHAgEBAQGBVAIBAQEBCwGBDoECRXMhEieEDoh7jE6SQ4dyDQEBhGwChSw?= =?us-ascii?q?3Bg0BAQMBAQkBAwJtKIVKAQEBAwEjVgULCxgqAgJXBhODIoFuCK4AgS+FRoR?= =?us-ascii?q?igS8Bi0iBf4E4H4JMPodOMYImA6UWCZM5GZN+m1SCcgIEBgUCFYFjIiiBLjM?= =?us-ascii?q?aCBsVZQGCQT6BWBeOHz4DMI9TAQE?= X-IronPort-AV: E=Sophos; i="5.60,256,1549929600"; d="scan'208,217"; a="10947978" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 25 Mar 2019 09:13:29 +0000 Received: from dhcp-10-61-105-142.cisco.com (dhcp-10-61-105-142.cisco.com [10.61.105.142]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2P9DS9S000568 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 25 Mar 2019 09:13:29 GMT From: Eliot Lear Message-Id: <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_A25614EC-1899-461C-8161-E383A17F86A6" Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Mon, 25 Mar 2019 10:13:28 +0100 In-Reply-To: Cc: Brian Dickson , "dnsop@ietf.org" , "doh@ietf.org" To: Paul Wouters References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.105.142, dhcp-10-61-105-142.cisco.com X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:13:33 -0000 --Apple-Mail=_A25614EC-1899-461C-8161-E383A17F86A6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hi, > On 24 Mar 2019, at 23:25, Paul Wouters wrote: >=20 >> The blocking of DoT to a given provider should be interpreted as an = explicit policy. Users should be informed >> that they may, and very likely will, be violating someone=E2=80=99s = policy, if they choose to use DoH in that >> circumstance, and that they may be violating laws by doing so, and = should only do so if they are willing to >> accept that risk. >=20 > Again, this is the network operator centric view. There are many = hostile > networks that would block DoT just so that they could monetize = (legally > or illegally!) from my harvested DNS data. I can assure you the = warning > you want to write to users would be very different from the warning I > would want to give those users. Which is why the IETF doesn't do > banners towards endusers. Putting aside legal language, but Brian=E2=80=99s basic notion is that = the user can make an informed decision and the network can express its = policies, with which the user can agree or not agree (and go elsewhere). = Having the protocol elements to permit this sort of agreement is its = own tussle. Eliot= --Apple-Mail=_A25614EC-1899-461C-8161-E383A17F86A6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hi,

On 24 Mar 2019, at 23:25, Paul Wouters = <paul@nohats.ca> = wrote:

The = blocking of DoT to a given provider should be interpreted as an explicit = policy. Users should be informed
that they may, and very = likely will, be violating someone=E2=80=99s policy, if they choose to = use DoH in that
circumstance, and that they may be = violating laws by doing so, and should only do so if they are willing = to
accept that risk.

Again, this is the network = operator centric view. There are many hostile
networks that would block DoT = just so that they could monetize (legally
or illegally!) from my harvested DNS data. I can assure you = the warning
you want to = write to users would be very different from the warning I
would want to give those users. = Which is why the IETF doesn't do
banners towards = endusers.

Putting aside legal language, but Brian=E2=80=99s basic = notion is that the user can make an informed decision and the network = can express its policies, with which the user can agree or not agree = (and go elsewhere).  Having the protocol elements to permit this = sort of agreement is its own tussle.

Eliot
= --Apple-Mail=_A25614EC-1899-461C-8161-E383A17F86A6-- From nobody Mon Mar 25 02:24:48 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C2615120418 for ; Mon, 25 Mar 2019 02:24:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=d6HXHoqP; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=6xz3JHXv Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J_GqWSyblXy6 for ; Mon, 25 Mar 2019 02:24:40 -0700 (PDT) Received: from new1-smtp.messagingengine.com (new1-smtp.messagingengine.com [66.111.4.221]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56D7F1203A1 for ; Mon, 25 Mar 2019 02:24:26 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailnew.nyi.internal (Postfix) with ESMTP id 0103F148F8 for ; Mon, 25 Mar 2019 05:24:24 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Mon, 25 Mar 2019 05:24:24 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type:content-transfer-encoding; s=fm1; bh=Y1x5E UK108pH/CTf7zkP7X8k3V8tz/VOb8kGR1PKFHg=; b=d6HXHoqPNyrmMAKj2OU35 kZTROyIpYKSK6AlrtPCOby3MWE+bICcXeFl2lM34BcHnY9zoBcCHbB2yxJhmdXWZ VLEGLYVfN4uLxhiELfifNBPpN8QuchADHyyyvRxEMC+fElHsKLPtAFMlyTX1dGUP v9mIvE2xBS+Fe1h70rZmtUh5qyLuOzOwmm33La2hqfZuWzFfyZWsakhLioqwFm3p GCpbtjaRYW5CCl9LEXd8ZIDeICZPjGG2Nrf7meFWHgxgOgL2PpBI+IUsqRmrrnpb Oy3lWmufmRGg2Ua9/QTbfzCP6q+xjx6uLRT2a+iMq3lHeJmShmqLA+9Yi1KQj5i4 w== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:in-reply-to:message-id:mime-version:references :subject:to:x-me-proxy:x-me-proxy:x-me-sender:x-me-sender :x-sasl-enc; s=fm2; bh=Y1x5EUK108pH/CTf7zkP7X8k3V8tz/VOb8kGR1PKF Hg=; b=6xz3JHXvep8J1U2rtyytHBz5jkQ4gPJKkUA585TIz2prLrFPsWf9RCo6Q z44RYYrHxa/wgsuASQ1FrjJ+1rGyvCOKcui4xMhG6BOy739/qOHhNYRdgaoSR9AA Tz3HItkVGCKrvQg1Y4c6XgaHHoruTtK0wJaRyq8Gojoc0lzQokZjOqKq191JsYpz urvs9M0yAEBVaxeDTxuVc2FyMjaFstSg35oOcA7SoaIiN4euWz5kgXNg0DCBjPqq 6PkozQc3Xxco/Wzm7yCzxoPNpgJPZ2cdCUWik2b+6qqjZWqHQoSTph66ykRE+GAl 96QWqJHWaIlHogqYGg5k+IS1j9Uwg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrjeekgddtgecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgfgsehtqh ertderreejnecuhfhrohhmpedfofgrrhhtihhnucfvhhhomhhsohhnfdcuoehmtheslhho figvnhhtrhhophihrdhnvghtqeenucfrrghrrghmpehmrghilhhfrhhomhepmhhtsehloh ifvghnthhrohhphidrnhgvthenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id B02937C67E; Mon, 25 Mar 2019 05:24:23 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.5-976-g376b1f3-fmstable-20190314v3 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <8b885f68-702a-40e3-a9fe-9a779b0c5c24@www.fastmail.com> In-Reply-To: <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> Date: Mon, 25 Mar 2019 05:24:25 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain;charset=utf-8 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:24:47 -0000 On Mon, Mar 25, 2019, at 10:13, Eliot Lear wrote: > Putting aside legal language, but Brian=E2=80=99s basic notion is that= the user=20 > can make an informed decision and the network can express its policies= ,=20 > with which the user can agree or not agree (and go elsewhere). Having=20= > the protocol elements to permit this sort of agreement is its own=20 > tussle. I would encourage people who would like to participate in aspects of tha= t tussle to join the capport working group. =20 WEDNESDAY, March 27, 2019 1120-1320 Karlin 3 The glib treatment of the role of informed consent here is probably wort= h some more discussion, but this thread is beyond the point that I consi= der it to be productive. From nobody Mon Mar 25 02:25:28 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D3F5912037B; Mon, 25 Mar 2019 02:25:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 23VKvG0CJiLz; Mon, 25 Mar 2019 02:25:17 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0235B12037F; Mon, 25 Mar 2019 02:25:16 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id AE64DBE2F; Mon, 25 Mar 2019 09:25:14 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id snlD7vnD5cLk; Mon, 25 Mar 2019 09:25:13 +0000 (GMT) Received: from [31.133.128.194] (dhcp-80c2.meeting.ietf.org [31.133.128.194]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 7E356BE24; Mon, 25 Mar 2019 09:25:12 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553505913; bh=RxjGIk63L2fPoWKgWEFY0N1yWCH9fxjr85NJ7RGZiGQ=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=B9GMsGg65fG9z+AM2RnnXeBmePco+JQK3lrb6bYh+qp9g/iHtp5gpomh2oePjru0Z dWS1syVFA0dhuDKEJfb+DCZPuZz0ZsE7AtAit86iDazf1JyAXovf/gdZRncjZYlvf9 5JdlDhhCAvTMhaym+hzdbIV9ovzg78yxpc/O4phc= To: Eliot Lear , Paul Wouters Cc: "dnsop@ietf.org" , "doh@ietf.org" , Brian Dickson References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <5d57c8a7-d8c7-fa62-db07-a5ffd74c5dfd@cs.tcd.ie> Date: Mon, 25 Mar 2019 09:25:08 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="6SJqarAkDPI1FfsmNyg1sll3YHTrtvexo" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:25:20 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --6SJqarAkDPI1FfsmNyg1sll3YHTrtvexo Content-Type: multipart/mixed; boundary="eO7PMASUJqeIwuLAcq9HBQ2V6wgzGiZpN"; protected-headers="v1" From: Stephen Farrell To: Eliot Lear , Paul Wouters Cc: "dnsop@ietf.org" , "doh@ietf.org" , Brian Dickson Message-ID: <5d57c8a7-d8c7-fa62-db07-a5ffd74c5dfd@cs.tcd.ie> Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> In-Reply-To: <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> --eO7PMASUJqeIwuLAcq9HBQ2V6wgzGiZpN Content-Type: multipart/mixed; boundary="------------B7F30101FC15169EAE801D91" Content-Language: en-GB This is a multi-part message in MIME format. --------------B7F30101FC15169EAE801D91 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 25/03/2019 09:13, Eliot Lear wrote: > Putting aside legal language, but Brian=E2=80=99s basic notion is that = the > user can make an informed decision and the network can express its > policies, with which the user can agree or not agree (and go > elsewhere). Having the protocol elements to permit this sort of > agreement is its own tussle. I see a problem with the above argument. DNS means nothing to most people, so I can't see how they can ever make the informed decision you mention. Cheers, S. --------------B7F30101FC15169EAE801D91 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------B7F30101FC15169EAE801D91-- --eO7PMASUJqeIwuLAcq9HBQ2V6wgzGiZpN-- --6SJqarAkDPI1FfsmNyg1sll3YHTrtvexo Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyYnnQACgkQWrL68XsX K+q2nxAAv117PFdVqFfQyBe/OuKxfLOKGoO2xMGptvR9IRaq238d++ytoJCtO1As 9KvhbpVqSfsRKLJ3X9XHGrPcUvEffee26ERoEZnUNNiSa1bTWAuxwQeAaNl16mkH G7JUDemyVaAL8UkktNdoLYQUXv5T1XQA41mtkNKyqwNLLA6NBpXS4g4Sp35JXCaO tMdgU3jW1teXv0cohXA4LSX9cVz01qm23RLaa4p85+1uYoWvnKLdsos33gCa1Lw0 h7me1SxNE3pekJ+OTlKSPQe4MXH2B1UyUl5fDA61PJgJQEb4CRqr7tkdHyzzXWjm lLZ4iJlGkm5JKcuer+2zkEiBZnx40htWTlPz2CfJ3qW0h9uuZJenBmjk993WmPmV qi7AfYOKQqbNevftafzWGNRAgIk9uAQGg2Tfn3KJO8sJbPWVOybtiDYbLPItJ/Mz gXReIbDoWjj2jHV04VrRSxHGLjgHUgTQ+D4dmUsaWR6nFnpsNULfDPp/CtXjrvDL 2jj3oqXyOnN77yGy+sXKlca3KRg9hCDg7q3q5QZf+uSH/YeEDq1+hUd3vTTHrmID SUxTXlIlMqmSbdR7nrG1R05t4cqoxtd0Ggv3TOGjETxrrtze791ltdo7NCTvF0Gh LjnA/UWLX4vRs1F6noRcv2RlaGg9veo26eS2Fui0Ik+y6/ay6+4= =hfxc -----END PGP SIGNATURE----- --6SJqarAkDPI1FfsmNyg1sll3YHTrtvexo-- From nobody Mon Mar 25 02:27:52 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DC32120391; Mon, 25 Mar 2019 02:27:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8sq5hobqMiOf; Mon, 25 Mar 2019 02:27:44 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CF88A1203ED; Mon, 25 Mar 2019 02:27:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=477; q=dns/txt; s=iport; t=1553506064; x=1554715664; h=mime-version:subject:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to; bh=p1D+fOPV6PCrlnwJxnUeM8l5fxU8Y/wXWcX4gjqb5XQ=; b=aO/ugK7izFgcjv2Sd8XEgkkB3qabfZ0EfD6U0HoQBIh267MJTsc4mjXR tw1cOap7G/T2lZpTcHJD+wgQ2OMsDLw7ew77qJ12yj3b908GpE768xcTj 1P3xoxrGCSgDGN8ELbSTLgiBy3P9y9tH13R/OQWAxamTywZCXinErtDz+ 0=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AQAAC+nphc/xbLJq1jGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBVAEBAQEBAQsBghBFbwQhEieEDoh7jE6aNQ0BAYRsAoU?= =?us-ascii?q?tNwYNAQEDAQEJAQMCbSiFSwEFI1YQCxgCAiYCAlcGE4MigXatfYEviiiBCyQ?= =?us-ascii?q?Bi0iBf4E4H4JMPoREgwoxgiYDpRYJkzkZgXKSDJtUgnICBAYFAhWBYyKBVjM?= =?us-ascii?q?aCBsVZQGCQT6BWBeOHz4DMI9TAQE?= X-IronPort-AV: E=Sophos;i="5.60,256,1549929600"; d="scan'208";a="10891208" Received: from aer-iport-nat.cisco.com (HELO aer-core-1.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 25 Mar 2019 09:27:41 +0000 Received: from dhcp-10-61-105-142.cisco.com (dhcp-10-61-105-142.cisco.com [10.61.105.142]) by aer-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2P9ReBH002811 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 25 Mar 2019 09:27:41 GMT Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Eliot Lear In-Reply-To: <5d57c8a7-d8c7-fa62-db07-a5ffd74c5dfd@cs.tcd.ie> Date: Mon, 25 Mar 2019 10:27:40 +0100 Cc: Paul Wouters , "dnsop@ietf.org" , "doh@ietf.org" , Brian Dickson Content-Transfer-Encoding: quoted-printable Message-Id: <353AA9FF-C7C5-4AE4-9DEF-772EC571767A@cisco.com> References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> <5d57c8a7-d8c7-fa62-db07-a5ffd74c5dfd@cs.tcd.ie> To: Stephen Farrell X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.105.142, dhcp-10-61-105-142.cisco.com X-Outbound-Node: aer-core-1.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:27:51 -0000 On 25 Mar 2019, at 10:25, Stephen Farrell = wrote: > I see a problem with the above argument. DNS means nothing to > most people, so I can't see how they can ever make the informed > decision you mention. I view that as a research question (I don=E2=80=99t accept your = assertion, but neither can I disprove it). That is- could a question be = formed around local network trust that encompasses this component? = Possibly. Eliot= From nobody Mon Mar 25 02:31:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2B65112038A for ; Mon, 25 Mar 2019 02:31:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=B0JGrUGg; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=fL951X9M Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XxGSS_T_xv8s for ; Mon, 25 Mar 2019 02:31:34 -0700 (PDT) Received: from outbound1f.eu.mailhop.org (outbound1f.eu.mailhop.org [52.28.59.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 31644120385 for ; Mon, 25 Mar 2019 02:31:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553506291; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=pW35Cg0OdSh5acBCgsfxIwGo+5mSoOnPoFVzjwOTc2MOXxn2mAqGpQfBsFnBF+0BPi7J/aJyDphZO 0W23UJUt9hpWWVZf0DCWrN4/IpFichqHuI6THbTak0/dxwqFEHx4k11BuSjTwesGghCtVTMSDWnDyU zUwCRCPYHhakU4elQ0+ftd3id4bXOsLdADxaV3LyFhgsnLWykYqK9Ho7MjYNyX+dsqNXd0h7hqQ2PX lwmDpyS7CkQKZOzSJesyJkTgY99dwzAUPGq+zWIjAb9ZptOy5wxpudu/NergINt8zl7AKH+3BiR1Qw rlY3ROgAL4hIHintlP6KayzgAxH53LA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=7RBGxW3NhccRVa/PfRstk5sM+M4XvVxI6oLzE0u9fqY=; b=F+HT/pTxBOW9bo5I6NvsNGeA61tyoHHN/73OUydyCjpjphx6BstsUSoHpXbNw/L2TsnZdwIxZfVzS UVKqYXu6RIgZSXkZUMAaPJ1n+n63Nd+FkLprtXfHC+jszdgc6WkwhwT5zJZDOoIrUXFpcn5ErKQjz2 MZj2plgCgT0SklbJHlOsyVlMu5tR+nyDEn7x3v8t9QVXT8eeQ3ADazEBRE5hW5+zKNyriw+YRjoMfs RWiwnUtknodL8T+hbps0eQuE65RNLbm7Rc0HfqRv8KbTtwGpvu0WKPn24cfVdKBUOJ6sVOlL6gSU15 Qzfk3E9606maRZm1XYtnhEHVAGnz3Kw== ARC-Authentication-Results: i=1; outbound2.eu.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.210.46; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=7RBGxW3NhccRVa/PfRstk5sM+M4XvVxI6oLzE0u9fqY=; b=B0JGrUGgoOroP1FaZJDcf+5yXoEBY0EEYVMDE0sucqzsn8cMLBG7ACOlbOfhGvNn+wIOu4GvuAmms x2yxXJ29yE/jvzBuB05Ww333JffI6jfagZuH6e4irR2utw8cJTtdFl6f+u3G1uoKm2Feu/vAEwq75C 6ZDwHrzWYYogh57E= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=7RBGxW3NhccRVa/PfRstk5sM+M4XvVxI6oLzE0u9fqY=; b=fL951X9MPYsPMFmvsVqIAJuOGaSbgUDO/8btvnXXn89mIF1XGAsgZ7zM6LOTahee2TKwooM928bqq waYu2H/jvMhFLT4O6kKHSo2tZHfURgreuDl4gSKVEn/zFRRkT0nbE+9otIENknuhV2Yn3tn9rB9QrI 5yLuEdFQdVU5an3gly0n8QmspWYHFJFIYenE4gwfaOOfYms8LAaWk8sGoWTN0MZBNqkEtN66LWBga4 DWtjBAbgE+1BextJJyziQMLeAeFli2/e2e8BTlMv2uq7oxRNm1VpBSqm/EsJ/sprxKbk727jxDJqXj GqJx3iVHsUmtmHOsEHpS1VWxpDtAuqQ== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: c458748a-4ee0-11e9-803b-31925da7267c X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.210.46 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-ot1-f46.google.com (unknown [209.85.210.46]) by outbound2.eu.mailhop.org (Halon) with ESMTPSA id c458748a-4ee0-11e9-803b-31925da7267c; Mon, 25 Mar 2019 09:31:29 +0000 (UTC) Received: by mail-ot1-f46.google.com with SMTP id c16so7386222otn.4; Mon, 25 Mar 2019 02:31:28 -0700 (PDT) X-Gm-Message-State: APjAAAVWdTKt/4rVbAxm4KFlpfic0nye41ENYwQQ9PudEYRdpIx8agQR dxh9BuGZnbr3TGCulMcbsGWHImhOuo6QBnhfNfI= X-Google-Smtp-Source: APXvYqxCT6/Wa+8v2GAt/e2mGmCXpKii+GBClz8Yio8DJlrvAMusLso7XvCd07w89RG7g/GRzn8PxC+TKeOdvu/v1d8= X-Received: by 2002:a05:6830:183:: with SMTP id q3mr18030074ota.204.1553506288300; Mon, 25 Mar 2019 02:31:28 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Patrick McManus Date: Mon, 25 Mar 2019 10:31:17 +0100 X-Gmail-Original-Message-ID: Message-ID: To: Brian Dickson Cc: Patrick McManus , "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="0000000000007876100584e7de3c" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:31:36 -0000 --0000000000007876100584e7de3c Content-Type: text/plain; charset="UTF-8" On Mon, Mar 25, 2019 at 9:37 AM Brian Dickson wrote: > > >> >> \Other than blocking all-but-a-few (or all, or a few) DoT servers, I do > not believe anyone has proposed explicit downgrade triggers. > that's the downgrade I am referring to > Or do you mean, when a DoT connection is blocked by e.g. a firewall (or > other network enforcement device), that an RST is generated? I believe the > RST requires sequence number validation before it can be processed by the > TCP stack, which means the entity doing the RST generally needs to be in > the data path. Other than "lucky guess" or "high volume attempts", I don't > believe RST to be a serious threat. > path manipulation attacks are real. arp attacks.. bootp attacks.. rouge access points. stingray. all kinds of things. unauthenticated network packets are just that: unauthenticated. RST (or blackhole) is a good indication that a path isn't going to work - its not a good indication of who is expressing that policy (or whether it is a policy at all). Anyhow - I'm really not trying to amp up this thread.. I just felt that there were a few relevant points to the discussion that had not been introduced. > --0000000000007876100584e7de3c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Mar 25, 2019 at 9:37 AM Brian= Dickson <brian.peter.d= ickson@gmail.com> wrote:



\Other than blocking all-but-a-few (or = all, or a few) DoT servers, I do not believe anyone has proposed explicit d= owngrade triggers.

th= at's the downgrade I am referring to

=C2=A0
Or do you mean, when a DoT connection is blocked= by e.g. a firewall (or other network enforcement device), that an RST is g= enerated? I believe the RST requires sequence number validation before it c= an be processed by the TCP stack, which means the entity doing the RST gene= rally needs to be in the data path. Other than "lucky guess" or &= quot;high volume attempts", I don't believe RST to be a serious th= reat.

path manipulati= on attacks are real. arp attacks.. bootp attacks.. rouge access points. sti= ngray. all kinds of things. unauthenticated network packets are just that: = unauthenticated. RST (or blackhole) is a good indication that a path isn= 9;t going to work - its not a good indication of who is expressing that pol= icy (or whether it is a policy at all).

Anyhow - I= 'm really not trying to amp up this thread.. I just felt that there wer= e a few relevant points to the discussion that had not been introduced.


=C2=A0
--0000000000007876100584e7de3c-- From nobody Mon Mar 25 02:43:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 44F34120385; Mon, 25 Mar 2019 02:43:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4qiH2B3FgaHX; Mon, 25 Mar 2019 02:43:01 -0700 (PDT) Received: from mail-qt1-x843.google.com (mail-qt1-x843.google.com [IPv6:2607:f8b0:4864:20::843]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B7C1812014F; Mon, 25 Mar 2019 02:43:01 -0700 (PDT) Received: by mail-qt1-x843.google.com with SMTP id d13so4754963qth.5; Mon, 25 Mar 2019 02:43:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NYM3WQMP8Jkwmnr8oLxtRT5PoUdBhmrT/qydqG+zrTY=; b=NNKqd3hin9nO48E09oxhp7c/Yab8W5OKm9lnFw8Nu90/o3RTUAxx6RG5CnwoRpGneM kdZHzLIwGfCVMlOrblaLrNh3xmyiaDfv7fJDd37qgRKw1mTE7dFRUEsYlfMPsFB98D9c HsRJr5Cv4xgSH6b/gpYl2ZP77LzK34LzKgeCjBpy6VLhrfsQDA9CGA4SKamR8Y3eHju4 j3oChH4YHpdxsBED5rOzvxa7GzY4LtshfwRbNfONwe7sEfsTDgNTvjcBcUGhal9haWM+ +u0kEnkNFpLmUl1zUyJDKOkDMHJh8OjGQMdrl9MHb42miHi7yVbAFTBzPktp3AfhUQLk 2ykA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NYM3WQMP8Jkwmnr8oLxtRT5PoUdBhmrT/qydqG+zrTY=; b=cLnk3Q6orNLWvmdqGOVmHUXPfhxxQDIyDvse2gSsQzl16UN1CKwucuL6RfHhMOQZHT UsG2eA1I5+3kuKHhxV4itmC5PIHVhJ0u6CqgCfnL4i/3TxBnJuOhozXWwNPRDd+s6o8n SxgojMraIH+GZDqmxmQKb5JsOc1/QKhhdkCpUUqLDUJu8+TS+i+jRjJQ5ZwyfBvuOLU7 ufc1mXW5sbg89p2ewQG6pN2sCvp4oi5qzbET/fdMo+bfr1e76h6d+FGangI2UpL6D0by CObsLU9rfO5kvXF+yDf3dZl/k5FSmU7NauKb49bj1Hnz69IGJtJZ9rdAkzPsdwFinjHY Xc9w== X-Gm-Message-State: APjAAAXZqzQ/8TIgpDiNdbFta/WIybq5rd3knWv+kZJ0h6vwNiAox3kv sdPfeofRCWDdn/9/x/K9+J5fuPu76gKjANsg5ME= X-Google-Smtp-Source: APXvYqy4BaavXn7RlKH1NTDftiI0q1rHjtlRt9nNY2y0L/NHQPONJsieRp4u//nKi/ac3j5kaxB4ISHxq2pDZbykP3c= X-Received: by 2002:ac8:2d62:: with SMTP id o31mr20319456qta.370.1553506980959; Mon, 25 Mar 2019 02:43:00 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Brian Dickson Date: Mon, 25 Mar 2019 10:42:44 +0100 Message-ID: To: Patrick McManus Cc: "Winfield, Alister" , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , "dnsop@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="000000000000c198ae0584e80716" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 09:43:04 -0000 --000000000000c198ae0584e80716 Content-Type: text/plain; charset="UTF-8" On Mon, Mar 25, 2019 at 10:31 AM Patrick McManus wrote: > > > On Mon, Mar 25, 2019 at 9:37 AM Brian Dickson < > brian.peter.dickson@gmail.com> wrote: > >> >> >>> >>> \Other than blocking all-but-a-few (or all, or a few) DoT servers, I do >> not believe anyone has proposed explicit downgrade triggers. >> > > that's the downgrade I am referring to > > > >> Or do you mean, when a DoT connection is blocked by e.g. a firewall (or >> other network enforcement device), that an RST is generated? I believe the >> RST requires sequence number validation before it can be processed by the >> TCP stack, which means the entity doing the RST generally needs to be in >> the data path. Other than "lucky guess" or "high volume attempts", I don't >> believe RST to be a serious threat. >> > > path manipulation attacks are real. arp attacks.. bootp attacks.. rouge > access points. stingray. all kinds of things. unauthenticated network > packets are just that: unauthenticated. RST (or blackhole) is a good > indication that a path isn't going to work - its not a good indication of > who is expressing that policy (or whether it is a policy at all). > > Anyhow - I'm really not trying to amp up this thread.. I just felt that > there were a few relevant points to the discussion that had not been > introduced. > Okay, that's good to know, and I think we are in agreement (i.e. that inference is a poor substitute for declarations.) I think that this is an area that needs thought and mechanism development, possibly aligned with DoT/DoH operation, possibly not (or orthogonal to them). Brian --000000000000c198ae0584e80716 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Mar 25, 2019 at 10:31 AM Patr= ick McManus <mcmanus@ducksong.co= m> wrote:


On Mon, Mar 25, 2019 at 9:37 AM Bria= n Dickson <brian.peter.dickson@gmail.com> wrote:



\Other than blocking= all-but-a-few (or all, or a few) DoT servers, I do not believe anyone has = proposed explicit downgrade triggers.

that's the downgrade I am referring to

<= /div>
=C2=A0
Or do you mean, when a DoT co= nnection is blocked by e.g. a firewall (or other network enforcement device= ), that an RST is generated? I believe the RST requires sequence number val= idation before it can be processed by the TCP stack, which means the entity= doing the RST generally needs to be in the data path. Other than "luc= ky guess" or "high volume attempts", I don't believe RST= to be a serious threat.

<= div>path manipulation attacks are real. arp attacks.. bootp attacks.. rouge= access points. stingray. all kinds of things. unauthenticated network pack= ets are just that: unauthenticated. RST (or blackhole) is a good indication= that a path isn't going to work - its not a good indication of who is = expressing that policy (or whether it is a policy at all).

Anyhow - I'm really not trying to amp up this thread.. I just = felt that there were a few relevant points to the discussion that had not b= een introduced.

Okay, tha= t's good to know, and I think we are in agreement (i.e. that inference = is a poor substitute for declarations.)

I think th= at this is an area that needs thought and mechanism development, possibly a= ligned with DoT/DoH operation, possibly not (or orthogonal to them).
<= div>
Brian=C2=A0
--000000000000c198ae0584e80716-- From nobody Mon Mar 25 03:47:39 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 475F8120395 for ; Mon, 25 Mar 2019 03:47:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ggbjiLHm2t1q for ; Mon, 25 Mar 2019 03:47:36 -0700 (PDT) Received: from mail-qt1-x841.google.com (mail-qt1-x841.google.com [IPv6:2607:f8b0:4864:20::841]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B18C12039D for ; Mon, 25 Mar 2019 03:47:36 -0700 (PDT) Received: by mail-qt1-x841.google.com with SMTP id h39so9642422qte.2 for ; Mon, 25 Mar 2019 03:47:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SA0VVnyScI8mJcCwEZia8PfAeZrFH0aGTVcoM7HI5eg=; b=UUgobWm66AYTcDbHDtGOU4hqT5W6rbDkbGFQdIr9PQ1eYk7DziPL+wr2nVgJk6VOck ZnQYvhbrJnaTElgl2cFUDnqKPRQLnN/tuVrM9ZafXhQSj49st4Vd0TmzHnRKn7ccYiaT wokIUzF0DtG0j06WssgEmHLiN3Tfhx3gdpdxM/6XbatjxJUGUlW6moNFzwfW8XrkKySW 6+YLrr5fo+H9sRNQ7qMh7SSqZq3YE8OCTGB+SFcovYNy8+nYxwCW3c64vrzJOFZhf99y DZIiv3W+Fs0gfpokQMd9Kqa1EraTiHAcZKajHS0/WHb6vgSGF+SCxqJ9goRJY4dcFPjT kmWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SA0VVnyScI8mJcCwEZia8PfAeZrFH0aGTVcoM7HI5eg=; b=aIoGX7RNGLjhgNXf8esc1gBeR+1CqwdtDH4+EUxi9DT1iHoOIG0pQNJPZGVWpj/tLN Ob/dtRf8ScrwoGR+JGJiP8EtC9qWOAjhMDZipg5HQJmTK7+dPbrx+LMcbuaopj7bLIzV PBHFgIuhC2j2CUYXYP4JsznwZLKV/d2+sj7jZ9NL5RTqjEka9wJECvK8P1j+c73lkxRN 7aQ1/D6w7x0O+MbpxUfpIDGeow1aFlec1emPmhQ6O82mbPuuLwFgDVd0dWAU8EeANxPj ybsEyc1bRLbEg/rJ23E5dxMMKK1WJnXVw4cbVKuZxEvQA1wCSDz/L2mBSy0mQVQP4j6q Yliw== X-Gm-Message-State: APjAAAVzQcI/d7nCHBuUWDi+x0oM+AiMbRHJrWXKVVTDf9kOCrhtQquH xtXhJC0ro3k07wKcXxg0AL621pj+3Pird2x/FeuE7w== X-Google-Smtp-Source: APXvYqwiKcbBRGkuZFlMC/CyQISjrhwpgWqOv9HywJ/Pw61qE1DvgIqj66VtRNBnRCoU1wubKgPhdlFNHPIJ0mXmbAg= X-Received: by 2002:a0c:d401:: with SMTP id t1mr19041917qvh.38.1553510855415; Mon, 25 Mar 2019 03:47:35 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: Ted Lemon Date: Mon, 25 Mar 2019 11:47:15 +0100 Message-ID: To: Brian Dickson Cc: Eric Rescorla , Patrick McManus , "Winfield, Alister" , "dnsop@ietf.org" , "doh@ietf.org" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" , "wjhns1@hardakers.net" Content-Type: multipart/alternative; boundary="000000000000b12f790584e8eef0" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 10:47:38 -0000 --000000000000b12f790584e8eef0 Content-Type: text/plain; charset="UTF-8" This is equally an argument for doing DNS over DTLS. This would give similar performance to DoH over QUIC. On Mon, Mar 25, 2019 at 10:43 Brian Dickson wrote: > > > On Mon, Mar 25, 2019 at 10:31 AM Patrick McManus > wrote: > >> >> >> On Mon, Mar 25, 2019 at 9:37 AM Brian Dickson < >> brian.peter.dickson@gmail.com> wrote: >> >>> >>> >>>> >>>> \Other than blocking all-but-a-few (or all, or a few) DoT servers, I do >>> not believe anyone has proposed explicit downgrade triggers. >>> >> >> that's the downgrade I am referring to >> >> >> >>> Or do you mean, when a DoT connection is blocked by e.g. a firewall (or >>> other network enforcement device), that an RST is generated? I believe the >>> RST requires sequence number validation before it can be processed by the >>> TCP stack, which means the entity doing the RST generally needs to be in >>> the data path. Other than "lucky guess" or "high volume attempts", I don't >>> believe RST to be a serious threat. >>> >> >> path manipulation attacks are real. arp attacks.. bootp attacks.. rouge >> access points. stingray. all kinds of things. unauthenticated network >> packets are just that: unauthenticated. RST (or blackhole) is a good >> indication that a path isn't going to work - its not a good indication of >> who is expressing that policy (or whether it is a policy at all). >> >> Anyhow - I'm really not trying to amp up this thread.. I just felt that >> there were a few relevant points to the discussion that had not been >> introduced. >> > > Okay, that's good to know, and I think we are in agreement (i.e. that > inference is a poor substitute for declarations.) > > I think that this is an area that needs thought and mechanism development, > possibly aligned with DoT/DoH operation, possibly not (or orthogonal to > them). > > Brian > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000b12f790584e8eef0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
This is equally an argument for doing DNS over DTLS.= This would give similar performance to DoH over QUIC.

=
On Mon, Ma= r 25, 2019 at 10:43 Brian Dickson <brian.peter.dickson@gmail.com> wrote:


On Mon, Mar 25,= 2019 at 10:31 AM Patrick McManus <mcmanus@ducksong.com> wrote:
=

On Mon, Mar 25, 2019 at 9:37 AM Brian Dickson <brian.peter.dickson@gmail.com= > wrote:
=



\Other than blocking all-but-a-few (or all, or a few) D= oT servers, I do not believe anyone has proposed explicit downgrade trigger= s.

that's the dow= ngrade I am referring to

=C2=A0
Or do you mean, when a DoT connection is blocked by e.g. a firew= all (or other network enforcement device), that an RST is generated? I beli= eve the RST requires sequence number validation before it can be processed = by the TCP stack, which means the entity doing the RST generally needs to b= e in the data path. Other than "lucky guess" or "high volume= attempts", I don't believe RST to be a serious threat.
<= /div>

path manipulation attacks are r= eal. arp attacks.. bootp attacks.. rouge access points. stingray. all kinds= of things. unauthenticated network packets are just that: unauthenticated.= RST (or blackhole) is a good indication that a path isn't going to wor= k - its not a good indication of who is expressing that policy (or whether = it is a policy at all).

Anyhow - I'm really no= t trying to amp up this thread.. I just felt that there were a few relevant= points to the discussion that had not been introduced.

Okay, that's good to know, and I think w= e are in agreement (i.e. that inference is a poor substitute for declaratio= ns.)

I think that this is an area that needs thoug= ht and mechanism development, possibly aligned with DoT/DoH operation, poss= ibly not (or orthogonal to them).

Brian=C2=A0
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000b12f790584e8eef0-- From nobody Mon Mar 25 04:03:50 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCD57120395 for ; Mon, 25 Mar 2019 04:03:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id o0nq0DbKXXEH for ; Mon, 25 Mar 2019 04:03:47 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F24DC120390 for ; Mon, 25 Mar 2019 04:03:46 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 45B21A0531; Mon, 25 Mar 2019 12:03:44 +0100 (CET) Received: by godin (Postfix, from userid 1000) id 8B5BFEC0B0E; Mon, 25 Mar 2019 12:01:36 +0100 (CET) Date: Mon, 25 Mar 2019 12:01:36 +0100 From: Stephane Bortzmeyer To: doh@ietf.org Message-ID: <20190325110136.GA23793@laperouse.bortzmeyer.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <155341529409.18062.10657099011172813446@ietfa.amsl.com> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] I-D Action: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 11:03:49 -0000 On Sun, Mar 24, 2019 at 01:14:54AM -0700, internet-drafts@ietf.org wrote a message of 43 lines which said: > Title : Associating a DoH Server with a Resolver > Author : Paul Hoffman > Filename : draft-ietf-doh-resolver-associated-doh-03.txt My biggest issue is that the rationale in section 1 has many weak points: * "There is a use case for browsers and web applications". Why not for local limited resolvers like stubby or systemd-resolve? We assume they will always prefer DoT? * "much less often, they use manual configuration" Less often but more and more, to workaround failures and/or censorships. On a gamer forum, these days, any report of an issue, whatever the issue is, elicit a suggestion "switch to [some public DNS resolver]" * "In a common scenario" "Common" is way too vague for something which exists in *some* corporate networks but never (I hope so!) in public ISPs. Otherwise, even after reading the whole thread "Reviewing Resolver-Associated DOH", I don't understand why https is required in section 2. We don't require DNSSEC in section 3, so why having stronger requirments for HTTP? Since having certificates for IP addresses will be difficult in practice, why not just accepting http as well as https? (Or, https without cert. checking.) Editorial: * in section 5, server is written serer. * in section 1, "Users typically configure their DNS recursive resolvers with through automatic configuration" With through? From nobody Mon Mar 25 04:15:57 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 55071120454 for ; Mon, 25 Mar 2019 04:15:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.502 X-Spam-Level: X-Spam-Status: No, score=-14.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qvz31Bf6MlwI for ; Mon, 25 Mar 2019 04:15:49 -0700 (PDT) Received: from aer-iport-4.cisco.com (aer-iport-4.cisco.com [173.38.203.54]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1122B120428 for ; Mon, 25 Mar 2019 04:15:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1353; q=dns/txt; s=iport; t=1553512549; x=1554722149; h=mime-version:subject:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to; bh=/q2s+KCKLMnGT1P5o7CWusRMjjGkS73NBc+hrnkHvUU=; b=mQN42UHDjrieh2PUxkgPT3qOovYHMOxER55ZpDwXYz1RktkAbepic3/C /Jt+X/oD12p7tQQxzE1jdMO9bUmVdBVd2vmZ+oW1Dn/15qgoweeKKh7T1 vVgcq2WvhkYS1LSQ5pF7HJl11hHGsDN10p5Bv2bK2CTe9URC1jdH5hBOL w=; X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0APAABPt5hc/xbLJq1jGQEBAQEBAQE?= =?us-ascii?q?BAQEBAQcBAQEBAQGBVAEBAQEBAQsBghBoUCESJ4QOiHuMKSWaNQ0BARgLhEk?= =?us-ascii?q?ChS83Bg0BAQMBAQkBAwJtHAyFSgEBAQMBAQEhSwsFCwsOCgICJgICJzAGE4M?= =?us-ascii?q?iAYFtCA+tZYEvhUaEXQWBCyQBi0iBf4E4DBOCTD6CYQEBgWGDCjGCJgOlFgm?= =?us-ascii?q?TORmTfptUgnICBAYFAhWBYyKBVjMaCBsVOyoBgkE+gVgXiF+FQD4DMJAmAQE?= X-IronPort-AV: E=Sophos;i="5.60,256,1549929600"; d="scan'208";a="10894096" Received: from aer-iport-nat.cisco.com (HELO aer-core-3.cisco.com) ([173.38.203.22]) by aer-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 25 Mar 2019 11:15:46 +0000 Received: from dhcp-10-61-105-142.cisco.com (dhcp-10-61-105-142.cisco.com [10.61.105.142]) by aer-core-3.cisco.com (8.15.2/8.15.2) with ESMTPS id x2PBFkSd031752 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO); Mon, 25 Mar 2019 11:15:46 GMT Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Eliot Lear In-Reply-To: <8b885f68-702a-40e3-a9fe-9a779b0c5c24@www.fastmail.com> Date: Mon, 25 Mar 2019 12:15:45 +0100 Cc: doh@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <02322DB8-D2B6-4AF6-B445-C56CBDC93123@cisco.com> <8b885f68-702a-40e3-a9fe-9a779b0c5c24@www.fastmail.com> To: Martin Thomson X-Mailer: Apple Mail (2.3445.102.3) X-Outbound-SMTP-Client: 10.61.105.142, dhcp-10-61-105-142.cisco.com X-Outbound-Node: aer-core-3.cisco.com Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 11:15:56 -0000 I think if you review my position on this list and elsewhere you will be = reminded that I find the user interface aspects of all of this anything = but simple, which is one reason there is a tussle in the first place. = Do not confuse my observation with =E2=80=9Cglib treatment=E2=80=9D. = That would show a poor understanding of what a tussle is. Eliot > On 25 Mar 2019, at 10:24, Martin Thomson wrote: >=20 > On Mon, Mar 25, 2019, at 10:13, Eliot Lear wrote: >> Putting aside legal language, but Brian=E2=80=99s basic notion is = that the user=20 >> can make an informed decision and the network can express its = policies,=20 >> with which the user can agree or not agree (and go elsewhere). Having=20= >> the protocol elements to permit this sort of agreement is its own=20 >> tussle. >=20 > I would encourage people who would like to participate in aspects of = that tussle to join the capport working group. =20 >=20 > WEDNESDAY, March 27, 2019 > 1120-1320 > Karlin 3 >=20 > The glib treatment of the role of informed consent here is probably = worth some more discussion, but this thread is beyond the point that I = consider it to be productive. >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Mon Mar 25 04:32:34 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 52FD61203B9 for ; Mon, 25 Mar 2019 04:32:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0jXRFcrBYQjp for ; Mon, 25 Mar 2019 04:32:32 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C2CC120390 for ; Mon, 25 Mar 2019 04:32:32 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 25 Mar 2019 04:32:30 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Mon, 25 Mar 2019 04:32:29 -0700 From: Paul Hoffman To: Stephane Bortzmeyer CC: "doh@ietf.org" Thread-Topic: [Ext] [Doh] I-D Action: draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU4v5t1x5UeG9r80SO/OtTdhqgQA== Date: Mon, 25 Mar 2019 11:32:29 +0000 Message-ID: References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> In-Reply-To: <20190325110136.GA23793@laperouse.bortzmeyer.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="us-ascii" Content-ID: Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] I-D Action: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 11:32:33 -0000 On Mar 25, 2019, at 12:01 PM, Stephane Bortzmeyer wrote= : >=20 > On Sun, Mar 24, 2019 at 01:14:54AM -0700, > internet-drafts@ietf.org wrote=20 > a message of 43 lines which said: >=20 >> Title : Associating a DoH Server with a Resolver >> Author : Paul Hoffman >> Filename : draft-ietf-doh-resolver-associated-doh-03.txt >=20 > My biggest issue is that the rationale in section 1 has many weak points: >=20 > * "There is a use case for browsers and web applications". Why not for > local limited resolvers like stubby or systemd-resolve? We assume they > will always prefer DoT? Yes. >=20 > * "much less often, they use manual configuration" Less often but more > and more, to workaround failures and/or censorships. On a gamer forum, > these days, any report of an issue, whatever the issue is, elicit a > suggestion "switch to [some public DNS resolver]" I'll remove the "much". > * "In a common scenario" "Common" is way too vague for something which > exists in *some* corporate networks but never (I hope so!) in public > ISPs. Good catch; fixed. > Editorial: >=20 > * in section 5, server is written serer. >=20 > * in section 1, "Users typically configure their DNS recursive > resolvers with through automatic configuration" With through? Both fixed. --Paul Hoffman From nobody Mon Mar 25 04:37:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4CE8A1203BE for ; Mon, 25 Mar 2019 04:37:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DM0rYK-fRnpg for ; Mon, 25 Mar 2019 04:36:59 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3E49B120390 for ; Mon, 25 Mar 2019 04:36:59 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 25 Mar 2019 04:36:57 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Mon, 25 Mar 2019 04:36:57 -0700 From: Paul Hoffman To: DoH WG Thread-Topic: Authentication in draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU4v8NDpajfuqh1EySiYPcfrHJQQ== Date: Mon, 25 Mar 2019 11:36:56 +0000 Message-ID: <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> In-Reply-To: <20190325110136.GA23793@laperouse.bortzmeyer.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="utf-8" Content-ID: <50FE70FE3746E542BAFA83A3D5EEC7E7@pexch112.icann.org> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 11:37:00 -0000 T24gTWFyIDI1LCAyMDE5LCBhdCAxMjowMSBQTSwgU3TDqXBoYW5lIEJvcnR6bWV5ZXIgPGJvcnR6 bWV5ZXJAbmljLmZyPiB3cm90ZToNCj4gT3RoZXJ3aXNlLCBldmVuIGFmdGVyIHJlYWRpbmcgdGhl IHdob2xlIHRocmVhZCAiUmV2aWV3aW5nDQo+IFJlc29sdmVyLUFzc29jaWF0ZWQgRE9IIiwgSSBk b24ndCB1bmRlcnN0YW5kIHdoeSBodHRwcyBpcyByZXF1aXJlZCBpbg0KPiBzZWN0aW9uIDIuIFdl IGRvbid0IHJlcXVpcmUgRE5TU0VDIGluIHNlY3Rpb24gMywgc28gd2h5IGhhdmluZw0KPiBzdHJv bmdlciByZXF1aXJtZW50cyBmb3IgSFRUUD8gU2luY2UgaGF2aW5nIGNlcnRpZmljYXRlcyBmb3Ig SVANCj4gYWRkcmVzc2VzIHdpbGwgYmUgZGlmZmljdWx0IGluIHByYWN0aWNlLCB3aHkgbm90IGp1 c3QgYWNjZXB0aW5nIGh0dHANCj4gYXMgd2VsbCBhcyBodHRwcz8gKE9yLCA8aG9ycm9yPmh0dHBz IHdpdGhvdXQgY2VydC4gY2hlY2tpbmc8L2hvcnJvcj4uKQ0KDQpUaGUgcmVhc29uIEkgZGlkbid0 IGRyb3AgZG93biB0byBodHRwOiBpcyB0aGF0IGRvaW5nIHNvIGV2b2tlcyB0aGUgPGhvcnJvcj4g cmVzcG9uc2UsIGV2ZW4gdGhvdWdoIHlvdSBhcmUgcXVpdGUgY29ycmVjdCB0aGF0IHRoZSBvdGhl ciB0d28gbWV0aG9kcyBnaXZlbiBpbiB0aGlzIGRvY3VtZW50IGRvIG5vdCBvZmZlciBhbnkgYXV0 aGVudGljYXRpb24uIFNvLCBsZXQgbWUgYXNrIHRoZSBXRzoNCg0KV291bGQgdGhpcyBkb2N1bWVu dCBiZSBiZXR0ZXIgb2ZmIHdpdGggYWxsIHRocmVlIG1ldGhvZHMgYmVpbmcgZXF1YWxseSB1bmF1 dGhlbnRpY2F0ZWQ/IERvaW5nIHNvIHdvdWxkIHJlbW92ZSB0aGUgImJ1dCB5b3UgY2FuJ3QgZ2V0 IElQIGFkZHJlc3MgY2VydGlmaWNhdGVzISIgYXJndW1lbnQgdGhhdCBrZWVwcyBjb21pbmcgdXAg KGV2ZW4gdGhvdWdoIHRoYXQgaXMgb3ZlcnN0YXRlZCkuIERvaW5nIHNvIHdvdWxkIHNpbXBsaWZ5 IHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBieSBtYWtpbmcgYWxsIHRocmVlIHByb3RvY29s cyBoYXZlIHRoZSBzYW1lIG9idmlvdXMgd2Vha25lc3MuDQoNCkFuIGFsdGVybmF0aXZlIGlzIHRv IGhhdmUgdHdvIFVSSSwgb25lIHdpdGggaHR0cHM6IGFuZCBvbmUgd2l0aCBodHRwOiwgYW5kIGV4 cGxhaW4gdGhhdCB0cnlpbmcgdGhlIGZpcnN0IG1pZ2h0IGJlIGEgZ29vZCBpZGVhIGJ1dCB0byBm YWxsIGJhY2sgdG8gdGhlIHNlY29uZCBpZiBhdXRoZW50aWNhdGlvbiBmYWlscy4NCg0KVGhvdWdo dHM/DQoNCi0tUGF1bCBIb2ZmbWFu From nobody Mon Mar 25 07:46:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AF5A1203D0; Mon, 25 Mar 2019 07:46:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fkakpVm3O5Lk; Mon, 25 Mar 2019 07:46:39 -0700 (PDT) Received: from ppsw-31.csi.cam.ac.uk (ppsw-31.csi.cam.ac.uk [131.111.8.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 700C91203BB; Mon, 25 Mar 2019 07:46:39 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:38710) by ppsw-31.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.137]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1h8Qs0-000QcL-LA (Exim 4.91) (return-path ); Mon, 25 Mar 2019 14:46:36 +0000 Date: Mon, 25 Mar 2019 14:46:36 +0000 From: Tony Finch To: Ian Swett cc: "doh@ietf.org" , "dnsop@ietf.org" In-Reply-To: Message-ID: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 14:46:42 -0000 Ian Swett wrote: > One way DoH may be faster than DoT in the near future is that DoH can go > over HTTP/3 via QUIC and avoid head of line blocking like Do53. It ought to be better to have native DoQ to eliminate the overhead of the http layer. Dunno whether this should use yet another port (all the obvious ones are already taken) or use ALPN. Tony. -- f.anthony.n.finch http://dotat.at/ German Bight, Humber: Northwest 6 or 7, occasionally gale 8 at first, decreasing 4 or 5. Rough or very rough, becoming moderate later. Showers. Good. From nobody Mon Mar 25 07:49:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AD9F1203EF for ; Mon, 25 Mar 2019 07:49:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.502 X-Spam-Level: X-Spam-Status: No, score=-17.502 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PWRb94n80Uoi for ; Mon, 25 Mar 2019 07:48:57 -0700 (PDT) Received: from mail-yw1-xc42.google.com (mail-yw1-xc42.google.com [IPv6:2607:f8b0:4864:20::c42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B73191203D0 for ; Mon, 25 Mar 2019 07:48:57 -0700 (PDT) Received: by mail-yw1-xc42.google.com with SMTP id c4so7217430ywa.11 for ; Mon, 25 Mar 2019 07:48:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=qaCgyPP7FUEeUhLMDF3pWF3I/OeK7egb9C4fueqL6bA=; b=UmEc00o3LAgXbzRbbtlsVSlBYR8ZlC+xIpIA7dg+3p1tD/eblGMQybfvV3wBE0pR0q AEYhTUohH/FyYFvgfxyxrkICDecHBs2cIG/1tTQMmKx4NUO00nzamVjnQFzA7t41L+GA s5rBmOOwRHx4sD2EM4K4iSET5tXGzjGpO9RcSLohOPtEbfp5KAuncPdzURw4rUflZGPC e8+HxyT27RQbgoTQeiAtuw68hZJpn79//15lrjEhLBwld6PDJ8E6Hl/gwOQDUdppLnV/ p2WWcgsxazQSWdJohB+3S15n2H4Dl8PbFTC0yi2bUYkQnEX7uhx+GRn6D25uVznVlL1v l+0g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=qaCgyPP7FUEeUhLMDF3pWF3I/OeK7egb9C4fueqL6bA=; b=H1ueFWhdFsQQLYcZHb1lhMZPY7rxjLVPgpApuyjhRS134Tty28WgkUxYZ12K9LAC48 I1T+CiyKdCppFMLIQlK9g92BeFoN7MQiNdFVqISXdDLU/V9m7Soma1EWgXf4t2ZT0N7T CstQtgTBG5kM4G0j5n7vHeiWyGr21yL0vZto/ZJKchM2x8OZzOBzzAxRxaY3ueyd2eOG LvfVCsEcrNwEJGZHJqyHBx36tNb/7ak57avC2tgc5sLdvZ8xOw/pZXu1fynJ3g/P86Py E+astLs4cInX8PxlboTAxZQM+Wmem1k4WcfFhdggPUb8b0KyonX2uWl1BPzg2lyx3hNR ft5w== X-Gm-Message-State: APjAAAViSIYVCXMCOfcFp6EXDqkOBke6zF+BUvwbW/JitXd3hnaTfvh5 VDQNLtTsKeOxY6FX8/6c1ocob3o5aMVGhdB4MOFLKg== X-Google-Smtp-Source: APXvYqz48zWLfB6jBqze8IvNqiY1N0RypXC43ONQIPTDX7RJecNcjVMuTmGqimJVsdlADoay3wR3bQMJRzwrhwAWcIc= X-Received: by 2002:a81:17d5:: with SMTP id 204mr21967120ywx.337.1553525336359; Mon, 25 Mar 2019 07:48:56 -0700 (PDT) MIME-Version: 1.0 References: <155218771419.28706.1428072426137578566.idtracker@ietfa.amsl.com> <3457266.o2ixm6i3xM@linux-9daj> <1914607.BasjITR8KA@linux-9daj> <4599B066-BA82-4EA8-92C1-F1BE1464A790@puck.nether.net> <91A0BBD0-CB73-498E-B4E0-57C7E5ABE0B4@hopcount.ca> <4E034A1E-1282-4459-8B4E-3F6BE89A90C4@bennett.com> In-Reply-To: <4E034A1E-1282-4459-8B4E-3F6BE89A90C4@bennett.com> From: Puneet Sood Date: Mon, 25 Mar 2019 15:48:43 +0100 Message-ID: To: IETF DNSOP WG , DoH WG Cc: Richard Bennett , Stephen Farrell Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [DNSOP] New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 14:49:00 -0000 Reposting to the list what I shared with Richard Bennett earlier. The Google Public DNS privacy policy is at https://developers.google.com/speed/public-dns/privacy. Maybe I should have included a link to it in the earlier email. If you have comments on it, please share. We are following https://tools.ietf.org/html/draft-ietf-dprive-bcp-op and have commented on an earlier version. -Puneet On Sat, Mar 23, 2019 at 3:48 AM Richard Bennett wrote= : > > I like it if you would kindly define =E2=80=9Cprivacy=E2=80=9D in the con= text of =E2=80=9Ca DNS resolver that protects our users=E2=80=99 privacy.= =E2=80=9D Does that mean hiding their lookups from ISPs who might want to e= nter the market for targeted ads while using them for your company=E2=80=99= s own purposes, or just protecting user queries made over insecure public W= i-Fi networks from easy snooping? Because there are better ways to do the l= atter than with a system that opts users into a centralized resolver. > > RB > > On Mar 22, 2019, at 4:08 PM, Puneet Sood wrote: > > Hello, > > There has been much discussion in the IETF lists over the impact of > using DNS-over-HTTPS (DoH) in a network. We would like to clarify the > Google Public DNS position on this topic. The post I am replying to is > particularly relevant since it makes some assumptions about the plans > of the Google Public DNS service. > > For future support of a RFC 8484 compliant service, we plan to do the fol= lowing: > * Serve RFC 8484 compliant DoH from the well known Google Public DNS > anycast IP addresses (e.g. 8.8.8.8) on the standard HTTPS port 443. > * Migrate our existing DoH services to the well known Google Public > DNS anycast IP addresses, including the beta version (at > https://dns.google.com/resolve) and IETF draft version (at > https://dns.google.com/experimental). > > The Google Public DNS anycast IP addresses are distinct from the IP > addresses used to host web content for Google properties. This will > allow operators to control access to the Google Public DNS DoH service > on their networks without impeding access to other Google services. > > For DoH implementers we want to ensure the same access to our > implementation whether it is a Google product (like the Chrome > browser) or a third-party product. To this end we aim to track IETF > work on standardized ways to detect DoH support by the system-selected > DNS resolver service (like > https://tools.ietf.org/html/draft-ietf-doh-resolver-associated-doh-02 > or https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-01= ). > > As a core principle, Google Public DNS aims to provide a DNS resolver > that respects our users=E2=80=99 privacy. Towards that goal, we aim to pr= ovide > high quality implementations of various DNS transport mechanisms that > our users can use to reach the service. This includes the traditional > UDP and TCP transports as well as DNS-over-TLS and DNS-over-HTTPS that > provide privacy for the user=E2=80=99s communication with a DNS resolver. > > -Puneet Sood > TL/Manager for the Google Public DNS team. > > PS: I am attending IETF 104 and will be available for face-to-face discus= sion. > > On Wed, Mar 20, 2019 at 2:40 PM =E7=A5=9E=E6=98=8E=E9=81=94=E5=93=89 wrote: > > > At Wed, 20 Mar 2019 12:38:05 +0100, > Joe Abley wrote: > > Often as an industry we may discuss various solutions that are great for = oneself but don=E2=80=99t scale when looking at the big picture. > > > I think what we are seeing is the fundamental tension between privacy and= control. You need to give up some privacy in order to make the control pos= sible; you need to give up some control in order to afford privacy. > > > Some in this thread want certainty that they are able to exercise control= , e.g. for devices in their network. > > > Some in this thread want certainty that they can obtain privacy, e.g. for= for their device in any network. > > > [...] > > Thank you for the nice, concise summary. I think it's well-balanced > observation of where we are. (I'm so glad I can finally see a > constructive post after seeing a common pattern of boring IETF > discussion, where people with different opinions just keep stating > their views without making any real progress:). > > Seems to me that there's a middle ground within sight here. > > Standardise this privacy mechanism, and specify (with reasoning) that it = should be implemented such that the existence of the channel (but not the c= ontent) can be identified as distinct from other traffic by third parties. = Maybe specify use of a different port number, as was done with DoT. > > > I see that those who want to exercise control can live with this (or > at least using a different set of IP addresses for DoH servers than > those for other ordinary web services). But I'm not so sure if that's > acceptable for the other group.. In that sense I'm curious whether > some big possible DoH providers are now willing to accept this middle > ground. If my memory is correct the longer term plan at Google (and > maybe also Clouldflare?) is to provide DoH service on the same IP > addresses as those for other ordinary and popular web services (and on > port 443, of course), so that an intermediate operator cannot easily > block access to their DoH services. > > Those who choose to ignore that direction and create a covert channel usi= ng port 443 instead will do so. Nothing much we can do to stop that today (= I guarantee it is already happening). The future is not really different. > > > True. But I think giant providers tend to respect a community > consensus. Niche or really malicious players may/will still ignore > it, but it would be very difficult for them to collocate their DoH > services with other important web services that can hardly be blocked, > so it shouldn't be a big problem for "those who want certainty of > control". So if we can really agree on the above "middle ground" and > publish a BCP or something that describes the consensus, I guess we > can now really work on technical issues. But I'm not sure if we can > reach that consensus. > > -- > JINMEI, Tatuya > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > > > =E2=80=94 > Richard Bennett > High Tech Forum Founder > Ethernet & Wi-Fi standards co-creator > > Internet Policy Consultant > From nobody Mon Mar 25 08:04:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D15F1203F4; Mon, 25 Mar 2019 08:04:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9PKfLPqWMJXm; Mon, 25 Mar 2019 08:04:44 -0700 (PDT) Received: from ppsw-30.csi.cam.ac.uk (ppsw-30.csi.cam.ac.uk [131.111.8.130]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57AAC1203C5; Mon, 25 Mar 2019 08:04:44 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:44820) by ppsw-30.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.136]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1h8R9V-0007Ee-dP (Exim 4.91) (return-path ); Mon, 25 Mar 2019 15:04:41 +0000 Date: Mon, 25 Mar 2019 15:04:41 +0000 From: Tony Finch To: Ted Lemon cc: "doh@ietf.org" , "dnsop@ietf.org" In-Reply-To: Message-ID: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 15:04:47 -0000 Ted Lemon wrote: > This is equally an argument for doing DNS over DTLS. This would give > similar performance to DoH over QUIC. If I understand it correctly, DTLS leaves MTU and fragmentation up to the application protocol. The DNS has horrible packet size problems, so it needs a lot more help than DTLS provides. QUIC is much better. Tony. -- f.anthony.n.finch http://dotat.at/ The Minch: Westerly 4 or 5, backing southwesterly 5 or 6, occasionally 7 later in north. Rough in far north and in far south, otherwise slight or moderate. Occasional drizzle. Good, occasionally poor. From nobody Mon Mar 25 08:05:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B5C941203F4 for ; Mon, 25 Mar 2019 08:05:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P7JdpQ3WjcC4 for ; Mon, 25 Mar 2019 08:05:52 -0700 (PDT) Received: from smtp.guxx.net (nyx.guxx.net [85.10.208.173]) by ietfa.amsl.com (Postfix) with ESMTP id 47A561203C5 for ; Mon, 25 Mar 2019 08:05:52 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id B34F15F40907; Mon, 25 Mar 2019 16:05:50 +0100 (CET) Received: from [172.19.152.227] (dhcp-9ce7.meeting.ietf.org [31.133.156.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id B362D5F40458; Mon, 25 Mar 2019 16:05:49 +0100 (CET) From: "Ralf Weber" To: "Paul Hoffman" Cc: "DoH WG" Date: Mon, 25 Mar 2019 16:05:48 +0100 X-Mailer: MailMate (1.12.4r5594) Message-ID: In-Reply-To: <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 15:05:55 -0000 Moin! On 24 Mar 2019, at 9:20, Paul Hoffman wrote: > The diffs here are what I think have general agreement from the > discussion about this draft so far, but I may have missed things. > Comments are still quite welcome. I have some questions after reading -03 (and skipping -02 ;-) - The resolver IP addresses returned from DNS on section 4 are these Do53 server addresses or DoH server address or are they just the IP to start the process in section 2 (maybe 3)? - On section 3 a non compliant current server will return NXDomain. What are we going to do with this answer (treat is as no DoH associated)? > As for the late discussion of using the URI RRtype instead of TXT, I > would not know what to put in the "priority" and "weight" values. That > alone seems enough reason to leave this as a TXT record, but others > might disagree. It's not a lot of effort to change the text to the URI > RRtype, but I don't want to do so unless it is actually better than > TXT. Another option could be a new RRType, given that it doesn’t have to be provisioned on auth servers it should not be that difficult to roll it out. We still could use the special name or just ask . So long -Ralf —-- Ralf Weber From nobody Mon Mar 25 08:16:41 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F0DCD1203F4 for ; Mon, 25 Mar 2019 08:16:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fhA5B7uRfIkD for ; Mon, 25 Mar 2019 08:16:29 -0700 (PDT) Received: from mail-wr1-x42c.google.com (mail-wr1-x42c.google.com [IPv6:2a00:1450:4864:20::42c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F5FC1203C5 for ; Mon, 25 Mar 2019 08:16:29 -0700 (PDT) Received: by mail-wr1-x42c.google.com with SMTP id y13so10649017wrd.3 for ; Mon, 25 Mar 2019 08:16:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=JGLCWEFvLKCD4z18ZUh+vboWRuEg6DiJWzEFVBqH65w=; b=m5VPFRBIU1dZJWmnOkUhhgeywvJ3t2sG/0sZdkwALJwh4Sv2ghcwA7+06ApHsMMhHF fouuMNAnAWb+lgUXO1uQh9jATUxodyOTfHx/92fDqGPQlGsEFp1c7S3nGH3C/qKOeEGE YVM8mXJZhM9mraMdqyO4Nhr8PTDgPD4r1qt7ylDkL+KzYfsx2RPYxdJ6J1k8Glwcc/x1 wutA9qYamnnxWTEH9HrZwUBE3JDqFb0DLvYSxg779Yps/OWmGUfs/18La9rGI62/1jWD /nB6PX/SB575uyT2UySZyOJorWTh51fIGCF315IYeZrZ/RjUqV8qAooAus4x/sQ1O/gV SIlA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=JGLCWEFvLKCD4z18ZUh+vboWRuEg6DiJWzEFVBqH65w=; b=Dea85NH1AWDCnSkXaU5cRKmiKymnLb5Effhf6AvvXhIvNMVdhnOIPnT0mqB7RaRAdM hoZdHjAWWJ6Up9IqTP7wSmuR8NQkrP4WGGAeq8GHHzfGBaX/66HIPWYxCJBIaNu3yES8 pZEOFpxfANepbPHEBajNu11erLgFXKTxSUTX+r2SgOMK9dghxyCbUfuafGGEFkWP8feC 42yIe3y5GzVL+zyFO+Sno7Y5XiQLArenw6jZi3JLecNr1xpa/V5zGWveVPidCmUR5CBF r9GV4T57bw2awHZ4d2rygjEDW8XobC/WCLPOTf8F7hzDnyhA3CpEbjP2aH+4v0lJsbIL SpmA== X-Gm-Message-State: APjAAAVyqamkcRXlEajp1oUuWDnMZO+A8hdTr3OmwcHBGvQNQEIOoZG/ oEIJOjrZzw2XpGGwhFycEZkgSA== X-Google-Smtp-Source: APXvYqxqNE+4U56s5CRpkr+Rx3NTfBKTZWUdSzikrIV0+uSCUvoCoqSaABB9Rh8immElqVl0ZKgdvg== X-Received: by 2002:adf:eed1:: with SMTP id a17mr15543057wrp.268.1553526987832; Mon, 25 Mar 2019 08:16:27 -0700 (PDT) Received: from dhcp-889a.meeting.ietf.org (dhcp-889a.meeting.ietf.org. [31.133.136.154]) by smtp.gmail.com with ESMTPSA id a9sm18110516wmb.30.2019.03.25.08.16.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 25 Mar 2019 08:16:27 -0700 (PDT) From: Ted Lemon Message-Id: Content-Type: multipart/alternative; boundary="Apple-Mail=_76D943A4-D105-4FB5-A307-FE5E48CEDC8F" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.2\)) Date: Mon, 25 Mar 2019 16:16:25 +0100 In-Reply-To: Cc: "doh@ietf.org" , "dnsop@ietf.org" To: Tony Finch References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> X-Mailer: Apple Mail (2.3445.104.2) Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 15:16:32 -0000 --Apple-Mail=_76D943A4-D105-4FB5-A307-FE5E48CEDC8F Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 On Mar 25, 2019, at 4:04 PM, Tony Finch wrote: > If I understand it correctly, DTLS leaves MTU and fragmentation up to = the > application protocol. The DNS has horrible packet size problems, so it > needs a lot more help than DTLS provides. QUIC is much better. Indeed. My point was simply that this avoids ordering problems, just = as QUIC does. I suspect that it is worth having DNS-over-DTLS; QUIC is = great, but based on what I=E2=80=99ve been seeing, quite a lot, and = probably not appropriate for a lot of use cases where DNS-over-DTLS = would do just fine. --Apple-Mail=_76D943A4-D105-4FB5-A307-FE5E48CEDC8F Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 On = Mar 25, 2019, at 4:04 PM, Tony Finch <dot@dotat.at> wrote:
If I understand it correctly, DTLS leaves MTU and = fragmentation up to the
application protocol. The DNS has horrible packet size = problems, so it
needs a lot more help than DTLS provides. QUIC is much = better.

Indeed.   My point was simply that this avoids ordering = problems, just as QUIC does.   I suspect that it is worth having = DNS-over-DTLS; QUIC is great, but based on what I=E2=80=99ve been = seeing, quite a lot, and probably not appropriate for a lot of use cases = where DNS-over-DTLS would do just fine.

= --Apple-Mail=_76D943A4-D105-4FB5-A307-FE5E48CEDC8F-- From nobody Mon Mar 25 08:25:51 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B56AE1203CB for ; Mon, 25 Mar 2019 08:25:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l8HESLbaKAVo for ; Mon, 25 Mar 2019 08:25:49 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAD561203C5 for ; Mon, 25 Mar 2019 08:25:48 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 25 Mar 2019 08:25:46 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Mon, 25 Mar 2019 08:25:46 -0700 From: Paul Hoffman To: Ralf Weber CC: DoH WG Thread-Topic: [Ext] [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU4x8ESCmlJ+SFTkKwlZVf9bBsZQ== Date: Mon, 25 Mar 2019 15:25:46 +0000 Message-ID: <39393D27-1905-4832-B9A7-D5BBA1A7FA7C@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="utf-8" Content-ID: <2F24CEFFBB07364BA5AB01137135D99B@pexch112.icann.org> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 15:25:51 -0000 T24gTWFyIDI1LCAyMDE5LCBhdCA0OjA1IFBNLCBSYWxmIFdlYmVyIDxkbnNAZmwxZ2VyLmRlPiB3 cm90ZToNCj4gSSBoYXZlIHNvbWUgcXVlc3Rpb25zIGFmdGVyIHJlYWRpbmcgLTAzIChhbmQgc2tp cHBpbmcgLTAyIDstKQ0KPiAtIFRoZSByZXNvbHZlciBJUCBhZGRyZXNzZXMgcmV0dXJuZWQgZnJv bSBETlMgb24gc2VjdGlvbiA0IGFyZSB0aGVzZSBEbzUzIHNlcnZlciBhZGRyZXNzZXMgb3IgRG9I IHNlcnZlciBhZGRyZXNzIG9yIGFyZSB0aGV5IGp1c3QgdGhlIElQIHRvIHN0YXJ0IHRoZSBwcm9j ZXNzIGluIHNlY3Rpb24gMiAobWF5YmUgMyk/DQoNClRoZXkgYXJlIHRoZSBJUCBhZGRyZXNzZXMg b2YgdGhlIERvNTMgcmVzb2x2ZXIgdGhhdCB0aGUgY29tcHV0ZXIgaXMgdXNpbmcuIEknbGwgbWFr ZSB0aGF0IGNsZWFyZXIgaW4gdGhlIG5leHQgZHJhZnQuDQoNCj4gLSBPbiBzZWN0aW9uIDMgYSBu b24gY29tcGxpYW50IGN1cnJlbnQgc2VydmVyIHdpbGwgcmV0dXJuIE5YRG9tYWluLiBXaGF0IGFy ZSB3ZSBnb2luZyB0byBkbyB3aXRoIHRoaXMgYW5zd2VyICh0cmVhdCBpcyBhcyBubyBEb0ggYXNz b2NpYXRlZCk/DQoNClllcywgdGhhdCB3YXMgdGhlIGludGVudGlvbi4gSSdsbCBjbGFyaWZ5IHRo YXQuDQoNCj4+IEFzIGZvciB0aGUgbGF0ZSBkaXNjdXNzaW9uIG9mIHVzaW5nIHRoZSBVUkkgUlJ0 eXBlIGluc3RlYWQgb2YgVFhULCBJIHdvdWxkIG5vdCBrbm93IHdoYXQgdG8gcHV0IGluIHRoZSAi cHJpb3JpdHkiIGFuZCAid2VpZ2h0IiB2YWx1ZXMuIFRoYXQgYWxvbmUgc2VlbXMgZW5vdWdoIHJl YXNvbiB0byBsZWF2ZSB0aGlzIGFzIGEgVFhUIHJlY29yZCwgYnV0IG90aGVycyBtaWdodCBkaXNh Z3JlZS4gSXQncyBub3QgYSBsb3Qgb2YgZWZmb3J0IHRvIGNoYW5nZSB0aGUgdGV4dCB0byB0aGUg VVJJIFJSdHlwZSwgYnV0IEkgZG9uJ3Qgd2FudCB0byBkbyBzbyB1bmxlc3MgaXQgaXMgYWN0dWFs bHkgYmV0dGVyIHRoYW4gVFhULg0KPiBBbm90aGVyIG9wdGlvbiBjb3VsZCBiZSBhIG5ldyBSUlR5 cGUsIGdpdmVuIHRoYXQgaXQgZG9lc27igJl0IGhhdmUgdG8gYmUgcHJvdmlzaW9uZWQgb24gYXV0 aCBzZXJ2ZXJzIGl0IHNob3VsZCBub3QgYmUgdGhhdCBkaWZmaWN1bHQgdG8gcm9sbCBpdCBvdXQu IFdlIHN0aWxsIGNvdWxkIHVzZSB0aGUgc3BlY2lhbCBuYW1lIG9yIGp1c3QgYXNrIC4NCg0KSSBo YXZlIGJlZW4gdG9sZCB0aGF0IHNvbWUgT1NzIGhhdmUgInNlbmQgYSBUWFQgcmVxdWVzdCIgQVBJ IGNhbGwsIGJ1dCBJIGhhdmUgbm90IHZlcmlmaWVkIHRoYXQuIElmIHNvLCB0aGVuIFRYVCByZWNv cmRzIHdpbGwgaGF2ZSBhbiBhZHZhbnRhZ2UuIE90aGVyd2lzZSwgdXNpbmcgYSBuZXcgUlJ0eXBl IGlzIGNsZWFuZXIuDQoNCkNhbiBzb21lb25lIHdobyBmcm9tIHRoZSBhcHBsaWNhdGlvbiBpbXBs ZW1lbnRhdGlvbiB3b3JsZCB2ZXJpZnkgb3IgcmVmdXRlIG15IGhhenkgbWVtb3J5IG9mIEFQSSBj YWxscyBmb3IgVFhUIHJlY29yZHM/DQoNCi0tUGF1bCBIb2ZmbWFu From nobody Mon Mar 25 09:03:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D6FA1203E3 for ; Mon, 25 Mar 2019 09:03:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O-bX2nwZJvXv for ; Mon, 25 Mar 2019 09:03:49 -0700 (PDT) Received: from mail-vs1-xe35.google.com (mail-vs1-xe35.google.com [IPv6:2607:f8b0:4864:20::e35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6C9E51203D6 for ; Mon, 25 Mar 2019 09:03:49 -0700 (PDT) Received: by mail-vs1-xe35.google.com with SMTP id i207so5684384vsd.10 for ; Mon, 25 Mar 2019 09:03:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=se5h6LS9iYMkydgJ/EsnjfPPxIK4N6PzqQtw3VW5BuY=; b=gKpNsJxqnRNRp0C7ozP+xQ5SRrsb/zWPmcj5Tc3BZPp9cp4BNx2CvqjLxJxqSGCSGz lwBB7Vzieezh+eGJaYl6HJ35jH9jJWaQ0imbOP9mhzicmnkzd8mUAmBHRjvQh4UfaYwl upjTbaTPWypjCswYVCL1rtPo8mUtuK+tfM9XZSFTd8cB66L32DN6iKAr+Sj3owFxAwyc VqXa4H3HynCafVK63f9wSIPs2OgfvcyAeqlbzbEKnsJaYdfEhDUYaPp3yqyet2WZ3MWN QD75ny3fPno8cGeVNNfpHORUYf9m9o2Dzx96Xo7Eu2KGQmaoukuXeXGs2XcYf9wXbJiu Fo+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=se5h6LS9iYMkydgJ/EsnjfPPxIK4N6PzqQtw3VW5BuY=; b=L7mmnPYn3PRJvQiSCP0/Iw/MFnSNPcjdc7HApPrfNzpkdBybLZJ6Mpp4ZVlK9LhNI3 deM6LCctY1s56uGuRua3L/S9N40ewjI9YLRNlXD3cZWyakJI98USCSaPyLKulqu6oQAh QE3En6+bRc7J4Kfpt6XwQyTmTeop4PQy8HFn/bIP1C/caMdcihGO9tuGPIkIwsyftLu6 rdMA8ePXrY2xWNcb/7sI3i7hREE7wu2ifO9dE9hzxbx/bHAs/vp/a7NAmIV7IjCX9zUn SuerqR5mULTP8RFfMRNlfjZHnUM3zcqTTpENWGPcwVcIvNBefbwlgktSw3zeCnK2geIP ioJw== X-Gm-Message-State: APjAAAWwlX+1lrlErqJrL5unvNyoDbFgA33eR+hHzhJOdh0jIrvztZp1 PKd/6PJkqO39x5IESrRe2ztqe8LnpNnZcl14/t2+DRQ66pE= X-Google-Smtp-Source: APXvYqwK4ydLDj832QxbCI1zCQuZvHFiByVEXIeJJAuhYFQQXR+GyxQT+OLSyd8TlkZQtY6fk+P/jGrfy62fhu5xu54= X-Received: by 2002:a67:fdc4:: with SMTP id l4mr597704vsq.1.1553529828297; Mon, 25 Mar 2019 09:03:48 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> <39393D27-1905-4832-B9A7-D5BBA1A7FA7C@icann.org> In-Reply-To: <39393D27-1905-4832-B9A7-D5BBA1A7FA7C@icann.org> From: Ben Schwartz Date: Mon, 25 Mar 2019 12:03:35 -0400 Message-ID: To: Paul Hoffman Cc: Ralf Weber , DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="00000000000096e6c30584ed594e" Archived-At: Subject: Re: [Doh] [Ext] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 16:03:52 -0000 --00000000000096e6c30584ed594e Content-Type: multipart/alternative; boundary="00000000000090b3f00584ed5968" --00000000000090b3f00584ed5968 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Mar 25, 2019 at 11:25 AM Paul Hoffman wrote: > On Mar 25, 2019, at 4:05 PM, Ralf Weber wrote: > > I have some questions after reading -03 (and skipping -02 ;-) > > - The resolver IP addresses returned from DNS on section 4 are these > Do53 server addresses or DoH server address or are they just the IP to > start the process in section 2 (maybe 3)? > > They are the IP addresses of the Do53 resolver that the computer is using= . > I'll make that clearer in the next draft. > > > - On section 3 a non compliant current server will return NXDomain. Wha= t > are we going to do with this answer (treat is as no DoH associated)? > > Yes, that was the intention. I'll clarify that. > > >> As for the late discussion of using the URI RRtype instead of TXT, I > would not know what to put in the "priority" and "weight" values. That > alone seems enough reason to leave this as a TXT record, but others might > disagree. It's not a lot of effort to change the text to the URI RRtype, > but I don't want to do so unless it is actually better than TXT. > > Another option could be a new RRType, given that it doesn=E2=80=99t hav= e to be > provisioned on auth servers it should not be that difficult to roll it ou= t. > We still could use the special name or just ask . > > I have been told that some OSs have "send a TXT request" API call, but I > have not verified that. If so, then TXT records will have an advantage. > Otherwise, using a new RRtype is cleaner. > > Can someone who from the application implementation world verify or refut= e > my hazy memory of API calls for TXT records? > POSIX systems generally lack such an API. --Paul Hoffman > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000090b3f00584ed5968 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Mon, Mar 25, 2019 at 11:25 AM Paul= Hoffman <paul.hoffman@icann.o= rg> wrote:
dns@fl1ger.de> wrote:
> I have some questions after reading -03 (and skipping -02 ;-)
> - The resolver IP addresses returned from DNS on section 4 are these D= o53 server addresses or DoH server address or are they just the IP to start= the process in section 2 (maybe 3)?

They are the IP addresses of the Do53 resolver that the computer is using. = I'll make that clearer in the next draft.

> - On section 3 a non compliant current server will return NXDomain. Wh= at are we going to do with this answer (treat is as no DoH associated)?

Yes, that was the intention. I'll clarify that.

>> As for the late discussion of using the URI RRtype instead of TXT,= I would not know what to put in the "priority" and "weight&= quot; values. That alone seems enough reason to leave this as a TXT record,= but others might disagree. It's not a lot of effort to change the text= to the URI RRtype, but I don't want to do so unless it is actually bet= ter than TXT.
> Another option could be a new RRType, given that it doesn=E2=80=99t ha= ve to be provisioned on auth servers it should not be that difficult to rol= l it out. We still could use the special name or just ask .

I have been told that some OSs have "send a TXT request" API call= , but I have not verified that. If so, then TXT records will have an advant= age. Otherwise, using a new RRtype is cleaner.

Can someone who from the application implementation world verify or refute = my hazy memory of API calls for TXT records?

POSIX systems generally lack such an API.

--Paul Hoffman
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000090b3f00584ed5968-- --00000000000096e6c30584ed594e Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCCXC1RSItCMbROZZYyPpFQw VRaXrmH7adQofuK67poUBjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMjUxNjAzNDhaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAnzfJSTQb2e5jWlGGi5iLigQ6EVxSBR4fOqBCVtWq NLu2HiT5BZ6GBlmX3jcrbzo85dIQRM8mW54cwCzzo/RNccMpAo72fRs2q9bwwzq4gt1a9NjKw3rd Le+s+gZCRdv5kQDLbnGxKBlyjzsct/eiCdAPgObKW6UlIFTr0Yp1mhkBWsoIleJrh/JpdltwXWGI SteQ34pDwG77WYzIhxlEY1prAjXSGgumipnY+TOTJLwL2BOvL+Ib9kBNuRv41Z3B8q3cMvoakfE4 coDvAam0HDr5ND20ReJ8d2dNX0SPBxQrQarWGKt1cpt2WgiUdP9WnnV+uX87CMQ+qKrup0XBNQ== --00000000000096e6c30584ed594e-- From nobody Mon Mar 25 09:10:45 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 556B41203E3 for ; Mon, 25 Mar 2019 09:10:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.501 X-Spam-Level: X-Spam-Status: No, score=-17.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z0vX98jUV98F for ; Mon, 25 Mar 2019 09:10:42 -0700 (PDT) Received: from mail-vs1-xe34.google.com (mail-vs1-xe34.google.com [IPv6:2607:f8b0:4864:20::e34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E41A11203D6 for ; Mon, 25 Mar 2019 09:10:41 -0700 (PDT) Received: by mail-vs1-xe34.google.com with SMTP id i207so5699356vsd.10 for ; Mon, 25 Mar 2019 09:10:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fzuPmq/RESWsUmF1fBcW+WD0B5zpvGflJUq/fx+lFkY=; b=MTjKxu8ja+l9R73Lh7FsCkHuRTx9nW/nk+08RUULxVnMDNXpiK/6blN1cp6+gb0gvu kV+99gmPWRGAQSFo4KVMh0IO/J9IuqAWE+DDXfFSYJ9RFqUXkoodPE/CfZJHx/fKy3ko fLnz7pT2IdgvIfLCW87RLD1mJhwRPLB9N956erKfGRtNjkfAhjUaidgqoiexnyymhoOY hJP132ONHL+hKKzMXeaMm/LnFNQOynA96ulyxgOuXxa6Dmj4jwev81fRSj8dAzmuyhL7 tpOX7yPrX8ODYKUPZMEANm3TxRpQaMxLikNh3NnVQBjcf1BjDSBjnAGEAtcWP0VBYJd+ QKuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fzuPmq/RESWsUmF1fBcW+WD0B5zpvGflJUq/fx+lFkY=; b=S27SYOcNYuTyqCy26CSDI4GaQChZpRR6DUBVGAwyaH1ucjqCaQLvM6YVxr2zXDqNbU Y97N7jSnfuXGzFiUemGQ1J24FHsoC1oqJOHjR3QyGgv5n0IbsGCnPlu167t42dPCAtwY isXv5DYFaFSyGvULCXnzUB+7QIpUxdGQome9hhv9M7Axj0NQnVRJPo+2mIgg7wSq40fM Ws7+B4nrAlHA2j3dhuPgdJragpnEIJTL3uvGRLmdDPe5VJLR+0zHs4DsIbm0ohqLFI7u gJH4Mz32qIRR2xblWDCF7LfFZejlWObv5dcfpR9vLnpCYawY0AToQLoxqBXODOZA2Ycy tXXg== X-Gm-Message-State: APjAAAUR1BODG9e4viArHRcR0cQQP3HoTdqjTIUkXGdCVj2+aCp+Nefk kej5HU46vLsppqcbaMRDapQ1P9biZL+F48x9GhX8HQ== X-Google-Smtp-Source: APXvYqwynJIZYCaOlMHx2nffp61neRWEK5AoEUmOLUfDKEXOCCZXaYwMWIJqV5O8yhfNSs5gqWd6sn4xJ9RPCF/umLI= X-Received: by 2002:a67:f790:: with SMTP id j16mr15436696vso.232.1553530240698; Mon, 25 Mar 2019 09:10:40 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> In-Reply-To: <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> From: Ben Schwartz Date: Mon, 25 Mar 2019 12:10:29 -0400 Message-ID: To: Paul Hoffman Cc: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000002b07f90584ed7204" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 16:10:44 -0000 --0000000000002b07f90584ed7204 Content-Type: multipart/alternative; boundary="000000000000257b6a0584ed7235" --000000000000257b6a0584ed7235 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Mon, Mar 25, 2019 at 7:37 AM Paul Hoffman wrote= : > On Mar 25, 2019, at 12:01 PM, St=C3=A9phane Bortzmeyer > wrote: > > Otherwise, even after reading the whole thread "Reviewing > > Resolver-Associated DOH", I don't understand why https is required in > > section 2. We don't require DNSSEC in section 3, so why having > > stronger requirments for HTTP? Since having certificates for IP > > addresses will be difficult in practice, why not just accepting http > > as well as https? (Or, https without cert. checking.) > > The reason I didn't drop down to http: is that doing so evokes the > response, even though you are quite correct that the other two > methods given in this document do not offer any authentication. So, let m= e > ask the WG: > > Would this document be better off with all three methods being equally > unauthenticated? Doing so would remove the "but you can't get IP address > certificates!" argument that keeps coming up (even though that is > overstated). Doing so would simplify the security considerations by makin= g > all three protocols have the same obvious weakness. > > An alternative is to have two URI, one with https: and one with http:, an= d > explain that trying the first might be a good idea but to fall back to th= e > second if authentication fails. > > Thoughts? > Given that the protocol is called "DNS over HTTPS", running it over unencrypted HTTP seems like a contradiction. It also complicates any security status indication by introducing a mode that no longer offers any confidentiality benefit over standard DNS. Apart from security issues, insecure HTTP is generally restricted to HTTP/1.1. DoH implementations are strongly encouraged to use HTTP/2, because HTTP/1.1 requires in-order responses. Running DoH over HTTP/1.1 increases the likelihood of performance problems. --Paul Hoffman > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000257b6a0584ed7235 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, Mar 25, 2019 at 7:37 AM Paul Hoff= man <paul.hoffman@icann.org> wrote:
On Mar 25, 2019, at 12:01 PM, St=C3=A9phane Bortzme= yer <bortzmeyer@n= ic.fr> wrote:
> Otherwise, even after reading the whole thread "Reviewing
> Resolver-Associated DOH", I don't understand why https is req= uired in
> section 2. We don't require DNSSEC in section 3, so why having
> stronger requirments for HTTP? Since having certificates for IP
> addresses will be difficult in practice, why not just accepting http > as well as https? (Or, <horror>https without cert. checking</= horror>.)

The reason I didn't drop down to http: is that doing so evokes the <= horror> response, even though you are quite correct that the other two m= ethods given in this document do not offer any authentication. So, let me a= sk the WG:

Would this document be better off with all three methods being equally unau= thenticated? Doing so would remove the "but you can't get IP addre= ss certificates!" argument that keeps coming up (even though that is o= verstated). Doing so would simplify the security considerations by making a= ll three protocols have the same obvious weakness.

An alternative is to have two URI, one with https: and one with http:, and = explain that trying the first might be a good idea but to fall back to the = second if authentication fails.

Thoughts?

Given that the protocol is ca= lled "DNS over HTTPS", running it over unencrypted HTTP seems lik= e a contradiction.=C2=A0 It also complicates any security status indication= by introducing a mode that no longer offers any confidentiality benefit ov= er standard DNS.

Apart from security issues, insec= ure HTTP is generally restricted to HTTP/1.1.=C2=A0 DoH implementations are= strongly encouraged to use HTTP/2, because HTTP/1.1 requires in-order resp= onses.=C2=A0 Running DoH over HTTP/1.1 increases the likelihood of performa= nce problems.

--Paul Hoffman
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000257b6a0584ed7235-- --0000000000002b07f90584ed7204 Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCB86aTQ1GfZEm6rN56KF8TE agbQwamxpVXnXChlwPMliTAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMjUxNjEwNDFaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAi1EUFn07JGsRdiLtI4vgFje029nWF12ap2TAYcXI Fuyt1Zc9OtVs0EhuJfqM3v36OFngjK7JbVVoJixtoZTFoxFEmJDOWHljlpkgSNWuVLp2vakr216X WwmObmvjkSYbYFAPw2/Cxson/b4giwTmiQpYsQICFUi6Gzra3/4felAZ8gJwty19Hrj22M+JNTgI OxpS1TyHo68voXnWYm7dbFtuymxM9vLPsfQz2Y7tHLclGqiFBfqg0W0wvr0dnsbVBO6RfvlDBuq0 OVtxVzbx9qmIAkI/YoouHf+1rDWjx26V94r6DiGOjndJEDqAKL/2g4I5wWKAlrqrXnRWKtjVOA== --0000000000002b07f90584ed7204-- From nobody Mon Mar 25 09:12:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F128B1203FF for ; Mon, 25 Mar 2019 09:12:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.201 X-Spam-Level: X-Spam-Status: No, score=-4.201 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y9bWeKiXfDwB for ; Mon, 25 Mar 2019 09:12:11 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B2F61203D6 for ; Mon, 25 Mar 2019 09:12:11 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 25 Mar 2019 09:12:09 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Mon, 25 Mar 2019 09:12:09 -0700 From: Paul Hoffman To: Ben Schwartz CC: DoH WG Thread-Topic: [Doh] [Ext] New version: draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU4yRc6ElS8ncDSUyWuzlX/E6D6KYc+g6A Date: Mon, 25 Mar 2019 16:12:09 +0000 Message-ID: <73320990-AA1A-43CC-B560-106B561021A0@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> <39393D27-1905-4832-B9A7-D5BBA1A7FA7C@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="us-ascii" Content-ID: <8C42010D94281245815C14F6D87AF716@pexch112.icann.org> Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 16:12:13 -0000 On Mar 25, 2019, at 5:03 PM, Ben Schwartz wrote: >> I have been told that some OSs have "send a TXT request" API call, but I= have not verified that. If so, then TXT records will have an advantage. Ot= herwise, using a new RRtype is cleaner. >>=20 >> Can someone who from the application implementation world verify or refu= te my hazy memory of API calls for TXT records? >>=20 > POSIX systems generally lack such an API. Yes, of course, but I had heard that many OSs add it. --Paul Hoffman= From nobody Mon Mar 25 09:13:35 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23EB11203D6; Mon, 25 Mar 2019 09:13:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.2 X-Spam-Level: X-Spam-Status: No, score=-4.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aDMnjYly2hgw; Mon, 25 Mar 2019 09:13:23 -0700 (PDT) Received: from ppsw-33.csi.cam.ac.uk (ppsw-33.csi.cam.ac.uk [131.111.8.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 732401200B3; Mon, 25 Mar 2019 09:13:23 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:34538) by ppsw-33.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.139]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1h8SDv-000zAq-ik (Exim 4.91) (return-path ); Mon, 25 Mar 2019 16:13:19 +0000 Date: Mon, 25 Mar 2019 16:13:19 +0000 From: Tony Finch To: Ted Lemon cc: "doh@ietf.org" , "dnsop@ietf.org" In-Reply-To: Message-ID: References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: multipart/mixed; BOUNDARY="1870870841-985717742-1553530399=:13313" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 16:13:26 -0000 This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1870870841-985717742-1553530399=:13313 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: QUOTED-PRINTABLE Ted Lemon wrote: > On Mar 25, 2019, at 4:04 PM, Tony Finch wrote: > > If I understand it correctly, DTLS leaves MTU and fragmentation up to t= he > > application protocol. The DNS has horrible packet size problems, so it > > needs a lot more help than DTLS provides. QUIC is much better. > > Indeed. My point was simply that this avoids ordering problems, just as > QUIC does. I suspect that it is worth having DNS-over-DTLS; QUIC is > great, but based on what I=E2=80=99ve been seeing, quite a lot, and proba= bly not > appropriate for a lot of use cases where DNS-over-DTLS would do just > fine. It isn't so much ordering that is the problem, but not delaying answer B when answer A suffers packet loss. I'm kind of curious about what the relative trade-offs might be between DoQ and DoT with a decent SACK implementation, when there is not much latency between the client and the resolver. DNS-over-DTLS will need its own application layer retry strategy. I kind of prefer the idea of DNS being able to re-use a good off-the-shelf transport protocol rather than doing its own thing. Tony. --=20 f.anthony.n.finch http://dotat.at/ Irish Sea: West or northwest 4 or 5. Smooth or slight. Showers. Good. --1870870841-985717742-1553530399=:13313-- From nobody Mon Mar 25 09:15:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 230691203E3 for ; Mon, 25 Mar 2019 09:15:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u3Y3l9-5y66V for ; Mon, 25 Mar 2019 09:15:43 -0700 (PDT) Received: from out.west.pexch112.icann.org (out.west.pexch112.icann.org [64.78.40.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2C8B11200B3 for ; Mon, 25 Mar 2019 09:15:43 -0700 (PDT) Received: from PMBX112-W1-CA-1.pexch112.icann.org (64.78.40.21) by PMBX112-W1-CA-2.pexch112.icann.org (64.78.40.23) with Microsoft SMTP Server (TLS) id 15.0.1367.3; Mon, 25 Mar 2019 09:15:40 -0700 Received: from PMBX112-W1-CA-1.pexch112.icann.org ([64.78.40.21]) by PMBX112-W1-CA-1.PEXCH112.ICANN.ORG ([64.78.40.21]) with mapi id 15.00.1367.000; Mon, 25 Mar 2019 09:15:40 -0700 From: Paul Hoffman To: Ben Schwartz CC: DoH WG Thread-Topic: [Ext] Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU4v8NErSydLS5/EmthYUYA3yQXaYc+eKAgAABcYA= Date: Mon, 25 Mar 2019 16:15:40 +0000 Message-ID: <728F76D1-A87B-4EA5-AEEA-2775FB32DC00@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-messagesentrepresentingtype: 1 x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [192.0.47.234] Content-Type: text/plain; charset="utf-8" Content-ID: <078C80B71D565A42BEB5170A6E3DB69C@pexch112.icann.org> Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [Ext] Re: Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 16:15:45 -0000 PiBPbiBNYXIgMjUsIDIwMTksIGF0IDU6MTAgUE0sIEJlbiBTY2h3YXJ0eiA8YmVtYXNjQGdvb2ds ZS5jb20+IHdyb3RlOg0KPiANCj4gT24gTW9uLCBNYXIgMjUsIDIwMTkgYXQgNzozNyBBTSBQYXVs IEhvZmZtYW4gPHBhdWwuaG9mZm1hbkBpY2Fubi5vcmcgPG1haWx0bzpwYXVsLmhvZmZtYW5AaWNh bm4ub3JnPj4gd3JvdGU6DQo+IE9uIE1hciAyNSwgMjAxOSwgYXQgMTI6MDEgUE0sIFN0w6lwaGFu ZSBCb3J0em1leWVyIDxib3J0em1leWVyQG5pYy5mciA8bWFpbHRvOmJvcnR6bWV5ZXJAbmljLmZy Pj4gd3JvdGU6DQo+ID4gT3RoZXJ3aXNlLCBldmVuIGFmdGVyIHJlYWRpbmcgdGhlIHdob2xlIHRo cmVhZCAiUmV2aWV3aW5nDQo+ID4gUmVzb2x2ZXItQXNzb2NpYXRlZCBET0giLCBJIGRvbid0IHVu ZGVyc3RhbmQgd2h5IGh0dHBzIGlzIHJlcXVpcmVkIGluDQo+ID4gc2VjdGlvbiAyLiBXZSBkb24n dCByZXF1aXJlIEROU1NFQyBpbiBzZWN0aW9uIDMsIHNvIHdoeSBoYXZpbmcNCj4gPiBzdHJvbmdl ciByZXF1aXJtZW50cyBmb3IgSFRUUD8gU2luY2UgaGF2aW5nIGNlcnRpZmljYXRlcyBmb3IgSVAN Cj4gPiBhZGRyZXNzZXMgd2lsbCBiZSBkaWZmaWN1bHQgaW4gcHJhY3RpY2UsIHdoeSBub3QganVz dCBhY2NlcHRpbmcgaHR0cA0KPiA+IGFzIHdlbGwgYXMgaHR0cHM/IChPciwgPGhvcnJvcj5odHRw cyB3aXRob3V0IGNlcnQuIGNoZWNraW5nPC9ob3Jyb3I+LikNCj4gDQo+IFRoZSByZWFzb24gSSBk aWRuJ3QgZHJvcCBkb3duIHRvIGh0dHA6IGlzIHRoYXQgZG9pbmcgc28gZXZva2VzIHRoZSA8aG9y cm9yPiByZXNwb25zZSwgZXZlbiB0aG91Z2ggeW91IGFyZSBxdWl0ZSBjb3JyZWN0IHRoYXQgdGhl IG90aGVyIHR3byBtZXRob2RzIGdpdmVuIGluIHRoaXMgZG9jdW1lbnQgZG8gbm90IG9mZmVyIGFu eSBhdXRoZW50aWNhdGlvbi4gU28sIGxldCBtZSBhc2sgdGhlIFdHOg0KPiANCj4gV291bGQgdGhp cyBkb2N1bWVudCBiZSBiZXR0ZXIgb2ZmIHdpdGggYWxsIHRocmVlIG1ldGhvZHMgYmVpbmcgZXF1 YWxseSB1bmF1dGhlbnRpY2F0ZWQ/IERvaW5nIHNvIHdvdWxkIHJlbW92ZSB0aGUgImJ1dCB5b3Ug Y2FuJ3QgZ2V0IElQIGFkZHJlc3MgY2VydGlmaWNhdGVzISIgYXJndW1lbnQgdGhhdCBrZWVwcyBj b21pbmcgdXAgKGV2ZW4gdGhvdWdoIHRoYXQgaXMgb3ZlcnN0YXRlZCkuIERvaW5nIHNvIHdvdWxk IHNpbXBsaWZ5IHRoZSBzZWN1cml0eSBjb25zaWRlcmF0aW9ucyBieSBtYWtpbmcgYWxsIHRocmVl IHByb3RvY29scyBoYXZlIHRoZSBzYW1lIG9idmlvdXMgd2Vha25lc3MuDQo+IA0KPiBBbiBhbHRl cm5hdGl2ZSBpcyB0byBoYXZlIHR3byBVUkksIG9uZSB3aXRoIGh0dHBzOiBhbmQgb25lIHdpdGgg aHR0cDosIGFuZCBleHBsYWluIHRoYXQgdHJ5aW5nIHRoZSBmaXJzdCBtaWdodCBiZSBhIGdvb2Qg aWRlYSBidXQgdG8gZmFsbCBiYWNrIHRvIHRoZSBzZWNvbmQgaWYgYXV0aGVudGljYXRpb24gZmFp bHMuDQo+IA0KPiBUaG91Z2h0cz8NCj4gDQo+IEdpdmVuIHRoYXQgdGhlIHByb3RvY29sIGlzIGNh bGxlZCAiRE5TIG92ZXIgSFRUUFMiLCBydW5uaW5nIGl0IG92ZXIgdW5lbmNyeXB0ZWQgSFRUUCBz ZWVtcyBsaWtlIGEgY29udHJhZGljdGlvbi4gIEl0IGFsc28gY29tcGxpY2F0ZXMgYW55IHNlY3Vy aXR5IHN0YXR1cyBpbmRpY2F0aW9uIGJ5IGludHJvZHVjaW5nIGEgbW9kZSB0aGF0IG5vIGxvbmdl ciBvZmZlcnMgYW55IGNvbmZpZGVudGlhbGl0eSBiZW5lZml0IG92ZXIgc3RhbmRhcmQgRE5TLg0K DQpUaGlzIG1heSBiZSBhIG1pc3VuZGVyc3RhbmRpbmcuIFRoZSBwcm90b2NvbCBpbiBzZWN0aW9u IDIgaXMgbm90IHJ1bm5pbmcgRG9ILCBpdCBpcyBmb3IgZmluZGluZyBhIERvSCBzZXJ2ZXIsIGlu IHRoaXMgY2FzZSwgYXNraW5nIGZvciBkYXRhIGZyb20gYSAud2VsbC1rbm93biBsb2NhdGlvbi4g V2UgY2FuIGNob29zZSB3aGF0ZXZlciBwcm90b2NvbCB3ZSB3YW50IGZvciB0aGF0OyBpbiBTZWN0 aW9uIDMsIHdlIHVzZSBETlMuDQoNCj4gQXBhcnQgZnJvbSBzZWN1cml0eSBpc3N1ZXMsIGluc2Vj dXJlIEhUVFAgaXMgZ2VuZXJhbGx5IHJlc3RyaWN0ZWQgdG8gSFRUUC8xLjEuICBEb0ggaW1wbGVt ZW50YXRpb25zIGFyZSBzdHJvbmdseSBlbmNvdXJhZ2VkIHRvIHVzZSBIVFRQLzIsIGJlY2F1c2Ug SFRUUC8xLjEgcmVxdWlyZXMgaW4tb3JkZXIgcmVzcG9uc2VzLiAgUnVubmluZyBEb0ggb3ZlciBI VFRQLzEuMSBpbmNyZWFzZXMgdGhlIGxpa2VsaWhvb2Qgb2YgcGVyZm9ybWFuY2UgcHJvYmxlbXMu DQoNCkFnYWluLCB0aGlzIGlzIG5vdCBhYm91dCBydW5uaW5nIERvSC4= From nobody Mon Mar 25 09:23:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 237D81203FF for ; Mon, 25 Mar 2019 09:23:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3rX2R37sKD6v for ; Mon, 25 Mar 2019 09:23:22 -0700 (PDT) Received: from mail-wm1-x342.google.com (mail-wm1-x342.google.com [IPv6:2a00:1450:4864:20::342]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 068AA1200B3 for ; Mon, 25 Mar 2019 09:23:22 -0700 (PDT) Received: by mail-wm1-x342.google.com with SMTP id z11so9688307wmi.0 for ; Mon, 25 Mar 2019 09:23:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=lOX8nyj8nI7PG5DbqFDxUspwdSvdjF9AiuOAtY+F/ew=; b=C2qx1A4VqlaewkLVm1Bo+JFrp7R1iNnSTbPbYXoe36Ug4UU91wUavwLHFh8BXTHGy4 DA4GZe0KlFrwoBAI++mrfn+TiOI/todJcpk8RoJf7PJmKaBWYCbGns6GFMEjPIpY00Ux 9f3Y7B5Q43EI5beCqDXZw5b2SGG8bnaus6c5b12c4QmxJ6vp9Ga7XCJflTr/cSUBXnvx i96eosgA4TUrI+FnJHeITpNTXBE7/pg1a5W+yYG5ek2wq6ppXA/rA/tQubDlGhcB1xiD bO5j/f7WxvmVkEKTTe+TRv97JSBPqKipg2lZAgAgj5NovamvDgDECOUmFbxdA11kkL8T U5pg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=lOX8nyj8nI7PG5DbqFDxUspwdSvdjF9AiuOAtY+F/ew=; b=KxdiwQs8eocc9V4J3CVUY28SqbiGSyd/9OYmVLOxvPNTj79uEbtfDarMPCQMWdaFy8 Jix3DxigknpMTYY8tLcy6pNESAlF/DmxCGfKY76zRCp/3k90cwUX/Vtz7mmQcFdpOlGC zNr1kdZggxRDMYJVkA18izaFWVVeOpVkGiEFdMk+4odAzU/loX3DRj9I7xHEM/g4pOkn eOLAxWobFLXLzvZCK+O0Dl4bYGnZX3Z/0T6a79IDvGlAez9xNLLc/MiSN2exFzOHw/ut M2sKrBKMgbm6Njg85LUpz+tzbxPXaKNb8M6yq18N1DVvYRN74o3Liz3xUjm0ToHownDa D+Ug== X-Gm-Message-State: APjAAAWiLQlKUtLGmDcJLc6cSEEV4kRNLn6Ug4gUaLPKm3g+EoCTql9v NC4UsZ8yYXKZA0oja4x/fLMbmY4wJeF3PoB3 X-Google-Smtp-Source: APXvYqy++iIWjhShlrMXWXyGMnJS44AwWRtDQiVINp/XorPikZnBvYz028p+kZL/t+hrULbCFVxhLQ== X-Received: by 2002:a1c:d106:: with SMTP id i6mr11156615wmg.134.1553531000450; Mon, 25 Mar 2019 09:23:20 -0700 (PDT) Received: from dhcp-889a.meeting.ietf.org (dhcp-889a.meeting.ietf.org. [31.133.136.154]) by smtp.gmail.com with ESMTPSA id d6sm18158670wrx.62.2019.03.25.09.23.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 25 Mar 2019 09:23:19 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.2\)) From: Ted Lemon In-Reply-To: Date: Mon, 25 Mar 2019 17:23:17 +0100 Cc: "doh@ietf.org" , "dnsop@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: <394A2493-4C87-41C7-9B9E-57441E4F673E@fugue.com> References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> To: Tony Finch X-Mailer: Apple Mail (2.3445.104.2) Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 16:23:24 -0000 It seems like SACK would make the problem less bad in theory, but = wouldn=E2=80=99t eliminate the problem. With DNS-over-DTLS, if a = packet is lost, the next packet still gets an immediate answer, because = DTLS is a datagram protocol, not a stream protocol. The retry strategy = for DNS-over-DTLS would be the same as DNS-over-UDP, once the = Diffie-Hellman shared key has been derived. So assuming you are using = this to communicate to a resolver, there would be an initial handshake = that=E2=80=99s extra compared to DNS-over-UDP, and then it would just be = DNS-over-UDP until such time as re-keying is needed. > On Mar 25, 2019, at 5:13 PM, Tony Finch wrote: >=20 > Ted Lemon wrote: >> On Mar 25, 2019, at 4:04 PM, Tony Finch wrote: >>> If I understand it correctly, DTLS leaves MTU and fragmentation up = to the >>> application protocol. The DNS has horrible packet size problems, so = it >>> needs a lot more help than DTLS provides. QUIC is much better. >>=20 >> Indeed. My point was simply that this avoids ordering problems, just = as >> QUIC does. I suspect that it is worth having DNS-over-DTLS; QUIC is >> great, but based on what I=E2=80=99ve been seeing, quite a lot, and = probably not >> appropriate for a lot of use cases where DNS-over-DTLS would do just >> fine. >=20 > It isn't so much ordering that is the problem, but not delaying answer = B > when answer A suffers packet loss. I'm kind of curious about what the > relative trade-offs might be between DoQ and DoT with a decent SACK > implementation, when there is not much latency between the client and = the > resolver. DNS-over-DTLS will need its own application layer retry > strategy. I kind of prefer the idea of DNS being able to re-use a good > off-the-shelf transport protocol rather than doing its own thing. >=20 > Tony. > --=20 > f.anthony.n.finch http://dotat.at/ > Irish Sea: West or northwest 4 or 5. Smooth or slight. Showers. Good. From nobody Mon Mar 25 12:27:49 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9308E120021 for ; Mon, 25 Mar 2019 12:27:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tXsQEAetAE1v for ; Mon, 25 Mar 2019 12:27:47 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB91F120020 for ; Mon, 25 Mar 2019 12:27:46 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.riseup.net (Postfix) with ESMTPS id 4CC8F1B8E7A for ; Mon, 25 Mar 2019 12:27:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1553542066; bh=4Rx68LOV7fzp7D9mNRo4r+1pDDjma+ilmzBgP7fFEeo=; h=Subject:To:References:From:Date:In-Reply-To:From; b=gTg5QWgjtcoR6uylBFXuSU6a9AmxakGDsKIVlLUxCG2nLXi/BJv+2U4Ue3Gtf5HSO miIngtI1fMC36Qr2CzTIC9Q3Hb3HD9HndTa8R7wGZB5Yrc3oEqTxeLZjbA+OLVPHmk xyDlbhzZd7cvn56b1pZF0iko9oPBfhyQTS6wGzBo= X-Riseup-User-ID: A206C0DD914ECDC4BBBB03F5AA3D7D35C183D17223AB3B6B133565613C7BDA42 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 0C0111204F4 for ; Mon, 25 Mar 2019 12:27:44 -0700 (PDT) To: doh@ietf.org References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> From: nusenu Openpgp: preference=signencrypt Autocrypt: addr=nusenu-lists@riseup.net; prefer-encrypt=mutual; keydata= xsFNBFj53gUBEADYKwT0pW1yiqt6UReZW8T2nXVCyeVT2G6z7AvW69afp82uthRH237pQ7Qs 5vq91DivN6fGN6cVksp0N9Yv+5HEQAwUxpLfcNDcGzmHMd0JMItEtozGv3a4FuiUoHAqeGXM 6Kzi3v5F2PZGF+U4QaGKEZq6u50gO/ZFy4GfC9z9tsO6Cm7s7KldVHMGx/a0MEGMwh6ZI9x2 hGXSSAKu58KRUkEpHzDiQTj+/j58ndNfZRQv6P5BLppHADRPqwEOm4RQcQYskyM0FdKXbJ8E 5GW268meflfv2BASsl3X/Xqxp+LNrstXIbFZ+38hVlQDDmdvaASpPTzIAxf8FxMYZqI+K1UE kP5nU45q84KiZoXwT6YYJDKToLSDnYkKlsrCSnLkE3Nb/IexgNoYO4nE6lT9BDV3athQCWw1 FwB5idRYWnIqbVgUFgYZDUdZBJmeTEeI+Wn5hFz6HvFVc/+haMVTcoEKSkG/tsSGsKOc2mp6 z+71io9JWrVQGmw7OeZeE4TvkF9GhwS8jrKO4E0crfcT/zT6368PZCO6Wpir8+po/ZfOWbbh 1hi3MxmXn4Fki55Zrvhy3sf28U+H/nByQV4CssYv/xVhIZsN/wNQLcDLgVs4JTBUik8eQR0Y Qrq9lG3ZVtbpEi7ZTJ6BOGIn2TKHsVIVGSQA0PdKpKYV45Lc4QARAQABzSBudXNlbnUgPG51 c2VudS1saXN0c0ByaXNldXAubmV0PsLBfQQTAQgAJwUCWPneBQIbAwUJBaOagAULCQgHAgYV CAkKCwIEFgIDAQIeAQIXgAAKCRCtYTjCRc1Cfq/kD/sHx+mnL6OLwJvBj1rVTyoHJYJARajz Go0yRlbrZSH6Z05OD3SDR9UVpWOZeY8JyFoTyCFQjAbIVjKifj0uSmi0j1iahrAgGGfik0cN XUkCxrW6jcJQ37EbvYWu4PryqLuC7IeQW1wCcB1ioyGYKkm2K6LZ9rzZPVYSmPohJ+gVI0Jt EdlNZl4JuZot9eA5w/22uvcStQHzXDsUxfqK8OAJpU8E3iBBdNpLPMDWpFz4g2yw5PD6jZ+K Q39PYMUFULaKe4YCw1O+0MFhZJI4KEcRYHuVy1b3cJjxzgVfEyFctLDsO1sh07vBhoVKUi8W e00pvGtv8QYxxMYIA3iACbsjGEr69GvvZ2pAnu9vT9OUCaES4riDCxbkMxK/Cbwk8F6mo0eq HDQ7sOZWQv81ncdG9ovlA7Pj96cEXgdtbbllF1aUZ8sAmT14YjGzhArGv7kyJ1imH5tX3OXk hBGA9JTk2mDNjEpFaTEajSvDiKyeEhWNTLm15siWkpg1124yjUkhQ3OCkw7aUDMiVn8+DQHo J2pP/84uUvngbhm1jV7nk8mxTUFgppUePkb5hhnRRzeK72QY00EwRdn7qnpNgijMJ3Fpjfy2 EeCEl3nNdcB7U0F+0ijA6P/+DROldxNr4eiP50RvV8XiW/yi2IkKBk50GNB87yYnDETxxx/c 2i00AM7BTQRY+d4FARAAwJZ6U7UT8uB1WCfLK3AOR1Wa9bzOAghlTR4WXbHB4ajQKG7/Fzud 99bnwD0V3/AOVz/SbGDyHe+7HMvd1A0Ll4NgyH6OpxY7wOwCXAYTAbcXLpM7eKTjjsb9A9XG 3FcIGvjcy76OkaewqhiABaShlStEYcPkRusHZuecXtCnfCjJKihU/kinWpBO9gY6SrF2KFCw aeS4r37brXQ9y8uy3gZ168QFuIa5AKfL0r5YN3k4StNSA2p5Z/pufWXMN3B03QC+3fireiz3 dinlHK6XjUW8oWSdNxJhexT/lUw+episNuWTQruy7PD+HeohYGXqjggmPUiWc171Sewb2f8H CHViHMee8QXqo/LSRkYVrtsx0HUSMKsVQOma/u2By03ucroIkQJQQfqX3YpK1i3EpUO2L0/m E8UpBvUm1vrst54EFym4tYNJTj9reVffFKh2cczmPVN5o8v3RrdTF96mGtcb9EJbGV4277ZE LqUspviEBXynqU3yZ48JhIWHj22/ha6TeBpapYZDOJ8lePed8E34J/GYE2YXl65LhpXAKvWz O3KiByGMysb9Li6zqZ9/BYQtg5CA6Q8Oo7pBxK4iiDH3GX2WvymmLoaOBpOaIYdvKr39fajE mzfbg7TdZKXxqp2KDrbw7vUJLDyrmPWpxHyhKHItzoi1Y59wzYSq3h0AEQEAAcLBZQQYAQgA DwUCWPneBQIbDAUJBaOagAAKCRCtYTjCRc1CfpfgEAC3tXZzhgKbF6fx5gMNDp/9MBpialvu k69UaGL3HUqM0/ytiT4FjYUmOK2mk37iop46GivsOC50PykG9gjbg9/QKUqgsZzJ8LJ+ldY4 /GKtiP5JoO59Obj8MJJ5Ta8yPfZiiNx/I8ydqd18E4PmQUCPlEKhett81t3+8R/mGwG72TaA hHwDjZAEjiXdnXh+z0AKpflCnYQafq0V73ofzuw4KovpJWMk/WPs5oSHhuV4TZ8nRkF6BR4y rEvs1kq8Y6DuNqQGwY3yilpnmqfMzzlWo7MlY657domU54bhGOsvNuZZsFDlcBczQo6h9OKq ckkVHUMAw38pX+EghzEfhYVWYmLNv5G9TA/M2s3frO3aN7ukNDq7CKIwfVz71/VfPaLQMY7/ jirzp9yIBZEi4E+PwP38FAGiD+nxzuUJv1rvxf6koqUGoHRvdppju2JLrC2nKW0La7RX7uZJ esCVkamT/XaXPROBTrZZqwbIXh2uSMzgXkC2mE1dsBf2rdsJ4y73+0DYq7YE52OV9MNoCYLH vpkapmD00svsP4sskRsrquPHkBBVCJa22lTaS8Oow9hGQe7BDjEhsVoPol889F0mbTRb3klv mGQ6/B/HA0pGWR9wISY8a7D40/qz6eE6+Yg22mtN1T8FFlNbyVmtBj0R/2HfJYhGBElLPefH jhF0TA== Message-ID: <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> Date: Mon, 25 Mar 2019 19:27:00 +0000 MIME-Version: 1.0 In-Reply-To: <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="hERHC1S6r364vj6BX2CXAQPP2g7cH1FfJ" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 19:27:48 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --hERHC1S6r364vj6BX2CXAQPP2g7cH1FfJ Content-Type: multipart/mixed; boundary="heGDvagP58pqlaNI3p4XX3JE21fZp5Q1v"; protected-headers="v1" From: nusenu To: doh@ietf.org Message-ID: <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> In-Reply-To: <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> --heGDvagP58pqlaNI3p4XX3JE21fZp5Q1v Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable Paul Hoffman wrote: > Would this document be better off with all three methods being > equally unauthenticated? Doing so would remove the "but you can't get > IP address certificates!" argument that keeps coming up (even though > that is overstated). Doing so would simplify the security > considerations by making all three protocols have the same obvious > weakness. >=20 > An alternative is to have two URI, one with https: and one with > http:, and explain that trying the first might be a good idea but to > fall back to the second if authentication fails. >=20 > Thoughts? Since implementations might choose to implement only=20 the authenticated discovery portion using authenticated https I'd suggest to keep https in. --=20 https://twitter.com/nusenu_ --heGDvagP58pqlaNI3p4XX3JE21fZp5Q1v-- --hERHC1S6r364vj6BX2CXAQPP2g7cH1FfJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEElpDPH7u0KYWVTfK7rWE4wkXNQn4FAlyZK6kACgkQrWE4wkXN Qn6iyw//XdqF0Hka54paSjF5Z01b+HntQgyuidA3lK53b6kYVhHMQb2HX0fRAi49 ZPMxJ1BUZry8AmvRx6qFIfiALavLwF5yteOLV/bUrv5IXvWOLNkdQQvkuw5Nyjdv nqeXoXd2xmeS7f0e9iw+icJSEnQKK1SYD6/H+hbwQ6TYNQnm4EXH7FDqo3jYiQHJ IjKbrJZkDxn/IMpeGTIipZV8hal7V+SO+Lwg87kI1mWAL9/c73WWQEBQnEQfXen5 9/pSoYYiA2lndqAdxbPW+RwGKcVKXvRKpynCwuR863hpo57C0bDVMd8eFQs5x0gq ydkMtP39/GJX4XBWyIZ+7JFdBALTQuujrkBPxrBXly+ba5cBGI1dkox6Mgwsmhea fq1XGWtfiueYHWrDoIFU/dH0v61DwKkruARgj8cc6jJy7d/NoRqmjOiFIwKo+2l+ QHjVV/AbX+tNrywjBj9SodZ/oHx42H6Tabcg6xU+dquTxXXTR1EOptA4yWmCsy3J XPwRRJSPvU92daNFX1ky1Po9NhLmdj6pNkmbuNoXHJLLEJeEhI9VE1bbFavorD7+ pADyVURlUTMx0vWwZ4OH7SOiJVe6kGNs9arM4uni8BQ+d/swOjQwzXjqnrSRHYoP 1e8LLLjLuCVaaeX2qvk+mMuvluq+lj9D/BarHTbqZ+mKcnwuJI0= =8VC1 -----END PGP SIGNATURE----- --hERHC1S6r364vj6BX2CXAQPP2g7cH1FfJ-- From nobody Mon Mar 25 14:20:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C03BC1200B7 for ; Mon, 25 Mar 2019 14:20:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.021 X-Spam-Level: X-Spam-Status: No, score=-6.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WOKyUsLI3k10 for ; Mon, 25 Mar 2019 14:20:20 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 44D54120090 for ; Mon, 25 Mar 2019 14:20:19 -0700 (PDT) Received: from pc-cznic19.fit.vutbr.cz (ip-86-49-44-131.net.upcbroadband.cz [86.49.44.131]) by mail.nic.cz (Postfix) with ESMTPSA id 47C5262E9F for ; Mon, 25 Mar 2019 22:20:17 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1553548817; bh=zYVwoWtmd4N769LljfbMgRls35Dx7qHLUskHgK2kvCw=; h=To:From:Date; b=Gof4V6Hcq2jY5PcQMtMn4984phgbInzP+RgbjWr/Ri8HszqU8YtyVohW+gMdt0uMO o5xgySeclKCj/a6EeWjj5Ql1SdyrZtWM5ToY2j8WiOGidFjrIJv+g46m0yLk+wynl/ CEdWhOVNX1NgNJBbIOpKjK+laFmO487FI3DyPagA= To: doh@ietf.org References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> From: =?UTF-8?B?UGV0ciDFoHBhxI1law==?= Openpgp: preference=signencrypt Autocrypt: addr=petr.spacek@nic.cz; prefer-encrypt=mutual; keydata= mQINBFhri/0BEADByTMkvpHcvPYwyhy0IDQ1B2+uU6AWP0QJQB3upM/YqxoJBeMQ5SxpO+W6 BsU0hTIF90AKIgiiDtMH1oNhHnzRXqePKORIgL3BbH5OxGcbqCYk1fIKk43DliCN1RcbTyRV REnCRQGWMTUbRS/jQ3uyTAX4rT0NhPWhPy6TMLGEg6WJJz0IzhBEw3TitvAlq6XHbi5EZYwU AHqIcuqr3sS+qkWqlIBlahu1hqhTcmYGz7ihjnWkOFi1rjRfLfudAtgFpUSmsixh2tifdy+C d8OBQbtF2kM7V1X5dUzw/nUBXm1Qex2qohRmCspwqivu7nlDMrLoilmPaeoR5evr5hpIDdfP cJAPTJk4n56q6MTHFJWkGa0yq13AJHLANNjQ/dF+W6Dhw9w2KBpuw0iGZQBBf5G9SQ1xJ+tU 9filaldsTAX1gMkVso//kGEbuRIJnJr7Z8foE/zofFyoAv21VWy2vpgQ3CnEWOZMSmYH7/gZ qcM7nfkjk4zAijpjYA3qlXoWa44/nrkAGvt7sAMsxY1C2H7tr3h3/rwyfbBqQ9nMpNwYLXXa Dil7uzyqlpKDjwWCzYd3sH7ATyT4htrd0BY5+IFimSfHyLwixhakH8E14YYyV9tzkrB7fiWd g7+zDThLtZMvtrehtkjVDPT50xg8TMr68hd3GRWBUJHszMTnlQARAQABtCBQZXRyIFNwYWNl ayA8cGV0ci5zcGFjZWtAbmljLmN6PokCVAQTAQgAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIe AQIXgBYhBL4m67nL4FmzkQyjW86N1qGlCiHkBQJcEOXhBQkFp4LgAAoJEM6N1qGlCiHkxNwQ ALFyQ7Rrghf0rM9GN2+kgP92Qvot21h8/Je3bRTvoLyhYUXcAMRmODZQ/0EsjExFc+pRwn+E 0GD2TpiorDnRMpJYEmHqenYGIrZ5TE0lHwwu0fi/X3evDY4j68OFlim5Q6+7pHOlZWaRsSm5 T6blSwIaNDFYtBhI0X1ZXTGqbXIUBFuGxolo/xEgUkeDy+6D4R8yT17CTHkuGYYrfUYnoBTr j3xMVil/lNMievaklAL8kRNVl0It4M8VzHTyEdMq7pG0CJ0CfU8COizCsu4+zy8dsxMVE0Su hju05LSsClZ9X1csxSK9HjKq+TG1Hx2qciFHRB1qC2mNIvWTm10Gkj4tLTWcJp3k2Wyv+1K2 sLFxreGOwbx0uR7XtIIBTiiZAiVsjBH0D39qG2ZLz+bJkQvlTDZQuXzsMS51wROvTVxPYcXX p069hON2+/QqJasmpOHhOydGkB3uokA0crqvMOnK+EcueKQQspvdLGiFLefJPuM8VVyR9fFZ YjnX2vfGZbE+MxY8wG4mDbhgxsUORAEtNUH/G0dvTv66fzKpl5q9GIZs7el+1IU31w7KivgS 7fsWcOsdzq4KzZzNBRJtEDoxX4b9lQ8P6ttMlPi7PnQ+iN0OUxKSnAnKQiqKMFRO1zH22vn7 iiF4JMO32//0HcpsyV8oEdjDkSJsFRnDfLW2uQINBFhri/0BEADFp4ZfxSoKTAad0IkFK9CV oZ6XKywYLFNPPhzw++gbvHL2EX7QqhEsqbsWMYpH4jc/Kq55OYYU/lIcULuD0Y9oDR26XFQo u0FeSNnzRGb607U8OFOPQ+ei92Mm1YPQ33GPj8GqbQpkAp35sfjJ64TH/EQY38RN33jsHRkh wtWU/6yo+RZs7cFRuihuLl8FuoP0A5u/x+lNNeIBk8f27LVYrF81NSDDDYjnObCah+QLzGAw GDtjWkBVawpoHWwq58OQSx5piwyOCnFJeFONRcTRgOz239rsEA5LeYfmOGcnNwG6CHoJ5ZdW Jw5OV9BoA7UTHG95xVHV5QiEm6q6igI6wKV2RtFS7Roe0Wt8H7gC41JeqaKTUsGkz6uJraF8 mmKyS8E+mSh3djmqdJNHF1pJqKxAxPYA9Y0jPnYWeEH4fPeOR2YvBjztsye9nOv1AuKNu03d uzocyU95DfP/lwNJr5SH918Vf1t7WcJj9dg6J9Jc5LOwg13Qr31TuZijrMdqM7LJKC/0tOkS eXNoMlHJOIqbqm7N414I0HytbENf7AiyDxNA5TzJKkB0eBPLm2FMQCHLfasJHgbCrQut6nYw 3f3Gn3+PDzGEHI9sfQv/mYvO77oRSGw+3Hy1ToxIncIirAyRpa5KdPLklDpADvpfkXjuL6If ZZ0OIWKLSRa/DQARAQABiQI8BBgBCAAmAhsMFiEEvibrucvgWbORDKNbzo3WoaUKIeQFAlwQ 5fcFCQWngvoACgkQzo3WoaUKIeTg+w/9Gyp5EcB4AoR3vKVxP0SAh1zBher3bh9uGaKTAWt0 +0v8fyZYGEPqZr//9rkodPnXbQnr9ogzjJmZpsPvGPyRZikWjYIwkfM2Vb4BCyr5wQ9++9KB kob5zCQmUw2o7s/gISpFsCC5B0eYusArVDnrCyrroyaxbN6MpUb5lzVMEOCzYljtdrPRAXPL FKRm3ijLV0RcYPzJJVOPV5EzUfCtGsGTXXRI9Y9O/7lFaJ+iWnwygo/Xoi0IgBHvOAj9Gp3Q 0BY+sI6Rgzm9dbddm8gYJ4+FjfZivI7fbdfSubTWvrtFmFdHovIPJYLvXK7hUG22ww4CneIF D4oZSVy9xUoqJf0qQNruzEqTr7y7lbZIzxgPCSVmH0jpgJ1po6RLaJllNA+ZklOQ76fCMiaD 5yQuJluwD5w+acPWTbmZX6DijGHPZSjzeUkiMKctYSRqVUo6JmK0dgwwm3l1/Orb4D3YsLVP QDa4ZrCfSldrGC3zkEJ8iCVSYQwlc0JfIxyn8C3LLxToPYeFv/bQTeDYBjaV7a0SQ/xKUdpg RFzrGrxj7CM2WHcpxCLVK0agobuUO7YXoufHRM6y0rfMwT10baDjh+hLKMshxTqsP55lWvtM SleSGjheVTiZChb3jK0rUPCC4Rg3gDTEQsptC3TgN48PtLpmhsNc4JPm64zlrreInZQ= Organization: CZ.NIC Message-ID: <8f03f9d4-2639-3519-7bbb-29ce6847a7f4@nic.cz> Date: Mon, 25 Mar 2019 22:20:48 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: cs Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.99.2 at mail X-Virus-Status: Clean Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 21:20:24 -0000 On 25. 03. 19 15:46, Tony Finch wrote: > Ian Swett wrote: > >> One way DoH may be faster than DoT in the near future is that DoH can go >> over HTTP/3 via QUIC and avoid head of line blocking like Do53. > > It ought to be better to have native DoQ to eliminate the overhead of the > http layer. Dunno whether this should use yet another port (all the > obvious ones are already taken) or use ALPN. BTW one of products of IETF 104 hackaton is DNS-over-QUIC proxy and a benchmarking client. See https://github.com/IETF-Hackathon/ietf104-project-presentations/blob/master/IETF_104_Hackathon_DNS.pdf slide 5 Client in flamethrower (C++ open source perf tool) • github.com/DNS-OARC/flamethrower/tree/dns-over-quic Server side: Proxy from quic to udp • https://github.com/ns1/doq-proxy -- Petr Špaček @ CZ.NIC From nobody Mon Mar 25 16:08:25 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 707ED120176 for ; Mon, 25 Mar 2019 16:08:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rayhaan-ch.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EWqdAFR2kn93 for ; Mon, 25 Mar 2019 16:08:08 -0700 (PDT) Received: from mail-ed1-x531.google.com (mail-ed1-x531.google.com [IPv6:2a00:1450:4864:20::531]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E65CA120175 for ; Mon, 25 Mar 2019 16:08:07 -0700 (PDT) Received: by mail-ed1-x531.google.com with SMTP id q3so9115090edg.0 for ; Mon, 25 Mar 2019 16:08:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rayhaan-ch.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=xY/MYTmfhTJ2t6yyp1Dr9MXQd6AoIKpeKANm2KAq85I=; b=PHqd/Fi5evpSrMTAPQfe2JIY/601+pJi7iKJ5tcALv+rClq+6pvXMGhECmTT70NNcl z4MkTUnKSE7WQYnoIyrvyXcjQlEjZqg+J5s372Rx23rDh9wE2OhXcuGWZajuN9njZdom 2nxl72j+fBsOhiyqzGee9XROU0BXzuki2mVZtcMpWZMUkBd1r5aEMYanHUebmOlxRsQB UcIvjB03vTAZICMYAMIspdEMUu4SB8CRJv9m5JbvBk2KHePfrVuQk40tDhDkQvjl33Kd 6nm+lt69JB+IrL1B5pw+uU2RBWavh7jsjn6OlZTNqMZWfg0sc8matFcLJgoo6zhc+Jyt Hm9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=xY/MYTmfhTJ2t6yyp1Dr9MXQd6AoIKpeKANm2KAq85I=; b=R/LY2hppJicdfirGe++FroV+DFwO2ACSCbk534fB9i49DEtmC8pV42p+X27LMZ0eHm YaUCHSOxvb8O4/ihrnnSE1CwF3SO8ma/RRMtG8v3G0H2/lRf74rEWKbsJ1VGAysgN41g sdl4zlxXxln2+U2N9gIw+YmADoW6g6MaPT6GZRpurf9SUlh7WdGkpT3dgwxhvm0yzFK5 4Dj570CuMt6YW4suwAhjG68MTBpc5seoXrxF8GkW972GxazbCsZa9Bxunx8AIy4/Cgun kr77lT7Ze0XhNfLtfDul0d8Jrbcy+5BXdlAmS3m49eDHc3a3mHG5ZiD0Z1YbcogKc8sp 8A5w== X-Gm-Message-State: APjAAAV3D8MTQZxySBUlw6cskx27VEJO35fRP/hZmPIsVE05kZGPbhvk 7ntc1FnJkQhBLdkUpBBwm4eGZs8rfGnzV7Q77Xrk1s/7aG4= X-Google-Smtp-Source: APXvYqxECI2d30wDycQ+Z5+3ZJj+HTJl7JnfRmPQ1mDt5/gMrtX80nyihs78r/NTx4PfW78Obw2Q9Et0cjPkvgyZUFo= X-Received: by 2002:a50:94fa:: with SMTP id t55mr17613179eda.229.1553555285882; Mon, 25 Mar 2019 16:08:05 -0700 (PDT) MIME-Version: 1.0 From: "Rayhaan Jaufeerally (IETF)" Date: Tue, 26 Mar 2019 00:07:42 +0100 Message-ID: To: doh@ietf.org Content-Type: multipart/alternative; boundary="000000000000f44b6e0584f346f2" Archived-At: Subject: [Doh] ICMPv6 Option for DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Mar 2019 23:08:23 -0000 --000000000000f44b6e0584f346f2 Content-Type: text/plain; charset="UTF-8" Dear DoH WG, I came across your `draft-ietf-doh-resolver-associated-doh` whilst thinking about how to propagate DoH configuration information to end hosts. Specifically, I was thinking about proposing an ICMPv6 Router Advertisement option which would embed this information in an RA message, in a similar manner to the Provisioning Domain architecture ( https://datatracker.ietf.org/doc/draft-ietf-intarea-provisioning-domains/?include_text=1 ). The information contained in this option could be the URL template, and current IP address of the resolver, and a lifetime. This would be to bootstrap the resolution process (i.e. instead of fetching the /.well-known/doh-servers-associated/ path). In my opinion two advantages of this approach would be that the configuration information passing through this channel can be secured using Secure Neighbor Discovery (as opposed to do53 which is more easily intercepted). Furthermore, using a domain name to refer to the server means that end host can refresh the IP address of the server by periodically looking up the FQDN of the DNS server. This could simplify processing of RA messages since only a lifetime timer needs to be kept to re-query for the FQDN (assuming the same FQDN is being distributed by the RA). Unfortunately, I cannot make it to IETF 104 in Prague this week, but do let me know if anyone has any opinions on this proposal. Regards, Rayhaan -- Rayhaan Jaufeerally -- https://www.rayhaan.ch NOC contact: +41 078 636 7556 / noc@rayhaan.ch --000000000000f44b6e0584f346f2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Dear DoH WG,

I came across your `draft-ietf-doh-resolver-associated-doh` whilst = thinking about how to propagate DoH configuration information to end hosts.=

Specifically, I was thinking about proposing an I= CMPv6 Router Advertisement option which would embed this information in an = RA message, in a similar manner to the Provisioning Domain architecture (https://datatracker.ietf.org/do= c/draft-ietf-intarea-provisioning-domains/?include_text=3D1).

The information contained in this option could be the URL t= emplate, and current IP address of the resolver, and a lifetime. This would= be to bootstrap the resolution process (i.e. instead of fetching the /.wel= l-known/doh-servers-associated/ path).

In my opini= on two advantages of this approach would be that the configuration informat= ion passing through this channel can be secured using Secure Neighbor Disco= very (as opposed to do53 which is more easily intercepted). Furthermore, us= ing a domain name to refer to the server means that end host can refresh th= e IP address of the server by periodically looking up the FQDN of the DNS s= erver. This could simplify processing of RA messages since only a lifetime = timer needs to be kept to re-query for the FQDN (assuming the same FQDN is = being distributed by the RA).

Unfortunately, I can= not make it to IETF 104 in Prague this week, but do let me know if anyone h= as any opinions on this proposal.

Regards,
Rayhaan

--=C2=A0
Rayhaan Jaufeerally --=C2=A0https://www.rayhaan.ch=

NOC contact: +41 078 636 7556 /=C2=A0noc@rayhaan.ch
=
--000000000000f44b6e0584f346f2-- From nobody Tue Mar 26 01:47:46 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6051A1202CA for ; Tue, 26 Mar 2019 01:47:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id U7llzjeXt9kp for ; Tue, 26 Mar 2019 01:47:34 -0700 (PDT) Received: from mail-it1-x129.google.com (mail-it1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8F4391202C1 for ; Tue, 26 Mar 2019 01:47:34 -0700 (PDT) Received: by mail-it1-x129.google.com with SMTP id m18so18575313ita.3 for ; Tue, 26 Mar 2019 01:47:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=sqaZeUoN1BoQokJcr0MdE2LVwTHxzG0AMpOkuzFsSlM=; b=gbXY5Wn6u2+5cU0YA5nI0/lhrQF5GsMhSEWFCeO45rGoqlZTB34RT6WhjP2mz4lKnr V94Dy/qDO2cAgcskcVXqXK5G9xsZHNbVvgiamROcEXmdNHYzkDF2M9y2L49gzJsaiQg4 zsUi96ak+RRHrdfopWjEH22fzxTQJUflUu2m5KFxhs8VSDLeQhBPzaBR4/2Hbt/GOyz5 icug0AMbYaMZz/v1ExLS9bCJpvH4XREaKdCeogAxpvo4A5W3HhxpVpMg/6pu3kKXV47U YC4eNa16gXdEzji7dn3Fb4MUnykvp7azeft7TqjHOxFj/DLiNIeEC1SN82w1St0grI6T lmyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=sqaZeUoN1BoQokJcr0MdE2LVwTHxzG0AMpOkuzFsSlM=; b=PtRMKY7fK2/NX8+YFU27A7BMDCJkzIUkRrmPM9uSVeKQ/GgqHZGRwJyYUkE5Y+BsHQ 9uQpzq4Gh10I/rLzTSjxTBEEMhwdg8o/1TrhmJ/b8sNi0vOxvREv3XF/1sZJV040Wqmd wRKr58pfSQ8tzOandhY3RrG5ZOHvbwsNGDtTH4m8IXg4cGVs/ej0+SCWvo9AzE54qOUJ /bjWpU7VBmv+loJcyE3n+9Bi76pCniG6AsG7p2Z8QV6BvlzLAYbNL3JfsqkhEJiCkdfK VVestClYQ2jNvGY5uZVwZ+ZZkTbXFEUWA/3a0bX85q2bZcWAVxkZ05XnaJZdHGQgF+LC cOBQ== X-Gm-Message-State: APjAAAWFqIeitAkhRixVC/Ci3QWqHwXZiT4Jawq7jIw5GfMNrFLh9EGT tBNZTUvq0IwKVhEwqCSIWWrvhEeUzswYjd89rbc= X-Google-Smtp-Source: APXvYqydrrpLluWhP8Jx2UNm/rKtkmBD8R3oWl96NjPgXGQz5GvhuobhwCfF4LEaBGSbQGXOMFhlIQuZv4OEiXHmJKw= X-Received: by 2002:a24:6a8b:: with SMTP id l133mr7976190itc.92.1553590053910; Tue, 26 Mar 2019 01:47:33 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> In-Reply-To: <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> From: tirumal reddy Date: Tue, 26 Mar 2019 09:47:23 +0100 Message-ID: To: nusenu Cc: doh@ietf.org Content-Type: multipart/alternative; boundary="0000000000004a3d340584fb5f42" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 08:47:45 -0000 --0000000000004a3d340584fb5f42 Content-Type: text/plain; charset="UTF-8" On Mon, 25 Mar 2019 at 20:27, nusenu wrote: > > > Paul Hoffman wrote: > > Would this document be better off with all three methods being > > equally unauthenticated? Doing so would remove the "but you can't get > > IP address certificates!" argument that keeps coming up (even though > > that is overstated). Doing so would simplify the security > > considerations by making all three protocols have the same obvious > > weakness. > > > > An alternative is to have two URI, one with https: and one with > > http:, and explain that trying the first might be a good idea but to > > fall back to the second if authentication fails. > > > > Thoughts? > > > Since implementations might choose to implement only > the authenticated discovery portion using authenticated https > I'd suggest to keep https in. > Agreed, and with our proposal in https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02, the query for URI templates can use FQDN instead of IP address, and the HTTPS server certificate can be validated by the DoH client. -Tiru > > > -- > https://twitter.com/nusenu_ > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000004a3d340584fb5f42 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Mon, 25 Mar 2019 at 2= 0:27, nusenu <nusenu-lists@ri= seup.net> wrote:


Paul Hoffman wrote:
> Would this document be better off with all three methods being
> equally unauthenticated? Doing so would remove the "but you can&#= 39;t get
> IP address certificates!" argument that keeps coming up (even tho= ugh
> that is overstated). Doing so would simplify the security
> considerations by making all three protocols have the same obvious
> weakness.
>
> An alternative is to have two URI, one with https: and one with
> http:, and explain that trying the first might be a good idea but to > fall back to the second if authentication fails.
>
> Thoughts?


Since implementations might choose to implement only
the authenticated discovery portion using authenticated https
I'd suggest to keep https in.

Agree= d, and with our proposal in https://tools.ietf.org/html/draft-reddy= -dprive-bootstrap-dns-server-02, the query for=C2=A0URI templates=C2=A0can use FQDN in= stead of=C2=A0
IP address, and the HTTPS server certificate can b= e validated by the DoH client.

-Tiru=C2=A0




--
https://twitter.com/nusenu_

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--0000000000004a3d340584fb5f42-- From nobody Tue Mar 26 01:56:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DF5B120296; Tue, 26 Mar 2019 01:56:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EiYrev4fzntI; Tue, 26 Mar 2019 01:56:48 -0700 (PDT) Received: from mail-it1-x12d.google.com (mail-it1-x12d.google.com [IPv6:2607:f8b0:4864:20::12d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 403DC1202C7; Tue, 26 Mar 2019 01:56:48 -0700 (PDT) Received: by mail-it1-x12d.google.com with SMTP id e24so18332172itl.1; Tue, 26 Mar 2019 01:56:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=voqaA2mMFTl6jAenqd1spoFErErXgZaFpMxvAomQ3ck=; b=GX6cTBJFv2HFWM/lbqUts+BJgEVntz4uqlDE3xINXgElS3iur+nUFKfXDQ9SCvXM0N 6iCywNBLK9kYLeB27PUcZLcOU7TNIDU/qpn8WTh5SiV45tsfifalgbThJXGEvLYiGD7m IxtJ9e/nbulufjqp62iL4WKZwJMDFVSJuqnzINhAoBHS4CXD6blosWi3y99TQSm7Zms7 eYvckuwBJogxm4/D7fSK90EC6Jf0bhqu8XXIjZerSDiLVy3Cw70j9eE3Hnzm8Ytv/6KJ lFi29fPqzWR203DJhL5vrX9zrNQSQv9A8Zj7OSn2GxCa5FlJXZD+pbEvF9b98pckwZCt oTNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=voqaA2mMFTl6jAenqd1spoFErErXgZaFpMxvAomQ3ck=; b=LTIMUGRgDfhRUfwswo7I/crDqKrDcJGuJVkOij38OXgCeDAw3ogcQurm+4GV+eu7sp ppfo96XURzmG3HA0bHKicaM7kkhA3cAPjTkfRzLlyuvKK2en1HsgJLUxaANZ+CnegIiP WxOv3liiN0WaB2uihNVitjedWchePR2qjQ/Xw2J96Iq8I/VzWdqYU/pRuOQF0GLwbLOe IvcWNQTZPJ3VANkfQXqi73taqSh3I0PW1AvxYCu0hh0PkBLs3eLKbT58g1Zo3+FAtoyR rIy3TZSJJOLxqnG0LITM2lHgz5iVWSB93uc10IOOs8Nunq5q/34qm3DYBeer+HqSfRCJ d1cg== X-Gm-Message-State: APjAAAWBxOpDIeztscyzSew0G4uuPh6EXOdcfpi8yN169A3zX1WCR+qq zw4D0cmYUzkeRUlNggZnhxdsq6+r9YpovrQr5O+l4pJRGlEVww== X-Google-Smtp-Source: APXvYqyDXReYSe8kG402+mIb5o8BjRI0bLu3JZSKdlOAAYwYFU4UYWibkzG4BbkOHz+FDU+Ee/kiNn04ZiGV/o4Fgz4= X-Received: by 2002:a02:a399:: with SMTP id y25mr21920212jak.58.1553590607484; Tue, 26 Mar 2019 01:56:47 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> In-Reply-To: From: tirumal reddy Date: Tue, 26 Mar 2019 09:56:36 +0100 Message-ID: To: Tony Finch Cc: Ted Lemon , "dnsop@ietf.org" , "doh@ietf.org" Content-Type: multipart/alternative; boundary="000000000000491b300584fb80ec" Archived-At: Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 08:56:52 -0000 --000000000000491b300584fb80ec Content-Type: text/plain; charset="UTF-8" On Mon, 25 Mar 2019 at 16:05, Tony Finch wrote: > Ted Lemon wrote: > > > This is equally an argument for doing DNS over DTLS. This would give > > similar performance to DoH over QUIC. > > If I understand it correctly, DTLS leaves MTU and fragmentation up to the > application protocol. The DNS has horrible packet size problems, so it > needs a lot more help than DTLS provides. QUIC is much better. > We had a proposal in our draft https://tools.ietf.org/html/draft-ietf-dprive-dnsodtls-02#section-9 to handle fragmentation and reassembly but due to lack of support, it was removed in the next revision. If there is renewed interest in DNS-over-DTLS, we can submit a new draft discussing the fragmentation and reassembly procedure. Cheers, -Tiru > Tony. > -- > f.anthony.n.finch http://dotat.at/ > The Minch: Westerly 4 or 5, backing southwesterly 5 or 6, occasionally 7 > later > in north. Rough in far north and in far south, otherwise slight or > moderate. > Occasional drizzle. Good, occasionally poor. > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000491b300584fb80ec Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Mon, 25 Mar 2019 at 1= 6:05, Tony Finch <dot@dotat.at> w= rote:
Ted Lemon = <mellon@fugue.com<= /a>> wrote:

> This is equally an argument for doing DNS over DTLS. This would give > similar performance to DoH over QUIC.

If I understand it correctly, DTLS leaves MTU and fragmentation up to the application protocol. The DNS has horrible packet size problems, so it
needs a lot more help than DTLS provides. QUIC is much better.

We had a proposal in our draft https://tools.i= etf.org/html/draft-ietf-dprive-dnsodtls-02#section-9=C2=A0to handle fra= gmentation and reassembly but due to lack of support, it was removed in the= next revision.
If there is renewed interest in DNS-over-DTLS, we= can submit a new draft discussing the fragmentation and reassembly procedu= re.=C2=A0

Cheers,
-Tiru



Tony.
--
f.anthony.n.finch=C2=A0 <dot@dotat.at>=C2=A0 http://dotat.at/
The Minch: Westerly 4 or 5, backing southwesterly 5 or 6, occasionally 7 la= ter
in north. Rough in far north and in far south, otherwise slight or moderate= .
Occasional drizzle. Good, occasionally poor.

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000491b300584fb80ec-- From nobody Tue Mar 26 02:35:34 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FAA71202C1 for ; Tue, 26 Mar 2019 02:35:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gix2xiV8HvqZ for ; Tue, 26 Mar 2019 02:35:24 -0700 (PDT) Received: from mail-wr1-x434.google.com (mail-wr1-x434.google.com [IPv6:2a00:1450:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 68A611202AF for ; Tue, 26 Mar 2019 02:35:24 -0700 (PDT) Received: by mail-wr1-x434.google.com with SMTP id k11so6043260wro.5 for ; Tue, 26 Mar 2019 02:35:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:message-id:date:to; bh=TLnR3XFaqucrMufEN8scxjEf9HjTW1a1Fsw/Fqr4Dsc=; b=PYxUFwRs6QBnb3rV9CfWeg3BqxhxLs9Rwe6R1YBGSvIQjRuM548ovd/MEZwLgNSTlD 89FzQshlQsKtz41uuFMr0h+KA6H+vEuaZgmcGQaM07wwe+z90G3awuDLf8rjSw35JMYy dcANH6+A5teb0QQol9gcw0wPuJcnweHny+hQQRx61UdofAZx1Ax4COR3wFkEeu229qu7 NU5IQa9gbjA4BxjRrV2yAyiSwAzX/k3W+8OAARPvxjo7IoGsG2RiYgV4/M885WXVM6dg fQV+KejFmqDefYWw81ELhj6ujF677qq0zY3/VK5wh2NdN4WlIRgXqaEMU8Z1TzoTg/Fj kCFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:date:to; bh=TLnR3XFaqucrMufEN8scxjEf9HjTW1a1Fsw/Fqr4Dsc=; b=JooBF/fNOb3gpHZM/cZyZyLVpS0qnVaiPwRnWyxr2o1raI/B6gZum/ELPM15CV60An XytAzaCA51GCQ9jAZ1G8BbkAVTba88+xQD40t9qcfO4HeXR8v7rQZBw7FzHBh4pZXtbB 0467/DPO+NbwFu0LmXqqT2PORvI7dR9EsszuZuSiNSSXyS5yuy/B30laEfkh2D5vkyOC 0zg5eTJht1rjlXR22N06HJX+X/Mpo4xJQVVQNIgG7shJqjRs7dnDwgxo5Ee4b/DHjgIJ /APWbYHMt1wzjdz/yLoDcT5AbgJxP4rkEsx9Qse5jglvLYyN++QWdW7ZeAuvTkw11AL6 ncdQ== X-Gm-Message-State: APjAAAX1HrZ5A/ZORL21y07Hsiut35FVD4RB2C38FNw1WSXUZH/PtgUx RWzav8Z8wQ/qx1bwY5/ldMcxIMH+U/8= X-Google-Smtp-Source: APXvYqyM/kHoKD9B6omyIvZutpFwtaxhH5ZbAMP/U7ef6Mxt+iCRPBfxmYlN+IkiHg+d4oj44DGBmw== X-Received: by 2002:a5d:494c:: with SMTP id r12mr8032261wrs.250.1553592922731; Tue, 26 Mar 2019 02:35:22 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:e0f8:568d:3e71:dfac? ([2001:67c:1232:144:e0f8:568d:3e71:dfac]) by smtp.gmail.com with ESMTPSA id g12sm14323004wrw.40.2019.03.26.02.35.21 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Mar 2019 02:35:21 -0700 (PDT) From: Fred Baker Content-Type: multipart/signed; boundary="Apple-Mail=_80DC2EE7-C811-4705-B29D-4B57B523B6A6"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\)) Message-Id: <7D357986-AD33-4619-8037-8BCD59687AF0@gmail.com> Date: Tue, 26 Mar 2019 10:35:19 +0100 To: doh@ietf.org X-Mailer: Apple Mail (2.3445.104.8) Archived-At: Subject: [Doh] gethostbyname? X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 09:35:28 -0000 --Apple-Mail=_80DC2EE7-C811-4705-B29D-4B57B523B6A6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii I have a silly question. In section 4, the draft goes to the API level = to specify how to resolve a domain name. gethostbyname was deprecated in = favor of getaddrinfo (and therefore IPv6 capability) in 1999 (RFC 2553), = and is now found in all common OS's including Linux, FreeBSD, Windows, = MacOSX, and so on. A reference to gethostbyname in this draft comes = across as ignorant at best, perhaps deliberately so. What do we need to do to drag the authors into the current century? --Apple-Mail=_80DC2EE7-C811-4705-B29D-4B57B523B6A6 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEctjlJjQmVrp9uMq7EhdRnd2GP+AFAlyZ8lcACgkQEhdRnd2G P+Drbw//W1u5RZSi35WU0e3fGImDSgGC5C87H6RXDuV7nySzWKyTmjX0qspWWSEh 9pjrJfDq0/flQdNiXdccUBqb5v+AbfZHT2ycYzrJIvU1Hppj++EahVAFBMQZJqEe b/v0yo6r2jaQCRmgFJLhx3UXLSaZf+fn2PrlzSvOv+7Hoyz93SCPVYj5dDCInRjh YMMrdkeXcxcCnU+E+sIDggHmD2Pk4QnRi2+SnGKqPMkF40OIhmOl5yviUu0DJsuZ ieXDze03oFlu05arik7VdpKOnHykhrfa0M6SxANkGfXatHionIcHov1cKnsf8y13 MLLJFCX3up/htbRZqR4BekjwhWVZ8lDENiaXrOSkDboWkSrk6DJu7FpBf8GEWn3Z ICyoTv7fHtmVXi4SAlNa4iG28sXhuZ15FxIGacMQO5AS6rLBLleL/+vkRpJTgZjR iZiJXtY72aNTXWG84nFRW/EIpEBjQhqBIoxcMjg0mHlDljxr3GcIJKwCbZHXgzBO 9AnUoCcBxTqIUPoqy7OcPoa5Tw1A7tfaLw+4krdWbylKKmvzFTqi0sB/aUx32gjQ 2jiDMIe075yenuPTuNukF5x/Sx0av/OfJY3xrKLdsn0n9O8GfrPwIq/MfsvFOskr DkxAiIFJHYNG3skxC7Y5rWtrGDh4eCf44+Ng1ki/9QnR5rNvP54= =Spkk -----END PGP SIGNATURE----- --Apple-Mail=_80DC2EE7-C811-4705-B29D-4B57B523B6A6-- From nobody Tue Mar 26 02:37:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DFE712029B for ; Tue, 26 Mar 2019 02:37:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FNv7hB1tuqf5 for ; Tue, 26 Mar 2019 02:37:07 -0700 (PDT) Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0FEA120282 for ; Tue, 26 Mar 2019 02:37:06 -0700 (PDT) Received: by mail-qt1-x82b.google.com with SMTP id v20so13667350qtv.12 for ; Tue, 26 Mar 2019 02:37:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=Dw/MA0WrZnOCCT6NO7q+k1MRfxd8SlWy+0OSmxYbp/g=; b=iyhzc5gFLCZxZ6x8r++Oa/ky03JrLzrzD8/mPNl9Wb7jM6qEjk2POPBiO4PwTOfWX4 bS5FFxWJg+YDudDPOL5uRj9SDSteXXu4bV4esaST2UX0kkkmUh0dDNW2iNGer6w+bHSZ 8Zl8lkJA2CcTKMkTSEDI4Jb9cjADsR3X5rWES/KguhrLzkkjEAwWOVOLGk25gvkdCjDX TdzUOXgej+wcvYPb79biZKIa6ycs3zF35kFXlnQocwJ6yHxvu03acEO6BxA0hD1A8V3F R1/8DNlrVERlBoZTs4N+KaQxIIsTWLC6tNy18sUBwbxBlKbwWABRH0MiDEwMHksRDty4 NRiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=Dw/MA0WrZnOCCT6NO7q+k1MRfxd8SlWy+0OSmxYbp/g=; b=B8WNAj+Jlp89fIxTb4cpQBAUIUINjl7vtEKI3hade5tYQ/chfRUS2M8j46m6DERyfT 82lz2wJQ6zsieOf/gZt1HeG6heK3B8JYxaoJtzNBk8mFdJ0W9AyptTG0YhRrLTTNlPrI InwIePG9oxGYUCmHnCLZE7Kg1gI+ujjpG79uNKgb8F/wSxP0cl10VQlZpkTlt8yUjbli XdcQw7imJBaXXaiOoiaySMis7EMMrD9V7P4hwS6f9av4vKXKS12PM3TatAQ2i5cAEIGp qQdoDgd1AJTmwD4tIfEydd6FTnVfaTj5/hsMRuEf4C8I4YbdIE0Qi+pS41cGGCClFS/f Hvgw== X-Gm-Message-State: APjAAAU1FkWrXfy1/d61d9fcerKZ6AD/R9RBTLqGxA+yjbXARvFUdm1a o/GKvDJNgQJAUcAbGm5ogJ9g3WN5NoYA7KVdg78MXNa2XlY= X-Google-Smtp-Source: APXvYqxgEICDU0qlpSXCeFyZTqXYAJReks8u82W/qD4vxPPRJxQ/mILId3+xlUoV+QzavOHKMpRqs/aQkhbFkEgSRGQ= X-Received: by 2002:ac8:30ea:: with SMTP id w39mr25406844qta.351.1553593025673; Tue, 26 Mar 2019 02:37:05 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Brian Dickson Date: Tue, 26 Mar 2019 10:36:53 +0100 Message-ID: To: DoH WG Content-Type: multipart/alternative; boundary="0000000000006bbc220584fc10e2" Archived-At: Subject: [Doh] Question/proposal for DoH, for discussion at side meeting X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 09:37:09 -0000 --0000000000006bbc220584fc10e2 Content-Type: text/plain; charset="UTF-8" I have been considering many issues on the DoH and DoT protocols, along with the important use cases (dissidents, network operators, security issues, clients and servers). In the interests of advancing the discussion, I have the following observations, and possible proposal. I'm raising them here, in advance of the DoH meeting and of the side meeting, so as to not need to draw pictures or use a lot of words to describe these ideas, which hopefully will allow more focused discussion if this comes up in either meeting. Observation: DoH uses HTTPS, and as currently specified, re-uses the existing HTTPS port number, 443. However, as far as I know, most (or all?) HTTP(s) servers are fully capable of listing on multiple IP addresses, multiple ports, and doing name-based virtual hosting. Similarly, browsers are able to access HTTP servers on non-standard ports, by appending the port number to the server name in the URI. Proposal: Have IANA assign a new port number, for use exclusively for DoH. NB: I am not suggesting that DoH operate ONLY on the new port, but rather that DoH operate on BOTH the new and old port numbers. Also: this presumes that everything supported on the original DoH port, would be supported on the new DoH port, e.g. including HTTP/3 if/when it reaches the RFC status. Rationale: This is a compromise between those suggesting/requesting/demanding that browsers use DoT in addition to DoH, with preference of DoT over DoH, and possibly using inaccessibility on DoT as a way of inferring network policy prohibiting use of DoH. The main reasons for wanting DoT to be used are: (1) unique, dedicated port number; and (2) remove the burden/requirement to handle all the HTTP(S) encoding, parsing, negotiation, etc., and (3) having to choose between running a full-blown web server, or re-implementing only the necessary subset of web server software to support DoH. Thus, using an additional dedicated port number for DoH, would allow clients to cooperate with network operators' desire to have a dedicated port number for Do{HT}, while not having any additional implementation effort (since the DoH protocol would not be impacted, only the port number used). In addition, the inferred policy logic would be equally supportable, whether the first port used was DoT or DoH(new port). Failure to connect would potentially allow the client to infer that the issue is network policy preventing access on the port(s) in question. Dissidents would still have DoH(443) available, possibly without attempting to use the new port first. The informed user consent issue would still apply, whether through preferences configuration, or via UI. Also, the issue of what browsers use as their defaults, including whether/when to fall back, is a separate issue that needs to be discussed. I would still encourage browsers to implement DoT, since the incremental work required is negligible, and since there may be significant push-back by DNS operators against requiring the HTTP portion of DoH, in order to offer privacy to DNS customers. Browsers would be able to fall-back to DoT if no connection could be established on either of the two DoH ports, rather than having to fall back to plain DNS, or use of a different DNS service provider. Brian Dickson (speaking ONLY for myself) --0000000000006bbc220584fc10e2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I have been considering many issues on the DoH and DoT pro= tocols, along with the important use cases (dissidents, network operators, = security issues, clients and servers).

In the interests = of advancing the discussion, I have the following observations, and possibl= e proposal.

I'm raising them here, in advance = of the DoH meeting and of the side meeting, so as to not need to draw pictu= res or use a lot of words to describe these ideas, which hopefully will all= ow more focused discussion if this comes up in either meeting.
Observation:
DoH uses HTTPS, and as currently specif= ied, re-uses the existing HTTPS port number, 443.
However, as far= as I know, most (or all?) HTTP(s) servers are fully capable of listing on = multiple IP addresses, multiple ports, and doing name-based virtual hosting= . Similarly, browsers are able to access HTTP servers on non-standard ports= , by appending the port number to the server name in the URI.
Proposal:
Have IANA assign a new port number, for use= exclusively for DoH.
NB: I am not suggesting that DoH operate ON= LY on the new port, but rather that DoH operate on BOTH the new and old por= t numbers.
Also: this presumes that everything supported on the o= riginal DoH port, would be supported on the new DoH port, e.g. including HT= TP/3 if/when it reaches the RFC status.

Rationale:=
This is a compromise between those suggesting/requesting/demandi= ng that browsers use DoT in addition to DoH, with preference of DoT over Do= H, and possibly using inaccessibility on DoT as a way of inferring network = policy prohibiting use of DoH.

The main reasons fo= r wanting DoT to be used are: (1) unique, dedicated port number; and (2) re= move the burden/requirement to handle all the HTTP(S) encoding, parsing, ne= gotiation, etc., and (3) having to choose between running a full-blown web = server, or re-implementing only the necessary subset of web server software= to support DoH.

Thus, using an additional dedicat= ed port number for DoH, would allow clients to cooperate with network opera= tors' desire to have a dedicated port number for Do{HT}, while not havi= ng any additional implementation effort (since the DoH protocol would not b= e impacted, only the port number used). In addition, the inferred policy lo= gic would be equally supportable, whether the first port used was DoT or Do= H(new port). Failure to connect would potentially allow the client to infer= that the issue is network policy preventing access on the port(s) in quest= ion.

Dissidents would still have DoH(443) availabl= e, possibly without attempting to use the new port first. The informed user= consent issue would still apply, whether through preferences configuration= , or via UI. Also, the issue of what browsers use as their defaults, includ= ing whether/when to fall back, is a separate issue that needs to be discuss= ed.

I would still encourage browsers to implement = DoT, since the incremental work required is negligible, and since there may= be significant push-back by DNS operators against requiring the HTTP porti= on of DoH, in order to offer privacy to DNS customers. Browsers would be ab= le to fall-back to DoT if no connection could be established on either of t= he two DoH ports, rather than having to fall back to plain DNS, or use of a= different DNS service provider.

Brian Dickson
(speaking ONLY for myself)


--0000000000006bbc220584fc10e2-- From nobody Tue Mar 26 02:48:16 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85F2712028D; Tue, 26 Mar 2019 00:52:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id auOYnDLERxxb; Tue, 26 Mar 2019 00:52:54 -0700 (PDT) Received: from family.redbarn.org (family.redbarn.org [IPv6:2001:559:8000:cd::5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23116120047; Tue, 26 Mar 2019 00:52:54 -0700 (PDT) Received: from [192.168.20.236] (unknown [194.126.205.24]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client did not present a certificate) by family.redbarn.org (Postfix) with ESMTPSA id 6CD33892C6; Tue, 26 Mar 2019 07:52:50 +0000 (UTC) To: Ian Swett Cc: Brian Dickson , Eric Rescorla , "doh@ietf.org" , "wjhns1@hardakers.net" , Patrick McManus , "dnsop@ietf.org" , "Winfield, Alister" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> From: Paul Vixie Message-ID: <17294888-dacc-d163-91a4-cdf2aee04321@redbarn.org> Date: Tue, 26 Mar 2019 00:52:47 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 PostboxApp/6.1.12 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: X-Mailman-Approved-At: Tue, 26 Mar 2019 02:48:15 -0700 Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 07:52:56 -0000 Ian Swett wrote on 2019-03-25 01:28: > One way DoH may be faster than DoT in the near future is that DoH can go > over HTTP/3 via QUIC and avoid head of line blocking like Do53. Do53/UDP has no HoL prolem. nor does Do853/TCP. only Do53/TCP had an HoL problem, so, it was never widely used, and has been replaced by Do853/TCP. -- P Vixie From nobody Tue Mar 26 03:25:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A889B1202A3 for ; Tue, 26 Mar 2019 03:25:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=r5OCA89Z; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=Q9Cs6Kl5 Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yfv1UKatRnXn for ; Tue, 26 Mar 2019 03:25:53 -0700 (PDT) Received: from outbound2r.ore.mailhop.org (outbound2r.ore.mailhop.org [54.200.129.228]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E1E1B1202AF for ; Tue, 26 Mar 2019 03:25:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553595952; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=vgco57d/F0zavJH+oXYg1eP6n2lys24FPaZx4wNuwzWTuQKghKFGWF5+83ilXWSq4NjnRLYryB/3A pi1yOS9e3TeSu6gd9YOGh4xI0RU9ANsWmGsTmrm0bmR0SdXdbVcIHJ/48Wnc1g4kbW8Itzu7nQfzwu JTauOO/NQe9WqWOFjFlFmRo/rZ1+WbiDmoQprMZicTP2EED1IO6z1qeJfFjQQIY7tjQEN27V2IkIZT wfyN6ObutKo4uogfOuMNtmh8MUaohFd49qSR/NNFpsxEjjfHheix+o25OcmhtmZPlsknlYWCJOykXc ib1JOxga/c2U7UtEBydOkW3GBfl1xng== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=pHSQeLyeNS8Cp0JaOKlID3PSonVWMICfU2gqJzXkDnc=; b=lfpLRY3SklEKsulPPqgrZZdihAEV9pKaShOcCcMQX1995sDUXFULk200KqqRgNZgpMoDDqTvjGVwZ YAec+vDWgVU2CPLN4xf3P46v3WhvbTK9v0Kdh6kcmLnc/ou7fbZfq9xwFdHF1kRTS2awU3rWD6uWDJ eIgCTWSuORwtbcvjzIRR6e2Oagx6Y6Xu3wa64v/pBJxTQJRNWNHt8ixWsmnpyW/zqgVrd0/F7t0DA9 R9BGasvFssohErngZhkAX0wbGUCsu5GK1FD0qLROzV4tZ3PfRtLE4kJ8jzMYZXTrD1+rqNHS2UWdbq LjuTCKZvZHXX6LlNPN8KkR8LNdH/kqQ== ARC-Authentication-Results: i=1; outbound4.ore.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.210.52; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=pHSQeLyeNS8Cp0JaOKlID3PSonVWMICfU2gqJzXkDnc=; b=r5OCA89ZrhWIC32/ExHZQgKVv/kfT7ZELky39lRPrNo4a6569OPUknD+qaJPi+kjd4nbPe4nVXGKP 0Ybdj4knJXPBjICiayHpB1YCm14Dhp28tlUpDQo0ayb8zs7uw9QGnWuM+yTyM+WwsFeYXgFvkDsTX6 0PIMEwYvlqwXo1eU= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=pHSQeLyeNS8Cp0JaOKlID3PSonVWMICfU2gqJzXkDnc=; b=Q9Cs6Kl5dUs4WFDg11WXm+UjaT4FpWf8W8RtpXwZJRaCh9Y6Rv+sFIo0EIOKFtVtf1QF7rlS8bhZv +J9tqGs9GVXW5k1a1wnw528pLxHK3TAmCzFpajZPcZRIydmeDXU1NE7O5Gm/t3gF+Ac2RftykWbmLl BE3JVsUmSHPTOOtfq/B1LtxS7gLLVLLmPnBkiqPIQ9L9Q6li/5AAQlQYXUrkpLfKXAt/4ks+R26dUN KCzrdvG5hv6fkOq4T5yTUbOFqi97TkLXg2AnlG+9/iPtbwFiA5tCpqug+EykjbG6YEpDPmpVJAQ2Im cetFdiAeVMcO5xqrsCKelI3FpaHQV0A== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: 86ab6252-4fb1-11e9-befd-af03bedce89f X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.210.52 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-ot1-f52.google.com (unknown [209.85.210.52]) by outbound4.ore.mailhop.org (Halon) with ESMTPSA id 86ab6252-4fb1-11e9-befd-af03bedce89f; Tue, 26 Mar 2019 10:25:50 +0000 (UTC) Received: by mail-ot1-f52.google.com with SMTP id o74so10949756ota.3 for ; Tue, 26 Mar 2019 03:25:50 -0700 (PDT) X-Gm-Message-State: APjAAAXf9+De0Kv1SGkR1886IHYp4Smnfy7/NV7mR+zjVInsCweKJExY gPnaoN3VAIA2vzWbO+iXhtrR014X9MzG5/9lLAw= X-Google-Smtp-Source: APXvYqyqS035On/3KAE9P8Gk8KbNKmoKCwX82wPVVvxZq4DLfbanMQyckvOPKmB4Sd9wJIeYKGrvKEkzldxnDj5dXZA= X-Received: by 2002:a05:6830:109:: with SMTP id i9mr19237105otp.96.1553595949726; Tue, 26 Mar 2019 03:25:49 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> In-Reply-To: From: Patrick McManus Date: Tue, 26 Mar 2019 11:25:38 +0100 X-Gmail-Original-Message-ID: Message-ID: To: tirumal reddy Cc: nusenu , DoH WG Content-Type: multipart/alternative; boundary="000000000000b5414a0584fcbe86" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 10:25:56 -0000 --000000000000b5414a0584fcbe86 Content-Type: text/plain; charset="UTF-8" On Tue, Mar 26, 2019 at 9:48 AM tirumal reddy wrote: > > Agreed, and with our proposal in > https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02, > the query for URI templates can use FQDN instead of > IP address, and the HTTPS server certificate can be validated by the DoH > client. > > right. The weakness here is that validating a name that probably comes from an unauthenticated source is not a very strong signal. That seems inherent in the draft, but maybe worth calling out more explicitly. otoh - and out of scope for this draft - the DoH client could do some kind of validation beyond the name.. like looking for a x509 attribute (and cross signature) indicating some kind of better-business like endorsement of privacy practices. So I think validation in the scope of associated-resolver is a desirable property even though the usually validated thing, the name, is a little less valuable here. --000000000000b5414a0584fcbe86 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, Mar 26, 2019 at 9:48 AM tirum= al reddy <kondtir@gmail.com>= wrote:

Agreed, and with our proposal in https:= //tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02, the q= uery for=C2=A0URI temp= lates=C2=A0can use FQDN instead of=C2=A0
IP address, and t= he HTTPS server certificate can be validated by the DoH client.
<= br>

right. The weak= ness here is that validating a name that probably comes from an unauthentic= ated source is not a very strong signal. That seems inherent in the draft, = but maybe worth calling out more explicitly.

otoh = - and out of scope for this draft - the DoH client could do some kind of va= lidation beyond the name.. like looking for a x509 attribute (and cross sig= nature) indicating some kind of better-business like endorsement of privacy= practices. So I think validation in the scope of associated-resolver is a = desirable property even though the usually validated thing, the name, is a = little less valuable here.

=C2=A0
--000000000000b5414a0584fcbe86-- From nobody Tue Mar 26 03:46:42 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 759F51202B0 for ; Tue, 26 Mar 2019 03:46:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oBqXXFZI65Rg for ; Tue, 26 Mar 2019 03:46:38 -0700 (PDT) Received: from mail-it1-x129.google.com (mail-it1-x129.google.com [IPv6:2607:f8b0:4864:20::129]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3088F1202A4 for ; Tue, 26 Mar 2019 03:46:38 -0700 (PDT) Received: by mail-it1-x129.google.com with SMTP id e24so18763920itl.1 for ; Tue, 26 Mar 2019 03:46:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=m2ZaQXvKHqkbj1v7qrkd1io9l+WO0xHmlBu44J5dU9I=; b=QnrA0voH3xprvDbFzeiwzuUIP1VzF1iCDbMT5L69JxUhKcKlezPNxaxBZJZUeIxUJ1 ESrKR+FHuUvtldlCN1kLKLwM5WdReEj4b5CZNoy+dvBvbv5mA4Pot5kpKbmL5Jn7Lque S5xVjz8e2glOmmhQLKQ/Pk3gsb7zbrzQeszrwdHpICmqCsgVm8WaDUBcLR/2uaKOcc8P wUFE42D4k7uIoKbiodXtJ1yVmXBid3IZJF9ndNO2ZLT9vwHIDZd1fvJt4SVGrv+em/1b vlHultpJu7nZXt45LBZLbnTVuGD6gpEzP9kAiP4kcGhOATfeL6qgxr6/W6yjs6vj5d12 i5Mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=m2ZaQXvKHqkbj1v7qrkd1io9l+WO0xHmlBu44J5dU9I=; b=AufvrCDXaclbA8Jjr5/BL0Leak/BLvtOKzZaABRIW9aGKtuYJ0mHUWE2g6KeMLvLEG zBQEvCTlixYXVGuvXwM4EFeKIMqSG2gBCI8xgifSzY1mn4A8lmZ+Rj1GjJ2RM+SXA/k6 dRKpPu7r9SGTy8fWnPPdmXsyKj8aMX5UIzHK/ku47lpaVvTp6jZBP3v9oogHNZEOYosk atKEinclnA1nCAKDGC8C+nWQ9eAMcOfGgfUG5GyEEKVX2DyXgmGSasYklQIJwLM8NUtb 5OWY9ukn4Ae0e6PplQLfWMElt9wXEG254Wcaao6jwJAtvC451tDepYkInptEzgML476d 49lw== X-Gm-Message-State: APjAAAXArzOFuysx3zSvrszPSNZZniks7HYHl8PuHB5nN/6uQAm2ZGxC BIKjJxZR/QSw2uqSqbyZAp9ExQTqOZn7RxREvig= X-Google-Smtp-Source: APXvYqzkllrrKdD34AXiPBvSrvovYT8271lPKfdFfDksPKOMiHPGfsedeadb+mRjEgTO1XLRMNErEyw78OqLEombECs= X-Received: by 2002:a24:c842:: with SMTP id w63mr2677348itf.17.1553597197533; Tue, 26 Mar 2019 03:46:37 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> In-Reply-To: From: tirumal reddy Date: Tue, 26 Mar 2019 11:46:26 +0100 Message-ID: To: Patrick McManus Cc: nusenu , DoH WG Content-Type: multipart/alternative; boundary="0000000000001544b60584fd096a" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 10:46:40 -0000 --0000000000001544b60584fd096a Content-Type: text/plain; charset="UTF-8" On Tue, 26 Mar 2019 at 11:25, Patrick McManus wrote: > > > On Tue, Mar 26, 2019 at 9:48 AM tirumal reddy wrote: > >> >> Agreed, and with our proposal in >> https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02, >> the query for URI templates can use FQDN instead of >> IP address, and the HTTPS server certificate can be validated by the DoH >> client. >> >> > right. The weakness here is that validating a name that probably comes > from an unauthenticated source is not a very strong signal. > No, the name is coming from a authenticated source. The explicit trust store to validate the local DoH server certificate can also be used to validate the S-NAPTR lookup response is authentic using DNSSEC. > That seems inherent in the draft, but maybe worth calling out more > explicitly. > > otoh - and out of scope for this draft - the DoH client could do some kind > of validation beyond the name.. like looking for a x509 attribute (and > cross signature) indicating some kind of better-business like endorsement > of privacy practices. > The draft discusses a privacy certificate extension that helps the endpoint identify the privacy preserving data policy of the DNS server. The extension contains a URL that points to the privacy preserving data policy. > So I think validation in the scope of associated-resolver is a desirable > property even though the usually validated thing, the name, is a little > less valuable here. > The name is a reference identifier for validating the local DoH server certificate. Cheers, -Tiru > > > --0000000000001544b60584fd096a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, 26 Mar 2019 at 1= 1:25, Patrick McManus <mcmanus@d= ucksong.com> wrote:

On Tue, Mar 26, 2019 at 9:48 AM tirumal reddy <kondtir@gmail.com> wrote:

Agreed,= and with our proposal in https://tools.ietf.org/= html/draft-reddy-dprive-bootstrap-dns-server-02, the query for=C2=A0URI templates=C2=A0can use FQDN instead of=C2=A0
IP address, and the HTTPS server c= ertificate can be validated by the DoH client.


right. The weakness here is that= validating a name that probably comes from an unauthenticated source is no= t a very strong signal.

= No, the name is coming from a authenticated source. The explicit trust stor= e to validate the local DoH server certificate can also be used to validate= the S-NAPTR lookup=C2=A0
response is authentic using DNSSEC.=C2= =A0
=C2=A0
That seems inherent in th= e draft, but maybe worth calling out more explicitly.

<= div>otoh - and out of scope for this draft - the DoH client could do some k= ind of validation beyond the name.. like looking for a x509 attribute (and = cross signature) indicating some kind of better-business like endorsement o= f privacy practices.

The = draft discusses a privacy certificate extension that helps the endpoint
identify the privacy preserving data policy of the DNS
ser= ver. The extension contains a URL that points to the privacy
pres= erving data policy.

=C2=A0
So I think validation in the scope of associated-resolver is a desir= able property even though the usually validated thing, the name, is a littl= e less valuable here.

The= name is a reference identifier for validating the local DoH server certifi= cate.

Cheers,
-Tiru
=C2=A0

=C2=A0
--0000000000001544b60584fd096a-- From nobody Tue Mar 26 04:03:02 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB93D1202C9 for ; Tue, 26 Mar 2019 04:02:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=SObeb1lz; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=X3ukAotW Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xZXRVXJy8E60 for ; Tue, 26 Mar 2019 04:02:56 -0700 (PDT) Received: from outbound1h.ore.mailhop.org (outbound1h.ore.mailhop.org [54.149.35.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C867F1202BD for ; Tue, 26 Mar 2019 04:02:56 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553598176; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=Oh99W47QQjeuoYGm9d3U+OzK9KjJFaZ6vJYy11B/WWdZifSePkzQuE62+MpURkDOMb7f2JnPzdfJ9 ENjUb5Eaun2FLbuzJ3p75a5GEzAEaOyKCypw5kgNHdAAvQop+Pjp4ZnIZ+5ajYJGbtd2astWkXF7wD X3zr79CJWM71v6TyBUa4xj6HXnky3Nh+FzG2KomGdC6P7WhPwNFUhmdFOw1iAXJbNM+25fwmeQTlqG CFG/lJw3e5PPAeksyYbgHUfIot4ZY2wyq5GHu0yPgZSwRkG1If89/yZF7P2kyXCEpG/OJ4jn08hixu 042Yn1juzhX8xHy73nruo+0rm6wZdEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=4b3Wav9ETunCHoWzkAIiii3ndyrSsqWwLhtWo8iMwNs=; b=D1peKBa0InU7yGiILe9x3XGtzRV4NTaA8d3j+R4SoL2218G1mrpFPbh4lunaf3q+T2fSbwrHPIfwp xnQ5EkaskQ4oh0CQco1KWE5s4lDdwFPWjWXuah4xrP8bFxOgj/FKTOlkwkxaKIzlHAzmlidfTqotd5 hLtvqllJDqUAiQJPvPLif9xjfkUXd1yeVFrnWf7klI23YqYONbi6HonCreMiJenHKCPcNnbBhojb26 zdEUXWHmvoqzRumpUzDx5OhS7jGHx+ZCdzhhyRRKpLvX7Cd9DQlLopWIDcoV4OyH7bwgmxsN0Zy84d sJ9RYUtKA/yRd0kPcqVIKIjAkTKRhnQ== ARC-Authentication-Results: i=1; outbound3.ore.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.210.45; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=4b3Wav9ETunCHoWzkAIiii3ndyrSsqWwLhtWo8iMwNs=; b=SObeb1lzb10JErNpoTX4vC1RDV968b2CDgP/7Mdd1FDpI5M3pgfyGMqkBWgh/Axb9VLzVmMiWJqWq /+eO4TYcJYCXWH6Fj8c1UkATrE+t3D889vQ8F+eiI0shzQB9GhAolmDY8cuuICjMeN1qTukQBrEmD3 pJTBZU8Bt0LcgSfg= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-low; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=4b3Wav9ETunCHoWzkAIiii3ndyrSsqWwLhtWo8iMwNs=; b=X3ukAotWWiZ4EEQPDoxVvWWwBF1QOnfkAUNRw0LBVVCRlwrCbCEqnxo2vuY23hPa37jvtgwzqtpGg IloZFcE1yJ0BO6JvrAb9cAV7mj43TZuGgctTSJe4mXlN36+y3opo0AghNji+IHupvLIAarqTLlj+hc cJvByjm1h0mMiXr8immcTXjgfBAubCk09mZ+qrd4CtraaMFXGExxGMzXohJdVSZxc7r8XikcTphE7J k8lOxZYR0VT4n9n4bN5YjW3rc8aP7wljVzCnypMyZbVZa/7wR33K9Ef7B5yhPxow56Oex5cG88QyDe ydHL4jmRvotAF86zK1RKKkDLbNXpmMg== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: b452bd91-4fb6-11e9-9bb1-1f29e4676f89 X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.210.45 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-ot1-f45.google.com (unknown [209.85.210.45]) by outbound3.ore.mailhop.org (Halon) with ESMTPSA id b452bd91-4fb6-11e9-9bb1-1f29e4676f89; Tue, 26 Mar 2019 11:02:54 +0000 (UTC) Received: by mail-ot1-f45.google.com with SMTP id u15so11000808otq.10 for ; Tue, 26 Mar 2019 04:02:54 -0700 (PDT) X-Gm-Message-State: APjAAAXItI0flXe6PKiAmkY6MWIF8qeusfD86QpKSs+QhVaFKJxKEMbc eaT549REQ5IgGIw7ZRxp9ox5JYVVzjmL0rO9CBo= X-Google-Smtp-Source: APXvYqyOHj5CujcS17Vz76wwbyivroXwqZQFQUyCPXPsU/97hIJHkg+Td3kpXS2SO0NfXwEhLEL+reAvy5MeZwCGosk= X-Received: by 2002:a9d:de4:: with SMTP id 91mr20012263ots.5.1553598173787; Tue, 26 Mar 2019 04:02:53 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> In-Reply-To: From: Patrick McManus Date: Tue, 26 Mar 2019 12:02:42 +0100 X-Gmail-Original-Message-ID: Message-ID: To: tirumal reddy Cc: Patrick McManus , nusenu , DoH WG Content-Type: multipart/alternative; boundary="00000000000045bef80584fd43b5" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 11:03:00 -0000 --00000000000045bef80584fd43b5 Content-Type: text/plain; charset="UTF-8" I'm sorry - I quoted your draft name when I was referring to Paul's. On Tue, Mar 26, 2019 at 11:46 AM tirumal reddy wrote: > On Tue, 26 Mar 2019 at 11:25, Patrick McManus > wrote: > >> >> >> On Tue, Mar 26, 2019 at 9:48 AM tirumal reddy wrote: >> >>> >>> Agreed, and with our proposal in >>> https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02, >>> the query for URI templates can use FQDN instead of >>> IP address, and the HTTPS server certificate can be validated by the DoH >>> client. >>> >>> >> right. The weakness here is that validating a name that probably comes >> from an unauthenticated source is not a very strong signal. >> > > No, the name is coming from a authenticated source. The explicit trust > store to validate the local DoH server certificate can also be used to > validate the S-NAPTR lookup > response is authentic using DNSSEC. > > >> That seems inherent in the draft, but maybe worth calling out more >> explicitly. >> >> otoh - and out of scope for this draft - the DoH client could do some >> kind of validation beyond the name.. like looking for a x509 attribute (and >> cross signature) indicating some kind of better-business like endorsement >> of privacy practices. >> > > The draft discusses a privacy certificate extension that helps the endpoint > identify the privacy preserving data policy of the DNS > server. The extension contains a URL that points to the privacy > preserving data policy. > > > >> So I think validation in the scope of associated-resolver is a desirable >> property even though the usually validated thing, the name, is a little >> less valuable here. >> > > The name is a reference identifier for validating the local DoH server > certificate. > > Cheers, > -Tiru > > >> >> >> > --00000000000045bef80584fd43b5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'm sorry - I quoted your draft name when I was referr= ing to Paul's.

On Tue, Mar 26, 2019 at 11:46 AM tirumal reddy <kondtir@gmail.com> wrote:
On Tue, 26 Mar 2019 at 11:25, Patrick McManus <= ;mcmanus@ducksong= .com> wrote:


On T= ue, Mar 26, 2019 at 9:48 AM tirumal reddy <kondtir@gmail.com> wrote:

Agreed, and wi= th our proposal in https://tools.ietf.org/html/dr= aft-reddy-dprive-bootstrap-dns-server-02, the query for=C2=A0URI templates=C2=A0can us= e FQDN instead of=C2=A0
IP address, and the HTTPS server certific= ate can be validated by the DoH client.


right. The weakness here is that valida= ting a name that probably comes from an unauthenticated source is not a ver= y strong signal.

No, the= name is coming from a authenticated source. The explicit trust store to va= lidate the local DoH server certificate can also be used to validate the S-= NAPTR lookup=C2=A0
response is authentic using DNSSEC.=C2=A0
=C2=A0
That seems inherent in the draft,= but maybe worth calling out more explicitly.

otoh= - and out of scope for this draft - the DoH client could do some kind of v= alidation beyond the name.. like looking for a x509 attribute (and cross si= gnature) indicating some kind of better-business like endorsement of privac= y practices.

The draft di= scusses a privacy certificate extension that helps the endpoint
i= dentify the privacy preserving data policy of the DNS
server. The= extension contains a URL that points to the privacy
preserving d= ata policy.

=C2=A0
So= I think validation in the scope of associated-resolver is a desirable prop= erty even though the usually validated thing, the name, is a little less va= luable here.

The name is = a reference identifier for validating the local DoH server certificate.

Cheers,
-Tiru
=C2=A0

=C2=A0
--00000000000045bef80584fd43b5-- From nobody Tue Mar 26 04:11:10 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 421C41202F0 for ; Tue, 26 Mar 2019 04:11:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rnZoif9I0w3L for ; Tue, 26 Mar 2019 04:10:58 -0700 (PDT) Received: from mail-it1-x132.google.com (mail-it1-x132.google.com [IPv6:2607:f8b0:4864:20::132]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 911561202F8 for ; Tue, 26 Mar 2019 04:10:57 -0700 (PDT) Received: by mail-it1-x132.google.com with SMTP id w18so18831346itj.4 for ; Tue, 26 Mar 2019 04:10:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=w1DDhQIObyBulQVQX0GcVoizhaar0yzuo6pU0lgYccI=; b=cKgGbdE/9Ec3p3yd/YgIA5QcVxsHuWYlJW3CfLxPrnnaNfakO1gGF/OqsJhpHBmMVU ZntW1ugO57fmKqSqTNBUyMobH/IKfqnksMNiWXuTMEW6l9gdcxABz50QiM5vqxqcZRbu ctzgW+rtkxqn1S/JHJxyUqboq58ZzeIrU5lPb1SRVW2+/QQNODHP0/wDGdqHq54uKABT 8VacX75eNTtaUONf8140hB7L+pDGRw9yash73B699mZM83oOwjJTn/c6HCbsJm7imTOQ hdHdvCFfrfz3oGiPR19QQhtPC/gqMHSz4/tIbI90RfjGKOb4FN/QTARFqLLg6neJnMal TzbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=w1DDhQIObyBulQVQX0GcVoizhaar0yzuo6pU0lgYccI=; b=EKqhP9Qxd5C1B5GwEs84ZoF+pZNX+D0mU2Bf3PpVpu4SqDejrkYp232sdYeRyvYX6K tWYk8JxkXXbl94NUxP80lvSlB/AKjGPtHtbgJmMzgnswoURL4M14Y1iZ2V1qZOB2C/Sl JQPhOI/+3mmiHhNEuS+L5mMHa5VJYjlXJZjtDyICU3kFQe0d3kYdbUr+GB+fPjslv1Lr 78VsgjoVbgISZcXJ7AtoWu/yzk5N4RTsZKa6zNAObwFK0HqrfkZuGqi029y5pBk/etsP yH49dQImotE1qfphModnlVAFUrd8P6Cjh+a3jyKxnjPatLQQNMNHd7OE7gN3iLpKaBdc 5AEw== X-Gm-Message-State: APjAAAUHYY3t71LhpFi7FOGodYlNRwolDvdAdiHNIsMtWS4P8kTsldpZ w0bYJkjmj4gtyJaT42pC1/oWkIenvIaUjbQkPtw= X-Google-Smtp-Source: APXvYqw7SpoGMQeP8BpIrDMxR/iqeEKcHz3cmh2wVGImGgWy8DZrSrQNT/DeCkn+Nyi6uxkIMMmLYeHziZQ/TtKFVxQ= X-Received: by 2002:a24:6a8b:: with SMTP id l133mr8375924itc.92.1553598656822; Tue, 26 Mar 2019 04:10:56 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> In-Reply-To: From: tirumal reddy Date: Tue, 26 Mar 2019 12:10:46 +0100 Message-ID: To: Patrick McManus Cc: nusenu , DoH WG Content-Type: multipart/alternative; boundary="00000000000010409a0584fd6067" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 11:11:09 -0000 --00000000000010409a0584fd6067 Content-Type: text/plain; charset="UTF-8" No worries. My point is client must be configured with a explicit trust store to validate the local DoH server certificate. The network domain name can be retrieved from the explicit trust store itself. -Tiru On Tue, 26 Mar 2019 at 12:02, Patrick McManus wrote: > I'm sorry - I quoted your draft name when I was referring to Paul's. > > On Tue, Mar 26, 2019 at 11:46 AM tirumal reddy wrote: > >> On Tue, 26 Mar 2019 at 11:25, Patrick McManus >> wrote: >> >>> >>> >>> On Tue, Mar 26, 2019 at 9:48 AM tirumal reddy wrote: >>> >>>> >>>> Agreed, and with our proposal in >>>> https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02, >>>> the query for URI templates can use FQDN instead of >>>> IP address, and the HTTPS server certificate can be validated by the >>>> DoH client. >>>> >>>> >>> right. The weakness here is that validating a name that probably comes >>> from an unauthenticated source is not a very strong signal. >>> >> >> No, the name is coming from a authenticated source. The explicit trust >> store to validate the local DoH server certificate can also be used to >> validate the S-NAPTR lookup >> response is authentic using DNSSEC. >> >> >>> That seems inherent in the draft, but maybe worth calling out more >>> explicitly. >>> >>> otoh - and out of scope for this draft - the DoH client could do some >>> kind of validation beyond the name.. like looking for a x509 attribute (and >>> cross signature) indicating some kind of better-business like endorsement >>> of privacy practices. >>> >> >> The draft discusses a privacy certificate extension that helps the >> endpoint >> identify the privacy preserving data policy of the DNS >> server. The extension contains a URL that points to the privacy >> preserving data policy. >> >> >> >>> So I think validation in the scope of associated-resolver is a desirable >>> property even though the usually validated thing, the name, is a little >>> less valuable here. >>> >> >> The name is a reference identifier for validating the local DoH server >> certificate. >> >> Cheers, >> -Tiru >> >> >>> >>> >>> >> --00000000000010409a0584fd6067 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
No worries. My point is client must be configured with a e= xplicit trust store to validate the local DoH server certificate.=C2=A0The network domain name can be retrieved from the explicit trust store its= elf.=C2=A0=C2=A0

-Tiru

On Tue, 26 Mar 201= 9 at 12:02, Patrick McManus <mcm= anus@ducksong.com> wrote:
I'm sorry - I quoted your draft name = when I was referring to Paul's.

On Tue, Mar 26, 2019 at 11:46 AM tirumal= reddy <kondtir@g= mail.com> wrote:
On Tue, 26 Mar 2= 019 at 11:25, Patrick McManus <mcmanus@ducksong.com> wrote:


On Tue, Mar 26, 2019 at 9:48 AM tirumal reddy &l= t;kondtir@gmail.com<= /a>> wrote:
<= div dir=3D"ltr">

Agreed, and with our proposal in https://tools.ietf.org/html/draft-reddy-dprive-bootstrap-dns-server-02= , the query for=C2=A0U= RI templates=C2=A0can use FQDN instead of=C2=A0
IP address= , and the HTTPS server certificate can be validated by the DoH client.


right. T= he weakness here is that validating a name that probably comes from an unau= thenticated source is not a very strong signal.

No, the name is coming from a authenticated source.= The explicit trust store to validate the local DoH server certificate can = also be used to validate the S-NAPTR lookup=C2=A0
response is aut= hentic using DNSSEC.=C2=A0
=C2=A0
Th= at seems inherent in the draft, but maybe worth calling out more explicitly= .

otoh - and out of scope for this draft - the DoH= client could do some kind of validation beyond the name.. like looking for= a x509 attribute (and cross signature) indicating some kind of better-busi= ness like endorsement of privacy practices.
<= div>
The draft discusses a privacy certificate extension that= helps the endpoint
identify the privacy preserving data policy o= f the DNS
server. The extension contains a URL that points to the= privacy
preserving data policy.

=C2=A0<= /div>
So I think validation in the scope of associat= ed-resolver is a desirable property even though the usually validated thing= , the name, is a little less valuable here.
<= div>
The name is a reference identifier for validating the lo= cal DoH server certificate.

Cheers,
-Tir= u
=C2=A0
<= div dir=3D"ltr">

=C2=A0
=
--00000000000010409a0584fd6067-- From nobody Tue Mar 26 04:15:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 732741202D1 for ; Tue, 26 Mar 2019 04:15:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.902 X-Spam-Level: X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=algebras-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WUgUfzDAasHS for ; Tue, 26 Mar 2019 04:15:54 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2E02F1202D0 for ; Tue, 26 Mar 2019 04:15:54 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id x7so10408713ioh.4 for ; Tue, 26 Mar 2019 04:15:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=algebras-org.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=QljjC6yPm2DQXYiVOzglOdXflxIZeYWRdNw+Y44uJGY=; b=HYOV1AqtuHbHxB2E4W328Lxc9jEKtYX9h61yxYPW8xj73gbaUj/qAizmBMQZMC1an5 jkRXjVQBxiioovENxieCpU6/NgWX0iOfOtbD83Qyb7oEyFtERLgYFd5hPrWsjWnTN6Jx 02YARttOzZCBlF6DCZTMEME4+vhJ3xYAy4ScMBZirZWqTDH0P0XWpwey1tFpt77j8tpL Zmb7d+gS6GgGGrlf170Pag9aALUfqhOdc66yoEH+/GKy9CQGEtcZoNI9d9tfSfEkf/9/ 6EqqfFa4w28SGdAv4fq5m+cb3FJINgM8ieFAi2nj02e3Max0WWNqXiiYQ3s9u5wqC9mL XtDA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=QljjC6yPm2DQXYiVOzglOdXflxIZeYWRdNw+Y44uJGY=; b=oThVY9quKg4nfoAM7ELrJrIQb+fRnpKugw5h9IYdusDRx4O2aFniM8S6B92LQiAWxX 71IF4KeN8KN2jSsYxRHvZT4nxTwuWcEMrCZdaIOjUB7ZhvhXwHYi7trUevnKIN04I65O Gb7G1dIhuSxXjvfz2/G1UlYqi3sb6gPmqm+9cYNUsUfSMUSbX3gqPplkpFuBHlca8FRp WEyg1lt9yZuk3kYm24rSsFrBPl+uBc8qQvSuYOc7Z7zz2JKTIzED16tgURV6nXUEwBQZ /bx6LbTy9JqLWQRqEy7rucfC4zmXqUblTkzqIUVGk03J3WVNdFbqiV5KY4dMopqDI1KV YN/g== X-Gm-Message-State: APjAAAUgSvg05NnebMmZwMJ76OAxOVlxD3qWOb3uR/+UwJv3VGsIGj2d wV+Gah4ELUy3gU6B/Vb42fwtsJe+sNWNW7D7iLJ6YIAvWYA= X-Google-Smtp-Source: APXvYqzFiZg1NRw+Ru0CaeNOKO8Hityu88V4Ijk75GjKEjcDC/GpKgzrUOEciNiER2dlmDwVz4GPf0SwzlDWTfgXliQ= X-Received: by 2002:a5d:899a:: with SMTP id m26mr22090605iol.268.1553598953128; Tue, 26 Mar 2019 04:15:53 -0700 (PDT) MIME-Version: 1.0 From: George Michaelson Date: Tue, 26 Mar 2019 12:15:36 +0100 Message-ID: To: DoH WG Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: [Doh] ..I don't get it (the hate) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 11:15:58 -0000 I have (fictionally) invented two new technologies. Lets call them "VPN" and "IP in IP" at this point, every ISP in the IETF microphone queue wants to stand up and say this has severe operational issues for them in running a carriage service and "stop this nonsense" the "DOH will cause me operational problems" thing, I simply don't understand. * I can write web pages with embedded IP addresses any time. I can remove the DNS from my web calls * Nobody really knows what is flowing over the end-to-end any more, given QUIC and like protocols. This standard is a mechanism to define how to embed state in HTTP, which means DNS traffic doesn't happen. But, DNS does or doesn't happen *come what may* -we are arguing about a *standard* way to specify how "not to do DNS" visibly. I am not saying I'm in love with DOH (I ask myself what cache poisoning risks there are in held state in the browser, and how far outside a sandbox fetched data can extend) but, the .. "it is evil and must die" side, I just don't understand. The "DOH breaks privacy" and "centralization must be confronted" questions, thats different. But, I am trying to think like a customer, sending packets, and what I feel about the packets, and who gets to say what is in them and what they are for. This is (surely) between me, the browser vendor, and the website? Why does the ISP have any say in this? Not standardising this, is not going to stop people thinking about ways to construct web site state which pass information in JSON form, which informs which getURL() calls are made, and which demand gethostbyname() and which do not invoe gethostbyname() From nobody Tue Mar 26 04:18:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B6481202C6 for ; Tue, 26 Mar 2019 04:18:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rferNb99baoV for ; Tue, 26 Mar 2019 04:18:01 -0700 (PDT) Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DB3571202A4 for ; Tue, 26 Mar 2019 04:18:00 -0700 (PDT) Received: by mail-wm1-x32b.google.com with SMTP id 4so12169405wmf.1 for ; Tue, 26 Mar 2019 04:18:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:subject:message-id:date:to; bh=fs+KVq4bVajZwr66mzFDduMsdJ5JtomLGiyIky6WNNM=; b=cw2PScTXnMcSRIrQfsL3vf5VX82nRkM1A4gCFOTpFXrmzAIgJzVHdW38VSKcoOhdRF xO3Cro15Zzi+jBepxv/DXLmbRRngYpI4M9bfYZAUWSuWYfFK5yldSBtnnSTE5BUt8BQO X6w06eQzcsCf4M7xjP0j+HHMV+kVJDSTrmDYA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:message-id:date:to; bh=fs+KVq4bVajZwr66mzFDduMsdJ5JtomLGiyIky6WNNM=; b=YbhgNbZgWxDboGR/PHubaGuDOT+OUIhOOIfjkH1sRTVGXwDQac01h4oY+4OKZRL7y4 dzQCtfao+6+rilRaGR1ddxzOIcuL9v3MHEw2mKhnxa0rNvuFS7sp6+91pY/N2bIgFyFr 9H1xrUQYDnOa1+dQ7+rbkI/jhegeNXoOGBKmOX8We1AGeDX14MRB64BxQ0cOTLO/uDT/ d4Eg8FDrAbmw8J+Hm4A22f8VEU7C71ZQd1gmuuaL7LrvA1OmPoR6M9R+Nt3aNB/UWMdK F3qJM4ZtpTAMYebdG9gYKJw8gGiC3q/5lGlNrDH4CiuhI+l/ZL8jED/xv4yR4oZ26Kbb setQ== X-Gm-Message-State: APjAAAVfnak2mZXyciI/+TFmsINkIvnREdz5rM135YFhPuAPBDtrA6ff TOik7CkFP3Z8r5amcP7B+e1bU0D9eHxFcQ== X-Google-Smtp-Source: APXvYqy1at9Gy7vHM77Dr7UE6h/kSrt2uo9jxWZf2a1OEbKnzmddlTScplti0LexKPMoA37N94ht4A== X-Received: by 2002:a1c:7901:: with SMTP id l1mr2516801wme.144.1553599078820; Tue, 26 Mar 2019 04:17:58 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:41ad:44eb:a301:b245? ([2001:67c:1232:144:41ad:44eb:a301:b245]) by smtp.gmail.com with ESMTPSA id y3sm18880990wrh.18.2019.03.26.04.17.57 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Mar 2019 04:17:57 -0700 (PDT) From: Joe Abley Content-Type: multipart/signed; boundary="Apple-Mail=_FC50C2CA-801C-4167-A1AA-8C1A08E53FF5"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Message-Id: Date: Tue, 26 Mar 2019 12:17:56 +0100 To: DoH WG X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: [Doh] on blackholing resolver-associated-doh.arpa and resolver-associated-doh.arpa X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 11:18:04 -0000 --Apple-Mail=_FC50C2CA-801C-4167-A1AA-8C1A08E53FF5 Content-Type: multipart/alternative; boundary="Apple-Mail=_5E7D516A-FDEC-4480-898B-BB97A5AA3CB9" --Apple-Mail=_5E7D516A-FDEC-4480-898B-BB97A5AA3CB9 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi all, There was a suggestion at the microphone this morning in the Grand = Ballroom that the resolver-associated-doh.arpa and = resolver-associated-doh.arpa domains be "blackholed". The draft = currently specifies that these MUST NOT be delegated from ARPA. The microphone queue was already cut off before I could ask more about = what this means, but I think it's worth reminding the wg what blackhole = generally means in this context of DNS names in and near ARPA, and how = it can be implemented, since I think there is a security concern. RFC 7534 provides two mechanisms to blackhole DNS traffic: one uses = DNAME (see RFC 7535) and the other uses a zone cut. The DNAME approach = is technically compatible with the MUST NOT in the draft (since it's = technically not a delegation but rather a redirection) but the direct = delegation mechanism is not. In both cases, however, blackholing these domains would point their DNS = resolution away from the authoritative servers that serve ARPA towards a = loosely-coordinated set of AS112 servers. Anybody can operate an AS112 server; in fact, operators have in the past = been actively encouraged to operate AS112 servers without any = requirement for coordination. This has been considered a reasonable = approach so long as the query data being sent to AS112 servers is = recognised to be junk that only leaks by accident; since it's generally = private network PTR query traffic the potential for exploitation by bad = actors (malicious AS112 node operators) is arguably low. However, in the case of these doh resolver domains, there is the = potential for a bad actor to respond with an unauthorised list of DoH = URIs and steal the resolver traffic of a large array of end-users whose = local (or configured) resolvers don't implement the mechanisms described = in this draft. This would be a bit like DNS changer, but without the = need to infect individual end-hosts.. I think this a problem. I think (in contrast to the thought at the microphone) if we mention = blackholing at all it ought to be of the form "don't ever do this = because it would be bad for the following reasons". Joe --Apple-Mail=_5E7D516A-FDEC-4480-898B-BB97A5AA3CB9 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi = all,

There was a = suggestion at the microphone this morning in the Grand Ballroom that = the resolver-associated-doh.arpa and resolver-associated-doh.arpa = domains be "blackholed". The draft currently specifies that these MUST = NOT be delegated from ARPA.

The microphone queue was already cut off before I could ask = more about what this means, but I think it's worth reminding the wg what = blackhole generally means in this context of DNS names in and near ARPA, = and how it can be implemented, since I think there is a security = concern.

RFC 7534 provides two mechanisms to blackhole DNS traffic: one = uses DNAME (see RFC 7535) and the other uses a zone cut. The DNAME = approach is technically compatible with the MUST NOT in the draft (since = it's technically not a delegation but rather a redirection) but the = direct delegation mechanism is not.

In = both cases, however, blackholing these domains would point their DNS = resolution away from the authoritative servers that serve ARPA towards a = loosely-coordinated set of AS112 servers.

Anybody can operate an AS112 = server; in fact, operators have in the past been actively encouraged to = operate AS112 servers without any requirement for coordination. This has = been considered a reasonable approach so long as the query data being = sent to AS112 servers is recognised to be junk that only leaks by = accident; since it's generally private network PTR query traffic the = potential for exploitation by bad actors (malicious AS112 node = operators) is arguably low.

However, in the case of these doh resolver domains, there is = the potential for a bad actor to respond with an unauthorised list of = DoH URIs and steal the resolver traffic of a large array of end-users = whose local (or configured) resolvers don't implement the mechanisms = described in this draft. This would be a bit like DNS changer, but = without the need to infect individual end-hosts..

I think this a = problem.

I = think (in contrast to the thought at the microphone) if we mention = blackholing at all it ought to be of the form "don't ever do this = because it would be bad for the following reasons".


Joe
= --Apple-Mail=_5E7D516A-FDEC-4480-898B-BB97A5AA3CB9-- --Apple-Mail=_FC50C2CA-801C-4167-A1AA-8C1A08E53FF5 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXJoKZAAKCRA0jwy9hlI6 LLszAJ9RaUFb6lOti06RQE1noSEgoTcBpgCggcvLhaiORhY1UYCLTRnanG1sOr0= =U4xz -----END PGP SIGNATURE----- --Apple-Mail=_FC50C2CA-801C-4167-A1AA-8C1A08E53FF5-- From nobody Tue Mar 26 04:21:29 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 252771202B0; Tue, 26 Mar 2019 03:31:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YIrWd5dKVYRy; Tue, 26 Mar 2019 03:31:38 -0700 (PDT) Received: from mail-it1-x12e.google.com (mail-it1-x12e.google.com [IPv6:2607:f8b0:4864:20::12e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 389671202A3; Tue, 26 Mar 2019 03:31:38 -0700 (PDT) Received: by mail-it1-x12e.google.com with SMTP id 139so19080927ita.4; Tue, 26 Mar 2019 03:31:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=65lJfSc67Tm9PICWC1/dJ7vh9qthpPtTwViYNsoNdqU=; b=ihm//q6uv58TtS7ER+vIJqHs+tDqWs9NVA5z7IqoIhRY+u1xcab0tD+Erdy/s1RBmS e4vsU3tGKix9B+zs6vX8lmazB9kj7vyYpGpXVJ9nftqGExoMb+60BhJLKc/kf+7SjUts bkLWxyzwSM8jr8b8kfUo1FVBwt+T+R2rPhGDBgLRrUJrAgp/pvaiVVutdgOXnY1KjYq1 8jKicA5B47oBiWwYMz2/diiMe01yYPlLp10b4eaqYZkYLZ7FFw7nSvZuRcOtKedyJWzV Yy43ekGTrfIEvbk2UuyGItRfCpRte3c38s9rpa5Al25UaMzLPGhIpRBEnTOPOTjsEVm7 hqLg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=65lJfSc67Tm9PICWC1/dJ7vh9qthpPtTwViYNsoNdqU=; b=nS4DmwwLHmPuNiR96kc1peFrZ1KGfOSaDG1fAiYug6qb9ziq8lFXgg7ZzlfzbIffbo tOc9jRWQoDndqYDFkNAAvs+JBxJiyNRidxbVYRjWZAJlx4yx9MLtzyfSOK7ZOVD10ukX Jqc/bWxH46rVa17mb1PvmEhnIc3it0kSZ8dzym1QQK1n13nLX6OnigIU4VJJ7/Gu4UQl YDCkzwZHfecJ9MPjqyURe+0N1/ZyaftuMERQL1eB4Dbt7xy5ZkEzjW6QUAKuwgz/cPgb kpvMcoc096nhITMo5RCjO3R2iIjZAMc4lG8tzOsMjLgp+3Ek77A12JDp8HetCQb0tagk EJ0Q== X-Gm-Message-State: APjAAAVLs6nHYe9pL57Q5V57D2T9cK2kFcrWowdxlPHQWpX9PfGl6HOt t5PXrrOz7If7p4mUQunhhh7LP1aYXmpd2OEgc2E= X-Google-Smtp-Source: APXvYqyyRt5Lo19Dl95vuKkLfQu9BLjPMRY+4twyswAPEW9C+SHfPmpm2OjGM6kf59RljHmYDY7Fy3K2LQgTqXhP2jg= X-Received: by 2002:a24:6a8b:: with SMTP id l133mr8256599itc.92.1553596297530; Tue, 26 Mar 2019 03:31:37 -0700 (PDT) MIME-Version: 1.0 References: <04C556AF-D3B3-41A5-B119-8FE5F81FB9A7@huitema.net> <1878722055.8877.1553241201213@appsuite.open-xchange.com> <20190322.101434.307385973.sthaug@nethelp.no> <32A78B0C-52B6-46E5-A46F-D63D21DEC52C@sky.uk> <1C720263-10E4-423B-B152-5673E115A4C1@gmail.com> <17294888-dacc-d163-91a4-cdf2aee04321@redbarn.org> In-Reply-To: <17294888-dacc-d163-91a4-cdf2aee04321@redbarn.org> From: tirumal reddy Date: Tue, 26 Mar 2019 11:31:26 +0100 Message-ID: To: Paul Vixie Cc: Ian Swett , Eric Rescorla , "doh@ietf.org" , Brian Dickson , "wjhns1@hardakers.net" , Patrick McManus , "dnsop@ietf.org" , "Winfield, Alister" , "huitema@huitema.net" , "vittorio.bertola=40open-xchange.com@dmarc.ietf.org" Content-Type: multipart/alternative; boundary="0000000000007053a80584fcd3ab" Archived-At: X-Mailman-Approved-At: Tue, 26 Mar 2019 04:21:28 -0700 Subject: Re: [Doh] [DNSOP] [EXTERNAL] Re: New I-D: draft-reid-doh-operator X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 10:31:40 -0000 --0000000000007053a80584fcd3ab Content-Type: text/plain; charset="UTF-8" On Tue, 26 Mar 2019 at 10:48, Paul Vixie wrote: > > > Ian Swett wrote on 2019-03-25 01:28: > > One way DoH may be faster than DoT in the near future is that DoH can go > > over HTTP/3 via QUIC and avoid head of line blocking like Do53. > Do53/UDP has no HoL prolem. > > nor does Do853/TCP. > TCP suffers from network head-of-line blocking. -Tiru > > only Do53/TCP had an HoL problem, so, it was never widely used, and has > been replaced by Do853/TCP. > > -- > P Vixie > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000007053a80584fcd3ab Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable --0000000000007053a80584fcd3ab-- From nobody Tue Mar 26 04:27:07 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 02E161202D9 for ; Tue, 26 Mar 2019 04:27:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.5 X-Spam-Level: X-Spam-Status: No, score=-17.5 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7lX9AqaxY7kc for ; Tue, 26 Mar 2019 04:27:02 -0700 (PDT) Received: from mail-vs1-xe34.google.com (mail-vs1-xe34.google.com [IPv6:2607:f8b0:4864:20::e34]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B8C01202D2 for ; Tue, 26 Mar 2019 04:27:01 -0700 (PDT) Received: by mail-vs1-xe34.google.com with SMTP id w13so7391246vsc.4 for ; Tue, 26 Mar 2019 04:27:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=3gsMOwvyOez+NWEJEGs+uYi644t2WXqnc7EmlK9Z8jI=; b=KWMsBvETuCQwDPMCSz8lRYctjgCqmkB0vuWSadYqEfLiSyOWRCwqfJl8jxU7IWRkIo 3YcVlhTBSifweKbjGAJREJlKRw6JA5h5S6yz3azoodRmQj7t2p8Q7usvyTq3zKobtNmk exIddZdYPT+fe5aN8uFzOYAAJqrnzFYwn8g3kqUpRsQGGlXab47TGYWyd1GFlZyaRKEJ SvM9sabBlTofBnRb5KF93mIVBhKJZw0QSz0PuH20FRNdH5WSfXjYf2qtXf3uHo7/aW82 uiUVaGgSTWG/bUigAyOUTt5TBT/+Ct2gkGftPTmXx3Cku4wTyNUM+AfRgAZ+R634A3F+ bjag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=3gsMOwvyOez+NWEJEGs+uYi644t2WXqnc7EmlK9Z8jI=; b=OrASbIaqDQ66fxt73hhrfMqZjDvb3ocqVjfdk88L4deG8DVFLIolQYL4QpIZaILJ8L BGObj8Uxn8+MhBQuXB7AR/F2U36iCUo5MiSi49JwcR4SAPC4CUaKb1fKvn5KkOG+NzIQ Jd5jbUf2zbSSlYgywtrjnHwlKmdPqXCnaaYqTqqfixIagQ9Quo6y3dYLB0Up+zmAJAxV JSXkeOWpcscflLfNNbfoNWP9rnZu13kDzy1cn+sNpHymRErtwzscNXmkvT+lY29F3JJ+ pK6xCuh7dhMsnn1bAmg01rR2iNhree7hnVB/WanKaXqFT3SL3+gywIS1bQQdwKWEQOzQ FY7A== X-Gm-Message-State: APjAAAVVccfqwzS7aDVrVWb1YRpW+S7YBm6Ckk9xVp4/utim1OQL+BFL qKEzE+2ObnLVnbnb27a69RPmLQsvqRHctla+iJ18yg== X-Google-Smtp-Source: APXvYqzsxo6aQyTys8HYvJ418v+Oru0AK/WHMVsp/Ho5JV77pNdictVNFTI8+OjbIxD6ppYUavZ42whCnk2MFn0Gsto= X-Received: by 2002:a67:f790:: with SMTP id j16mr18099483vso.232.1553599620288; Tue, 26 Mar 2019 04:27:00 -0700 (PDT) MIME-Version: 1.0 References: <7D357986-AD33-4619-8037-8BCD59687AF0@gmail.com> In-Reply-To: <7D357986-AD33-4619-8037-8BCD59687AF0@gmail.com> From: Ben Schwartz Date: Tue, 26 Mar 2019 07:26:49 -0400 Message-ID: To: Fred Baker Cc: DoH WG Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="0000000000008585ab0584fd99cc" Archived-At: Subject: Re: [Doh] gethostbyname? X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 11:27:04 -0000 --0000000000008585ab0584fd99cc Content-Type: multipart/alternative; boundary="0000000000007e116c0584fd992b" --0000000000007e116c0584fd992b Content-Type: text/plain; charset="UTF-8" Please avoid casting aspersions on other working group participants, even in jest, as it might be misconstrued and cause offense. On Tue, Mar 26, 2019 at 5:35 AM Fred Baker wrote: > I have a silly question. In section 4, the draft goes to the API level to > specify how to resolve a domain name. gethostbyname was deprecated in favor > of getaddrinfo (and therefore IPv6 capability) in 1999 (RFC 2553), and is > now found in all common OS's including Linux, FreeBSD, Windows, MacOSX, and > so on. A reference to gethostbyname in this draft comes across as ignorant > at best, perhaps deliberately so. > > What do we need to do to drag the authors into the current century? > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000007e116c0584fd992b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Please avoid casting aspersions on other working group par= ticipants, even in jest, as it might be misconstrued and cause offense.
On T= ue, Mar 26, 2019 at 5:35 AM Fred Baker <fredbaker.ietf@gmail.com> wrote:
I have a silly question. In section 4, = the draft goes to the API level to specify how to resolve a domain name. ge= thostbyname was deprecated in favor of getaddrinfo (and therefore IPv6 capa= bility) in 1999 (RFC 2553), and is now found in all common OS's includi= ng Linux, FreeBSD, Windows, MacOSX, and so on. A reference to gethostbyname= in this draft comes across as ignorant at best, perhaps deliberately so.
What do we need to do to drag the authors into the current century?
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--0000000000007e116c0584fd992b-- --0000000000008585ab0584fd99cc Content-Type: application/pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIS5wYJKoZIhvcNAQcCoIIS2DCCEtQCAQExDzANBglghkgBZQMEAgEFADALBgkqhkiG9w0BBwGg ghBNMIIEXDCCA0SgAwIBAgIOSBtqDm4P/739RPqw/wcwDQYJKoZIhvcNAQELBQAwZDELMAkGA1UE BhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVy c29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hBMjU2IC0gRzIwHhcNMTYwNjE1MDAwMDAwWhcNMjEw NjE1MDAwMDAwWjBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEiMCAG A1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCC AQoCggEBALR23lKtjlZW/17kthzYcMHHKFgywfc4vLIjfq42NmMWbXkNUabIgS8KX4PnIFsTlD6F GO2fqnsTygvYPFBSMX4OCFtJXoikP2CQlEvO7WooyE94tqmqD+w0YtyP2IB5j4KvOIeNv1Gbnnes BIUWLFxs1ERvYDhmk+OrvW7Vd8ZfpRJj71Rb+QQsUpkyTySaqALXnyztTDp1L5d1bABJN/bJbEU3 Hf5FLrANmognIu+Npty6GrA6p3yKELzTsilOFmYNWg7L838NS2JbFOndl+ce89gM36CW7vyhszi6 6LqqzJL8MsmkP53GGhf11YMP9EkmawYouMDP/PwQYhIiUO0CAwEAAaOCASIwggEeMA4GA1UdDwEB /wQEAwIBBjAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwQwEgYDVR0TAQH/BAgwBgEB/wIB ADAdBgNVHQ4EFgQUyzgSsMeZwHiSjLMhleb0JmLA4D8wHwYDVR0jBBgwFoAUJiSSix/TRK+xsBtt r+500ox4AAMwSwYDVR0fBEQwQjBAoD6gPIY6aHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9ncy9n c3BlcnNvbmFsc2lnbnB0bnJzc2hhMmcyLmNybDBMBgNVHSAERTBDMEEGCSsGAQQBoDIBKDA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzANBgkqhkiG 9w0BAQsFAAOCAQEACskdySGYIOi63wgeTmljjA5BHHN9uLuAMHotXgbYeGVrz7+DkFNgWRQ/dNse Qa4e+FeHWq2fu73SamhAQyLigNKZF7ZzHPUkSpSTjQqVzbyDaFHtRBAwuACuymaOWOWPePZXOH9x t4HPwRQuur57RKiEm1F6/YJVQ5UTkzAyPoeND/y1GzXS4kjhVuoOQX3GfXDZdwoN8jMYBZTO0H5h isymlIl6aot0E5KIKqosW6mhupdkS1ZZPp4WXR4frybSkLejjmkTYCTUmh9DuvKEQ1Ge7siwsWgA NS1Ln+uvIuObpbNaeAyMZY0U5R/OyIDaq+m9KXPYvrCZ0TCLbcKuRzCCBB4wggMGoAMCAQICCwQA AAAAATGJxkCyMA0GCSqGSIb3DQEBCwUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAt IFIzMRMwEQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTExMDgwMjEw MDAwMFoXDTI5MDMyOTEwMDAwMFowZDELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24g bnYtc2ExOjA4BgNVBAMTMUdsb2JhbFNpZ24gUGVyc29uYWxTaWduIFBhcnRuZXJzIENBIC0gU0hB MjU2IC0gRzIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCg/hRKosYAGP+P7mIdq5NB Kr3J0tg+8lPATlgp+F6W9CeIvnXRGUvdniO+BQnKxnX6RsC3AnE0hUUKRaM9/RDDWldYw35K+sge C8fWXvIbcYLXxWkXz+Hbxh0GXG61Evqux6i2sKeKvMr4s9BaN09cqJ/wF6KuP9jSyWcyY+IgL6u2 52my5UzYhnbf7D7IcC372bfhwM92n6r5hJx3r++rQEMHXlp/G9J3fftgsD1bzS7J/uHMFpr4MXua eoiMLV5gdmo0sQg23j4pihyFlAkkHHn4usPJ3EePw7ewQT6BUTFyvmEB+KDoi7T4RCAZDstgfpzD rR/TNwrK8/FXoqnFAgMBAAGjgegwgeUwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8C AQEwHQYDVR0OBBYEFCYkkosf00SvsbAbba/udNKMeAADMEcGA1UdIARAMD4wPAYEVR0gADA0MDIG CCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzA2BgNVHR8E LzAtMCugKaAnhiVodHRwOi8vY3JsLmdsb2JhbHNpZ24ubmV0L3Jvb3QtcjMuY3JsMB8GA1UdIwQY MBaAFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQACAFVjHihZCV/IqJYt 7Nig/xek+9g0dmv1oQNGYI1WWeqHcMAV1h7cheKNr4EOANNvJWtAkoQz+076Sqnq0Puxwymj0/+e oQJ8GRODG9pxlSn3kysh7f+kotX7pYX5moUa0xq3TCjjYsF3G17E27qvn8SJwDsgEImnhXVT5vb7 qBYKadFizPzKPmwsJQDPKX58XmPxMcZ1tG77xCQEXrtABhYC3NBhu8+c5UoinLpBQC1iBnNpNwXT Lmd4nQdf9HCijG1e8myt78VP+QSwsaDT7LVcLT2oDPVggjhVcwljw3ePDwfGP9kNrR+lc8XrfClk WbrdhC2o4Ui28dtIVHd3MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAw TDEgMB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNpZ24x EzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4MTAwMDAwWjBMMSAw HgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSMzETMBEGA1UEChMKR2xvYmFsU2lnbjETMBEG A1UEAxMKR2xvYmFsU2lnbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMwldpB5Bngi FvXAg7aEyiie/QV2EcWtiHL8RgJDx7KKnQRfJMsuS+FggkbhUqsMgUdwbN1k0ev1LKMPgj0MK66X 17YUhhB5uzsTgHeMCOFJ0mpiLx9e+pZo34knlTifBtc+ycsmWQ1z3rDI6SYOgxXG71uL0gRgykmm KPZpO/bLyCiR5Z2KYVc3rHQU3HTgOu5yLy6c+9C7v/U9AOEGM+iCK65TpjoWc4zdQQ4gOsC0p6Hp sk+QLjJg6VfLuQSSaGjlOCZgdbKfd/+RFO+uIEn8rUAVSNECMWEZXriX7613t2Saer9fwRPvm2L7 DWzgVGkWqQPabumDk3F2xmmFghcCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF MAMBAf8wHQYDVR0OBBYEFI/wS3+oLkUkrk1Q+mOai97i3Ru8MA0GCSqGSIb3DQEBCwUAA4IBAQBL QNvAUKr+yAzv95ZURUm7lgAJQayzE4aGKAczymvmdLm6AC2upArT9fHxD4q/c2dKg8dEe3jgr25s bwMpjjM5RcOO5LlXbKr8EpbsU8Yt5CRsuZRj+9xTaGdWPoO4zzUhw8lo/s7awlOqzJCK6fBdRoyV 3XpYKBovHd7NADdBj+1EbddTKJd+82cEHhXXipa0095MJ6RMG3NzdvQXmcIfeg7jLQitChws/zyr VQ4PkX4268NXSb7hLi18YIvDQVETI53O9zJrlAGomecsMx86OyXShkDOOyyGeMlhLxS67ttVb9+E 7gUJTb0o2HLO02JQZR7rkpeDMdmztcpHWD9fMIIEZDCCA0ygAwIBAgIMB/CJK1MgpV83jiIZMA0G CSqGSIb3DQEBCwUAMEwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSIw IAYDVQQDExlHbG9iYWxTaWduIEhWIFMvTUlNRSBDQSAxMB4XDTE5MDMxMzA4MjIxOVoXDTE5MDkw OTA4MjIxOVowIjEgMB4GCSqGSIb3DQEJAQwRYmVtYXNjQGdvb2dsZS5jb20wggEiMA0GCSqGSIb3 DQEBAQUAA4IBDwAwggEKAoIBAQCsphkGEsCh0fF4+6Wsi1u40JxI6W6Izew+dLGK4b93LCRAuJ8y g9wSnwGAtk9/23VmtKwBrMaJD5j9SVZpscvLAjrWwADl/THU22uTW0MsUE2fPOPv2s4hE+vMgRmK P2E+xpI6n0gFvn8qrUHO1dm6PJaP5SWa+zdB/Ja1LgMJTpevQqjK4LKjWmHFPR6CplS4RImjGk7U 0I6invTyQnL5p583t5PI7FcM5UyjAqxGEETdAuc7N4IqjNETvPwL0wLIzxPDA5PMqcWPSzg7sBAB LVUQRYNIAJPlVpUdg1IeAjil5BaaWBjEeCLBSGDFX3WaWfMNzQvRZr4i6oJxzV+1AgMBAAGjggFu MIIBajAcBgNVHREEFTATgRFiZW1hc2NAZ29vZ2xlLmNvbTBQBggrBgEFBQcBAQREMEIwQAYIKwYB BQUHMAKGNGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzaHZzbWltZWNhMS5j cnQwHQYDVR0OBBYEFFSy8ovdLNSQc8aqxOgKS7sBOm/UMB8GA1UdIwQYMBaAFMs4ErDHmcB4koyz IZXm9CZiwOA/MEwGA1UdIARFMEMwQQYJKwYBBAGgMgEoMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8v d3d3Lmdsb2JhbHNpZ24uY29tL3JlcG9zaXRvcnkvMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9j cmwuZ2xvYmFsc2lnbi5jb20vZ3NodnNtaW1lY2ExLmNybDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0l BBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4IBAQCbQ++Znz6xh85ZlZEN Y/vAF0vn111O0c2houe4LlLQkoQ1QS4fH5EYcBx/393FTq5n08ezWYVtmeQ6W15e34CqjYNop1Vh mihZ+3J6+LL/6YNi91cp5yMFgxOP9aI/Y8IaIWZJAY2e8yHbYSq0z8kka0H6S4VvFjwtRogkWW95 0SStEwo/8viJ02BwpmVj4YIA6Fva1ZbeN2TnUMCAHJAlKWOGlpHxpcdcWckED0XbSY9w6bllMw1T tsbiUwQxDeO++Y8NfS8rieZgfv3RlobKihE8xbIVGRHIq1gup4nXv6XDwHDYyGhafIfUD4Ix00Wk gnODGb+jPwoQlDX0X64qMYICXjCCAloCAQEwXDBMMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQR2xv YmFsU2lnbiBudi1zYTEiMCAGA1UEAxMZR2xvYmFsU2lnbiBIViBTL01JTUUgQ0EgMQIMB/CJK1Mg pV83jiIZMA0GCWCGSAFlAwQCAQUAoIHUMC8GCSqGSIb3DQEJBDEiBCAuw5QgZUdlomZLMc5k2BUx rOTrxtTjNKbFZ1b0cwJkpjAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEP Fw0xOTAzMjYxMTI3MDBaMGkGCSqGSIb3DQEJDzFcMFowCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB FjALBglghkgBZQMEAQIwCgYIKoZIhvcNAwcwCwYJKoZIhvcNAQEKMAsGCSqGSIb3DQEBBzALBglg hkgBZQMEAgEwDQYJKoZIhvcNAQEBBQAEggEAdYj5yG3s+rqTCB7r1b3FX4D8zmGdwlcQy/oQ9GeX +iiOstxvdSF493Gg97uGfRNQdHriiVJ0OSoRDu/FX2FbWSf+Zu2PQ42wb170hBfi0X2QZvXnw3gB SXvbomNLq7AnvAw72UTFf5a5y6jwz96L5YVksPyD982BYE51UhUq8+rN7XnUXYmykBcBmPVXw5sD NcOpz20hi5u/vz/FZxE+NQbnLv3kFoD+OEokK1T+HVRtYsvwZDjdnVoH8wpZxBwbRxEtOHQqdEw5 zoPtWdt6+a2d4quKaOUQAOX6MaWaAlPm5lDD5SJFbbQub6dTglQDtTxjk7UrTt+X1QdfALhlwQ== --0000000000008585ab0584fd99cc-- From nobody Tue Mar 26 04:31:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 688AF120047 for ; Tue, 26 Mar 2019 04:31:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, UNPARSEABLE_RELAY=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Iwa-zbsmd7tw for ; Tue, 26 Mar 2019 04:31:27 -0700 (PDT) Received: from mail-lf1-x12c.google.com (mail-lf1-x12c.google.com [IPv6:2a00:1450:4864:20::12c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 213181202D0 for ; Tue, 26 Mar 2019 04:31:27 -0700 (PDT) Received: by mail-lf1-x12c.google.com with SMTP id d18so8397425lfn.3 for ; Tue, 26 Mar 2019 04:31:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:references:in-reply-to:date:message-id:subject:to :cc; bh=A260eH7IoJ6DtKAeTm0NeWTGZRrZ7uihLDgJKxchJJs=; b=L4/cKOvAZ75Q5nN0aXZtm0giUN/cB8DmzxPgfFtFAvPlsgYVCITkQGYw2D2fl5xY6v 9npycSGlvq0Ica1eTILOcZP0fFUSnRYXvuO4L3785DZyD/ewd+68y06nxhp+Paohg8Sh U6LlevNoJZenwZwxvm73k9an1V76XeU+0P3JA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:references:in-reply-to:date :message-id:subject:to:cc; bh=A260eH7IoJ6DtKAeTm0NeWTGZRrZ7uihLDgJKxchJJs=; b=JBUVUwDHhh0Hy2jtaL3ii7X2mOoPlH7iHUAKI4j5h/u4EUewBWH7or6c3fJo9p9HOo fxg3D/Bkmau6EWYraAPUtfigpw0Wg6WJsjM/Ahkx/9zvgti9FjPZYaL83okDt0hpjhoD t5zYaNI6ltHpVE6WuSJbHb3VosxIHUI7MLwVD2GgYSIQ5lPih7ryo7E76zhLtue582dp AFOpbnPxGj8XJmF4fOqmCMX2kAHLAQHC4XmshztRECE76KPfUqX5N6117G95BBBpVMdD uCQp4/LCJSF58eXzOnYj3Trs64/Lm1lNIzNnFTdF54xhYwRNIdgc3D2h+NgUURFVKgf3 GZxQ== X-Gm-Message-State: APjAAAUyAlhBqWO/zDyb2rCSlsvtJ1lB7+8ux/h8KdpANKOktIjExzaA ey8OLuU/OUqrwDcyxFdlultOz96ymX+9HoX5W6doQlikeH4= X-Google-Smtp-Source: APXvYqyVX3MeYJ504e74iOY8D+32HgBA9E2qK8Q+aEJBbCo1HrnEe1jehnQ8NcWD29TWJSTnsYHQ7+jc+qk5GZ4/+4s= X-Received: by 2002:a19:c507:: with SMTP id w7mr16248680lfe.56.1553599885194; Tue, 26 Mar 2019 04:31:25 -0700 (PDT) Received: from unknown named unknown by gmailapi.google.com with HTTPREST; Tue, 26 Mar 2019 04:31:24 -0700 From: Joe Abley Mime-Version: 1.0 (1.0) References: In-Reply-To: Date: Tue, 26 Mar 2019 04:31:24 -0700 Message-ID: To: George Michaelson Cc: DoH WG Content-Type: text/plain; charset="UTF-8" Archived-At: Subject: Re: [Doh] ..I don't get it (the hate) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 11:31:30 -0000 On Mar 26, 2019, at 12:15, George Michaelson wrote: > This is (surely) between me, the browser vendor, and the website? Why > does the ISP have any say in this? The ISP (or equivalent actor) has the opportunity to have a say today. Some deployment models would take this opportunity away. I don't believe the concern is for sophisticated users who can make informed choices. I can use a tor browser right now that also defeats the ISP's opportunity to participate in the resolution process. That's not controversial. The contentious aspect is, I think, the potential for a majority of end-users who are not sophisticated and hence are unable to make informed decisions to have this behaviour changed for them. It's not the existence of the mechanism, it's the potential scale of the deployment. Joe From nobody Tue Mar 26 05:37:16 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE64F12001E for ; Tue, 26 Mar 2019 05:37:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vpA5suhGcIIp for ; Tue, 26 Mar 2019 05:37:12 -0700 (PDT) Received: from mail-it1-x136.google.com (mail-it1-x136.google.com [IPv6:2607:f8b0:4864:20::136]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 93A1C12000F for ; Tue, 26 Mar 2019 05:37:12 -0700 (PDT) Received: by mail-it1-x136.google.com with SMTP id h9so19651932itl.1 for ; Tue, 26 Mar 2019 05:37:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=U9xOR9hk3yfe73UxwHDf6MC/J0Usou1Qa7lmvPtcHQA=; b=ZhajJI9lCf5r5IQYrBu/A1a2xjKKcq/tN7CSTGNS5EPVlEzC2UAdizFwny4N5m6+D0 03TlZbnk+waoD4Suz1y3q/tzYGWXxG4HaLswW7SDJSNEjNQKEi/7f93T18oHkhReto7E rRbv8+qx50MVE6lY5zvtmEILwlzaNjg17htfxGcifOlRQsT2TUhvMoX3arduxpXEJ5Mr zMZtzJ7hlAJBTmKJ/7l5HiOx86OXqvNUyvb9sL+JP0y9b9zpDKz/haIlE3DtT3Zr+kh+ fqsJPXxyxXQvXhchu0EfHZu70v403NtC0RdsB6F0NaMATD4S5S52EwkHQF+CK7VT/vKd KGbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=U9xOR9hk3yfe73UxwHDf6MC/J0Usou1Qa7lmvPtcHQA=; b=dXq9uNYPiDP62gwXsinHG80p7IZ7YpdsfHKkVvkIMWhuXytq52RIdxx2ZEPEPO6tsg ESJsW/WEEkAVE2UHRZbcSOh+6wbBNH4BZ6I+Q/UYwzorolh5Y5AcOfh37oKkljeeq/xP Bf87fF+FsljGcqbM/yI+efuJeJ17oFB+HefBR7mtdQhPJtdMCBmx4T8hKXOmko4BIxh2 LaXzB8mvSIiVeybl/7HhoWIn3W4VCPrUkkww6FrzbEKLEiHvZucp5JprSswpY/EW4+22 eh07PF/ZhUsqH5QHNuXsxTLT+5cmJnMl4tmLlS6a0Jf/UB7OCpNE1WXHfyTIMvhDslMj hVEA== X-Gm-Message-State: APjAAAUQfeBmTkC7t9TfCLE+K7V6UO89AM+A9qr30kdyeoq0Xmfjy27p 9UDQ+b1iB9Lq9UOgXBMUdbsf682e/3qWa8jC/anWW8m8CdOpyQ== X-Google-Smtp-Source: APXvYqzOIVguRHP79vi5iKptcuuxPtQCatdOCILKOgsfRs6SASiUKA1DlNQZF7QwbnVrC45TWjNHpL2GY/KTV34RkJk= X-Received: by 2002:a02:13ca:: with SMTP id 193mr21757442jaz.117.1553603831714; Tue, 26 Mar 2019 05:37:11 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Matthew Pounsett Date: Tue, 26 Mar 2019 13:36:57 +0100 Message-ID: To: Joe Abley Cc: George Michaelson , DoH WG Content-Type: multipart/alternative; boundary="00000000000082ee280584fe94aa" Archived-At: Subject: Re: [Doh] ..I don't get it (the hate) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 12:37:15 -0000 --00000000000082ee280584fe94aa Content-Type: text/plain; charset="UTF-8" On Tue, 26 Mar 2019 at 12:31, Joe Abley wrote: > On Mar 26, 2019, at 12:15, George Michaelson wrote: > > > This is (surely) between me, the browser vendor, and the website? Why > > does the ISP have any say in this? > > The ISP (or equivalent actor) has the opportunity to have a say today. > Some deployment models would take this opportunity away. > > I don't believe the concern is for sophisticated users who can make > informed choices. I can use a tor browser right now that also defeats > the ISP's opportunity to participate in the resolution process. That's > not controversial. > > The contentious aspect is, I think, the potential for a majority of > end-users who are not sophisticated and hence are unable to make > informed decisions to have this behaviour changed for them. > And in a similar vein, unsophisticated end users who might change this configuration deliberately, and then still expect their ISP to help them out when they've got a problem. I think the biggest enterprise concern is more around the balance between users' privacy in one context (e.g. protecting dissidents) and user privacy and security in other contexts (e.g. data exfiltration by malware). I'm concerned, and I believe others are as well, that while we're making gains in the former, the loss in the latter may outweigh those gains by quite a lot. The malware on a user's system that is now able to reach its C&C because its DNS queries cannot be blocked doesn't just put the user of that computer at risk, but all the other users on that network as well. And there, again, it's a question of scale. While it's possible for malware to set up similar resolution systems today, if they do it stands out in ways that can be detected and mitigated. If they're hiding in the forest of all the standard web browser traffic, that becomes a much more complex (and therefore expensive) problem. > > It's not the existence of the mechanism, it's the potential scale of > the deployment. > > > Joe > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000082ee280584fe94aa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, 26 Mar 2019 at 12:31, Joe Abl= ey <jabley@hopcount.ca> wro= te:
On Mar 26, 2= 019, at 12:15, George Michaelson <ggm@algebras.org> wrote:

> This is (surely) between me, the browser vendor, and the website? Why<= br> > does the ISP have any say in this?

The ISP (or equivalent actor) has the opportunity to have a say today.
Some deployment models would take this opportunity away.

I don't believe the concern is for sophisticated users who can make
informed choices. I can use a tor browser right now that also defeats
the ISP's opportunity to participate in the resolution process. That= 9;s
not controversial.

The contentious aspect is, I think, the potential for a majority of
end-users who are not sophisticated and hence are unable to make
informed decisions to have this behaviour changed for them.

And in a similar vein, unsophisticated end users who m= ight change this configuration deliberately, and then still expect their IS= P to help them out when they've got a problem.

I think the biggest enterprise concern is more around the balance between = users' privacy in one context (e.g. protecting dissidents) and user pri= vacy and security in other contexts (e.g. data exfiltration by malware).=C2= =A0 I'm concerned, and I believe others are as well, that while we'= re making gains in the former, the loss in the latter may outweigh those ga= ins by quite a lot.=C2=A0 The malware on a user's system that is now ab= le to reach its C&C because its DNS queries cannot be blocked doesn'= ;t just put the user of that computer at risk, but all the other users on t= hat network as well.=C2=A0 And there, again, it's a question of scale.= =C2=A0 While it's possible for malware to set up similar resolution sys= tems today, if they do it stands out in ways that can be detected and mitig= ated.=C2=A0 If they're hiding in the forest of all the standard web bro= wser traffic, that becomes a much more complex (and therefore expensive) pr= oblem.




=C2=A0

It's not the existence of the mechanism, it's the potential scale o= f
the deployment.


Joe

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000082ee280584fe94aa-- From nobody Tue Mar 26 05:56:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C8A212030D for ; Tue, 26 Mar 2019 05:56:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=fugue-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TafAuozO61Ww for ; Tue, 26 Mar 2019 05:56:49 -0700 (PDT) Received: from mail-wr1-x435.google.com (mail-wr1-x435.google.com [IPv6:2a00:1450:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 91CC2120283 for ; Tue, 26 Mar 2019 05:56:49 -0700 (PDT) Received: by mail-wr1-x435.google.com with SMTP id w1so14264148wrp.2 for ; Tue, 26 Mar 2019 05:56:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fugue-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=XujDJJv0vlmYLmvG7UzpTdBCegCG6OuSIp7KOjIjLEA=; b=Yz4sV6elJrn5TqLodAqTO1vNZ2qU/13JpKMIu7mjBBVvGZthIHeheuFWHCQ9xb7h// 7UcIJdNPTIaUbsPrhPhExhcdHhMvu09M5n7LqYpy18JBciC3tvcfBTYXmrQrjD1nHSUP IVqn7vWcPoA6jijDISWUGfG548veyNsbPiJBIcUz3+EYl0Q6Ns2/QV4CidHqHv13T5MP 4pB6Cg4QkQlxKGy58SpAlYpAsaAkdlZG077qy3AnG3QpqKrP9kWbgmWSZVVbWkaWiOZC 6znJYYUD8qoy/3/vF/Xn5qJHRcHv2P6xoxpYZghW+b7DSeY3y3tDOrB4OeGsMzbLO8SD 9rVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=XujDJJv0vlmYLmvG7UzpTdBCegCG6OuSIp7KOjIjLEA=; b=mFBnSJA3f0WDtbIBWtswKosWsC0Agqm+BypbhfscglO6ETOX/xucDGQ5uSS3aYDHxz Inxcu19qyjrYCPXiuqQBn1iXeN+ETt02C2k8CfbKDlVdqmDS/Z6hHAub2gEtOeYMPogt cDDay64X9OadG3zSfpjmgi6pR+wPR7Rn3jqY9knY5SUZL9igi3tOkkfORhCqhmYcCiFy MUTDO1mDEADgCLTspDmGz44QtwN8PCaDR6rk/rlPABgdwGZdYL9bBICp2GsAgDxTiMxU x11NRLFd8rF549ohfr0P4C4j5TxqLrHJKeQ2s4NQE5uAnUR0iwAOaXh5E68UMdFVurVZ BXQg== X-Gm-Message-State: APjAAAUgYUvxUyCcEU92MQmg3VzxYe4Uk+ml6+6gewUkLPLokAF2+2BS WIec9YY+iKnb16b+dZkRm1bgIdLAs0PAQjao X-Google-Smtp-Source: APXvYqyisLtcK7hFBPscgz/JPmO4OlrSxNy4CLmMckDjQ8SzKZ3ebI7P86zLAUjEIGZT89fE7hs5zQ== X-Received: by 2002:adf:f04e:: with SMTP id t14mr19971087wro.263.1553605007951; Tue, 26 Mar 2019 05:56:47 -0700 (PDT) Received: from dhcp-889a.meeting.ietf.org (dhcp-889a.meeting.ietf.org. [31.133.136.154]) by smtp.gmail.com with ESMTPSA id j11sm23418737wrw.85.2019.03.26.05.56.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Mar 2019 05:56:47 -0700 (PDT) From: Ted Lemon Message-Id: <607C9E28-274B-4A18-825E-173275BF8A3E@fugue.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_C12D446E-95FA-41C0-A2A6-C0BBD9FBE486" Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.2\)) Date: Tue, 26 Mar 2019 13:56:45 +0100 In-Reply-To: Cc: George Michaelson , DoH WG To: Joe Abley References: X-Mailer: Apple Mail (2.3445.104.2) Archived-At: Subject: Re: [Doh] ..I don't get it (the hate) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 12:56:54 -0000 --Apple-Mail=_C12D446E-95FA-41C0-A2A6-C0BBD9FBE486 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I think it=E2=80=99s a correct observation that the majority of = end-users are not qualified to make security policy decisions at a = fine-grained level. It=E2=80=99s also the case that frequently = end-users do not have the opportunity to make choices that they would = make if they were available (e.g., Facebook, but without all the privacy = violations). But I think that=E2=80=99s not the right taxonomy. I think the actual split is between devices that have to have on-device = security policy enforcement, and devices that can=E2=80=99t. My iPhone = is roaming to networks with different policies all the time. No matter = how well-intentioned, the security policy of a particular network cannot = protect my iPhone, because my iPhone talks to other networks. So for devices like iPhones, a network-enforced security policy can only = really cause harm: any good that it could have caused is voided by the = fact that the network isn=E2=80=99t always there to protect it. This is okay, because when I chose my iPhone, one of the reasons I chose = it was that another entity would enforce a security policy on it that = protects it from attack: the manufacturer, in this case Apple. Apple = has made a very deliberate decision to secure the iPhone in such a way = that I can, with reasonable although not perfect confidence, trust that = it will not be hacked by the network to which it connects. On the other hand, my WeMo is wide open. It doesn=E2=80=99t have any = real security. I=E2=80=99m sure we all know of examples of devices for = which this is true. Such devices tend not to move from network to = network, and tend not to be seriously hardened against attack. In order to protect my WeMo from attack, I need the network to strictly = control what it communicates with. This can to some degree be = approximated by controlling DNS resolution. But to be sure that it is = controlled, the network also needs to do IP address filtering, and that = filter needs to be controlled somehow. As Eliot has demonstrated, it is possible to use DNS to control the = hosts to which a host connects through a firewall, but it=E2=80=99s = expensive, and it only works through the firewall. That=E2=80=99s why = we approximate this using DNS. But if what we care about is controlling what hosts my iPhone connects = to using DNS, the DNS resolver the iPhone uses has to be configured on = the iPhone, and the connection to it has to be secure. Controlling it = at the network egress simply doesn=E2=80=99t solve that problem. So when we are thinking about this problem, I think it=E2=80=99s = important to be really clear about exactly what problem we are thinking = about, and not confuse these two very different use cases and the very = different control planes they require to address them. > On Mar 26, 2019, at 12:31 PM, Joe Abley wrote: >=20 > On Mar 26, 2019, at 12:15, George Michaelson wrote: >=20 >> This is (surely) between me, the browser vendor, and the website? Why >> does the ISP have any say in this? >=20 > The ISP (or equivalent actor) has the opportunity to have a say today. > Some deployment models would take this opportunity away. >=20 > I don't believe the concern is for sophisticated users who can make > informed choices. I can use a tor browser right now that also defeats > the ISP's opportunity to participate in the resolution process. That's > not controversial. >=20 > The contentious aspect is, I think, the potential for a majority of > end-users who are not sophisticated and hence are unable to make > informed decisions to have this behaviour changed for them. >=20 > It's not the existence of the mechanism, it's the potential scale of > the deployment. >=20 >=20 > Joe >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh --Apple-Mail=_C12D446E-95FA-41C0-A2A6-C0BBD9FBE486 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I think it=E2=80=99s a correct observation = that the majority of end-users are not qualified to make security policy = decisions at a fine-grained level.   It=E2=80=99s also the = case that frequently end-users do not have the opportunity to make = choices that they would make if they were available (e.g., Facebook, but = without all the privacy violations).   But I think that=E2=80=99= s not the right taxonomy.

I think the = actual split is between devices that have to have on-device security = policy enforcement, and devices that can=E2=80=99t.   My = iPhone is roaming to networks with different policies all the time. =   No matter how well-intentioned, the security policy of a = particular network cannot protect my iPhone, because my iPhone talks to = other networks.

So for = devices like iPhones, a network-enforced security policy can only really = cause harm: any good that it could have caused is voided by the fact = that the network isn=E2=80=99t always there to protect it.

This is okay, because when I chose my iPhone, = one of the reasons I chose it was that another entity would enforce a = security policy on it that protects it from attack: the manufacturer, in = this case Apple.   Apple has made a very deliberate decision = to secure the iPhone in such a way that I can, with reasonable although = not perfect confidence, trust that it will not be hacked by the network = to which it connects.

On the = other hand, my WeMo is wide open.   It doesn=E2=80=99t have = any real security.   I=E2=80=99m sure we all know of examples = of devices for which this is true.   Such devices tend not to = move from network to network, and tend not to be seriously hardened = against attack.

In order to = protect my WeMo from attack, I need the network to strictly control what = it communicates with.   This can to some degree be = approximated by controlling DNS resolution.  But to be sure that it = is controlled, the network also needs to do IP address filtering, and = that filter needs to be controlled somehow.

As Eliot has demonstrated, it is possible to = use DNS to control the hosts to which a host connects through a = firewall, but it=E2=80=99s expensive, and it only works through the = firewall.   That=E2=80=99s why we approximate this using = DNS.

But if what we care about is controlling what = hosts my iPhone connects to using DNS, the DNS resolver the iPhone uses = has to be configured on the iPhone, and the connection to it has to be = secure.   Controlling it at the network egress simply = doesn=E2=80=99t solve that problem.

So when we are thinking about this problem, I think it=E2=80=99= s important to be really clear about exactly what problem we are = thinking about, and not confuse these two very different use cases and = the very different control planes they require to address = them.

On Mar 26, 2019, at 12:31 PM, Joe Abley = <jabley@hopcount.ca> wrote:

On = Mar 26, 2019, at 12:15, George Michaelson <ggm@algebras.org> = wrote:

This is (surely) between me, the browser vendor, and the = website? Why
does the ISP have any say in this?

The ISP (or equivalent actor) has = the opportunity to have a say today.
Some deployment = models would take this opportunity away.

I = don't believe the concern is for sophisticated users who can make
informed choices. I can use a tor browser right now that also = defeats
the ISP's opportunity to participate in the = resolution process. That's
not controversial.

The contentious aspect is, I think, the = potential for a majority of
end-users who are not = sophisticated and hence are unable to make
informed = decisions to have this behaviour changed for them.

It's not the existence of the mechanism, it's the potential = scale of
the deployment.


Joe

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh

= --Apple-Mail=_C12D446E-95FA-41C0-A2A6-C0BBD9FBE486-- From nobody Tue Mar 26 06:24:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EA0AD120043 for ; Tue, 26 Mar 2019 06:24:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.647 X-Spam-Level: X-Spam-Status: No, score=-1.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BYKPbn2UnoC0 for ; Tue, 26 Mar 2019 06:24:44 -0700 (PDT) Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CEFB912002F for ; Tue, 26 Mar 2019 06:24:43 -0700 (PDT) Received: by mail-wr1-f51.google.com with SMTP id s15so14312332wra.12 for ; Tue, 26 Mar 2019 06:24:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yJ8F3D4L/MkftnW4OrsAcjupjyMI3hF5UyF/1yZsOLU=; b=D0pDmo7slf+AXKRUY93tkRCZ/tdfNcabkpb//ZJnOevx8b4cKB2+e3T1KeETQSPJ8o 6fXEIRdhdlEMadnPhrHeVn0M7D5ujX/iKa+S+fRTP5NmCvdGdgJHG4sHkAzsJGtUAuoi 6GxEHq3dXXmnAFOLl+K9+IImCm3sz5RtH5KQtRBDR7hOfL+3jBxsGofbqHH2too/TdL2 CrKx2axVny03Pjo8DuLi8cVqCgYt3a15cEaYsWjNoMPLH9jQYCHTk0pr2XEzolDjPBuz Qq6TGMDF5LyEHPAe4R8EjsBIlC+d9XFWSsPWO7xVf4JrVKXfB9saMRL5ccfpc1ymozdj Z5Eg== X-Gm-Message-State: APjAAAXlBNOoESWgVFsHtB9sDBs1IIPDhbYR87CBxBmrYsy8dpVoinfb eG0zSoZ53Clnfn6ZbTpdXpWBW0OaznQzjFur4qI= X-Google-Smtp-Source: APXvYqzA6gnBIwSVgk5Efh7UZVmWKfb7QUi0lo41sSDRsJ4h210UAPs4kObRkRqQucgiDlGWLpPwgA+lLan7ET8EsHA= X-Received: by 2002:adf:f3ce:: with SMTP id g14mr20531324wrp.129.1553606681958; Tue, 26 Mar 2019 06:24:41 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> In-Reply-To: <55AE7511-5BDF-4E96-84B3-BD0B6E6C6FE3@icann.org> From: Erik Nygren Date: Tue, 26 Mar 2019 09:24:29 -0400 Message-ID: To: Paul Hoffman Cc: DoH WG Content-Type: multipart/alternative; boundary="000000000000661df70584ff3ec8" Archived-At: Subject: Re: [Doh] New version: draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 13:24:46 -0000 --000000000000661df70584ff3ec8 Content-Type: text/plain; charset="UTF-8" > As for the late discussion of using the URI RRtype instead of TXT, I would not know what to put in the "priority" and "weight" values. > That alone seems enough reason to leave this as a TXT record, but others might disagree. > It's not a lot of effort to change the text to the URI RRtype, but I don't want to do so unless it is actually better than TXT. Being able to specify at least priority (even if using fixed/equal weights) seems valuable, as many large networks architect their DNS infrastructure have "primary" and "secondary" site clusters. The primary and secondary clusters are often sized and located differently, such as with the primary being more widely distributed and the secondary more centrally deployed. I suspect this desire to have a ordered preference but with failover will carry over to DoH. Erik On Sun, Mar 24, 2019 at 4:20 AM Paul Hoffman wrote: > The diffs here are what I think have general agreement from the discussion > about this draft so far, but I may have missed things. Comments are still > quite welcome. > > As for the late discussion of using the URI RRtype instead of TXT, I would > not know what to put in the "priority" and "weight" values. That alone > seems enough reason to leave this as a TXT record, but others might > disagree. It's not a lot of effort to change the text to the URI RRtype, > but I don't want to do so unless it is actually better than TXT. > > --Paul Hoffman > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --000000000000661df70584ff3ec8 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
> As for the late discussion of using the URI RRtype instead of TXT, I=20 would not know what to put in the "priority" and "weight&quo= t; values.
> That=20 alone seems enough reason to leave this as a TXT record, but others=20 might disagree.
> It's not a lot of effort to change the text to= the URI=20 RRtype, but I don't want to do so unless it is actually better than TXT= .

Being able to specify at least priority (even if using fixed/equal wei= ghts) seems valuable,
as many large networks architect their DNS infras= tructure have "primary" and "secondary" site clusters.<= /div>
T= he primary and secondary clusters are often sized and located differently, = such as with the primary
being more widely distributed and the secondary mor= e centrally deployed.=C2=A0
I suspect this desire to have a ordered pre= ference but with failover will carry over to DoH.

<= div>
= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 Erik


On Sun, Mar 24, 20= 19 at 4:20 AM Paul Hoffman <pa= ul.hoffman@icann.org> wrote:
The diffs here are what I think have general agreement = from the discussion about this draft so far, but I may have missed things. = Comments are still quite welcome.

As for the late discussion of using the URI RRtype instead of TXT, I would = not know what to put in the "priority" and "weight" val= ues. That alone seems enough reason to leave this as a TXT record, but othe= rs might disagree. It's not a lot of effort to change the text to the U= RI RRtype, but I don't want to do so unless it is actually better than = TXT.

--Paul Hoffman
_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--000000000000661df70584ff3ec8-- From nobody Tue Mar 26 06:26:09 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0C2A51202FC for ; Tue, 26 Mar 2019 06:26:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bGcuOV4fZ4hG for ; Tue, 26 Mar 2019 06:26:00 -0700 (PDT) Received: from mail-wm1-x343.google.com (mail-wm1-x343.google.com [IPv6:2a00:1450:4864:20::343]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 73B86120043 for ; Tue, 26 Mar 2019 06:26:00 -0700 (PDT) Received: by mail-wm1-x343.google.com with SMTP id y197so12931957wmd.0 for ; Tue, 26 Mar 2019 06:26:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:mime-version:subject:date:references:to:in-reply-to:message-id; bh=Kf8vjETI6CFK8E2dIBBRwVhgvVVvoPi9tDBmHPbhb3I=; b=f5O6kZl1uDVL7bLi3yFUfbivKrMa3UCLFrpzRODUwFSpmpLwEUEENVRFBBzmquHYDU XDqL1t3V9mJtea1xukm6rB0hMNtJntsjKTXqMATpcYoE4Fv/yu407RKGPHCKAGSR2wsY 5EhSvBOHTNWtMb09bCQ7r+xh4rRiXgfzWTOTg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:to :in-reply-to:message-id; bh=Kf8vjETI6CFK8E2dIBBRwVhgvVVvoPi9tDBmHPbhb3I=; b=Rxwn40JakTNwzNi31ImnG9w2qQoz0kuDvlap70qJSUw2MJhihGr35yLq4xst5VzSG/ IiGKIwRou1+SKsseMjxqQUOAoV5BUDmacyEufoF6mBLFvgobSxk2uVHrF16+ViKuOLJp +UtVregpZdLdrW0PoRZhKZ6ZKGf7rcSidt4Bmy3nJ+9mGjbziv/Q58K0GnmUNCHycdvF 770qLNWE0u2N6yNOWR9Wu/xoBxZCbvZVTwj/D0fa1A2NZjTdA9QAWnsPg0pxFxGJdlZD jbz2tyy7w1Pgr6gn7S0b2o466AkfZ5zSGt9tAeFkGFtJK0ePrMsG8Lxh/MSq6Xb/tTdy NEIA== X-Gm-Message-State: APjAAAUjgcjXE81QbhaZTW80tpgLOhKnhZZZr/+h2feFSs/nRi4lzb1P j8RCaFTawmY1s7nhCCNQgKZ08R/+V6cNCA== X-Google-Smtp-Source: APXvYqyaf1k0YtHhvYtKhdtf603xfkH67jRr86TTja5UTdpy3o5ztI1G36xv66JjEdpCNb7f7+CuAQ== X-Received: by 2002:a1c:39d7:: with SMTP id g206mr8273594wma.99.1553606758452; Tue, 26 Mar 2019 06:25:58 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:4541:7170:3836:e433? ([2001:67c:1232:144:4541:7170:3836:e433]) by smtp.gmail.com with ESMTPSA id r16sm8436219wrx.37.2019.03.26.06.25.56 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Mar 2019 06:25:57 -0700 (PDT) From: Joe Abley Content-Type: multipart/signed; boundary="Apple-Mail=_C779F6B8-30E1-423A-9471-21E75CC7E63C"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Date: Tue, 26 Mar 2019 14:25:55 +0100 References: To: DoH WG In-Reply-To: Message-Id: <4D942FED-E2F3-4A78-A1C5-3F72E013BF69@hopcount.ca> X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: [Doh] more generally on resolver-associated-doh.arpa and resolver-associated-doh.arpa X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 13:26:08 -0000 --Apple-Mail=_C779F6B8-30E1-423A-9471-21E75CC7E63C Content-Type: multipart/alternative; boundary="Apple-Mail=_C033F0DE-EC8C-43E6-81A5-4C16C23DE6CE" --Apple-Mail=_C033F0DE-EC8C-43E6-81A5-4C16C23DE6CE Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi again, I think my concerns about the "DoH Servers from DNS" mechanism are = wider than those about the blackhole suggestion that I mentioned = earlier. The "DoH Servers from DNS" mechanism in general involves the retrieval = of security-critical information for an end-user's application = environment from the DNS in a way that necessarily precludes integrity = protection by DNSSEC. A polluted cache, a compromised upstream forwarder = or resolver, a man in the middle or just the accidental inheritance of a = non-malicious upstream policy can divert all end-user resolver traffic = to an unexpected location where the response policy is unknown.\ This is worse than DNSChanger or attacks on local DHCP infrastructure to = divert resolver traffic since it has the potential to affect larger = communities of end-users without the hurdle of local network or end-host = compromise. Any network that doesn't provision these domains on their local = resolvers is hence vulnerable. If successful the impact of such an = attack would be difficult to assess by the network operator since of = course the query traffic is at that point obscured, being carried as = DoH. Architecturally, I think this mechanism is vulnerable by default, which = is a poor security posture. It's a challenge to detect the attack and = it's also challenging to defend against (e.g. in the case that an = end-user doesn't start the discovery from a local resolver). Joe On 26 Mar 2019, at 12:17, Joe Abley wrote: > Hi all, >=20 > There was a suggestion at the microphone this morning in the Grand = Ballroom that the resolver-associated-doh.arpa and = resolver-associated-doh.arpa domains be "blackholed". The draft = currently specifies that these MUST NOT be delegated from ARPA. >=20 > The microphone queue was already cut off before I could ask more about = what this means, but I think it's worth reminding the wg what blackhole = generally means in this context of DNS names in and near ARPA, and how = it can be implemented, since I think there is a security concern. >=20 > RFC 7534 provides two mechanisms to blackhole DNS traffic: one uses = DNAME (see RFC 7535) and the other uses a zone cut. The DNAME approach = is technically compatible with the MUST NOT in the draft (since it's = technically not a delegation but rather a redirection) but the direct = delegation mechanism is not. >=20 > In both cases, however, blackholing these domains would point their = DNS resolution away from the authoritative servers that serve ARPA = towards a loosely-coordinated set of AS112 servers. >=20 > Anybody can operate an AS112 server; in fact, operators have in the = past been actively encouraged to operate AS112 servers without any = requirement for coordination. This has been considered a reasonable = approach so long as the query data being sent to AS112 servers is = recognised to be junk that only leaks by accident; since it's generally = private network PTR query traffic the potential for exploitation by bad = actors (malicious AS112 node operators) is arguably low. >=20 > However, in the case of these doh resolver domains, there is the = potential for a bad actor to respond with an unauthorised list of DoH = URIs and steal the resolver traffic of a large array of end-users whose = local (or configured) resolvers don't implement the mechanisms described = in this draft. This would be a bit like DNS changer, but without the = need to infect individual end-hosts.. >=20 > I think this a problem. >=20 > I think (in contrast to the thought at the microphone) if we mention = blackholing at all it ought to be of the form "don't ever do this = because it would be bad for the following reasons". >=20 >=20 > Joe --Apple-Mail=_C033F0DE-EC8C-43E6-81A5-4C16C23DE6CE Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii
Hi again,

I think my concerns about the "DoH Servers from DNS" = mechanism  are wider than those about the blackhole suggestion that = I mentioned earlier.

The  "DoH Servers from DNS" mechanism in general = involves the retrieval of security-critical information for an = end-user's application environment from the DNS in a way that = necessarily precludes integrity protection by DNSSEC. A polluted cache, = a compromised upstream forwarder or resolver, a man in the middle or = just the accidental inheritance of a non-malicious upstream policy can = divert all end-user resolver traffic to an unexpected location where the = response policy is unknown.\

This is worse than DNSChanger or = attacks on local DHCP infrastructure to divert resolver traffic since it = has the potential to affect larger communities of end-users without the = hurdle of local network or end-host compromise.

Any network that doesn't provision = these domains on their local resolvers is hence vulnerable. If = successful the impact of such an attack would be difficult to assess by = the network operator since of course the query traffic is at that point = obscured, being carried as DoH.

Architecturally, I think this = mechanism is vulnerable by default, which is a poor security posture. = It's a challenge to detect the attack and it's also challenging to = defend against (e.g. in the case that an end-user doesn't start the = discovery from a local resolver).


Joe

On 26 Mar 2019, at 12:17, Joe Abley <jabley@hopcount.ca> = wrote:

Hi all,

There was a suggestion at the = microphone this morning in the Grand Ballroom that = the resolver-associated-doh.arpa and resolver-associated-doh.arpa = domains be "blackholed". The draft currently specifies that these MUST = NOT be delegated from ARPA.

The microphone queue was already cut off before I could ask = more about what this means, but I think it's worth reminding the wg what = blackhole generally means in this context of DNS names in and near ARPA, = and how it can be implemented, since I think there is a security = concern.

RFC 7534 provides two mechanisms to blackhole DNS traffic: one = uses DNAME (see RFC 7535) and the other uses a zone cut. The DNAME = approach is technically compatible with the MUST NOT in the draft (since = it's technically not a delegation but rather a redirection) but the = direct delegation mechanism is not.

In = both cases, however, blackholing these domains would point their DNS = resolution away from the authoritative servers that serve ARPA towards a = loosely-coordinated set of AS112 servers.

Anybody can operate an AS112 = server; in fact, operators have in the past been actively encouraged to = operate AS112 servers without any requirement for coordination. This has = been considered a reasonable approach so long as the query data being = sent to AS112 servers is recognised to be junk that only leaks by = accident; since it's generally private network PTR query traffic the = potential for exploitation by bad actors (malicious AS112 node = operators) is arguably low.

However, in the case of these doh resolver domains, there is = the potential for a bad actor to respond with an unauthorised list of = DoH URIs and steal the resolver traffic of a large array of end-users = whose local (or configured) resolvers don't implement the mechanisms = described in this draft. This would be a bit like DNS changer, but = without the need to infect individual end-hosts..

I think this a = problem.

I = think (in contrast to the thought at the microphone) if we mention = blackholing at all it ought to be of the form "don't ever do this = because it would be bad for the following reasons".


Joe

= --Apple-Mail=_C033F0DE-EC8C-43E6-81A5-4C16C23DE6CE-- --Apple-Mail=_C779F6B8-30E1-423A-9471-21E75CC7E63C Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXJooYwAKCRA0jwy9hlI6 LECtAJwJEs4V9wJC9K4uV7//vx1SqSWQYwCfQILnGJZw+95wXYAyi4/D6gLVfIE= =IOi9 -----END PGP SIGNATURE----- --Apple-Mail=_C779F6B8-30E1-423A-9471-21E75CC7E63C-- From nobody Tue Mar 26 06:35:26 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E755D120160 for ; Tue, 26 Mar 2019 06:35:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AtRHDG00ckiW for ; Tue, 26 Mar 2019 06:35:20 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBF691203D3 for ; Tue, 26 Mar 2019 06:35:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 3B975BEFE; Tue, 26 Mar 2019 13:35:04 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NnBRHtYKzj4t; Tue, 26 Mar 2019 13:35:02 +0000 (GMT) Received: from [31.133.128.194] (dhcp-80c2.meeting.ietf.org [31.133.128.194]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id A0E96BEFA; Tue, 26 Mar 2019 13:35:01 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553607302; bh=HoVVEmJWQupqnRkzILbL8ZqPWLZfnnvJnpdFTOaShTc=; h=Subject:To:References:From:Date:In-Reply-To:From; b=Yh93eCZaz1IQANooOgdC0GxLjicNUwpd6xdn97UEKIT3+O2ORPoFuxqRIXJRgHeyg fgRMK1xIUhnVY1ZtDeO6K1stSJaFnvXHPP2qjxdXTGDXXheNB0JHQbjJDvoTM/NoOS R+jNbmIeXVziJXNTNqhJBLaaf5VhhppkPTnqp59k= To: Joe Abley , DoH WG References: <4D942FED-E2F3-4A78-A1C5-3F72E013BF69@hopcount.ca> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <6e72bf38-16b8-6c4f-b842-f3fd64c02e37@cs.tcd.ie> Date: Tue, 26 Mar 2019 13:34:59 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <4D942FED-E2F3-4A78-A1C5-3F72E013BF69@hopcount.ca> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ZTxeMZowhiAkJba8vYxCCtQPb5mNo8xQL" Archived-At: Subject: Re: [Doh] more generally on resolver-associated-doh.arpa and resolver-associated-doh.arpa X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 13:35:24 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --ZTxeMZowhiAkJba8vYxCCtQPb5mNo8xQL Content-Type: multipart/mixed; boundary="kd9Os55cBJrejkGpFrfqFqqdcT1C6Tk7c"; protected-headers="v1" From: Stephen Farrell To: Joe Abley , DoH WG Message-ID: <6e72bf38-16b8-6c4f-b842-f3fd64c02e37@cs.tcd.ie> Subject: Re: [Doh] more generally on resolver-associated-doh.arpa and resolver-associated-doh.arpa References: <4D942FED-E2F3-4A78-A1C5-3F72E013BF69@hopcount.ca> In-Reply-To: <4D942FED-E2F3-4A78-A1C5-3F72E013BF69@hopcount.ca> --kd9Os55cBJrejkGpFrfqFqqdcT1C6Tk7c Content-Type: multipart/mixed; boundary="------------473BDA7ECA585E3E239D9372" Content-Language: en-GB This is a multi-part message in MIME format. --------------473BDA7ECA585E3E239D9372 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable On 26/03/2019 13:25, Joe Abley wrote: > Hi again, >=20 > I think my concerns about the "DoH Servers from DNS" mechanism are > wider than those about the blackhole suggestion that I mentioned > earlier. >=20 > The "DoH Servers from DNS" mechanism in general involves the > retrieval of security-critical information for an end-user's > application environment from the DNS in a way that necessarily > precludes integrity protection by DNSSEC. A polluted cache, a > compromised upstream forwarder or resolver, a man in the middle or > just the accidental inheritance of a non-malicious upstream policy > can divert all end-user resolver traffic to an unexpected location > where the response policy is unknown.\ >=20 > This is worse than DNSChanger or attacks on local DHCP infrastructure > to divert resolver traffic since it has the potential to affect > larger communities of end-users without the hurdle of local network > or end-host compromise. >=20 > Any network that doesn't provision these domains on their local > resolvers is hence vulnerable.=20 If that is likely (and I'd suspect, but don't know, that it may be) then there's also a privacy leak - devices will make these requests at boot time and/or application start time. That may or may not be worse than the status-quo ante though, so is hard to evaluate. That said, a more localised mechanism (if one exists) could be better in both respects. S > If successful the impact of such an > attack would be difficult to assess by the network operator since of > course the query traffic is at that point obscured, being carried as > DoH. >=20 > Architecturally, I think this mechanism is vulnerable by default, > which is a poor security posture. It's a challenge to detect the > attack and it's also challenging to defend against (e.g. in the case > that an end-user doesn't start the discovery from a local resolver). >=20 >=20 > Joe >=20 > On 26 Mar 2019, at 12:17, Joe Abley wrote: >=20 >> Hi all, >>=20 >> There was a suggestion at the microphone this morning in the Grand >> Ballroom that the resolver-associated-doh.arpa and >> resolver-associated-doh.arpa domains be "blackholed". The draft >> currently specifies that these MUST NOT be delegated from ARPA. >>=20 >> The microphone queue was already cut off before I could ask more >> about what this means, but I think it's worth reminding the wg what >> blackhole generally means in this context of DNS names in and near >> ARPA, and how it can be implemented, since I think there is a >> security concern. >>=20 >> RFC 7534 provides two mechanisms to blackhole DNS traffic: one uses >> DNAME (see RFC 7535) and the other uses a zone cut. The DNAME >> approach is technically compatible with the MUST NOT in the draft >> (since it's technically not a delegation but rather a redirection) >> but the direct delegation mechanism is not. >>=20 >> In both cases, however, blackholing these domains would point their >> DNS resolution away from the authoritative servers that serve ARPA >> towards a loosely-coordinated set of AS112 servers. >>=20 >> Anybody can operate an AS112 server; in fact, operators have in the >> past been actively encouraged to operate AS112 servers without any >> requirement for coordination. This has been considered a reasonable >> approach so long as the query data being sent to AS112 servers is >> recognised to be junk that only leaks by accident; since it's >> generally private network PTR query traffic the potential for >> exploitation by bad actors (malicious AS112 node operators) is >> arguably low. >>=20 >> However, in the case of these doh resolver domains, there is the >> potential for a bad actor to respond with an unauthorised list of >> DoH URIs and steal the resolver traffic of a large array of >> end-users whose local (or configured) resolvers don't implement the >> mechanisms described in this draft. This would be a bit like DNS >> changer, but without the need to infect individual end-hosts.. >>=20 >> I think this a problem. >>=20 >> I think (in contrast to the thought at the microphone) if we >> mention blackholing at all it ought to be of the form "don't ever >> do this because it would be bad for the following reasons". >>=20 >>=20 >> Joe >=20 >=20 >=20 > _______________________________________________ Doh mailing list=20 > Doh@ietf.org https://www.ietf.org/mailman/listinfo/doh >=20 --------------473BDA7ECA585E3E239D9372 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------473BDA7ECA585E3E239D9372-- --kd9Os55cBJrejkGpFrfqFqqdcT1C6Tk7c-- --ZTxeMZowhiAkJba8vYxCCtQPb5mNo8xQL Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyaKoMACgkQWrL68XsX K+rl1w//ZrZ+J9wtOFSwM8nevey9+hRHc0BTxZS7hgJ+tMrABpM9ELvKoIejnAdL m+zCkV9wRWW8CAGn2VikuwkC0WOT0cmlqUJEzTeU8d4SnIfCW12D7bveutiCYl3Y u4jFOvpweR5bQ4CCp0i2kPHywE7qflyk+KFJw9w7CTLXO2PnWgENeixbkq2+5S5d 1SOoX1BjHbHpFk/I6ZyF4w73OPdacPgqcppadyjoC4FiZtWlIukpz30W7Ep6TrOa f0NKs7LSU3Paq+2K3xMNUlTqc4xc90eEQe9vLujxyXv8ZxpoyuIDvHwW3BicPpBg dxrpCK5yhfqmE5LrISbftnsksjbAT+hyso9ankH/HJRlqcVGr4EEK+prAP8GLVRf htDCszGAlOMEmRUQyw5PJNtnkH4OWkPNhIf0TOaS/RFkQ/1lYOOYO1zRVmJFUExF c/BeqtsZc4vOsui8x9EdcQm+XIGmGGIjA8f0HmOWwC46bfrXGBqOQ4XkHZP0H3bp avS58BdcGdvI47THIiGuxTdSdxs9ESAPUVDzCDT3Wj+3ZI+ibdJAlvtCj8KiFBkW 8OBjFiDqBF3zGRvDJON3mMXECkmWpmPDGBmdyFOQMlPcFr1Op4cD03WexLiY8Tj8 Cqou+IEo2IASp4jZwRl1vF+R6bUa1xDdr0UgQVnbeIe+OPYB0vQ= =HFuo -----END PGP SIGNATURE----- --ZTxeMZowhiAkJba8vYxCCtQPb5mNo8xQL-- From nobody Tue Mar 26 06:47:17 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0BB5212006A for ; Tue, 26 Mar 2019 06:47:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RZYmfxG3tLs6 for ; Tue, 26 Mar 2019 06:47:14 -0700 (PDT) Received: from mail-qk1-x734.google.com (mail-qk1-x734.google.com [IPv6:2607:f8b0:4864:20::734]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1BE8A1202D1 for ; Tue, 26 Mar 2019 06:47:14 -0700 (PDT) Received: by mail-qk1-x734.google.com with SMTP id c189so7606274qke.6 for ; Tue, 26 Mar 2019 06:47:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to; bh=ddsl8IyCxejzQHvbUm2WGhBrlZwBQs0/Gu9cq6lGymM=; b=CSsGC7KBmV7lZNfg/XIxCTmlUQfYzzt2ipI7cBhCvdRU02SRQ1b04/z51CcHIGr4zJ 9qXRI7uksopZNxzkEIIdZSdDFMBEDB4wyaXCGusXbfzGJwbKkNGR5k0qICgh3Fi0DXGK /N1ih974mrTf3Fx+zbuvU0fDFKM6b98xAw8aVUzorvCohcIQOlJhID7LXEKvU7DUTtM9 6LRCPNFuyJhZ5Vw4BRcKXiTYCwzd6ZrqLVBbYJMsVY/j0yo864QjIKY5b58cygnwIJE6 2Tyb8SKAqr/cX//9rkANOLKNkD6k11sTKMFTy/F0RHq9enuStInbi0zM3wPRD8VzD+8q q3Pw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=ddsl8IyCxejzQHvbUm2WGhBrlZwBQs0/Gu9cq6lGymM=; b=MiAQHThd11Oq9eXvvGdUfXPsa4Yc4asqvmg/kkQwWz2VBytj9fnSSky6NtOQakgRsF HwxDRsDNnNmzHtjp4Cz4jUXMp6BglSpuKPBOV/N7pxnw/656izyHGKfLkRNU6tZgiS53 Pol81N1N+AXmnG4QKzaZ1Vxnf11mXSyAR6oKFcshdbF6hfdFKLpa0i4+piOEmVcFnseo NU3Jejkfo/VVv2wZieN0EE/jBiP+Jhdw2zWvaiWY2XdKn2vt3J3lfYiS+FmG9uFQ66fp zVYgtliZ59t1FAvy3yHmAKAWUO5JxjTvmVXatyHdMefZzWO2/2SeABYjH9O5BGR6IGFI CotA== X-Gm-Message-State: APjAAAWfDA6hdNFjorvlNO+VXDNmdJwlOum6DglHE/Ze/7oL5laoI/QK HZYVpPQVOQCzWVc8iOLpt+qQk0nEPXpJUHi2QC93I2Wh X-Google-Smtp-Source: APXvYqxSpYziWs8OnysvcGgnkD/bO6jybHvrvVIr/pf2XBY+ZqUDkirsj3FyDIEvbxV8AVv93gMG5kH2px1sFFbG9ro= X-Received: by 2002:a37:6814:: with SMTP id d20mr25170192qkc.102.1553608032832; Tue, 26 Mar 2019 06:47:12 -0700 (PDT) MIME-Version: 1.0 From: Brian Dickson Date: Tue, 26 Mar 2019 14:47:01 +0100 Message-ID: To: DoH WG Content-Type: multipart/alternative; boundary="000000000000ead0830584ff8e71" Archived-At: Subject: [Doh] Resolver-associated comments (mike follow-up) X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 13:47:16 -0000 --000000000000ead0830584ff8e71 Content-Type: text/plain; charset="UTF-8" Hi, DoH folks, At the mike I had some comments, but it was recommended I put them on-list. This is that. One of the non-obvious challenges in any migration from a strict DNS-over-UDP to anything else, is that there are some interesting DNS topologies involving DNS Forwarders. The basic UDP resolution path would generally be: stub -> forwarder -> [forwarder ->][...] -> recursive/iterative resolver This creates ambiguity in any single-common-name response(s) in elevating from Do53 to Do{HT}. Upgrades from traditional DNS forwarder, to Do{TH}, possibly still acting as a forwarder, is the fundamental issue. It is possible that more than one forwarder is upgraded. It is also not possible to determine which forwarder(s) have upgraded. Since Do{TH} involves the client placing a significant amount of trust (for privacy, security, and data integrity) in the upgraded server, this seems important. The idea is that a client would first do discovery of the names of upgraded servers, and that the client would then select from those names (either via configured preferences, or via a UI), and use that name for Do{TH} connection to the selected server, explicitly and by name. This would facilitate TLS validation of the name, which I believe improves the security in ways that the current mechanisms don't seem to do. I suspect this would require a new reserved query name or possibly new opcode for the query. It might require that the first responding server discover its upstream forwarder/resolver name, and return both those upstream names plus its own name. It does involve some degree of trust and transitive trust, but the configuration of a DNS server inherently involves trust. These are just initial thoughts, but I think there is potential solutions, or at least problems, that might be in the above stuff. Comments welcome. Brian --000000000000ead0830584ff8e71 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi, DoH folks,

At the mike I had some c= omments, but it was recommended I put them on-list. This is that.

One of the non-obvious challenges in any migration from a s= trict DNS-over-UDP to anything else, is that there are some interesting DNS= topologies involving DNS Forwarders.

The basic UD= P resolution path would generally be:
stub -> forwarder -> = [forwarder ->][...] -> recursive/iterative resolver=C2=A0
<= br>
This creates ambiguity in any single-common-name response(s) = in elevating from Do53 to Do{HT}.

Upgrades from tr= aditional DNS forwarder, to Do{TH}, possibly still acting as a forwarder, i= s the fundamental issue. It is possible that more than one forwarder is upg= raded. It is also not possible to determine which forwarder(s) have upgrade= d. Since Do{TH} involves the client placing a significant amount of trust (= for privacy, security, and data integrity) in the upgraded server, this see= ms important.

The idea is that a client would firs= t do discovery of the names of upgraded servers, and that the client would = then select from those names (either via configured preferences, or via a U= I), and use that name for Do{TH} connection to the selected server, explici= tly and by name. This would facilitate TLS validation of the name, which I = believe improves the security in ways that the current mechanisms don't= seem to do.

I suspect this would require a new re= served query name or possibly new opcode for the query.

It might require that the first responding server discover its upstre= am forwarder/resolver name, and return both those upstream names plus its o= wn name.=C2=A0

It does involve some degree of trus= t and transitive trust, but the configuration of a DNS server inherently in= volves trust.

These are just initial thoughts, but= I think there is potential solutions, or at least problems, that might be = in the above stuff.

Comments welcome.
Brian
--000000000000ead0830584ff8e71-- From nobody Tue Mar 26 08:32:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7AB1F1203CA for ; Tue, 26 Mar 2019 08:32:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.2 X-Spam-Level: X-Spam-Status: No, score=-1.2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_BOUND_DIGITS_15=0.798, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cWucWuf-FPPb for ; Tue, 26 Mar 2019 08:32:27 -0700 (PDT) Received: from mail-it1-x12f.google.com (mail-it1-x12f.google.com [IPv6:2607:f8b0:4864:20::12f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9F0361203E9 for ; Tue, 26 Mar 2019 08:31:58 -0700 (PDT) Received: by mail-it1-x12f.google.com with SMTP id 139so20675607ita.4 for ; Tue, 26 Mar 2019 08:31:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=zalkdL9cppTUksuu9vmMgFUTDM7JoaVKHwEw4gzwv60=; b=Z9cgFqguMk3UFe4H9830FZFRdCJkOj6AYZTxgVckapo3oS9QRK6nC7TBP61hHvoWdS uJcZVKIZVXEqkzuPIgdqCLkywamglKt/BPX0RXhVjLyNwLU/PRjP9vQbo6jCy/Rmbngv KGt3Aev0lbPioDAs2GpfCRMDHygC1B88ad/AJmnW1sswCVNPoUu4uwFiVTiPZel92zhH B4kBKnZK5vUHDbX08iBo9h+BlcS6k5uzXirKUflBwXMy7JrRIU4IgwvBHai6HXWoPUVn liCIDzO9l2bGNkNDjq76nVJpZTYKyE0EUcT17Bhud1cA+xDo8yrxxU8ouVrAZAD0NxXi y30g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=zalkdL9cppTUksuu9vmMgFUTDM7JoaVKHwEw4gzwv60=; b=JY9DGzquq3INBQZqhmh1OFyp3UAlC+/nYipkXskjAyGT/SiF+HSa+TBFvpn5d1Lg62 0iC6/7c+T29dI9MkLo8Zy5tjtArzSlSuM+PHAcpGfKA9JxA73QPBdW4Oj7CjbcvzwELH 7IGFPYv+WKPZclLrxCIMTxuqcmGRw50Ha+JttII+m8MM9Gtut0erGtjmKLPapiZKVruX MSpWys8b3cBqNpbrlUqvt43f1/1b/58ECPBKXlHo6OJxJqXHij/a8ZT57LmL2IzDERrv DzY0QiQ3H2FbznEIVhzQajxV0pXPo1N8AuHmGo7eRiWo9ZvbT/T8+q5rBWJUBJzLiqui yObQ== X-Gm-Message-State: APjAAAXauNVC/nQpKIVuLUvnGh6kBwc2UdjdkhE7565NeO7wigrr8dOx TqCSwNjdPoAcVQqdZtV910tBj5d8PBoO047lW3U= X-Google-Smtp-Source: APXvYqxZ7hljSuMyVH1j+pkXNem5LocN7nmxGWBj028rRA8gvE6pJzbkpqNyIT5Vw7doyJ9pOqNuDdIc0AbRzda8uHg= X-Received: by 2002:a24:5f8c:: with SMTP id r134mr703047itb.110.1553614317686; Tue, 26 Mar 2019 08:31:57 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Ted Hardie Date: Tue, 26 Mar 2019 16:31:30 +0100 Message-ID: To: Joe Abley Cc: DoH WG Content-Type: multipart/alternative; boundary="0000000000008612090585010566" Archived-At: Subject: Re: [Doh] on blackholing resolver-associated-doh.arpa and resolver-associated-doh.arpa X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 15:32:30 -0000 --0000000000008612090585010566 Content-Type: text/plain; charset="UTF-8" Hi Joe, When I sent the text (as requested), I just grabbed a copy of the text from RFC 8375, Section 7. That suggests pointing to 'blackhole-1.iana.org.' and 'blackhole-2.iana.org.' which the AS112 project augments. The issue that these were built to solve, a high load of queries to .arpa for queries leaking into the zone, seems like it might apply to this special use name. DNAME is theoretically possible instead, but the .arpa server operators have historically been slow to take up the idea of using DNAME (they did not agree for .home.arpa). I have no objection to trying again, of course, if that is preferred. I agree that there is a possible issue here, and I would support documenting it. But since the basic trust model I'd suggest for a doh server discovered this way is equivalent to "something scrawled on the wall of a coffee shop", I think this situation (in which they are not recognized locally as special use names, and the particular anycast AS112 server answering the leaked query is an attacker) is pretty much par for a pretty rough course. Ted On Tue, Mar 26, 2019 at 12:18 PM Joe Abley wrote: > Hi all, > > There was a suggestion at the microphone this morning in the Grand > Ballroom that the resolver-associated-doh.arpa and > resolver-associated-doh.arpa domains be "blackholed". The draft currently > specifies that these MUST NOT be delegated from ARPA. > > The microphone queue was already cut off before I could ask more about > what this means, but I think it's worth reminding the wg what blackhole > generally means in this context of DNS names in and near ARPA, and how it > can be implemented, since I think there is a security concern. > > RFC 7534 provides two mechanisms to blackhole DNS traffic: one uses DNAME > (see RFC 7535) and the other uses a zone cut. The DNAME approach is > technically compatible with the MUST NOT in the draft (since it's > technically not a delegation but rather a redirection) but the direct > delegation mechanism is not. > > In both cases, however, blackholing these domains would point their DNS > resolution away from the authoritative servers that serve ARPA towards a > loosely-coordinated set of AS112 servers. > > Anybody can operate an AS112 server; in fact, operators have in the past > been actively encouraged to operate AS112 servers without any requirement > for coordination. This has been considered a reasonable approach so long as > the query data being sent to AS112 servers is recognised to be junk that > only leaks by accident; since it's generally private network PTR query > traffic the potential for exploitation by bad actors (malicious AS112 node > operators) is arguably low. > > However, in the case of these doh resolver domains, there is the potential > for a bad actor to respond with an unauthorised list of DoH URIs and steal > the resolver traffic of a large array of end-users whose local (or > configured) resolvers don't implement the mechanisms described in this > draft. This would be a bit like DNS changer, but without the need to infect > individual end-hosts.. > > I think this a problem. > > I think (in contrast to the thought at the microphone) if we mention > blackholing at all it ought to be of the form "don't ever do this because > it would be bad for the following reasons". > > > Joe > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --0000000000008612090585010566 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Joe,
<= br>
When I sent the text (as requested), I just grabbed a copy of= the text from=C2=A0 RFC 8375, Section 7.=C2=A0 That suggests pointing to &= #39;blackhole-1.iana.org.' = and 'blackhole-2.iana.org.&= #39;=C2=A0 which the AS112 project augments.=C2=A0 The issue that these wer= e built to solve, a high load of queries to .arpa for queries leaking into = the zone, seems like it might apply to this special use name.
DNAME is theoretically possible instead, but the .arpa server o= perators=C2=A0 have historically been slow to take up the idea of using DNA= ME (they did not agree for .home.arpa).=C2=A0 I have no objection to trying= again, of course, if that is preferred.

I agree t= hat there is a possible issue here, and I would support documenting it.=C2= =A0 But since the basic trust model I'd suggest for a doh server discov= ered this way is equivalent to "something scrawled on the wall of a co= ffee shop", I think this situation (in which they are not recognized l= ocally as special use names, and the particular anycast AS112 server answer= ing the leaked query is an attacker) is pretty much par for a pretty rough = course.

Ted


On Tue, Mar 26, 2019 at 12:18 PM Joe Abley <jabley@hopcount.ca> wrote:
= Hi all,

There was a suggestion at the microphone this mo= rning in the Grand Ballroom that the=C2=A0resolver-associated-doh.arpa and = resolver-associated-doh.arpa domains be "blackholed". The draft c= urrently specifies that these MUST NOT be delegated from ARPA.
The microphone queue was already cut off before I could ask mo= re about what this means, but I think it's worth reminding the wg what = blackhole generally means in this context of DNS names in and near ARPA, an= d how it can be implemented, since I think there is a security concern.

RFC=C2=A07534 pro= vides two mechanisms to blackhole DNS traffic: one uses DNAME (see RFC 7535= ) and the other uses a zone cut. The DNAME approach is technically compatib= le with the MUST NOT in the draft (since it's technically not a delegat= ion but rather a redirection) but the direct delegation mechanism is not.

<= font size=3D"2">In both cases, however, blackholing these domains would poi= nt their DNS resolution away from the authoritative servers that serve ARPA= towards a loosely-coordinated set of AS112 servers.

Anybody can operate an A= S112 server; in fact, operators have in the past been actively encouraged t= o operate AS112 servers without any requirement for coordination. This has = been considered a reasonable approach so long as the query data being sent = to AS112 servers is recognised to be junk that only leaks by accident; sinc= e it's generally private network PTR query traffic the potential for ex= ploitation by bad actors (malicious AS112 node operators) is arguably low.<= /font>

Ho= wever, in the case of these doh resolver domains, there is the potential fo= r a bad actor to respond with an unauthorised list of DoH URIs and steal th= e resolver traffic of a large array of end-users whose local (or configured= ) resolvers don't implement the mechanisms described in this draft. Thi= s would be a bit like DNS changer, but without the need to infect individua= l end-hosts..

I think this a problem.

<= /font>
I think (in contrast to the thought at th= e microphone) if we mention blackholing at all it ought to be of the form &= quot;don't ever do this because it would be bad for the following reaso= ns".


Joe
______= _________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--0000000000008612090585010566-- From nobody Tue Mar 26 15:46:44 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC1731200FA for ; Tue, 26 Mar 2019 15:46:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.647 X-Spam-Level: X-Spam-Status: No, score=-1.647 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VljnxSxXrlzs for ; Tue, 26 Mar 2019 15:46:40 -0700 (PDT) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A5031200F8 for ; Tue, 26 Mar 2019 15:46:40 -0700 (PDT) Received: by mail-wm1-f50.google.com with SMTP id z6so3447975wmi.0 for ; Tue, 26 Mar 2019 15:46:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ojHqcbaHfbwuNOnhIDW2feSB+0oBGyCxWPTrZIBPyiw=; b=lt4v7YSATuoCSavQtWEMMp10n7paaqsInVWC5kMs2/u3LZHqj4WvcK0eS3S/WzrruG bqgwAS5IhdGoed1fvxv6845kdLNoi8GcA9pQF6ZRtOZLgzmQHN4GhqT/bJlfi/aseenN h4kA5FHh7KtX98Ukc5KNIY8ZZPTxDPUqQ3IGEz2QEwJ2OB7AUdr2llFTAFMmKWCDDdu4 q5BlCptl54K2ax51Uc44PMvNGFtlYiyPCZvxQQH4tRrC2TYPYfFbjNzOR8KPUQeFCnyA HSE/szxt1KMSlESLzlJB+pp3YznP8pgwsZe3gxf8lBP7hla+EnABe8zfV+u7cR3XozAG 7pJQ== X-Gm-Message-State: APjAAAWWk7Br6EXy7+vlyFQ7eYZ5KMEy1nJV2xZHBe+HAepS8ZKUpUqX DMX5YOBCD/UCup0Kpatd1nv87InfmSBGE7oNC9o= X-Google-Smtp-Source: APXvYqzrkvpHUIYjneqoIFV2HnetINDSU56JMVo8Agk47cqkMKM2i7jgK8zstzfwhKQ3FPUCk6v3XwpsAUnzrQfJSXQ= X-Received: by 2002:a1c:98c9:: with SMTP id a192mr11455221wme.44.1553640398158; Tue, 26 Mar 2019 15:46:38 -0700 (PDT) MIME-Version: 1.0 References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> In-Reply-To: From: Erik Nygren Date: Tue, 26 Mar 2019 18:46:26 -0400 Message-ID: To: Patrick McManus Cc: tirumal reddy , nusenu , DoH WG Content-Type: multipart/alternative; boundary="0000000000000a838605850718fd" Archived-At: Subject: Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 Mar 2019 22:46:42 -0000 --0000000000000a838605850718fd Content-Type: text/plain; charset="UTF-8" On Tue, Mar 26, 2019 at 6:26 AM Patrick McManus wrote: > > right. The weakness here is that validating a name that probably comes > from an unauthenticated source is not a very strong signal. That seems > inherent in the draft, but maybe worth calling out more explicitly. > Right. It typically comes from unauthenticated DHCP or RDNSS. One thought I've pondered is whether there is a way to apply policy to the hostname in the DoH template URL, as that is an authenticated hostname. For example, clients could validate against a blacklist of known-bad DoH server hostnames/domains. This may not scale well enough to be viable. But we are inherently getting unauthenticated data from an unauthenticated source. But that unauthenticated data is something which is possible to authenticate and possibly authorize based on the hostname. A similar model is done in Provisioning Domains where unauthenticated PvDs come from the network and are used to construct well-known URLs: https://tools.ietf.org/html/draft-ietf-intarea-provisioning-domains-04 How to make this practical is where I get stuck. :-) Erik --0000000000000a838605850718fd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Mar 26, 2019 at 6:26 AM Patrick McManus <mcmanus@ducksong.com> wrote:

right. The weakness here is that validating a name that probabl= y comes from an unauthenticated source is not a very strong signal. That se= ems inherent in the draft, but maybe worth calling out more explicitly.

Right.=C2=A0 It typically comes from un= authenticated DHCP or RDNSS.=C2=A0

One thought I've pondered is= whether there is a way to apply policy to the hostname in the DoH template= URL, as that is an authenticated hostname.=C2=A0 For example, clients coul= d validate against a blacklist of known-bad DoH server hostnames/domains.= =C2=A0 This may not scale well enough to be viable.=C2=A0 But we are inhere= ntly getting unauthenticated data from an unauthenticated source.=C2=A0 But= that unauthenticated data is something which is possible to authenticate a= nd possibly authorize based on the hostname.

A similar model is done in = Provisioning Domains where unauthenticated PvDs come from the network and a= re used to construct well-known URLs:=C2=A0 https://tools.ietf.org/= html/draft-ietf-intarea-provisioning-domains-04

How to make this pra= ctical is where I get stuck.=C2=A0 :-)

=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0 Erik




--0000000000000a838605850718fd-- From nobody Tue Mar 26 17:05:23 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 63349120145 for ; Tue, 26 Mar 2019 17:05:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sdetMv9S1ult for ; Tue, 26 Mar 2019 17:05:19 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BB4F712010F for ; Tue, 26 Mar 2019 17:05:19 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id v4so12504213ioj.5 for ; Tue, 26 Mar 2019 17:05:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=NSZn0SSn0T34ScY4qCrDpk7FXWyffn4fK4IAzV+ZslE=; b=WZrACULY6CfXTEupfTHNK94dWs1fJCQNHGA4VQx7MhFG33F6xZm8X1f+g9wbevZsbe kP4xJB/P70Jom4NnClYiJ0DlbDf8WijiAMoN5pRqqqbkR3WhtXTt55s1XUW+0MqHeIdk KHzLZRhsNmbr4ae1zfqfPQoplxA6A8TQGO8YH+Ni2mOHvPjkl9xJZoynqnGvMj1l0kKN 7QjGZXUAN6HOTeEAVX6zuqmKNRwm//PziS5+xqqp2c9F4CbMGZMVp8jCX2RRck55Pcir pGHITd815rEildSpW4g3SEXHBjTqcSRVseKng0SURIpbU6d9lafq0BNNyC2czSlpFh5G WAKA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=NSZn0SSn0T34ScY4qCrDpk7FXWyffn4fK4IAzV+ZslE=; b=jouB33ER/TbadeXIZW3HSsgqtmsuouk4N2qtHe19thc1ryFiCUxrJx3Ve3/YKOdmUD sv+h5LgGQpUJicE5m3sDIX/+mHbEHQAYShC0kz2R7E94SebGf2U4t5NtrMuk07Krdk6M PCZYr/pi/YVG58ltKCG7RTyQ+Pi0T/3YlZSP4OCeBr5+m5Mu7+qPah19afc2QjE1xja8 CGXJrwn0RuEmH+Vw8uKMELoU0csQe25h1o53Kw2DRR132oGn9c2nPA38CJFuzVvFeEMY YT8emu+6vhlvFcw0IqbevL3wVEjIVsfAdWZbg0o9IQQtIDbME2BbF49czHc6Rr2Uk7Hb uFQw== X-Gm-Message-State: APjAAAU2A+hAuSmRXf8thTx7v0totLc4WC3Z1gkGICAzNtlbcW80qzIi RcECS3p4JH4ehasEsK14VieJbnfbLCw7xGjyo9YA6Q== X-Google-Smtp-Source: APXvYqxhmZKw9tTQNgjOnO3fOIGBMIB6CZSkAL4icGAjqbjr3nANzW7juXAefAmSKOBDeFCO4vsXP+5II0txID5bn5E= X-Received: by 2002:a6b:691a:: with SMTP id e26mr19944952ioc.124.1553645117879; Tue, 26 Mar 2019 17:05:17 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Matthew Pounsett Date: Wed, 27 Mar 2019 01:05:05 +0100 Message-ID: To: Ted Hardie Cc: Joe Abley , DoH WG Content-Type: multipart/alternative; boundary="0000000000005bd5760585083189" Archived-At: Subject: Re: [Doh] on blackholing resolver-associated-doh.arpa and resolver-associated-doh.arpa X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 00:05:22 -0000 --0000000000005bd5760585083189 Content-Type: text/plain; charset="UTF-8" On Tue, 26 Mar 2019 at 16:32, Ted Hardie wrote: > > I agree that there is a possible issue here, and I would support > documenting it. But since the basic trust model I'd suggest for a doh > server discovered this way is equivalent to "something scrawled on the wall > of a coffee shop", I think this situation (in which they are not recognized > locally as special use names, and the particular anycast AS112 server > answering the leaked query is an attacker) is pretty much par for a pretty > rough course. > > I think it's worse than that. What we're talking about doing is implementing WPAD all over again. --0000000000005bd5760585083189 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Tue, 26 Mar 2019 at 16:32, Ted Har= die <ted.ietf@gmail.com> wr= ote:

I agree that th= ere is a possible issue here, and I would support documenting it.=C2=A0 But= since the basic trust model I'd suggest for a doh server discovered th= is way is equivalent to "something scrawled on the wall of a coffee sh= op", I think this situation (in which they are not recognized locally = as special use names, and the particular anycast AS112 server answering the= leaked query is an attacker) is pretty much par for a pretty rough course.=


I think it'= ;s worse than that.=C2=A0 What we're talking about doing is implementin= g WPAD all over again.=C2=A0
--0000000000005bd5760585083189-- From nobody Wed Mar 27 01:24:24 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 24BDD120273 for ; Wed, 27 Mar 2019 01:24:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xrW-Jy3N08gn for ; Wed, 27 Mar 2019 01:24:19 -0700 (PDT) Received: from EUR01-DB5-obe.outbound.protection.outlook.com (mail-eopbgr150070.outbound.protection.outlook.com [40.107.15.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D6DE012026B for ; Wed, 27 Mar 2019 01:24:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=v8cwwSM0GjRpRRrOYSdV91phZjQ1lXscAJUMIwjzNw8=; b=PWR1zWn+nU2KjJGahsvGyi57ZSrFtbImwH3/iCeR4XZW5BYkpo5GqRTqIQ20f41O4ZHFXBv16CKum3ZNh8K9IXxvfgHj/cUE4xQhm9CvR8ZxGcAFoj/+yRDDr2s2yBhm5AY0w7khOuf/NP85R6RwHkLaaQiRVHYivthHuxxajxI= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2229.eurprd06.prod.outlook.com (10.168.56.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.18; Wed, 27 Mar 2019 08:24:16 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93%9]) with mapi id 15.20.1730.019; Wed, 27 Mar 2019 08:24:16 +0000 From: "Winfield, Alister" To: Erik Nygren , Patrick McManus CC: nusenu , DoH WG , tirumal reddy Thread-Topic: [EXTERNAL] Re: [Doh] Authentication in draft-ietf-doh-resolver-associated-doh-03.txt Thread-Index: AQHU40DcPma2NqMb50ShukyAax+Nt6Ydmo2AgAAbcwCAAM77AIAAsiWA Date: Wed, 27 Mar 2019 08:24:15 +0000 Message-ID: <05171615-9239-4832-9150-521F15058205@sky.uk> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> <236b4e32-3184-9792-a162-e3db3d09922b@riseup.net> In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [2001:67c:1232:144:bd2e:1f62:64fa:7da7] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 30329652-fbc1-43ff-17c0-08d6b28d99d6 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2229; x-ms-traffictypediagnostic: DB6PR0601MB2229: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-forefront-prvs: 0989A7979C x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(376002)(346002)(366004)(39860400002)(396003)(136003)(199004)(189003)(478600001)(68736007)(81166006)(316002)(4326008)(71200400001)(229853002)(54906003)(7736002)(97736004)(486006)(6116002)(8676002)(81156014)(6486002)(82746002)(256004)(14444005)(74482002)(966005)(5024004)(6512007)(83716004)(46003)(106356001)(110136005)(54896002)(93886005)(86362001)(36756003)(53936002)(8936002)(186003)(11346002)(6246003)(33656002)(236005)(99286004)(6436002)(76176011)(102836004)(53546011)(6506007)(72206003)(71190400001)(2616005)(476003)(606006)(446003)(58126008)(25786009)(14454004)(5660300002)(2906002)(6306002)(105586002); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2229; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:0; MX:1; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: /vOd/HhKwN5UfE6IiQUCZlTccG/fgF3rfhNmg/11Q7OB60Wz6HqhRyOITR4rHxZhQLuzqvgvaDNXh41hmhkAOI/XN5+RH5LSRBUz1YW92vcS4hP+FkBVkm5Mxn1KGhmtfETHW58UFdwA5SqIhcM3IZJnArq9CCwhylBwxNZxuJW+78uSK+iNvEd+FscSOqTBbvqYVPek0sm9ikIowTlsmvG0aWU45UKBBzttNjy4g1dFpKl8muyetW3WpXvchQ5dtlJ0hER139CExPp0VDSqeylSBD9e1a0VSrEU9WHPH+IPhXGWa2e9zqkR0Vpit73lQszFZA18LiWguyD/vuewEmceGewR0gSyJRj3AFE5AZqL1nJlePmhVIMl6eugcLaTAaEkUhRb3FjIY7zhmCfZBxthdFNp767SztOr1PiSH94= Content-Type: multipart/alternative; boundary="_000_05171615923948329150521F15058205skyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 30329652-fbc1-43ff-17c0-08d6b28d99d6 X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Mar 2019 08:24:15.8750 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2229 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: Authentication in draft-ietf-doh-resolver-associated-doh-03.txt X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 08:24:22 -0000 --_000_05171615923948329150521F15058205skyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQpPbiBUdWUsIE1hciAyNiwgMjAxOSBhdCA2OjI2IEFNIFBhdHJpY2sgTWNNYW51cyA8bWNtYW51 c0BkdWNrc29uZy5jb208bWFpbHRvOm1jbWFudXNAZHVja3NvbmcuY29tPj4gd3JvdGU6DQoNCnJp Z2h0LiBUaGUgd2Vha25lc3MgaGVyZSBpcyB0aGF0IHZhbGlkYXRpbmcgYSBuYW1lIHRoYXQgcHJv YmFibHkgY29tZXMgZnJvbSBhbiB1bmF1dGhlbnRpY2F0ZWQgc291cmNlIGlzIG5vdCBhIHZlcnkg c3Ryb25nIHNpZ25hbC4gVGhhdCBzZWVtcyBpbmhlcmVudCBpbiB0aGUgZHJhZnQsIGJ1dCBtYXli ZSB3b3J0aCBjYWxsaW5nIG91dCBtb3JlIGV4cGxpY2l0bHkuDQoNClJpZ2h0LiAgSXQgdHlwaWNh bGx5IGNvbWVzIGZyb20gdW5hdXRoZW50aWNhdGVkIERIQ1Agb3IgUkROU1MuDQoNCk9uZSB0aG91 Z2h0IEkndmUgcG9uZGVyZWQgaXMgd2hldGhlciB0aGVyZSBpcyBhIHdheSB0byBhcHBseSBwb2xp Y3kgdG8gdGhlIGhvc3RuYW1lIGluIHRoZSBEb0ggdGVtcGxhdGUgVVJMLCBhcyB0aGF0IGlzIGFu IGF1dGhlbnRpY2F0ZWQgaG9zdG5hbWUuICBGb3IgZXhhbXBsZSwgY2xpZW50cyBjb3VsZCB2YWxp ZGF0ZSBhZ2FpbnN0IGEgYmxhY2tsaXN0IG9mIGtub3duLWJhZCBEb0ggc2VydmVyIGhvc3RuYW1l cy9kb21haW5zLiAgVGhpcyBtYXkgbm90IHNjYWxlIHdlbGwgZW5vdWdoIHRvIGJlIHZpYWJsZS4g IEJ1dCB3ZSBhcmUgaW5oZXJlbnRseSBnZXR0aW5nIHVuYXV0aGVudGljYXRlZCBkYXRhIGZyb20g YW4gdW5hdXRoZW50aWNhdGVkIHNvdXJjZS4gIEJ1dCB0aGF0IHVuYXV0aGVudGljYXRlZCBkYXRh IGlzIHNvbWV0aGluZyB3aGljaCBpcyBwb3NzaWJsZSB0byBhdXRoZW50aWNhdGUgYW5kIHBvc3Np Ymx5IGF1dGhvcml6ZSBiYXNlZCBvbiB0aGUgaG9zdG5hbWUuDQoNCllvdSBjb3VsZCBlcXVhbGx5 IHN0YXRlIHRoYXQgdGhlIHVzZXIgaGFzIHRvIOKAmGFwcHJvdmXigJkgYWxsIG5ldyBEb0ggdGVt cGxhdGVzLiBFYWNoIGhhcyBpdHMgb3duIGlzc3VlcyBhbmQgaW4gYW55IHJlYXNvbmFibGUgc2No ZW1lIGl0cyBsaWtlbHkgeW914oCZZCBuZWVkIGJvdGguIE9uZSB0byBjYXB0dXJlIHVzZXJzIGFw cHJvdmFsIHRvIHVzZSBhIHBhcnRpY3VsYXIgRG9IIHByb3ZpZGVyIChpbmNsdWRpbmcgYWNjZXB0 aW5nIHRoZWlyIHByaXZhY3kgcG9saWN5IHQmY+KAmXMgd2hhdGV2ZXIpLiBUaGUgb3RoZXIgc28g dGhhdCBzb21lIGZvcm0gb2YgcG9saWN5IHByb3RlY3RpbmcgdGhlIHVzZXIgZnJvbSBtYWxpY2lv dXMgRG9IIGNhbiBiZSBhcHBsaWVkLiBUaGUgaXNzdWUgaXMgYXMgZXZlciBtYW5hZ2luZyBzdWNo IGxpc3RzIHdpdGhvdXQgY3JlYXRpbmcgdGhlIOKAmGNsaWNrIHRocm91Z2jigJkgcHJvYmxlbSBv biB0aGUgY2hvaWNlcyBzaWRlLiAgKHJlYWQgdXNlcnMgbmV2ZXIgcmVhZCBzdHVmZiB0aGF0IHBv cHMgdXAgdG9vIG9mdGVuKS4gT3IgaXNzdWVzIHdpdGggdGhlIGN1cmF0aW9uIG9mIHRoZSBibGFj a2xpc3QgYW5kIGFyZ3VtZW50cyBvbiB3aGF0IGlzIG1hbGljaW91cyBhbmQgd2hhdCBpcyBnb29k IGZvciB0aGUgdXNlci4NCg0KKE5leHQgaXMgYSB2ZXJ5IGVhcmx5IHRob3VnaHQgc28gSSBtYXkg eWV0IGZpbmQgYSByZWFzb24gbm90IHRvIGxpa2UgaXQpDQoNCkFub3RoZXIgb3B0aW9uIHRoYXQg SeKAmW0gbGlraW5nIG1vcmUgdGhlIGxvbmdlciBJIGNvbnNpZGVyIGl0IGlzIGEgbm90YXJ5IG1l Y2hhbmlzbS4gVGhpcyBpcyBsaWtlIHlvdXIgYmxhY2tsaXN0IGJ1dCBoYXMgcHJvcGVydGllcyB0 aGF0IGF2b2lkIHRoZSB3aG8gYXVkaXRzIC8gcG9saWNlcyB0aGUgbGlzdHMuIFNvIHlvdXIgbm90 YXJpZXMgcHJvdmlkZSB3aGl0ZSBhbmQgYmxhY2sgbGlzdHMgZm9yIERvVC9Eb0ggZXZlbiBEbzUz LiBBbnl0aGluZyBvdXRzaWRlIHRoZSBsaXN0IFNIT1VMRCBwcmVzZW50IHNvbWV0aGluZyB0byB0 aGUgdXNlciB3aXRoIHRoZSBwb2xpY3kgaW5mb3JtYXRpb24gcHJvdmlkZWQuIFllcyB0aGF0IGNv dWxkIGJlIGxpZSBidXQgdGhhdOKAmXMgbm90IHNvbWV0aGluZyB3ZSBjYW4gZml4Lg0KDQpOb3Qg c2F5aW5nIEnigJl2ZSB0aG91Z2h0IHRoaXMgdGhyb3VnaCBjb21wbGV0ZWx5IGJ1dCBpdHMgZmVl bHMgc2NhbGFibGUgYW5kIGRvZXNu4oCZdCBzaWduaWZpY2FudGx5IGltcGVkZSBuZXcgRG9IIHBy b3ZpZGVycy4gVXNlcnMgd2lsbCBzZWxmLXBvbGljZSB0aGUgbm90YXJpZXMgYW5kIHRoYXQgc2lk ZSBjYW4gYmUgYXMgc2ltcGxlIG9yIGNvbXBsaWNhdGVkIGFzIHRoZXkgbGlrZSBpbmNsdWRpbmcg aGF2aW5nIG11bHRpcGxlIGxpc3RzIHdpdGggZGlmZmVyZW50IHByaXZhY3kgcHJvcGVydGllcy4N Cg0KQSBzaW1pbGFyIG1vZGVsIGlzIGRvbmUgaW4gUHJvdmlzaW9uaW5nIERvbWFpbnMgd2hlcmUg dW5hdXRoZW50aWNhdGVkIFB2RHMgY29tZSBmcm9tIHRoZSBuZXR3b3JrIGFuZCBhcmUgdXNlZCB0 byBjb25zdHJ1Y3Qgd2VsbC1rbm93biBVUkxzOiAgaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1s L2RyYWZ0LWlldGYtaW50YXJlYS1wcm92aXNpb25pbmctZG9tYWlucy0wNDxodHRwczovL2V1cjAx LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZ0b29s cy5pZXRmLm9yZyUyRmh0bWwlMkZkcmFmdC1pZXRmLWludGFyZWEtcHJvdmlzaW9uaW5nLWRvbWFp bnMtMDQmZGF0YT0wMiU3QzAxJTdDYWxpc3Rlci53aW5maWVsZCU0MHNreS51ayU3Q2U1ODg4Y2U1 N2U0ZDRlNDYxNDhkMDhkNmIyM2NmNWM4JTdDNjhiODY1ZDVjZjE4NGIyYjgyYTRhNGVkZGI5YzUy MzclN0MwJTdDMCU3QzYzNjg5MjM3MjI2MTMzNDY3OSZzZGF0YT1BN1o3TyUyRk82cVU3cjU0JTJC YUl0ekhlSWZkRFAydWxRJTJGZlBwOExaM1FTYzNJJTNEJnJlc2VydmVkPTA+DQoNCkhvdyB0byBt YWtlIHRoaXMgcHJhY3RpY2FsIGlzIHdoZXJlIEkgZ2V0IHN0dWNrLiAgOi0pDQoNCiAgICAgICBF cmlrDQoNCg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1l bnRzIG1heSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1 c2l2ZWx5IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUg b2ZmaWNpYWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9y LiBJZiB5b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2Vu ZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ug c2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ug b3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2 ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBv dXIgaW50ZXJuYWwgYW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBTS1kgbWFya3Mg YXJlIHRyYWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlvbmFsIEFHIGFu ZCBhcmUgdXNlZCB1bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9u IE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24g Tm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0 aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUx MzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQg KFJlZ2lzdHJhdGlvbiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29tcGFuaWVzIG1lbnRpb25l ZCBpbiB0aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVz IGFuZCBzaGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBHcmFudCBXYXksIElzbGV3 b3J0aCwgTWlkZGxlc2V4IFRXNyA1UUQNCg== --_000_05171615923948329150521F15058205skyuk_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJNYWxndW4g R290aGljIjsNCglwYW5vc2UtMToyIDExIDUgMyAyIDAgMCAyIDAgNDt9DQpAZm9udC1mYWNlDQoJ e2ZvbnQtZmFtaWx5OnRhaG9tYTsNCglwYW5vc2UtMToyIDExIDYgNCAzIDUgNCA0IDIgNDt9DQpA Zm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJcQE1hbGd1biBHb3RoaWMiO30NCi8qIFN0eWxlIERl ZmluaXRpb25zICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJ e21hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5 cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0LWRl Y29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dl ZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVjb3Jh dGlvbjp1bmRlcmxpbmU7fQ0KcC5tc29ub3JtYWwwLCBsaS5tc29ub3JtYWwwLCBkaXYubXNvbm9y bWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1 dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCglt YXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJy aSIsc2Fucy1zZXJpZjt9DQpzcGFuLkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJz b25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0 ZXh0O30NCi5Nc29DaHBEZWZhdWx0DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZv bnQtc2l6ZToxMC4wcHQ7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6NjEyLjBwdCA3OTIu MHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0KZGl2LldvcmRTZWN0 aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPg0KPC9oZWFkPg0KPGJvZHkg bGFuZz0iRU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUiPg0KPGRpdiBjbGFzcz0iV29y ZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0K PGRpdj4NCjxkaXY+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJt YXJnaW4tbGVmdDoxMS41NXB0Ij5PbiBUdWUsIE1hciAyNiwgMjAxOSBhdCA2OjI2IEFNIFBhdHJp Y2sgTWNNYW51cyAmbHQ7PGEgaHJlZj0ibWFpbHRvOm1jbWFudXNAZHVja3NvbmcuY29tIj5tY21h bnVzQGR1Y2tzb25nLmNvbTwvYT4mZ3Q7IHdyb3RlOjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0ND Q0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJn aW4tdG9wOjUuMHB0O21hcmdpbi1yaWdodDowY207bWFyZ2luLWJvdHRvbTo1LjBwdCI+DQo8ZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDoxMS41NXB0 Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MTEuNTVwdCI+cmlnaHQuIFRoZSB3ZWFrbmVz cyBoZXJlIGlzIHRoYXQgdmFsaWRhdGluZyBhIG5hbWUgdGhhdCBwcm9iYWJseSBjb21lcyBmcm9t IGFuIHVuYXV0aGVudGljYXRlZCBzb3VyY2UgaXMgbm90IGEgdmVyeSBzdHJvbmcgc2lnbmFsLiBU aGF0IHNlZW1zIGluaGVyZW50IGluIHRoZSBkcmFmdCwgYnV0IG1heWJlIHdvcnRoIGNhbGxpbmcg b3V0IG1vcmUgZXhwbGljaXRseS48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2Nr cXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEx LjU1cHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjExLjU1cHQiPjxzcGFuIHN0eWxlPSJmb250LWZh bWlseTomcXVvdDt0YWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+UmlnaHQuJm5ic3A7IEl0IHR5cGlj YWxseSBjb21lcyBmcm9tIHVuYXV0aGVudGljYXRlZCBESENQIG9yIFJETlNTLiZuYnNwOw0KPG86 cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1hcmdpbi1sZWZ0OjExLjU1cHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVv dDt0YWhvbWEmcXVvdDssc2Fucy1zZXJpZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjEx LjU1cHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDt0YWhvbWEmcXVvdDssc2Fucy1z ZXJpZiI+T25lIHRob3VnaHQgSSd2ZSBwb25kZXJlZCBpcyB3aGV0aGVyIHRoZXJlIGlzIGEgd2F5 IHRvIGFwcGx5IHBvbGljeSB0byB0aGUgaG9zdG5hbWUgaW4gdGhlIERvSCB0ZW1wbGF0ZSBVUkws IGFzIHRoYXQgaXMgYW4gYXV0aGVudGljYXRlZCBob3N0bmFtZS4mbmJzcDsgRm9yIGV4YW1wbGUs IGNsaWVudHMNCiBjb3VsZCB2YWxpZGF0ZSBhZ2FpbnN0IGEgYmxhY2tsaXN0IG9mIGtub3duLWJh ZCBEb0ggc2VydmVyIGhvc3RuYW1lcy9kb21haW5zLiZuYnNwOyBUaGlzIG1heSBub3Qgc2NhbGUg d2VsbCBlbm91Z2ggdG8gYmUgdmlhYmxlLiZuYnNwOyBCdXQgd2UgYXJlIGluaGVyZW50bHkgZ2V0 dGluZyB1bmF1dGhlbnRpY2F0ZWQgZGF0YSBmcm9tIGFuIHVuYXV0aGVudGljYXRlZCBzb3VyY2Uu Jm5ic3A7IEJ1dCB0aGF0IHVuYXV0aGVudGljYXRlZCBkYXRhIGlzIHNvbWV0aGluZyB3aGljaA0K IGlzIHBvc3NpYmxlIHRvIGF1dGhlbnRpY2F0ZSBhbmQgcG9zc2libHkgYXV0aG9yaXplIGJhc2Vk IG9uIHRoZSBob3N0bmFtZS48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPllvdSBjb3VsZCBlcXVhbGx5IHN0YXRlIHRoYXQgdGhlIHVzZXIgaGFzIHRvIOKAmGFw cHJvdmXigJkgYWxsIG5ldyBEb0ggdGVtcGxhdGVzLiBFYWNoIGhhcyBpdHMgb3duIGlzc3VlcyBh bmQgaW4gYW55IHJlYXNvbmFibGUgc2NoZW1lIGl0cyBsaWtlbHkgeW914oCZZCBuZWVkIGJvdGgu IE9uZSB0byBjYXB0dXJlIHVzZXJzIGFwcHJvdmFsIHRvIHVzZSBhIHBhcnRpY3VsYXIgRG9IIHBy b3ZpZGVyIChpbmNsdWRpbmcgYWNjZXB0aW5nDQogdGhlaXIgcHJpdmFjeSBwb2xpY3kgdCZhbXA7 Y+KAmXMgd2hhdGV2ZXIpLiBUaGUgb3RoZXIgc28gdGhhdCBzb21lIGZvcm0gb2YgcG9saWN5IHBy b3RlY3RpbmcgdGhlIHVzZXIgZnJvbSBtYWxpY2lvdXMgRG9IIGNhbiBiZSBhcHBsaWVkLiBUaGUg aXNzdWUgaXMgYXMgZXZlciBtYW5hZ2luZyBzdWNoIGxpc3RzIHdpdGhvdXQgY3JlYXRpbmcgdGhl IOKAmGNsaWNrIHRocm91Z2jigJkgcHJvYmxlbSBvbiB0aGUgY2hvaWNlcyBzaWRlLiAmbmJzcDso cmVhZCB1c2VycyBuZXZlcg0KIHJlYWQgc3R1ZmYgdGhhdCBwb3BzIHVwIHRvbyBvZnRlbikuIE9y IGlzc3VlcyB3aXRoIHRoZSBjdXJhdGlvbiBvZiB0aGUgYmxhY2tsaXN0IGFuZCBhcmd1bWVudHMg b24gd2hhdCBpcyBtYWxpY2lvdXMgYW5kIHdoYXQgaXMgZ29vZCBmb3IgdGhlIHVzZXIuPC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj4oTmV4dCBpcyBhIHZlcnkgZWFybHkgdGhvdWdodCBzbyBJIG1heSB5ZXQgZmluZCBh IHJlYXNvbiBub3QgdG8gbGlrZSBpdCk8L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZu YnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkFub3RoZXIgb3B0aW9uIHRoYXQg SeKAmW0gbGlraW5nIG1vcmUgdGhlIGxvbmdlciBJIGNvbnNpZGVyIGl0IGlzIGEgbm90YXJ5IG1l Y2hhbmlzbS4gVGhpcyBpcyBsaWtlIHlvdXIgYmxhY2tsaXN0IGJ1dCBoYXMgcHJvcGVydGllcyB0 aGF0IGF2b2lkIHRoZSB3aG8gYXVkaXRzIC8gcG9saWNlcyB0aGUgbGlzdHMuIFNvIHlvdXIgbm90 YXJpZXMgcHJvdmlkZSB3aGl0ZSBhbmQgYmxhY2sgbGlzdHMgZm9yIERvVC9Eb0gNCiBldmVuIERv NTMuIEFueXRoaW5nIG91dHNpZGUgdGhlIGxpc3QgU0hPVUxEIHByZXNlbnQgc29tZXRoaW5nIHRv IHRoZSB1c2VyIHdpdGggdGhlIHBvbGljeSBpbmZvcm1hdGlvbiBwcm92aWRlZC4gWWVzIHRoYXQg Y291bGQgYmUgbGllIGJ1dCB0aGF04oCZcyBub3Qgc29tZXRoaW5nIHdlIGNhbiBmaXguDQo8L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPk5vdCBzYXlpbmcgSeKAmXZlIHRob3VnaHQgdGhpcyB0aHJvdWdoIGNvbXBsZXRl bHkgYnV0IGl0cyBmZWVscyBzY2FsYWJsZSBhbmQgZG9lc27igJl0IHNpZ25pZmljYW50bHkgaW1w ZWRlIG5ldyBEb0ggcHJvdmlkZXJzLiBVc2VycyB3aWxsIHNlbGYtcG9saWNlIHRoZSBub3Rhcmll cyBhbmQgdGhhdCBzaWRlIGNhbiBiZSBhcyBzaW1wbGUgb3IgY29tcGxpY2F0ZWQgYXMgdGhleSBs aWtlIGluY2x1ZGluZyBoYXZpbmcgbXVsdGlwbGUNCiBsaXN0cyB3aXRoIGRpZmZlcmVudCBwcml2 YWN5IHByb3BlcnRpZXMuPC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2lu LWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6JnF1b3Q7dGFob21hJnF1b3Q7 LHNhbnMtc2VyaWYiPkEgc2ltaWxhciBtb2RlbCBpcyBkb25lIGluIFByb3Zpc2lvbmluZyBEb21h aW5zIHdoZXJlIHVuYXV0aGVudGljYXRlZCBQdkRzIGNvbWUgZnJvbSB0aGUgbmV0d29yayBhbmQg YXJlIHVzZWQgdG8gY29uc3RydWN0IHdlbGwta25vd24gVVJMczombmJzcDsNCjxhIGhyZWY9Imh0 dHBzOi8vZXVyMDEuc2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUz QSUyRiUyRnRvb2xzLmlldGYub3JnJTJGaHRtbCUyRmRyYWZ0LWlldGYtaW50YXJlYS1wcm92aXNp b25pbmctZG9tYWlucy0wNCZhbXA7ZGF0YT0wMiU3QzAxJTdDYWxpc3Rlci53aW5maWVsZCU0MHNr eS51ayU3Q2U1ODg4Y2U1N2U0ZDRlNDYxNDhkMDhkNmIyM2NmNWM4JTdDNjhiODY1ZDVjZjE4NGIy YjgyYTRhNGVkZGI5YzUyMzclN0MwJTdDMCU3QzYzNjg5MjM3MjI2MTMzNDY3OSZhbXA7c2RhdGE9 QTdaN08lMkZPNnFVN3I1NCUyQmFJdHpIZUlmZERQMnVsUSUyRmZQcDhMWjNRU2MzSSUzRCZhbXA7 cmVzZXJ2ZWQ9MCI+DQpodHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtaWV0Zi1pbnRh cmVhLXByb3Zpc2lvbmluZy1kb21haW5zLTA0PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjwv ZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtYXJnaW4tbGVmdDozNi4w cHQiPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTomcXVvdDt0YWhvbWEmcXVvdDssc2Fucy1zZXJp ZiI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1sZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiZxdW90O3RhaG9tYSZxdW90OyxzYW5zLXNlcmlmIj5Ib3cgdG8gbWFrZSB0aGlzIHBy YWN0aWNhbCBpcyB3aGVyZSBJIGdldCBzdHVjay4mbmJzcDsgOi0pPG86cD48L286cD48L3NwYW4+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1hcmdpbi1s ZWZ0OjM2LjBwdCI+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiZxdW90O3RhaG9tYSZxdW90Oyxz YW5zLXNlcmlmIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MzYuMHB0Ij48c3BhbiBzdHls ZT0iZm9udC1mYW1pbHk6JnF1b3Q7dGFob21hJnF1b3Q7LHNhbnMtc2VyaWYiPiZuYnNwOyZuYnNw OyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyBFcmlrPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9k aXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIg c3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRv Ij48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PC9w Pg0KPC9kaXY+DQo8L2Rpdj4NCkluZm9ybWF0aW9uIGluIHRoaXMgZW1haWwgaW5jbHVkaW5nIGFu eSBhdHRhY2htZW50cyBtYXkgYmUgcHJpdmlsZWdlZCwgY29uZmlkZW50aWFsIGFuZCBpcyBpbnRl bmRlZCBleGNsdXNpdmVseSBmb3IgdGhlIGFkZHJlc3NlZS4gVGhlIHZpZXdzIGV4cHJlc3NlZCBt YXkgbm90IGJlIG9mZmljaWFsIHBvbGljeSwgYnV0IHRoZSBwZXJzb25hbCB2aWV3cyBvZiB0aGUg b3JpZ2luYXRvci4gSWYgeW91IGhhdmUgcmVjZWl2ZWQgaXQgaW4gZXJyb3IsIHBsZWFzZQ0KIG5v dGlmeSB0aGUgc2VuZGVyIGJ5IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIg c3lzdGVtLiBZb3Ugc2hvdWxkIG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRy YW5zbWl0LCB1c2Ugb3IgZGlzY2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5v dGUgd2UgcmVzZXJ2ZSB0aGUgcmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRp b24gdGhyb3VnaCBvdXIgaW50ZXJuYWwgYW5kDQogZXh0ZXJuYWwgbmV0d29ya3MuIFNLWSBhbmQg dGhlIFNLWSBtYXJrcyBhcmUgdHJhZGVtYXJrcyBvZiBTa3kgTGltaXRlZCBhbmQgU2t5IEludGVy bmF0aW9uYWwgQUcgYW5kIGFyZSB1c2VkIHVuZGVyIGxpY2VuY2UuDQo8YnI+DQo8YnI+DQpTa3kg VUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyOTA2OTkxKSwgU2t5LUluLUhvbWUgU2Vydmlj ZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIwNjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2Vy dmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0 ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkgYXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJz aWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lzdHJhdGlvbg0KIE5vLiAyMjQ3NzM1KS4gQWxs IG9mIHRoZSBjb21wYW5pZXMgbWVudGlvbmVkIGluIHRoaXMgcGFyYWdyYXBoIGFyZSBpbmNvcnBv cmF0ZWQgaW4gRW5nbGFuZCBhbmQgV2FsZXMgYW5kIHNoYXJlIHRoZSBzYW1lIHJlZ2lzdGVyZWQg b2ZmaWNlIGF0IEdyYW50IFdheSwgSXNsZXdvcnRoLCBNaWRkbGVzZXggVFc3IDVRRA0KPC9ib2R5 Pg0KPC9odG1sPg0K --_000_05171615923948329150521F15058205skyuk_-- From nobody Wed Mar 27 02:16:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9298B12042B for ; Wed, 27 Mar 2019 02:16:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X4TDB8gd8MrD for ; Wed, 27 Mar 2019 02:16:45 -0700 (PDT) Received: from mail-lj1-x22e.google.com (mail-lj1-x22e.google.com [IPv6:2a00:1450:4864:20::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C40F120575 for ; Wed, 27 Mar 2019 02:16:45 -0700 (PDT) Received: by mail-lj1-x22e.google.com with SMTP id r24so12632660ljg.3 for ; Wed, 27 Mar 2019 02:16:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=bRkxNxasmELdmJuEH4R4/KkOJBcm+WZ2UmlE+wi1zrc=; b=st5RxO+i02r1NC6PuVCE/2QOU966o2MoJyUTMfdHPnd91R+XzZMfQkOkMs741PCK4U 6mh9eO4aLLlNRNleD42b4rxfJ2Ta0a/47ayOtovnD771vZ5xQAsameI2ANi7qywPbjk5 ohSQ/iExmB99u4IisKhJ3IuuqklV1re21EjTbghLZ6JEF//R9CPcbJBxPC5VZBuFCyZW RwPiTTgCPWb9TMvWUfcbMpGM3risPzEAL6FzqvevaRxLCwn0VDwP8c+Mfa/EF06H142q BgT9irEIT0fTJPigMtvJz7quii17QYQHYy34fCuBsfAY9Iw7pfzhOEb2uQ0kxYhdCP2N jefg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=bRkxNxasmELdmJuEH4R4/KkOJBcm+WZ2UmlE+wi1zrc=; b=saaF3BBzfcV754krmfGtrMItKXExFjhAaFmDdp+sYp2+U6OhacOWX+knd2xk5FvL+k VfdT38m6J99NHu+PJ1xpajyhC03d1AaR40+AibM+8prFfz0gHrg2A9VHQfZ00ySo1+uh B/H/VHjL+L3l2VkrgDLsRTl46j/e6WgRbrFlgLt1lDB3SjNCezdg+H3DVeQckbUJP1Bn g5fRIiYyxaY3AEINeSg2pP9bMRzz0QHSqY75xOnBdEDd0nnR6n0h8sOR8hk8Tl9JRA56 5Fd1aOEEttgdIIsJqb/wG41uVeG1EI2jsGnZyx5QgAk1pz/ov8Jt5Au0jsscUv8e/CEa ccUA== X-Gm-Message-State: APjAAAXKYTcav8QzKonX/7cYxrLt0gyFmylQHdBVK3c74iTKrYHmIDUA JTKFJ7m4PIUgwt2scO/HdlZ82sbWedO1lYjcHUMasGmIIa4= X-Google-Smtp-Source: APXvYqzUMBPhG/ca79C96obwdGerWks4E4tQ1T5eKprm+dEyvf1BWhQE4zk7avcX3Re5A7R0OimZ7/seobouuAVhVJk= X-Received: by 2002:a2e:8905:: with SMTP id d5mr4771432lji.59.1553678202837; Wed, 27 Mar 2019 02:16:42 -0700 (PDT) MIME-Version: 1.0 From: Eric Rescorla Date: Wed, 27 Mar 2019 02:16:05 -0700 Message-ID: To: DoH WG Content-Type: multipart/alternative; boundary="00000000000060308105850fe56d" Archived-At: Subject: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 09:16:58 -0000 --00000000000060308105850fe56d Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I=E2=80=99ve heard a number of questions about Mozilla=E2=80=99s plans arou= nd DoH. We=E2=80=99ve made a number of public statements, but it might be usef= ul to try to put this all in one place. In context, the problem we are attempting to solve here is attack on the user=E2=80=99s name resolution from an attacker with full or partial control of the network, as contemplated by Section 3 of BCP 72 as well as BCP 188. There=E2=80=99s ample evidence of monitoring/manipulation of us= er traffic via this vector [0][1][2]. Importantly, this includes cases where the entity which owns the network infrastructure monitors and/or modifies DNS requests and responses without the user=E2=80=99s consent. With that problem statement, here are our plans: 1. We have implemented DNS over HTTPS [RFC8484] and would like to deploy it by default for our users. We intend to select a set of Trusted Recursive Resolvers (TRRs) that we will use for DoH resolution. TRRs will be required to conform to a specific set of policies intended to protect user privacy. We=E2=80=99re still refining= the final policy but we expect it to roughly match the one that Cloudflare has already agreed to use (https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/).Whil= e we expect the initial set of TRRs to be small, we=E2=80=99re interested= in adding new providers who are able to comply with these policies. 2. The precise details of the user interface are TBD, but we expect something like the following: 3. Copies of Firefox will be configured with a set of TRRs. Different regions may have different TRR sets or different defaults. In addition we may have DoH/TRR on by default in some regions and not others, especially initially. 4. The user will be informed that we have enabled use of a TRR and have the opportunity to turn it off at that time, but will not be required to opt-in to get DoH with a TRR. 5. Any given client will automatically select a resolver out of that set and use that for all resolutions [with the two exceptions noted below.] At any time, the user will have the option to select a different resolver out of the list, specify their own resolver, or disable DoH entirely. We have heard a number of concerns about the ability of the network to control the client=E2=80=99s resolver behavior. As noted above, just allowi= ng the network to dictate the DoH resolver would obviate the security objective listed above. However, there are two more restricted cases in which we do think some network control of the resolver is reasonable. In cases where the network has a preferred resolver that is on our approved list we might want a mechanism like draft-ietf-doh-resolver-associated-doh to guide resolver selection. We=E2=80=99re watching that document=E2=80=99s progression caref= ully. 1. In cases where the network also controls the client (e.g., they are able to remotely manage it via MDM), then they should be able to select the resolver themselves, disable DoH, etc. 2. We realize that in the short run, the need for resolvers to be on our list creates some challenges for resolver operators. We would be open to discussing how to adapt our security constraints to suit the needs of multiple applications, so that as more systems deploy DoH/TRR, they can share a list of resolvers vetted to a common standard. There are still a few open issues that we have to sort out, but if some of the above isn=E2=80=99t clear, I=E2=80=99m happy to try to explain.= One thing I am not able to provide is a detailed timeline. We are still performing measurements [3] to determine whether users will experience problems with DoH/TRR enabled, as well as figuring out precisely how we intend to deal with split horizon DNS, and will need to address these issues prior to shipping. -Ekr [0] https://cdt.org/blog/dns-strengthening-the-weakest-link-in-internet-privacy= / [1] https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-pearc= e.pdf [2] Many networks redirect NXDOMAIN to a search/advertising page. [3] For some of our previous experiments, see: https://blog.mozilla.org/futurereleases/2018/09/13/dns-over-https-doh-testi= ng-on-beta/ https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-expe= rimental-results/ --00000000000060308105850fe56d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I=E2=80=99ve heard a number of questions = about Mozilla=E2=80=99s plans around
DoH. We=E2=80=99ve made a number of= public statements, but it might be useful
to try to put this all in one= place.

In context, the problem we are attempting to solve here is a= ttack on
the user=E2=80=99s name resolution from an attacker with full o= r partial
control of the network, as contemplated by Section 3 of BCP 72= as well
as BCP 188. There=E2=80=99s ample evidence of monitoring/manipu= lation of user
traffic via this vector [0][1][2]. Importantly, this incl= udes cases
where the entity which owns the network infrastructure monito= rs and/or
modifies DNS requests and responses without the user=E2=80=99s= consent.


With that problem statement, here are our plans:
=C2=A0=C2=A0=C2=A0 1. We have implemented DNS over HTTPS [RFC8484] and wo= uld like to
=C2=A0=C2=A0=C2=A0 deploy it by default for our users. We in= tend to select a set of
=C2=A0=C2=A0=C2=A0 Trusted Recursive Resolvers (= TRRs) that we will use for DoH
=C2=A0=C2=A0=C2=A0 resolution. TRRs will = be required to conform to a specific set of
=C2=A0=C2=A0=C2=A0 policies = intended to protect user privacy. We=E2=80=99re still refining the
=C2= =A0=C2=A0=C2=A0 final policy but we expect it to roughly match the one that= Cloudflare
=C2=A0=C2=A0=C2=A0 has already agreed to use
=C2=A0=C2=A0= =C2=A0 (https://developers.cloudflare.com/1.1.1.1/commitment-to-pr= ivacy/).While
=C2=A0=C2=A0=C2=A0 we expect the initial set of TRRs t= o be small, we=E2=80=99re interested in
=C2=A0=C2=A0=C2=A0 adding new pr= oviders who are able to comply with these policies.
=C2=A0=C2=A0=C2=A0 <= br>=C2=A0=C2=A0=C2=A0 2. The precise details of the user interface are TBD,= but we expect
=C2=A0=C2=A0=C2=A0 something like the following:
=C2= =A0=C2=A0=C2=A0
=C2=A0=C2=A0=C2=A0 3. Copies of Firefox will be configu= red with a set of TRRs. Different
=C2=A0=C2=A0=C2=A0 regions may have di= fferent TRR sets or different defaults. In addition
=C2=A0=C2=A0=C2=A0 w= e may have DoH/TRR on by default in some regions and not others,
=C2=A0= =C2=A0=C2=A0 especially initially.
=C2=A0=C2=A0=C2=A0
=C2=A0=C2=A0= =C2=A0 4. The user will be informed that we have enabled use of a TRR and=C2=A0=C2=A0=C2=A0 have the opportunity to turn it off at that time, but = will not be
=C2=A0=C2=A0=C2=A0 required to opt-in to get DoH with a TRR.=
=C2=A0=C2=A0=C2=A0
=C2=A0=C2=A0=C2=A0 5. Any given client will auto= matically select a resolver out of that
=C2=A0=C2=A0=C2=A0 set and use t= hat for all resolutions [with the two exceptions noted
=C2=A0=C2=A0=C2= =A0 below.]=C2=A0 At any time, the user will have the option to select a=C2=A0=C2=A0=C2=A0 different resolver out of the list, specify their own r= esolver, or
=C2=A0=C2=A0=C2=A0 disable DoH entirely.

We have hear= d a number of concerns about the ability of the network to
control the c= lient=E2=80=99s resolver behavior. As noted above, just allowing
the net= work to dictate the DoH resolver would obviate the security
objective li= sted above. However, there are two more restricted cases
in which we do = think some network control of the resolver is
reasonable.

In case= s where the network has a preferred resolver that is on our
approved lis= t we might want a mechanism like
draft-ietf-doh-resolver-associated-doh = to guide resolver
selection. We=E2=80=99re watching that document=E2=80= =99s progression carefully.

=C2=A0=C2=A0=C2=A0 1. In cases where the= network also controls the client (e.g., they are
=C2=A0=C2=A0=C2=A0 abl= e to remotely manage it via MDM), then they should be able to
=C2=A0=C2= =A0=C2=A0 select the resolver themselves, disable DoH, etc.
=C2=A0=C2=A0= =C2=A0
=C2=A0=C2=A0=C2=A0 2. We realize that in the short run, the need= for resolvers to be on
=C2=A0=C2=A0=C2=A0 our list creates some challen= ges for resolver operators.=C2=A0 We would be
=C2=A0=C2=A0=C2=A0 open to= discussing how to adapt our security constraints to suit the
=C2=A0=C2= =A0=C2=A0 needs of multiple applications, so that as more systems deploy=C2=A0=C2=A0=C2=A0 DoH/TRR, they can share a list of resolvers vetted to a= common
=C2=A0=C2=A0=C2=A0 standard.
=C2=A0
There are still a few = open issues that we have to sort out, but if
some of the above isn=E2=80= =99t clear, I=E2=80=99m happy to try to explain. One thing
I am not able= to provide is a detailed timeline. We are still
performing measurements= [3] to determine whether users will experience
problems with DoH/TRR en= abled, as well as figuring out precisely how
we intend to deal with spli= t horizon DNS, and will need to address
these issues prior to shipping.<= br>
-Ekr

[0] https://cdt.org/blog/dns-strengthening= -the-weakest-link-in-internet-privacy/
[1] https:/= /www.usenix.org/system/files/conference/usenixsecurity17/sec17-pearce.pdf
[2] Many networks redirect NXDOMAIN to a search/advertising page.
= [3] For some of our previous experiments, see:
h= ttps://blog.mozilla.org/futurereleases/2018/09/13/dns-over-https-doh-testin= g-on-beta/
https://blog.nightly.mozill= a.org/2018/08/28/firefox-nightly-secure-dns-experimental-results/




--00000000000060308105850fe56d-- From nobody Wed Mar 27 02:25:33 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40A45120526 for ; Wed, 27 Mar 2019 02:25:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.101 X-Spam-Level: X-Spam-Status: No, score=-1.101 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, MIME_BOUND_DIGITS_15=0.798, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZlsFTh3YiS8G for ; Wed, 27 Mar 2019 02:25:09 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 040BB1202BA for ; Wed, 27 Mar 2019 02:25:09 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id h16so9232044ljg.11 for ; Wed, 27 Mar 2019 02:25:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=k8O/UWkZKJKTRc6Gy0CLT9OxbR7k2OaG/J7eN89goLc=; b=J16n1aXS3w21Juy/o0gOZSwnmxg46/FAx9Au+RkOIlo7Bye8ru8GzCUo/6ydD8y8U3 +alpdVLidGW5cNm+rf1FmSsIFoCr4aXMEhQtBE+7x7PjEC8AI6jEVjvSQ81gTpy+bRqw sbzx0WZMJrN+CcRQSI9Iin9gu2ZJoDguUq9C0gpmOSXzzJyrRICfQyRFYS77G3EBgPaN HxlmU0xCtSZ/GF2/fBay4oyAxEqL5RONnEAcAFy6rJ/U9Nx1Qk6sD8R4/3gWSlry3Dv9 1+WG0ZnTyg4LS1iepOXuBuz61VzTKacaPE11/eha99XyC8MykGU2a3fmUbdEjwpwxyMv zk5g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=k8O/UWkZKJKTRc6Gy0CLT9OxbR7k2OaG/J7eN89goLc=; b=qIQBblcJWkRrm+xB4rBJjaGCpdbVaGwFVfZ1r/m9cGpxDlSeP0zdW82L0d+b8TJlL6 iLuIE23WdZS2uicfIBMdGSjGPqsx955K15j4eGk1v4govS9E02ZrcTLWuB9gjaVFxeHF yOVMXP9daaNYx8urA1cNVkrdB0YIyvzjjLJEmDMkDVIOLtQ8hksfcdIAD/BWXdCx72tv W2/xE7asgANEwX7EvZGWVM3gwDPSd1syU4xucvmNU9y+ZQn0rMt3QH7xt8giwlTqkAOB xoIwFxHcGtm/dYkFiTdBO143fVSuV0tF9TduNS5thxgHMpZxHYHBNhl6JQ5j9dKhHNbJ 6VKQ== X-Gm-Message-State: APjAAAUhft0d++9LocBZQC5Z79Wo9pqOSsdBfY/dp0YTs8R2TL7/7S41 7b4aj+dSXdr6nLk/2PFQd9ZdXH/YwtNy/T8b7t+/ARkLo48= X-Google-Smtp-Source: APXvYqx6KejG0SjwKXzYaClQxySGz/2NG2fvIriigPcnXhMLIoTs71gAAx88Pi9bWu8ObdwLuz0nQg+/7Si9X8V8kJo= X-Received: by 2002:a2e:81da:: with SMTP id s26mr7329042ljg.86.1553678706562; Wed, 27 Mar 2019 02:25:06 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Wed, 27 Mar 2019 02:24:28 -0700 Message-ID: To: DoH WG Content-Type: multipart/alternative; boundary="0000000000006668770585100371" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 09:25:20 -0000 --0000000000006668770585100371 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Now with the numbered lists correctly formatted: I=E2=80=99ve heard a number of questions about Mozilla=E2=80=99s plans arou= nd DoH. We=E2=80=99ve made a number of public statements, but it might be usef= ul to try to put this all in one place. In context, the problem we are attempting to solve here is attack on the user=E2=80=99s name resolution from an attacker with full or partial control of the network, as contemplated by Section 3 of BCP 72 as well as BCP 188. There=E2=80=99s ample evidence of monitoring/manipulation of us= er traffic via this vector [0][1][2]. Importantly, this includes cases where the entity which owns the network infrastructure monitors and/or modifies DNS requests and responses without the user=E2=80=99s consent. With that problem statement, here are our plans: We have implemented DNS over HTTPS [RFC8484] and would like to deploy it by default for our users. We intend to select a set of Trusted Recursive Resolvers (TRRs) that we will use for DoH resolution. TRRs will be required to conform to a specific set of policies intended to protect user privacy. We=E2=80=99re still refining the final policy but we expect it to roughly match the one that Cloudflare has already agreed to use (https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/).While we expect the initial set of TRRs to be small, we=E2=80=99re interested in adding new providers who are able to comply with these policies. The precise details of the user interface are TBD, but we expect something like the following: 1. Copies of Firefox will be configured with a set of TRRs. Different regions may have different TRR sets or different defaults. In addition we may have DoH/TRR on by default in some regions and not others, especially initially. 2. The user will be informed that we have enabled use of a TRR and have the opportunity to turn it off at that time, but will not be required to opt-in to get DoH with a TRR. 3. Any given client will automatically select a resolver out of that set and use that for all resolutions [with the two exceptions noted below.] 4. At any time, the user will have the option to select a different resolver out of the list, specify their own resolver, or disable DoH entirely. We have heard a number of concerns about the ability of the network to control the client=E2=80=99s resolver behavior. As noted above, just allowi= ng the network to dictate the DoH resolver would obviate the security objective listed above. However, there are two more restricted cases in which we do think some network control of the resolver is reasonable. In cases where the network has a preferred resolver that is on our approved list we might want a mechanism like draft-ietf-doh-resolver-associated-doh to guide resolver selection. We=E2=80=99re watching that document=E2=80=99s progression caref= ully. 1. In cases where the network also controls the client (e.g., they are able to remotely manage it via MDM), then they should be able to select the resolver themselves, disable DoH, etc. 2. We realize that in the short run, the need for resolvers to be on our list creates some challenges for resolver operators. We would be open to discussing how to adapt our security constraints to suit the needs of multiple applications, so that as more systems deploy DoH/TRR, they can share a list of resolvers vetted to a common standard. There are still a few open issues that we have to sort out, but if some of the above isn=E2=80=99t clear, I=E2=80=99m happy to try to explain.= One thing I am not able to provide is a detailed timeline. We are still performing measurements [3] to determine whether users will experience problems with DoH/TRR enabled, as well as figuring out precisely how we intend to deal with split horizon DNS, and will need to address these issues prior to shipping. -Ekr [0] https://cdt.org/blog/dns-strengthening-the-weakest-link-in-internet-privacy= / [1] https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-pearc= e.pdf [2] Many networks redirect NXDOMAIN to a search/advertising page. [3] For some of our previous experiments, see: https://blog.mozilla.org/futurereleases/2018/09/13/dns-over-https-doh-testi= ng-on-beta/ https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-expe= rimental-results/ On Wed, Mar 27, 2019 at 2:16 AM Eric Rescorla wrote: > I=E2=80=99ve heard a number of questions about Mozilla=E2=80=99s plans ar= ound > DoH. We=E2=80=99ve made a number of public statements, but it might be us= eful > to try to put this all in one place. > > In context, the problem we are attempting to solve here is attack on > the user=E2=80=99s name resolution from an attacker with full or partial > control of the network, as contemplated by Section 3 of BCP 72 as well > as BCP 188. There=E2=80=99s ample evidence of monitoring/manipulation of = user > traffic via this vector [0][1][2]. Importantly, this includes cases > where the entity which owns the network infrastructure monitors and/or > modifies DNS requests and responses without the user=E2=80=99s consent. > > > With that problem statement, here are our plans: > > 1. We have implemented DNS over HTTPS [RFC8484] and would like to > deploy it by default for our users. We intend to select a set of > Trusted Recursive Resolvers (TRRs) that we will use for DoH > resolution. TRRs will be required to conform to a specific set of > policies intended to protect user privacy. We=E2=80=99re still refini= ng the > final policy but we expect it to roughly match the one that Cloudflar= e > has already agreed to use > ( > https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/).While > we expect the initial set of TRRs to be small, we=E2=80=99re interest= ed in > adding new providers who are able to comply with these policies. > > 2. The precise details of the user interface are TBD, but we expect > something like the following: > > 3. Copies of Firefox will be configured with a set of TRRs. Different > regions may have different TRR sets or different defaults. In additio= n > we may have DoH/TRR on by default in some regions and not others, > especially initially. > > 4. The user will be informed that we have enabled use of a TRR and > have the opportunity to turn it off at that time, but will not be > required to opt-in to get DoH with a TRR. > > 5. Any given client will automatically select a resolver out of that > set and use that for all resolutions [with the two exceptions noted > below.] At any time, the user will have the option to select a > different resolver out of the list, specify their own resolver, or > disable DoH entirely. > > We have heard a number of concerns about the ability of the network to > control the client=E2=80=99s resolver behavior. As noted above, just allo= wing > the network to dictate the DoH resolver would obviate the security > objective listed above. However, there are two more restricted cases > in which we do think some network control of the resolver is > reasonable. > > In cases where the network has a preferred resolver that is on our > approved list we might want a mechanism like > draft-ietf-doh-resolver-associated-doh to guide resolver > selection. We=E2=80=99re watching that document=E2=80=99s progression car= efully. > > 1. In cases where the network also controls the client (e.g., they ar= e > able to remotely manage it via MDM), then they should be able to > select the resolver themselves, disable DoH, etc. > > 2. We realize that in the short run, the need for resolvers to be on > our list creates some challenges for resolver operators. We would be > open to discussing how to adapt our security constraints to suit the > needs of multiple applications, so that as more systems deploy > DoH/TRR, they can share a list of resolvers vetted to a common > standard. > > There are still a few open issues that we have to sort out, but if > some of the above isn=E2=80=99t clear, I=E2=80=99m happy to try to explai= n. One thing > I am not able to provide is a detailed timeline. We are still > performing measurements [3] to determine whether users will experience > problems with DoH/TRR enabled, as well as figuring out precisely how > we intend to deal with split horizon DNS, and will need to address > these issues prior to shipping. > > -Ekr > > [0] > https://cdt.org/blog/dns-strengthening-the-weakest-link-in-internet-priva= cy/ > [1] > https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-pea= rce.pdf > [2] Many networks redirect NXDOMAIN to a search/advertising page. > [3] For some of our previous experiments, see: > > https://blog.mozilla.org/futurereleases/2018/09/13/dns-over-https-doh-tes= ting-on-beta/ > > https://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-ex= perimental-results/ > > > > > > --0000000000006668770585100371 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Now with the numbered li= sts correctly formatted:

I= =E2=80=99ve heard a number of questions about Mozilla=E2=80=99s plans aroun= d
DoH. We=E2=80=99ve made a number of public statements, but it might be= useful
to try to put this all in one place.

In context, the prob= lem we are attempting to solve here is attack on
the user=E2=80=99s name= resolution from an attacker with full or partial
control of the network= , as contemplated by Section 3 of BCP 72 as well
as BCP 188. There=E2=80= =99s ample evidence of monitoring/manipulation of user
traffic via this = vector [0][1][2]. Importantly, this includes cases
where the entity whic= h owns the network infrastructure monitors and/or
modifies DNS requests = and responses without the user=E2=80=99s consent.


With that prob= lem statement, here are our plans:

We have implemented DNS over HTTP= S [RFC8484] and would like to
deploy it by default for our users. We int= end to select a set of
Trusted Recursive Resolvers (TRRs) that we will u= se for DoH
resolution. TRRs will be required to conform to a specific se= t of
policies intended to protect user privacy. We=E2=80=99re still refi= ning the
final policy but we expect it to roughly match the one that Clo= udflare
has already agreed to use
(https://developers.cloudf= lare.com/1.1.1.1/commitment-to-privacy/).While
we expect the initial= set of TRRs to be small, we=E2=80=99re interested in
adding new provide= rs who are able to comply with these policies.
The precise details of th= e user interface are TBD, but we expect
something like the following:=C2=A0=C2=A0=C2=A0
=C2=A0=C2=A0=C2=A0 1. Copies of Firefox will be con= figured with a set of TRRs. Different
=C2=A0=C2=A0=C2=A0 regions may hav= e different TRR sets or different defaults. In addition
=C2=A0=C2=A0=C2= =A0 we may have DoH/TRR on by default in some regions and not others,
= =C2=A0=C2=A0=C2=A0 especially initially.
=C2=A0=C2=A0=C2=A0
=C2=A0= =C2=A0=C2=A0 2. The user will be informed that we have enabled use of a TRR= and
=C2=A0=C2=A0=C2=A0 have the opportunity to turn it off at that time= , but will not be
=C2=A0=C2=A0=C2=A0 required to opt-in to get DoH with = a TRR.
=C2=A0=C2=A0=C2=A0
=C2=A0=C2=A0=C2=A0 3. Any given client wil= l automatically select a resolver out of that
=C2=A0=C2=A0=C2=A0 set and= use that for all resolutions [with the two exceptions noted
=C2=A0=C2= =A0=C2=A0 below.]

=C2=A0=C2=A0=C2=A0 4. At any time, the user will h= ave the option to select a
=C2=A0=C2=A0=C2=A0 different resolver out of = the list, specify their own resolver, or
=C2=A0=C2=A0=C2=A0 disable DoH = entirely.

We have heard a number of concerns about the ability of th= e network to
control the client=E2=80=99s resolver behavior. As noted ab= ove, just allowing
the network to dictate the DoH resolver would obviate= the security
objective listed above. However, there are two more restri= cted cases
in which we do think some network control of the resolver is<= br>reasonable.

In cases where the network has a preferred resolver t= hat is on our
approved list we might want a mechanism like
draft-ietf= -doh-resolver-associated-doh to guide resolver
selection. We=E2=80=99re = watching that document=E2=80=99s progression carefully.

=C2=A0=C2=A0= =C2=A0 1. In cases where the network also controls the client (e.g., they a= re
=C2=A0=C2=A0=C2=A0 able to remotely manage it via MDM), then they sho= uld be able to
=C2=A0=C2=A0=C2=A0 select the resolver themselves, disabl= e DoH, etc.
=C2=A0=C2=A0=C2=A0
=C2=A0=C2=A0=C2=A0 2. We realize that= in the short run, the need for resolvers to be on
=C2=A0=C2=A0=C2=A0 ou= r list creates some challenges for resolver operators.=C2=A0 We would be=C2=A0=C2=A0=C2=A0 open to discussing how to adapt our security constraint= s to suit the
=C2=A0=C2=A0=C2=A0 needs of multiple applications, so that= as more systems deploy
=C2=A0=C2=A0=C2=A0 DoH/TRR, they can share a lis= t of resolvers vetted to a common
=C2=A0=C2=A0=C2=A0 standard.
=C2=A0=
There are still a few open issues that we have to sort out, but if
s= ome of the above isn=E2=80=99t clear, I=E2=80=99m happy to try to explain. = One thing
I am not able to provide is a detailed timeline. We are still<= br>performing measurements [3] to determine whether users will experienceproblems with DoH/TRR enabled, as well as figuring out precisely how
w= e intend to deal with split horizon DNS, and will need to address
these = issues prior to shipping.

-Ekr

[0] https://cdt.= org/blog/dns-strengthening-the-weakest-link-in-internet-privacy/
[1]= https://www.usenix.org/system/files/conference/usenixsec= urity17/sec17-pearce.pdf
[2] Many networks redirect NXDOMAIN to a se= arch/advertising page.
[3] For some of our previous experiments, see:https://blog.mozilla.org/futurereleases/2018/09/13= /dns-over-https-doh-testing-on-beta/
h= ttps://blog.nightly.mozilla.org/2018/08/28/firefox-nightly-secure-dns-exper= imental-results/




=C2=A0



On Wed, Mar 27, 2019 at 2:16 AM Eric Rescorla <ekr@rtfm.com> wrote:
I=E2= =80=99ve heard a number of questions about Mozilla=E2=80=99s plans aroundDoH. We=E2=80=99ve made a number of public statements, but it might be us= eful
to try to put this all in one place.

In context, the problem= we are attempting to solve here is attack on
the user=E2=80=99s name re= solution from an attacker with full or partial
control of the network, a= s contemplated by Section 3 of BCP 72 as well
as BCP 188. There=E2=80=99= s ample evidence of monitoring/manipulation of user
traffic via this vec= tor [0][1][2]. Importantly, this includes cases
where the entity which o= wns the network infrastructure monitors and/or
modifies DNS requests and= responses without the user=E2=80=99s consent.


With that problem= statement, here are our plans:

=C2=A0=C2=A0=C2=A0 1. We have implem= ented DNS over HTTPS [RFC8484] and would like to
=C2=A0=C2=A0=C2=A0 depl= oy it by default for our users. We intend to select a set of
=C2=A0=C2= =A0=C2=A0 Trusted Recursive Resolvers (TRRs) that we will use for DoH
= =C2=A0=C2=A0=C2=A0 resolution. TRRs will be required to conform to a specif= ic set of
=C2=A0=C2=A0=C2=A0 policies intended to protect user privacy. = We=E2=80=99re still refining the
=C2=A0=C2=A0=C2=A0 final policy but we = expect it to roughly match the one that Cloudflare
=C2=A0=C2=A0=C2=A0 ha= s already agreed to use
=C2=A0=C2=A0=C2=A0 (h= ttps://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/).While<= br>=C2=A0=C2=A0=C2=A0 we expect the initial set of TRRs to be small, we=E2= =80=99re interested in
=C2=A0=C2=A0=C2=A0 adding new providers who are a= ble to comply with these policies.
=C2=A0=C2=A0=C2=A0
=C2=A0=C2=A0= =C2=A0 2. The precise details of the user interface are TBD, but we expect<= br>=C2=A0=C2=A0=C2=A0 something like the following:
=C2=A0=C2=A0=C2=A0 <= br>=C2=A0=C2=A0=C2=A0 3. Copies of Firefox will be configured with a set of= TRRs. Different
=C2=A0=C2=A0=C2=A0 regions may have different TRR sets = or different defaults. In addition
=C2=A0=C2=A0=C2=A0 we may have DoH/TR= R on by default in some regions and not others,
=C2=A0=C2=A0=C2=A0 espec= ially initially.
=C2=A0=C2=A0=C2=A0
=C2=A0=C2=A0=C2=A0 4. The user w= ill be informed that we have enabled use of a TRR and
=C2=A0=C2=A0=C2=A0= have the opportunity to turn it off at that time, but will not be
=C2= =A0=C2=A0=C2=A0 required to opt-in to get DoH with a TRR.
=C2=A0=C2=A0= =C2=A0
=C2=A0=C2=A0=C2=A0 5. Any given client will automatically select= a resolver out of that
=C2=A0=C2=A0=C2=A0 set and use that for all reso= lutions [with the two exceptions noted
=C2=A0=C2=A0=C2=A0 below.]=C2=A0 = At any time, the user will have the option to select a
=C2=A0=C2=A0=C2= =A0 different resolver out of the list, specify their own resolver, or
= =C2=A0=C2=A0=C2=A0 disable DoH entirely.

We have heard a number of c= oncerns about the ability of the network to
control the client=E2=80=99s= resolver behavior. As noted above, just allowing
the network to dictate= the DoH resolver would obviate the security
objective listed above. How= ever, there are two more restricted cases
in which we do think some netw= ork control of the resolver is
reasonable.

In cases where the net= work has a preferred resolver that is on our
approved list we might want= a mechanism like
draft-ietf-doh-resolver-associated-doh to guide resolv= er
selection. We=E2=80=99re watching that document=E2=80=99s progression= carefully.

=C2=A0=C2=A0=C2=A0 1. In cases where the network also co= ntrols the client (e.g., they are
=C2=A0=C2=A0=C2=A0 able to remotely ma= nage it via MDM), then they should be able to
=C2=A0=C2=A0=C2=A0 select = the resolver themselves, disable DoH, etc.
=C2=A0=C2=A0=C2=A0
=C2=A0= =C2=A0=C2=A0 2. We realize that in the short run, the need for resolvers to= be on
=C2=A0=C2=A0=C2=A0 our list creates some challenges for resolver = operators.=C2=A0 We would be
=C2=A0=C2=A0=C2=A0 open to discussing how t= o adapt our security constraints to suit the
=C2=A0=C2=A0=C2=A0 needs of= multiple applications, so that as more systems deploy
=C2=A0=C2=A0=C2= =A0 DoH/TRR, they can share a list of resolvers vetted to a common
=C2= =A0=C2=A0=C2=A0 standard.
=C2=A0
There are still a few open issues th= at we have to sort out, but if
some of the above isn=E2=80=99t clear, I= =E2=80=99m happy to try to explain. One thing
I am not able to provide i= s a detailed timeline. We are still
performing measurements [3] to deter= mine whether users will experience
problems with DoH/TRR enabled, as wel= l as figuring out precisely how
we intend to deal with split horizon DNS= , and will need to address
these issues prior to shipping.

-Ekr
[0] https://cdt.org/blog/dns-strength= ening-the-weakest-link-in-internet-privacy/
[1] https://www.usenix.org/system/files/conference/usenixsecuri= ty17/sec17-pearce.pdf
[2] Many networks redirect NXDOMAIN to a searc= h/advertising page.
[3] For some of our previous experiments, see:
https://blog.mozilla.org/futurerele= ases/2018/09/13/dns-over-https-doh-testing-on-beta/
https://blog.nightly.mozilla.org/2018/08/28= /firefox-nightly-secure-dns-experimental-results/




--0000000000006668770585100371-- From nobody Wed Mar 27 03:19:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00EFF120622 for ; Wed, 27 Mar 2019 03:19:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=conundrum-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WYkLFHqKaA3E for ; Wed, 27 Mar 2019 03:18:59 -0700 (PDT) Received: from mail-io1-xd31.google.com (mail-io1-xd31.google.com [IPv6:2607:f8b0:4864:20::d31]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D175012028F for ; Wed, 27 Mar 2019 03:18:56 -0700 (PDT) Received: by mail-io1-xd31.google.com with SMTP id b6so13568060iog.0 for ; Wed, 27 Mar 2019 03:18:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=conundrum-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cdquF1/kgPeQqtLe1yoVfzH00Kp4T25QwmeynntOuT0=; b=RXfMH1JmGBmDuA4q6P8bmnt5Qt4TWYgSOmh0Kbo1tYva1WMd423dLuh9pI3zsunjDJ gYPJ9gupvuh7YjQmYEGXayI20Drc2U7oV3nG12QxuBvng4QtOY7F/E2GzzRhG+bKlV4G usrzSnw6e9S3ChMLj2+yiWfS0efdFVjZT5BQ40lPRRbmHnTOc7TehTJHzIkYAS2NnWXq KiAUHgiDMvcneFdzTOgti76ebhO9qCK8GFHp+DfQ1M6qD0uQqUxjdGLzCk0WybaQUdYY CEV5mCzlSFBLx5xcXEsSWfWpJGJOePmH6VzhLk8GkSU3e3o945wn6fw0B35PAZMrMkOh gBiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cdquF1/kgPeQqtLe1yoVfzH00Kp4T25QwmeynntOuT0=; b=ZzR/QlFzBNf8vbzqTnA3TIJhwsxpxXZ1prs/+EwL6qMTDYbg6Af35AONDYRUpbAETG 6f0pt+cFZtrCCugGvyRu3G5VpOWb5h85bLJWiVnbOyxYPPaI/5tZsE2XXJEZ8JY/122q 2HgVukuUjWW9JvP6HtSrVl4XB7NFksaKbHAcpyDgyXAhexcHV0rGBJtZoAq183JvqisL dN6NMzK0bUXNmYaTi9NpL3WtKK8Toh+oy2YrrzeU5740pEc6JDmfZ7p2oUzS2h4qrm0e rAdyF2MGyuOshqkGfpQZQ9AhuPIZ3UoL3em/lHEYpzR9lwj8C2/ss5cP/lvtu8cyQLdl f7HA== X-Gm-Message-State: APjAAAXv68PtZX6+1XeH8NlchGr7VWdSytG/iVsy5vIuuZxOlgRylWQO QWtlhKBG1FtfKQxSuMHzNkN5Qy1hOsHX0ssFUsBZPQ== X-Google-Smtp-Source: APXvYqyWfZ+3D3QE/lnI9/uJbpb8ubqde2S0nDNNlkZCL4bdv1OEMzijyp0kZ/V3T/9wbXVWPLqojtY16MekLZGtME0= X-Received: by 2002:a6b:ec15:: with SMTP id c21mr5172314ioh.152.1553681936024; Wed, 27 Mar 2019 03:18:56 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Matthew Pounsett Date: Wed, 27 Mar 2019 11:18:41 +0100 Message-ID: To: Eric Rescorla Cc: DoH WG Content-Type: multipart/alternative; boundary="000000000000e428d2058510c346" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 10:19:04 -0000 --000000000000e428d2058510c346 Content-Type: text/plain; charset="UTF-8" On Wed, 27 Mar 2019 at 10:25, Eric Rescorla wrote: > 1. Copies of Firefox will be configured with a set of TRRs. Different > regions may have different TRR sets or different defaults. In addition > we may have DoH/TRR on by default in some regions and not others, > especially initially. > Can I suggest you pick a default behaviour and stick with it? This idea of having a different default configuration depending on what region the user is in (at what point? at the time they downloaded it? installed it? at runtime? how big is a "region" and how are you determining which one the user is in?) is going to be a bit of a support nightmare for IT departments with users in different regions. I'm also curious what your fallback plan is in the event that DoH is disabled or unreachable. One hopes DoT will be tried next, before falling back to plan DNS. --000000000000e428d2058510c346 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, 27 Mar 2019 at 10:25, Eric Re= scorla <ekr@rtfm.com> wrote:
<= /div>
=C2=A0 =C2=A0 1. Copies of Firefox will be c= onfigured with a set of TRRs. Different
=C2=A0=C2= =A0=C2=A0 regions may have different TRR sets or different defaults. In add= ition
=C2=A0=C2=A0=C2=A0 we may have DoH/TRR on by default in some regio= ns and not others,
=C2=A0=C2=A0=C2=A0 especially initially.

Can I suggest you pick a default = behaviour and stick with it?=C2=A0 This idea of having a different default = configuration depending on what region the user is in (at what point?=C2=A0= at the time they downloaded it?=C2=A0 installed it?=C2=A0 at runtime? how = big is a "region" and how are you determining which one the user = is in?) is going to be a bit of a support nightmare for IT departments with= users in different regions.

I'm also curious = what your fallback plan is in the event that DoH is disabled or unreachable= .=C2=A0 One hopes DoT will be tried next, before falling back to plan DNS.<= /div>
--000000000000e428d2058510c346-- From nobody Wed Mar 27 03:22:32 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 092FC120291 for ; Wed, 27 Mar 2019 03:22:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HE1LSePLmsnz for ; Wed, 27 Mar 2019 03:22:28 -0700 (PDT) Received: from mail-io1-xd33.google.com (mail-io1-xd33.google.com [IPv6:2607:f8b0:4864:20::d33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84B0D120278 for ; Wed, 27 Mar 2019 03:22:28 -0700 (PDT) Received: by mail-io1-xd33.google.com with SMTP id c4so13542371ioh.9 for ; Wed, 27 Mar 2019 03:22:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5etnqIJwBnydCj2sGSy7GxXeeug1lprkbqjXSgRIRFY=; b=tefI35n9QtQPLseIg5mZvi6YXOqi7yimcYbs2WG3tyoiViIGvYwWtJe/Tkp/jvLJZL Rr8wNSXldX49IbvT9F8eBks3yeraQnyLRFM2/PMpZRpTwOvthpFQxLDKTLQuGnwArbi1 e/mo2RYjR6A+P8WOsE999sDeVp+ivKwSumqz/xsdS4y/yH5PbB/A/jQNl8B360DDzuhS NW1AP4HAUJ8ryhc8C+c0IL+ryx2ck4Jtih0fg2V8RFDiDBzY3U0XhjYLtybb3Iiux9fo 0abSAKzhVfXA8x4+ZN2jodMnGtwBZ4F0NAViGrTyBqbaOkBKpOWG6LvhLAA0GVXo0+ln 6pzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5etnqIJwBnydCj2sGSy7GxXeeug1lprkbqjXSgRIRFY=; b=MaXBm2YAQ9kr15/4gAHoq9FbLwMb2Zbl106wDdkeM0y0CKeB+9iaaEJ7FCahjjztOq 9su77KEFO0rrrFn0Ewy3Q+BxW6TH+mpuQ53ultpKbF21t+NsuK7D/7d4fD2VQoUMn0R9 x4tQyOovIMqS0DJoo6ZvtzJ9wlJ12tPVxYH2XkfLgGIkTRZxmREygOMKYolTWygRi4at lTsyNXB8IssKnfJBtTo5JdBA+W7ASkER4JfQQjdsFR1nGm0F9xT6rrfAaFk+u1pU2eLy dOKXD8XG1rSdKvDvF4hQ+zKp0td1nuccBPYEEnkGJZX3g3vZ6iwPmZn/hNQKnwrTp/80 v9Sg== X-Gm-Message-State: APjAAAUI5JDvShxNgMqnOIUwPezlWXvZzcJsCiPekzr1dGqahxLaTS73 ZcU9tT6pLSaAOrCapfwLBTzgVJiVApQhY65a/LM= X-Google-Smtp-Source: APXvYqxwYstntYQBZZxWCLkIIPOnxdubL2D6jvDiMzTdqhY072Drz6P9Nhm2ipCndDViG7oRMYaQsPnoj5spG8lpNPM= X-Received: by 2002:a6b:7e04:: with SMTP id i4mr7470672iom.137.1553682147737; Wed, 27 Mar 2019 03:22:27 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Valentin Gosu Date: Wed, 27 Mar 2019 11:22:16 +0100 Message-ID: To: Matthew Pounsett Cc: Eric Rescorla , DoH WG Content-Type: multipart/alternative; boundary="0000000000008287c3058510d04d" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 10:22:31 -0000 --0000000000008287c3058510d04d Content-Type: text/plain; charset="UTF-8" On Wed, 27 Mar 2019 at 11:19, Matthew Pounsett wrote: > > > On Wed, 27 Mar 2019 at 10:25, Eric Rescorla wrote: > >> 1. Copies of Firefox will be configured with a set of TRRs. Different >> regions may have different TRR sets or different defaults. In addition >> we may have DoH/TRR on by default in some regions and not others, >> especially initially. >> > > Can I suggest you pick a default behaviour and stick with it? This idea > of having a different default configuration depending on what region the > user is in (at what point? at the time they downloaded it? installed it? > at runtime? how big is a "region" and how are you determining which one the > user is in?) is going to be a bit of a support nightmare for IT departments > with users in different regions. > > I'm also curious what your fallback plan is in the event that DoH is > disabled or unreachable.. One hopes DoT will be tried next, before falling > back to plan DNS. > Firefox uses the system's resolver via getaddrinfo if the DoH server can't be reached. If the OS's stub resolver uses DoT, then that's great. Otherwise it's regular DNS. --0000000000008287c3058510d04d Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Wed, 27 Mar 2019 at 11:19, Matthew Pounsett <matt@conundrum.com> wrote:

On Wed, 27 Mar 2019 at 10:25, Eric Rescorla <ekr@rtfm.com> wrote:
=C2=A0 =C2=A0 1. Copies of Firefox will be configured with a s= et of TRRs. Different
=C2=A0=C2=A0=C2=A0 regions = may have different TRR sets or different defaults. In addition
=C2=A0=C2= =A0=C2=A0 we may have DoH/TRR on by default in some regions and not others,=
=C2=A0=C2=A0=C2=A0 especially initially.

Can I suggest you pick a default behaviour and stic= k with it?=C2=A0 This idea of having a different default configuration depe= nding on what region the user is in (at what point?=C2=A0 at the time they = downloaded it?=C2=A0 installed it?=C2=A0 at runtime? how big is a "reg= ion" and how are you determining which one the user is in?) is going t= o be a bit of a support nightmare for IT departments with users in differen= t regions.

I'm also curious what your fallback= plan is in the event that DoH is disabled or unreachable..=C2=A0 One hopes= DoT will be tried next, before falling back to plan DNS.

Firefox uses the system's resolver= via getaddrinfo if the DoH server can't be reached.
If the O= S's stub resolver uses DoT, then that's great. Otherwise it's r= egular DNS.
--0000000000008287c3058510d04d-- From nobody Wed Mar 27 03:30:29 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A72BC1202BE for ; Wed, 27 Mar 2019 03:30:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hopcount.ca Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EZrewOXSdan4 for ; Wed, 27 Mar 2019 03:30:22 -0700 (PDT) Received: from mail-wm1-x342.google.com (mail-wm1-x342.google.com [IPv6:2a00:1450:4864:20::342]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 369DD120294 for ; Wed, 27 Mar 2019 03:30:21 -0700 (PDT) Received: by mail-wm1-x342.google.com with SMTP id w15so1283385wmc.3 for ; Wed, 27 Mar 2019 03:30:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hopcount.ca; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=GqJUqFfQ1wytt1kC5+2Ivjh8ZWXx4cyMN+BkerND0sw=; b=AKw4P9if6FOcuQpTgPOAg52MJ5QKu9Js3WV74xLuowqrd3bBokaYSGskcF3DjJcNN2 jHy49Cenl5gyigAtrLItUiNysgtxExp0eQB7qQndIOvV4GtPBp4VclNNlmnJLRM63eFk +iTWZwSoZLII9zrVD/8XK4angaUtkJSOOVMlQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=GqJUqFfQ1wytt1kC5+2Ivjh8ZWXx4cyMN+BkerND0sw=; b=Iw+COjKo8SN+ljADnLmuAjWzpq7UirSEZdV7mBmap/dvcJl3joqeVlJArE5xSjkvk0 OcG6a9YeE2Q9lU6fg7Mk4jdOcOLSArEfUC2lhRlUXp4mhEwpBMuSjNq20Ajrnp671K4y wg2IA+Pz26eFncuRnd8BYnnMIonneP4hKa1IQyooGlb9rECPfdQNWprJWCqh9ZvNzAVj ZGaiAe267bICuXR5mZLx0OD4wxZ/+49U8YMMhpPIjHa5GOqGycbGhKdpvaQb+1Uk7r4P 4oUuGJ3T5zXC/1JTr5joJNpbpEMg1ZUrIVLfJ4h2wtzUCw8q0Hmtl8xX2y3ZCnZc+hgP xJqA== X-Gm-Message-State: APjAAAXwwN0kx1hIBlG4b2dAKZoRazZ9V0y8F1kxWhcszbEmM07/Ajqx nvTBM02plLmWSSkNSlu6oh3cjw== X-Google-Smtp-Source: APXvYqxmtaEpAAPdb40J/wGbmQ14BTuTJhbNs1yLSm7zZ2/+Dxb7OR455g0iKmUphFqH4b89KOUxoA== X-Received: by 2002:a1c:9cd1:: with SMTP id f200mr17333454wme.91.1553682619494; Wed, 27 Mar 2019 03:30:19 -0700 (PDT) Received: from ?IPv6:2001:67c:1232:144:b9cf:782:7eb9:e729? ([2001:67c:1232:144:b9cf:782:7eb9:e729]) by smtp.gmail.com with ESMTPSA id q26sm20523793wmc.6.2019.03.27.03.29.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Mar 2019 03:30:18 -0700 (PDT) From: Joe Abley Message-Id: <22AA82AA-7EA4-413F-B154-A38F8CA36306@hopcount.ca> Content-Type: multipart/signed; boundary="Apple-Mail=_927AC060-3EDC-4DD5-85AE-95B33A2E8B01"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\)) Date: Wed, 27 Mar 2019 11:29:46 +0100 In-Reply-To: Cc: DoH WG To: Ted Hardie References: X-Mailer: Apple Mail (2.3445.104.8) Archived-At: Subject: Re: [Doh] on blackholing resolver-associated-doh.arpa and resolver-associated-doh.arpa X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 10:30:26 -0000 --Apple-Mail=_927AC060-3EDC-4DD5-85AE-95B33A2E8B01 Content-Type: multipart/alternative; boundary="Apple-Mail=_C59E8BF6-2326-4388-8203-CECCAA539753" --Apple-Mail=_C59E8BF6-2326-4388-8203-CECCAA539753 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Ted, On 26 Mar 2019, at 16:31, Ted Hardie wrote: > When I sent the text (as requested), I just grabbed a copy of the text = from RFC 8375, Section 7. That suggests pointing to = 'blackhole-1.iana.org .' and = 'blackhole-2.iana.org .' which the AS112 = project augments. The issue that these were built to solve, a high load = of queries to .arpa for queries leaking into the zone, seems like it = might apply to this special use name. I am familiar with the AS112 project. The crucial difference between the = junk PTR queries for RFC1918 and RFC1918-like nets that are soaked up by = those servers and the two ARPA domains we're talking about here are that = the threat models are very different. It's a stretch to imagine that a = rogue PTR response can cause anybody any harm, whereas a rogue response = to these doh queries could subvert all subsequent name resolution in a = way that would be difficult to detect, and there is the potential to do = so on a large scale. > DNAME is theoretically possible instead, but the .arpa server = operators have historically been slow to take up the idea of using = DNAME (they did not agree for .home.arpa). I have no objection to = trying again, of course, if that is preferred. My DNAME observation was simply to illustrate that the blackhole idea = was inconsistent with the current text in the document. I'm aware of the = practical problems of using DNAME in ARPA in the way that it is = currently managed. > I agree that there is a possible issue here, and I would support = documenting it. But since the basic trust model I'd suggest for a doh = server discovered this way is equivalent to "something scrawled on the = wall of a coffee shop", I think this situation (in which they are not = recognized locally as special use names, and the particular anycast = AS112 server answering the leaked query is an attacker) is pretty much = par for a pretty rough course. I think the risk is far more serious than you are implying, and to be = honest I think the only useful advice here is that the mechanism should = be considered harmful and must not be used. Since the meeting this week also seemed to expose concerns about the = other two mechanisms, it's seems possible that this draft has led us = down a dead end. Joe --Apple-Mail=_C59E8BF6-2326-4388-8203-CECCAA539753 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii Hi = Ted,

On 26 Mar 2019, = at 16:31, Ted Hardie <ted.ietf@gmail.com> wrote:

When I sent the text (as = requested), I just grabbed a copy of the text from  RFC 8375, = Section 7.  That suggests pointing to 'blackhole-1.iana.org.' and 'blackhole-2.iana.org.'  which the AS112 project = augments.  The issue that these were built to solve, a high load of = queries to .arpa for queries leaking into the zone, seems like it might = apply to this special use = name.

I= am familiar with the AS112 project. The crucial difference between the = junk PTR queries for RFC1918 and RFC1918-like nets that are soaked up by = those servers and the two ARPA domains we're talking about here are that = the threat models are very different. It's a stretch to imagine that a = rogue PTR response can cause anybody any harm, whereas a rogue response = to these doh queries could subvert all subsequent name resolution in a = way that would be difficult to detect, and there is the potential to do = so on a large scale.

DNAME is = theoretically possible instead, but the .arpa server operators  = have historically been slow to take up the idea of using DNAME (they did = not agree for .home.arpa).  I have no objection to trying again, of = course, if that is = preferred.

My DNAME observation was simply to illustrate that = the blackhole idea was inconsistent with the current text in the = document. I'm aware of the practical problems of using DNAME in ARPA in = the way that it is currently managed.

I agree that = there is a possible issue here, and I would support documenting = it.  But since the basic trust model I'd suggest for a doh server = discovered this way is equivalent to "something scrawled on the wall of = a coffee shop", I think this situation (in which they are not recognized = locally as special use names, and the particular anycast AS112 server = answering the leaked query is an attacker) is pretty much par for a = pretty rough course.

I think the risk is far more serious than you are = implying, and to be honest I think the only useful advice here is that = the mechanism should be considered harmful and must not be = used.

Since the meeting this week = also seemed to expose concerns about the other two mechanisms, it's = seems possible that this draft has led us down a dead end.


Joe
= --Apple-Mail=_C59E8BF6-2326-4388-8203-CECCAA539753-- --Apple-Mail=_927AC060-3EDC-4DD5-85AE-95B33A2E8B01 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iF0EARECAB0WIQSAt40QkiztAcvphdg0jwy9hlI6LAUCXJtQmgAKCRA0jwy9hlI6 LEPpAKCCqoYzHyDucWJQGqQQOxhQ/X+xDACgwtS2Eee4Kb8thw8qGWTcY+sSypM= =lBmM -----END PGP SIGNATURE----- --Apple-Mail=_927AC060-3EDC-4DD5-85AE-95B33A2E8B01-- From nobody Wed Mar 27 03:58:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3945C120450 for ; Wed, 27 Mar 2019 03:58:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=iseclab.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wlruMZfnWiaW for ; Wed, 27 Mar 2019 03:58:14 -0700 (PDT) Received: from mail-wr1-x431.google.com (mail-wr1-x431.google.com [IPv6:2a00:1450:4864:20::431]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F2C32120579 for ; Wed, 27 Mar 2019 03:58:13 -0700 (PDT) Received: by mail-wr1-x431.google.com with SMTP id q1so18015585wrp.0 for ; Wed, 27 Mar 2019 03:58:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=iseclab.org; s=mail; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=oOSOjbuy1bp8yN9LdX3Im/NZ2j6czy5Amju4FFmZEkY=; b=W9C110YMTlIF66ews+rqlxzbop9L8KC0KYtHDLDsfRXNowlIuk8AsunW5v1QCyGoDt EwPZP/sHX1y3yhrNcM6cygpBRlR7i666KHZZAJclDEjoGKsq16yfS5nNWT0arMcyqhJ+ t86X+IcD9fKfQTAX3kGehjDC5d8bt4C4Rf39ZVUHEoXKsTkMptLW+7USQPTI3ILXv474 QN5f2+7+ehKMdgfgAGPHHJtI9YNDbPKNmpP+A7RNGjvTtvcFDF910pNM8bxmIZQzBG3Q wUHgne1k5JJ3MGtATLLITZNoWNGKr9LoDrLbIyNRKAflcSDTUcB/R6a1RK2h2ap0bkQ7 YHig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=oOSOjbuy1bp8yN9LdX3Im/NZ2j6czy5Amju4FFmZEkY=; b=I6Dz8wkYbPjOf+QfElnuvD8O36LR83wzKilGxv2S0mY8jDU5Lqd7utCeGRcNx1UL77 BOmtqPAmDJaFyVWDOisNkWnNDMMF2EConxS0N+gcFUUDeBuiFycYE1QZHiPgNXRJ80NO HDyU0luZWWHdHeNfuwPw6slv4GQs/NsHZzO/fWBUuHFRIRZ9tbfrg14ZKCdhBKxEx2WD TgGmU0vTBwaZ2SVexocIipSjOpHdrbobNDwV10431KxmfrHteVGC+jtLGyi6QMsD5mhu NZzNGGT+02NIfuc20sb3kUU2o2BoKed95PTNEAHQYkTQdhLVYXxo66u1H1Xhg5rvMPsK sTxQ== X-Gm-Message-State: APjAAAW3YkV4FRXiqm4gIJ1wXdttMOAUrIB4n4FnWwSrAkY6hbFjElMf aLyZ/Xom5TEKKUzalLqvvmd/rYSel2mBOg== X-Google-Smtp-Source: APXvYqwkIDImYlhozReNYuzGhkD611VHVME5Ln0G31s3+Iiv3EPWF+ji7sgQOV9WbduexXMeJjvhTg== X-Received: by 2002:adf:ee50:: with SMTP id w16mr22583258wro.293.1553684292371; Wed, 27 Mar 2019 03:58:12 -0700 (PDT) Received: from [192.168.42.126] (80-110-77-175.cgn.dynamic.surfer.at. [80.110.77.175]) by smtp.gmail.com with ESMTPSA id h7sm25076948wmb.41.2019.03.27.03.58.10 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Mar 2019 03:58:11 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Kevin Borgolte In-Reply-To: Date: Wed, 27 Mar 2019 11:58:09 +0100 Cc: DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <5A28681D-061E-4406-A625-2AC0F3B35606@iseclab.org> References: To: Eric Rescorla X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 10:58:18 -0000 > On Mar 27, 2019, at 10:24, Eric Rescorla wrote: >=20 > Now with the numbered lists correctly formatted: >=20 > I=E2=80=99ve heard a number of questions about Mozilla=E2=80=99s plans = around > DoH. We=E2=80=99ve made a number of public statements, but it might be = useful > to try to put this all in one place. Thanks, much appreciated! > 1. Copies of Firefox will be configured with a set of TRRs. = Different > regions may have different TRR sets or different defaults. In = addition > we may have DoH/TRR on by default in some regions and not others, > especially initially. Out of personal curiosity, does EU GDPR compliance/interpretation = uncertainty play a role in regionally different defaults? For example, = that a US-based DoH TRR if not opt-in could seen as a GDPR violation by = Mozilla? - Kevin= From nobody Wed Mar 27 06:22:14 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 854EE120526 for ; Wed, 27 Mar 2019 06:22:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hezzLTJeLm9U for ; Wed, 27 Mar 2019 06:22:05 -0700 (PDT) Received: from mail-io1-xd41.google.com (mail-io1-xd41.google.com [IPv6:2607:f8b0:4864:20::d41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 306DB1206D8 for ; Wed, 27 Mar 2019 06:22:02 -0700 (PDT) Received: by mail-io1-xd41.google.com with SMTP id c4so13997880ioh.9 for ; Wed, 27 Mar 2019 06:22:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=5pSuM71iyYzRveYiKmGOwNen1SM1YFmI75u9jCnqtZk=; b=ep6iMQqaY54sDIwto5kqSmehjAcN5LahqdVmnQuTPiVgTXopt6BOafKcMn7/1a3QaH hIuc9/ckOaZYU5KTzZMXQ4qjU9pbWsuk2uml5rL+mANTBscLGXzXj+2MAdadaxHPOBOi QoPZAq7WoSy8vKlWtazmspYod5CCT+OALma+L4E2Eyq3LolVIhW6LgNIfHotoq6oUrlz VMoN5kyNZH19bU6Ue99DT2mtJFnjmQbEMX1iMsoHXUQo8uSfXkhO58tN1RhSjthUsnMM PNBiYzq3RWmGiJas217cZkwpHetR53PxdtRBbPjDAy5duuEAzl2J4/1O+VoqPxBI3IAK 40QQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=5pSuM71iyYzRveYiKmGOwNen1SM1YFmI75u9jCnqtZk=; b=BSzr7pAqGxIteTbqluHx5C+MrR+tDVHDmCI7lwQyR/4ULYjxGRwokcRh6cozccu/bq mFh9r3YI89B+/o/XyTYraKhd04E0OPlCKR4Oodb+/1ufSXkFuq+B2d1b1i6pZi3uBPUN H6Qy0k16paWxMEkkU/ToeUiT+kzDbPwMJhCnWBWDZ6DJLWVM+LZakaiEFzIs5RNVhnU2 6i8K2aGUntHOGxvdLEI0Ev/cy93emRiqP9qsu50iCXw6kVFdkbbgbvguRMOjLNAllVxS DiyslUFCbqijtOhh+v8i2LZDj8rRO08FVx8AEir3UvhZp6M6PzN1z0FtOUdtNwawisMt VGhg== X-Gm-Message-State: APjAAAX1wvrwaOXx9rVYhg9TXz7g4QxCr1i7Y1x1HFDknxQjJB42TMOZ ZumEPQktuf3F+u0L+aD+rXQ3x4+fRclm3ByMYYQ= X-Google-Smtp-Source: APXvYqzGfs7CB9iuRJKLPkAarAJ8tTH1tP6sFtuii1kz8mcg+2PvIYk9vjlL3MAHIezvTbLt3nfzrN4AihKcJfavuoI= X-Received: by 2002:a6b:e202:: with SMTP id z2mr25516819ioc.6.1553692921276; Wed, 27 Mar 2019 06:22:01 -0700 (PDT) MIME-Version: 1.0 References: <22AA82AA-7EA4-413F-B154-A38F8CA36306@hopcount.ca> In-Reply-To: <22AA82AA-7EA4-413F-B154-A38F8CA36306@hopcount.ca> From: Ted Hardie Date: Wed, 27 Mar 2019 14:21:34 +0100 Message-ID: To: Joe Abley Cc: DoH WG Content-Type: multipart/alternative; boundary="000000000000a9c398058513520a" Archived-At: Subject: Re: [Doh] on blackholing resolver-associated-doh.arpa and resolver-associated-doh.arpa X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 13:22:13 -0000 --000000000000a9c398058513520a Content-Type: text/plain; charset="UTF-8" Hi Joe, Top posting, forgive me. I recognize that this is different from junk PTR case, but I would interested in how different you see this from the .home.arpa case laid out in RFC 8375? The critiques you make seem to indicate that you would have similar issues there, but if there is a distinction (e.g. single answers versus declared resolver), it would be useful to draw it out. thanks, Ted On Wed, Mar 27, 2019 at 11:30 AM Joe Abley wrote: > Hi Ted, > > On 26 Mar 2019, at 16:31, Ted Hardie wrote: > > When I sent the text (as requested), I just grabbed a copy of the text > from RFC 8375, Section 7. That suggests pointing to ' > blackhole-1.iana.org.' and 'blackhole-2.iana.org.' which the AS112 > project augments. The issue that these were built to solve, a high load of > queries to .arpa for queries leaking into the zone, seems like it might > apply to this special use name. > > > I am familiar with the AS112 project. The crucial difference between the > junk PTR queries for RFC1918 and RFC1918-like nets that are soaked up by > those servers and the two ARPA domains we're talking about here are that > the threat models are very different. It's a stretch to imagine that a > rogue PTR response can cause anybody any harm, whereas a rogue response to > these doh queries could subvert all subsequent name resolution in a way > that would be difficult to detect, and there is the potential to do so on a > large scale. > > DNAME is theoretically possible instead, but the .arpa server operators > have historically been slow to take up the idea of using DNAME (they did > not agree for .home.arpa). I have no objection to trying again, of course, > if that is preferred. > > > My DNAME observation was simply to illustrate that the blackhole idea was > inconsistent with the current text in the document. I'm aware of the > practical problems of using DNAME in ARPA in the way that it is currently > managed. > > I agree that there is a possible issue here, and I would support > documenting it. But since the basic trust model I'd suggest for a doh > server discovered this way is equivalent to "something scrawled on the wall > of a coffee shop", I think this situation (in which they are not recognized > locally as special use names, and the particular anycast AS112 server > answering the leaked query is an attacker) is pretty much par for a pretty > rough course. > > > I think the risk is far more serious than you are implying, and to be > honest I think the only useful advice here is that the mechanism should be > considered harmful and must not be used. > > Since the meeting this week also seemed to expose concerns about the other > two mechanisms, it's seems possible that this draft has led us down a dead > end. > > > Joe > --000000000000a9c398058513520a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Joe,

Top= posting, forgive me.=C2=A0 I recognize that this is different from junk PT= R case, but I would interested in how different you see this from the .home= .arpa case laid out in RFC 8375?=C2=A0 The critiqu= es you make seem to indicate that you would have similar issues there, but = if there is a distinction (e.g. single answers versus declared resolver), i= t would be useful to draw it out.

thanks,

T= ed

On Wed, Mar 27, 2019 at 11:30 AM Joe Abley <jabley@hopcount.ca> wrote:
<= blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-l= eft:1px solid rgb(204,204,204);padding-left:1ex">
Hi Ted,

On 26 Mar 2019, at 16:31, Ted Hard= ie <ted.ietf@gma= il.com> wrote:

When I sent the text (as requested), I= just grabbed a copy of the text from=C2=A0 RFC 8375, Section 7.=C2=A0 That= suggests pointing to 'blackhole-1.iana.org.' and 'blackhole-2.iana.org.'=C2=A0 wh= ich the AS112 project augments.=C2=A0 The issue that these were built to so= lve, a high load of queries to .arpa for queries leaking into the zone, see= ms like it might apply to this special use name.

I am familiar with the AS112 project. The cru= cial difference between the junk PTR queries for RFC1918 and RFC1918-like n= ets that are soaked up by those servers and the two ARPA domains we're = talking about here are that the threat models are very different. It's = a stretch to imagine that a rogue PTR response can cause anybody any harm, = whereas a rogue response to these doh queries could subvert all subsequent = name resolution in a way that would be difficult to detect, and there is th= e potential to do so on a large scale.

DNAME is = theoretically possible instead, but the .arpa server operators=C2=A0 have h= istorically been slow to take up the idea of using DNAME (they did not agre= e for .home.arpa).=C2=A0 I have no objection to trying again, of course, if= that is preferred.

My DNAME observation was simply to illustrate that the blackhole idea was = inconsistent with the current text in the document. I'm aware of the pr= actical problems of using DNAME in ARPA in the way that it is currently man= aged.

=
I agree that there is a possible issue here, and I wo= uld support documenting it.=C2=A0 But since the basic trust model I'd s= uggest for a doh server discovered this way is equivalent to "somethin= g scrawled on the wall of a coffee shop", I think this situation (in w= hich they are not recognized locally as special use names, and the particul= ar anycast AS112 server answering the leaked query is an attacker) is prett= y much par for a pretty rough course.
<= div>
I think the risk is far more serious than you are implyi= ng, and to be honest I think the only useful advice here is that the mechan= ism should be considered harmful and must not be used.

=
Since the meeting this week also seemed to expose concerns about the o= ther two mechanisms, it's seems possible that this draft has led us dow= n a dead end.


Joe
=
--000000000000a9c398058513520a-- From nobody Wed Mar 27 09:15:20 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BA8D71202F9 for ; Wed, 27 Mar 2019 09:15:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.107 X-Spam-Level: X-Spam-Status: No, score=-1.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RDNS_NONE=0.793, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tkDl44lFoxoM for ; Wed, 27 Mar 2019 09:15:17 -0700 (PDT) Received: from mail.noware.co.uk (unknown [IPv6:2604:a880:0:1010::add:2001]) by ietfa.amsl.com (Postfix) with ESMTP id 2AA261202E4 for ; Wed, 27 Mar 2019 09:15:17 -0700 (PDT) Received: from [10.101.2.154] (unknown [176.12.107.132]) by mail.noware.co.uk (Postfix) with ESMTPSA id CE9B21D8251 for ; Wed, 27 Mar 2019 16:11:33 +0000 (UTC) From: Neil Cook Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 12.1 \(3445.101.1\)) Date: Wed, 27 Mar 2019 16:15:14 +0000 References: To: DoH WG In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3445.101.1) X-VADE-SPAMSTATE: clean X-VADE-SPAMSCORE: 0 X-VADE-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgedutddrkedvgdekudcutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfpgffknfevqffqmfenuceurghilhhouhhtmecufedttdenucenucfjughrpefhtgfgggfuffhfvfgjkffosehtqhhmtdhhtdejnecuhfhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqeenucfkphepudejiedruddvrddutdejrddufedvnecurfgrrhgrmhepihhnvghtpedujeeirdduvddruddtjedrudefvddphhgvlhhopegluddtrddutddurddvrdduheegngdpmhgrihhlfhhrohhmpefpvghilhcuvehoohhkuceonhgvihhlrdgtohhokhesnhhofigrrhgvrdgtohdruhhkqedprhgtphhtthhopeguohhhsehivghtfhdrohhrghenucevlhhushhtvghrufhiiigvpedt Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 16:15:19 -0000 > On 27 Mar 2019, at 09:24, Eric Rescorla wrote: >=20 > Now with the numbered lists correctly formatted: >=20 > I=E2=80=99ve heard a number of questions about Mozilla=E2=80=99s plans = around > DoH. We=E2=80=99ve made a number of public statements, but it might be = useful > to try to put this all in one place. >=20 > In context, the problem we are attempting to solve here is attack on > the user=E2=80=99s name resolution from an attacker with full or = partial > control of the network, as contemplated by Section 3 of BCP 72 as well > as BCP 188. There=E2=80=99s ample evidence of monitoring/manipulation = of user > traffic via this vector [0][1][2]. Importantly, this includes cases > where the entity which owns the network infrastructure monitors and/or > modifies DNS requests and responses without the user=E2=80=99s = consent. >=20 But Mozilla doesn=E2=80=99t know whether the modification is with or = without the user=E2=80=99s consent. As the various drafts that have been = presented this week attempt to make clear, there are a large number of = use cases where users actively want the modification of their DNS = (parental control, enterprise networks, malware/phishing detection, = botnet C&C communication disruption etc.), indeed they may even be = paying for such a service. So the Mozilla answer to possible DNS modification without user=E2=80=99s = consent is to enable over-the-top DNS resolution for all users, using an = opt-out model (how a normal user is supposed to understand what = they=E2=80=99ve been opted into brings up all kinds of user consent = issues itself), and sending all DNS requests to a third-party with whom = the user almost certainly has no relationship, contractual or otherwise, = and potentially located in a third-party country. To summarise, in an attempt to deal with a possible (but essentially = unknown) issue of user consent, Mozilla "would like to deploy it by = default for our users.=E2=80=9D=20 All the above seems rich with irony and contradiction. Neil From nobody Wed Mar 27 09:32:29 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 902EE1202FF for ; Wed, 27 Mar 2019 09:32:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zwpP_82Ocfil for ; Wed, 27 Mar 2019 09:32:26 -0700 (PDT) Received: from ppsw-32.csi.cam.ac.uk (ppsw-32.csi.cam.ac.uk [131.111.8.132]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B27A51202FC for ; Wed, 27 Mar 2019 09:32:26 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:39244) by ppsw-32.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.138]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1h9BTU-000KUX-1O (Exim 4.91) (return-path ); Wed, 27 Mar 2019 16:32:24 +0000 Date: Wed, 27 Mar 2019 16:32:24 +0000 From: Tony Finch To: Eric Rescorla cc: DoH WG In-Reply-To: Message-ID: References: User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; CHARSET=US-ASCII Content-ID: Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 16:32:28 -0000 Eric Rescorla wrote: > > 4. At any time, the user will have the option to select a > different resolver out of the list, specify their own resolver, or > disable DoH entirely. Will Firefox inform its users whether the local resolver supports DoT or DoH? > However, there are two more restricted cases in which we do think some > network control of the resolver is reasonable. What about allowing Firefox users to access private / internal domain names? Tony. -- f.anthony.n.finch http://dotat.at/ each generation is responsible for the fate of our planet From nobody Wed Mar 27 09:56:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EC6112032D for ; Wed, 27 Mar 2019 09:56:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id owwnrxIOUM7Y for ; Wed, 27 Mar 2019 09:56:55 -0700 (PDT) Received: from mail-lj1-x234.google.com (mail-lj1-x234.google.com [IPv6:2a00:1450:4864:20::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DCDA612031D for ; Wed, 27 Mar 2019 09:56:54 -0700 (PDT) Received: by mail-lj1-x234.google.com with SMTP id t4so1952873ljc.2 for ; Wed, 27 Mar 2019 09:56:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QZmgzFK9K2u9ErJZ1sHvf/nZeztOSFDPj8CVFuJX1rE=; b=BoS3otUku2uz205QIUkaQcDJReObx+S8cZfDb6Q85mK51OYIFoabx0G+sdW4ZxxAsJ qhHRhXPdqhXc29nCPhWcT/hfC4GdA6KI0BAw2VvFjipG20Bi/igf8QhR4umdIcf7GaYY zygxWpgnjhA3+VZQBe/MR0H647iSssuc51kmNYakaHW2IlMMtT/CSeJ8GMmeOBahF6Yo 0rcAEvNVIDpDnEV9BqO9m2ugznIRABul/TQQ5fC1tMbo93DuS0m05wHYLCyCHfaca2dn B4dII4897xYSgr0As24OlnIzPhs2bu9H2Kpp7Xo/NGmbTM89p6+ZacESA7XKX2Fy7vY2 ukpA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QZmgzFK9K2u9ErJZ1sHvf/nZeztOSFDPj8CVFuJX1rE=; b=FHTQ7jrtFzYfszyF07uaYzpkj/t0jHmVPmMKJHksdqncggn9Y4VxofhG13HGr3aYof sNFgdGxc4UTZqXvgc5wWuIDv4WwFIuaKzZsXlITBTlnjTNBQ7SOlp/FeKs+0Va1U/VFt k33ffKsjqSZw5wGQcH8ebK99039f1nOfyh3nOI+x2v3ucdL7J06yF6C0orYfUBAkT+a6 NIaks2Gxc0H5yW6XYCm2AMLOlZWiArbbeF3w18PowQU26vsS+sF/ln7bBYMSnQv5MkBo 8GCbEeSooCYoVP66JeTc579XmCff/KA+0LaFneuNN9UsstIC5QeZAkVx8MlF4ldcO+Dc jnXA== X-Gm-Message-State: APjAAAXJmv5cKleP5/FMUi8eEGUNd36qI2AfjXciyBgh6pmyCQ/m14m9 w/ygAUnlcwmayaG3XFAv09VVIGnUszJsNpcPtMN9EQ== X-Google-Smtp-Source: APXvYqx8MSpSqIbmmqxNPUVNC1Hphmn18/vZoJwTPH3/niZuV9jecKUrh5pHIQI0V3ZMu3FsKIHnqxwDjhti+th8fCc= X-Received: by 2002:a2e:3506:: with SMTP id z6mr20326695ljz.72.1553705813117; Wed, 27 Mar 2019 09:56:53 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Eric Rescorla Date: Wed, 27 Mar 2019 09:56:12 -0700 Message-ID: To: Tony Finch Cc: DoH WG Content-Type: multipart/alternative; boundary="00000000000013aac105851653e2" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 16:56:57 -0000 --00000000000013aac105851653e2 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 27, 2019 at 9:32 AM Tony Finch wrote: > Eric Rescorla wrote: > > > > 4. At any time, the user will have the option to select a > > different resolver out of the list, specify their own resolver, or > > disable DoH entirely. > > Will Firefox inform its users whether the local resolver supports DoT or > DoH? > We don't currently expect to do so. As noted above, we don't think secure transport to the local resolver is sufficient to ensure the privacy and security guarantees we are trying to provide. > However, there are two more restricted cases in which we do think some > > network control of the resolver is reasonable. > > What about allowing Firefox users to access private / internal domain > names? > If a name doesn't resolve with DoH, we fall back to the system resolver. This doesn't work properly when the same name is available on the public DNS but pointing to a different location. As I alluded to in my email, we're still working out how to deal with this split horizon scenario. -Ekr > Tony. > -- > f.anthony.n.finch http://dotat.at/ > each generation is responsible for the fate of our planet > --00000000000013aac105851653e2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Mar 27, 2019 at 9:32 AM Tony = Finch <dot@dotat.at> wrote:
Eric Rescorla <ekr@rtfm.com> wrote:<= br> >
>=C2=A0 =C2=A0 =C2=A04. At any time, the user will have the option to se= lect a
>=C2=A0 =C2=A0 =C2=A0different resolver out of the list, specify their o= wn resolver, or
>=C2=A0 =C2=A0 =C2=A0disable DoH entirely.

Will Firefox inform its users whether the local resolver supports DoT or DoH?

We don't currently expect to d= o so. As noted above, we don't think secure transport to the local reso= lver is sufficient to ensure the privacy and security guarantees we are try= ing to provide.



> However, there are two more restricted cases in which we do think some=
> network control of the resolver is reasonable.

What about allowing Firefox users to access private / internal domain
names?

If a name doesn't resolve wi= th DoH, we fall back to the system resolver. This doesn't work properly= when the same name is available on the public DNS but pointing to a differ= ent location. As I alluded to in my email, we're still working out how = to deal with this split horizon scenario.

-Ekr=


Tony.
--
f.anthony.n.finch=C2=A0 <dot@dotat.at>=C2=A0 http://dotat.at/
each generation is responsible for the fate of our planet
--00000000000013aac105851653e2-- From nobody Wed Mar 27 10:34:42 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2264F12000F for ; Wed, 27 Mar 2019 10:34:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yqdCV-gSdHf5 for ; Wed, 27 Mar 2019 10:34:38 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 239411202AB for ; Wed, 27 Mar 2019 10:34:37 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id d13so15143825qth.5 for ; Wed, 27 Mar 2019 10:34:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YRuDPbtse60Gfbp6r++idtnTOCE0Nae1m+EPw7Hfl3g=; b=IX3YPrc9habWokUsEFjpO4flNcqz6BJkrfcgEMXVaucBBU35nZBGZMdtRPbkYJI1gz f2s7VK63++rP+SCIfSdJRx/tkn5LMH0jOdXjyjoG03gsMcgjxzrAflPwqnG/van3A2RC ir5vOHCtOYTUTm3D+T/lLtXqRRvNjEDG/xV1OIGTyK7UqoXiz+XYCJjW9AvIt+9CECUL pG2gSTS5ajE0jrKprn9wCosaU2b/0KjzAyWJh/iXW+6+DCsJ6mynbAZfwmE7Pvp3VQ+z Ru7eRvRtiOfxVRfv9awzRSJoz6Hg3lavCy5Ow8Kr50Es088/5k6E1IS2rMovZhhUyKS/ r+kQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YRuDPbtse60Gfbp6r++idtnTOCE0Nae1m+EPw7Hfl3g=; b=GWCCjOWxfjR6gw1M5pGJU31X8Mnbvw61lkGQWMKBDQ91BDa0BUfcyZ4bwiv4KmGFgm dMXJoC1qY8zv1Nh8glhsYdeqJKnP3+XBPxcUBFYn0ums1+9IY5sFOfY5AuNXdg1D04gl XxHjvyERlLwBq/P00m+7aJrKCxC5H/IOqsgOnesLkNVrVWbL5Q9ZIP50dtKKM+qkAhdm CgGRO4FdZ5IOQpVYqQruSwFS7oEgEAwtFQ6PQWlMEhgYaJss1wADOZiv5dSdh1BeWP9f JogICE9jEVKvuPVitFbwztHTfoInJ9LihcVPZ/dfALVJTgUN1ePdXUEjFqHoEQwYAGA/ bjsQ== X-Gm-Message-State: APjAAAXaEyZnupJ2u6deBJPISts8k56KOSjm7gBAH9RKVyg98mA+ykXe Gw7sC+mpqyZi/Jt+d6heTJPTWkYIoeBbTrUXOTNBmTzl X-Google-Smtp-Source: APXvYqw1Lw4YqvTDsts3tJBLhI62mem404TB01greIaiLV8/z/BePv4gSaLkboRvnfpieD6Aw+vuWSU83/oyRKBWRGA= X-Received: by 2002:ac8:2d62:: with SMTP id o31mr11615216qta.370.1553708076278; Wed, 27 Mar 2019 10:34:36 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Brian Dickson Date: Wed, 27 Mar 2019 18:34:24 +0100 Message-ID: To: Eric Rescorla Cc: Tony Finch , DoH WG Content-Type: multipart/alternative; boundary="000000000000f8a6ea058516d909" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 17:34:41 -0000 --000000000000f8a6ea058516d909 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 27, 2019 at 5:57 PM Eric Rescorla wrote: > > > On Wed, Mar 27, 2019 at 9:32 AM Tony Finch wrote: > >> Eric Rescorla wrote: >> > > > However, there are two more restricted cases in which we do think some >> > network control of the resolver is reasonable. >> >> What about allowing Firefox users to access private / internal domain >> names? >> > > If a name doesn't resolve with DoH, we fall back to the system resolver. > This doesn't work properly when the same name is available on the public > DNS but pointing to a different location. As I alluded to in my email, > we're still working out how to deal with this split horizon scenario. > > I think there are data leakage and enterprise-specific issues, above and beyond this, but I think there are ways to limit that, and identify the split horizon existence: If you do QNAME minimization and compare the delegations returned from the system resolver and DoH server, if they don't have identical results, that should point to the need to use the system resolver. I can't think of reasons why they would differ except for split-horizon, and possibly geo-ip stuff. Non-split-horizon stuff follows: I'd like to suggest other tests for determining whether using a public resolver might be contrary to network policy, and thus be indicative of a need for explicit user approval (opt-in). - Make connection attempts to the public resolver's IP address on UDP port 53, TCP port 53, and TCP port 853 (DoT). - Success on any of those could be interpreted as that public resolver being permitted by network policy. - Failure on all of those should be interpreted as that public resolver not being permitted by network policy. - I would also like to suggest adding a standardized DoH-only port, where the DoH-only port is used when policy appears to permit access to the third party resolver. - And finally, I would humbly suggest that the DoH "shared" 443 (HTTPS) port be used only with explicit user permission, and only when none of the above ports are accessible, i.e. "dissident mode". (IMHO, dissident mode should also engage, or require the user to have previously engage, whatever the specific browser calls its privacy mode, e.g. "incognito", "private", etc., so as to minimize any residual risk to dissidents.) There are host/network security reasons about why "DoH to third party, on by default" is a riskier choice, or where the mechanisms of enabling DoH to third party locations are easily accessible. Malware C&C communication, and malware data exfiltration over DNS, are host-specific concerns, whereby malware might take advantage of encrypted DNS to offsite providers, by accessing the browser as a DNS vector. Even if it doesn't raise the bar that much, taking it out of the realm of "trivial" (i.e. requiring some activity on the part of malware to enable DoH) would be preferable. Brian Brian --000000000000f8a6ea058516d909 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Mar 27, 2019 at 5:57 PM Eric = Rescorla <ekr@rtfm.com> wrote:
<= div dir=3D"ltr">

On Wed, Mar 27, 2019 at 9:32 AM Tony Finch <dot@dotat.at> wrote:
<= /div>
Eric Rescorla <ekr@rtfm.com> wrote:=

> However, there are two more restricted cases in which we do think some=
> network control of the resolver is reasonable.

What about allowing Firefox users to access private / internal domain
names?

If a name doesn't resolve wi= th DoH, we fall back to the system resolver. This doesn't work properly= when the same name is available on the public DNS but pointing to a differ= ent location. As I alluded to in my email, we're still working out how = to deal with this split horizon scenario.


I think there are data leakage and ente= rprise-specific issues, above and beyond this, but I think there are ways t= o limit that, and identify the split horizon existence:

If you do QNAME minimization and compare the delegations returned fro= m the system resolver and DoH server, if they don't have identical resu= lts, that should point to the need to use the system resolver.
I can't think of reasons why they would differ except for = split-horizon, and possibly geo-ip stuff.

Non-spli= t-horizon stuff follows:

I'd like to suggest o= ther tests for determining whether using a public resolver might be contrar= y to network policy, and thus be indicative of a need for explicit user app= roval (opt-in).
  • Make connection attempts to the public re= solver's IP address on UDP port 53, TCP port 53, and TCP port 853 (DoT)= .=C2=A0
  • Success on any of those could be interpreted as that public= resolver being permitted by network policy.
  • Failure on all of thos= e should be interpreted as that public resolver not being permitted by netw= ork policy.
  • I would also like to suggest adding a standardized DoH-= only port, where the DoH-only port is used when policy appears to permit ac= cess to the third party resolver.
  • And finally, I would humbly sugge= st that the DoH "shared" 443 (HTTPS) port be used only with expli= cit user permission, and only when none of the above ports are accessible, = i.e. "dissident mode".

(IMHO, = dissident mode should also engage, or require the user to have previously e= ngage, whatever the specific browser calls its privacy mode, e.g. "inc= ognito", "private", etc., so as to minimize any residual ris= k to dissidents.)

There are host/network security = reasons about why "DoH to third party, on by default" is a riskie= r choice, or where the mechanisms of enabling DoH to third party locations = are easily accessible.
Malware C&C communication, and malware= data exfiltration over DNS, are host-specific concerns, whereby malware mi= ght take advantage of encrypted DNS to offsite providers, by accessing the = browser as a DNS vector.
Even if it doesn't raise the bar tha= t much, taking it out of the realm of "trivial" (i.e. requiring s= ome activity on the part of malware to enable DoH) would be preferable.

Brian

Brian=C2=A0
--000000000000f8a6ea058516d909-- From nobody Wed Mar 27 10:52:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9DBC012031D; Wed, 27 Mar 2019 10:52:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HEADER_FROM_DIFFERENT_DOMAINS=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1BhIwGX4yXvv; Wed, 27 Mar 2019 10:52:46 -0700 (PDT) Received: from ayla.bortzmeyer.org (ayla.bortzmeyer.org [92.243.4.211]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B4BD71203B5; Wed, 27 Mar 2019 10:52:44 -0700 (PDT) Received: by ayla.bortzmeyer.org (Postfix, from userid 10) id 246B8A0533; Wed, 27 Mar 2019 18:52:42 +0100 (CET) Received: by godin (Postfix, from userid 1000) id 31486EC0AFD; Wed, 27 Mar 2019 18:48:55 +0100 (CET) Date: Wed, 27 Mar 2019 18:48:55 +0100 From: Stephane Bortzmeyer To: doh@ietf.org, dns-privacy@ietf.org, dnsop@ietf.org, hrpc@irtf.org Message-ID: <20190327174855.GA24649@laperouse.bortzmeyer.org> References: <20190311165813.ilrz5ocxomraavbq@nic.fr> <20190320072921.GA20969@laperouse.bortzmeyer.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="9jxsPFA5p3P2qPhR" Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20190320072921.GA20969@laperouse.bortzmeyer.org> X-Transport: UUCP rules X-Operating-System: Ubuntu 18.04 (bionic) X-Charlie: Je suis Charlie User-Agent: Mutt/1.9.4 (2018-02-28) Archived-At: Subject: Re: [Doh] Proposal for a side-meeting on services centralization at IETF 104 Prague X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 17:52:51 -0000 --9jxsPFA5p3P2qPhR Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Mar 20, 2019 at 08:29:21AM +0100, Stephane Bortzmeyer wrote a message of 22 lines which said: > I modified the title of the meeting > > because there is obviously no consensus on the problem or on the > agenda. Anyway, a room is reserved if people want to meet on > wednesday. I swear this is the last time I send an email to the four mailing lists together. One of the goals of the side meeting was precisely to discuss the proper venue. The side meeting had around 100 participants (room was full), and lasted 1.75 hours. Shane Kerr was nice enough to take notes, they are attached here. Also, I send the two set of slides that were shown at the beginning of the meeting. --9jxsPFA5p3P2qPhR Content-Type: text/markdown; charset=utf-8 Content-Disposition: attachment; filename="ietf-104-doh-side-meeting.md" Content-Transfer-Encoding: 8bit # IETF 104 DoH Unofficial Side Meeting When: 2019-03-27 15:00 CET ## Action Points None. ## Stéphane Bortzmeyer introduces the meeting Possible outcome: - List of issues? - Place(s) to discuss? Potential List of Issues: 1. Protocol? HTTP too revealing? 2. Risk of centralization (DNS over Cloud, DNS accessing Others, ...) 3. Applications bypassing OS ("resolverless", ADD - "Applications Doing DNS") 4. Loss of control (ability to see what's going on and/or change it) 5. Issues with public resolver (location-specific answers, "split horizon") ## Jim Reid presents a possible list of issues Issues from operator draft, draft-reid-doh-operator. Many will be statements of the obvious. In other forums these are _not_ obvious. ## Discussion Brian Dickson: Enterprise networks have a need to control DNS resolution. Separate dissident requirements from enterprise requirements. Jim Reid: All the choices here are bad. Brian Dickson: DoT & DoH overlap, and may better be treated collectively. For example service discovery and policy. Watson Ladd: Think that there should be an operator draft. Wide range of cases. Networks where you don't have administrative level controls. Do we want a world where hotels intercept DNS traffic? Or residential ISPs? Jim Reid: Not a simple matter of making it consumer choice. Bret Jordan: Like the concepts of DoH. Need to separate out enterprise. Cannot ignore (data leakage from internal systems). Like to understand threat actor behavior. Puneet Sood: Speaking as a home user. I want to ask the ISPs one question: "Where is the privacy policy that my ISP has?" Jonathan Reed: Like the idea of an operator draft. If we decide not to address something we should document that. Also, privacy means different things to different people. Stéphane Bortzmeyer: In 2 hours we won't solve the problems of "can my ISP access my data" and so on. Wider privacy issues are too large for this meeting. Jason Livingood: Incorrect assumption to say that enterprise networks have administrative control over all their endpoints. In terms of privacy policies... DoH has prompted discussion at operators about DNS privacy. In Europe the GDPR already covers that. A lot of other ISPs are having discussions about how to make their policies better about DNS data. From Comcast there will be more clarity coming soon; for example, we have never sold DNS data. Many of the policies (like Google) talk about DNS data, but they do not address other layers (like the web layer). Google tracks many different things at the web level, and we need to talk about both things. Daniel Khan Gillmor: It sounds like DNSOP may need to adopt work from DoH. There are dissidents in enterprises. Also, if we should split out the enterprise case, I would like to hear how. Eric Rescorla: Lots of things that make people sad about DoH, but we need to also think about the things that are good about DoH. We are talking about the use of a centralized personal resolver and not the local one. Someone who controls the network but does not control your computer is an attacker. When we did the DoH version, we had to make sure that the web level was not leaking information; since it was multiplexing there was an opportunity for leakage. Policy designed to protect that. Much conversation about privacy and GDPR; a number of practices that DoH is intended to stop are filtering and blocking, not privacy. Filtering and blocking are not covered by the GDPR. Tiru Konda: Malware exfiltrating information. Command and control information over DNS. Enterprises expect DNS messages to be blocked against these. Motivations should be that enterprises must provide DoT or DoH servers. 2nd class of problem is from devices, especially IoT devices. User does not know how to configure them, so we should have a way to locally provide a server. Vittorio Bertola: Before starting discussion we need a statement. If you want a list of issue that is fine with everyone you must accept all issues from everyone. After a first phase we can maybe do something else. Jim Reid and Ted Hardie have a hug. There's a lot of love in this room. 💕 Ted Hardie: "Privacy Considerations" RFC has useful terminology. Draft "for the users" which has a statement which might be made by the IETF where there is a hierarchy where users come first. Probably do not want a narrow context, just in DNS. Ralf Weber: Need to make sure that whatever we come up with _really_ helps the users. One solution may not fit all. 10's or 100's of thousands of entities providing service. This is harder for someone to go after rather than a few cloud providers. Need to come up with a way for people to provision in an easy way, scalable way. Probably need a working group to tackle DoH and DoT... probably DPRIVE since it doesn't have the HTTP. Matt Pounsett: Impossible to separate operational issues from dissidents. But we are ignoring the trade-offs. Increased privacy in one way means less privacy and security in other ways. Frequently operators protect users from hostile software. Without finding some way to address that (at a similar economic level) is irresponsible. Brian Dickson: We can solve all the issues. Enterprise blocking DNS queries for good reasons. Want to identify and block to maintain control for DNS. DoH is mostly about enabling DNS resolution over HTTPS. If DoH were to do the same thing over a unique port for non-dissident case it would solve most of the problem. On a DoT vs. DoH... as a resolver upgrade I would prefer DoT since it is a small upgrade on the resolver. Karl Henderson: Nice to have a unified service discovery. Katie P.: Thanks for the issues. With ISPs users know which companies they rely on and where their data goes. Some ISPs are excellent. I would like explicit opt-in. Expectations should not be changed by default. Stéphane Bortzmeyer reminds people that this is the IETF and the main goal is to develop protocols. We have to work on something concrete. Do not let the discussion of the general issues of the Internet interfere with getting stuff done. Eliot Lear: Plea to developers about how they will implement. Trying to convince people to change plans at the microphone are probably not a good use of time. Next, I have heard that there are multiple threat models to address. Probably we need to address that in the room. Next, it is not necessary for the end result to be more protocols. Maybe BCP or documenting impact of work already done would be useful. Daniel Khan Gillmor: DoH has forced us to grapple with the idea that we are leaking data. We have not informed the user. We may change who this data gets to, which upsets people. None of this has been informed by user choice. Many people do not have a choice about how they connect to the Internet. The default is not necessarily more respectful of user choice. Next, I agree with folks who are terrified of DNS over Cloudflare. That is _not_ a DoH problem. Ulrich Isser: I have heard that DoH improves privacy, but if you mean using Google then I am not impressed. Wes Hardaker: The IETF has done a miserable job of presenting user choice. I don't know how we can offer users more choices. Most users run on default services until it gets so oppressive that IP addresses are spray-painted on the side of a wall to get around it. Brian Dickson: I agree with all of that, but I have to go back to the enterprise. Naive since once a host is infected they will change the settings. We have to protect other machines and against data leakage. No browser should have a 3rd party as the default, ideally in a sandbox environment. Antoin Verschuren: I get the feeling we are only trying to solve one use case. We are forgetting that DNS is deployed so widely... there are networks which do not have users. Machine networks that you want to protect against intrusion. Sara Dickinson: Step back and think about the context. DoH came along and changed the discussion. Now people are reacting to it. People are being very reactive, "what are you doing to solve the problem now?" I think we need to be very mindful about 3 or 5 years down the road. Much larger trust models with long term implications. Watson Ladd: Need to implement egress filtering. Have other services that used to be provided by ISPs like e-mail. Unbundling of DNS has already been done, and the unbundling issue of encryption. Eric Rescorla: I don't want to ask a user for consent "do you want to use DoH?". We're concerned about the enterprise consent to monitor and block versus other kinds of networks monitoring and blocking. From a client perspective these are indistinguishable. I am interested in ways for the network to authenticate to the users to allow user choice. Next, I am also concerned about consolidation. All DNS traffic going through Cloudflare is not ideal. Policy-compliant ISP networks be able to advertise their DNS seems good. But current situation is not fantastic. Erik Nygren: The default scenario where a lot of the concern is around (not like how people buy VPN today). Secondary side-effects that are hard to proceed. Come up with a story where networks offer a trusted resolver, scaleably deploy these. If you have to know a trusted list of browser vendors we will only have 10. Need to think about economic incentives about trusted resovler operation. ISPs see name service as a critical part of their operation. If some people who will run it for the good of the Internet... the economic models should exist without hidden side-models to encourage this. Would be good to give something for operators to show regulators... but would that be good enough? So... is 90% of users being filtered good enough? If that changes to 40% will governments require something else? Will that be better or vastly worse? Steve Farrell: A lot of repetition. Someone should do an objective analysis. Talking about dissidents is absolutely not the right way to think about it. I am not a dissident but I do have interest in my privacy. I don't think that DNSOP is the right place, maybe merging DoH and DPRIVE. Don't give it to the IAB because I am on it. ## Process Discussion Paul Hoffman: Sending same message to 3 lists is not helpful. Subject lines matter. At last count fewer than half of messages about Jim's draft were about Jim's draft. We have heard that there are a wide variety of concerns. Some people want it to be DNS, some want it taken above. Some are concerned about the venue where DNS queries begin, others are not. If you have a concern, make it so that others can tell from the subject line. Every privacy RFC ends up in a last call that lasts 6 months. I have been impressed by lack of nastiness today, but on the last call it dives into the mud quickly. It should be as clean as possible to minimize acrimony that has come up every time. Lets do this right and not be in a rush to get to last call. I think there should be a venue, and it should not be a DNS venue (either DoH or DPRIVE). It's NOT protocol concerns. It's user concerns. It's operator concerns. Allison Mankin: Wondered whether we should have a Privacy Ops in Engineering working group which spans across multiple protocols. Stéphane Bortzmeyer: Some issues have nothing to do with privacy. Allison Mankin: Even concerns related like consolidation can be met. Alissa Cooper: Opinions about what to do can be discussed here but will not be decided here. Vittorio Bertola: Wanted to point out that you need a place with everything. Not about privacy, but about user control. Brian Dickson: Drafts that originated in DoH should go to a different location. Jonathan Hoyland: Maybe an HRPC working group instead of research group would be the right place to do it. Jon Peterson: I want to see a charter that explains the pros and cons. If this is about us telling people who they should trust I don't know where to put it. Eric Rescorla: I think there are 3 work items: 1) a document describing risks on all possible sides (I am not enthusiastic about that). 2) who we should trust 3) protocol engineering around reducing centralization (sound like new working group). Suggest people go away and have private conversations. Jason Livingood: Probably 3 areas. Liked John's idea of talking about use cases we are trying to solve. 2nd issue is DoH server/resolver discovery/selection and Paul's draft begins that. 3rd (hardest) is the meta-issues, cross the protocols. Issues around privacy, security, consolidation generally. How these 3 things get done is amorphous. Stéphane Bortzmeyer: We already have a lot of text in RFCs around this. Ralf Weber: We have DoH and DoT and I would prefer these be merged. Combined working group for operations. Mallory Knodel: Important to have these issues when topics come up across the board and not silo the issues when they come up. Add thoughts to considerations alongside the technical considerations. Need to think of it as part of the process and not something extra. Watson Ladd: A draft can reflect consensus even if they reflect concerns of operators. Can have a consolidated draft reflecting why DoH is good as well. Political discussion of where to do the work should not slow down the work. Sara Dickinson: DPRIVE privacy written as problem statement around DNS privacy. Missing wider document. Would have been good to have that before DoH protocol work, since DoH challenges the model. Revising the document now. Expand scope or do that separately? --9jxsPFA5p3P2qPhR Content-Type: application/pdf Content-Disposition: attachment; filename="ietf-104-side-meeting.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjUKJdDUxdgKMTQgMCBvYmoKPDwKL1R5cGUgL1hPYmplY3QKL1N1YnR5cGUgL0Zv cm0KL0JCb3ggWzAgMCA1NjY5LjI5MSA4XQovRm9ybVR5cGUgMQovTWF0cml4IFsxIDAgMCAx IDAgMF0KL1Jlc291cmNlcyAxNSAwIFIKL0xlbmd0aCAxNSAgICAgICAgCi9GaWx0ZXIgL0Zs YXRlRGVjb2RlCj4+CnN0cmVhbQp42tMPzlAozuACAAf9AfAKZW5kc3RyZWFtCmVuZG9iagox NiAwIG9iago8PAovVHlwZSAvWE9iamVjdAovU3VidHlwZSAvRm9ybQovQkJveCBbMCAwIDgg OF0KL0Zvcm1UeXBlIDEKL01hdHJpeCBbMSAwIDAgMSAwIDBdCi9SZXNvdXJjZXMgMTcgMCBS Ci9MZW5ndGggMTUgICAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNrT D85QKM7gAgAH/QHwCmVuZHN0cmVhbQplbmRvYmoKMTggMCBvYmoKPDwKL1R5cGUgL1hPYmpl Y3QKL1N1YnR5cGUgL0Zvcm0KL0JCb3ggWzAgMCAxNiAxNl0KL0Zvcm1UeXBlIDEKL01hdHJp eCBbMSAwIDAgMSAwIDBdCi9SZXNvdXJjZXMgMTkgMCBSCi9MZW5ndGggMTUgICAgICAgIAov RmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNrTD85QKM7gAgAH/QHwCmVuZHN0cmVh bQplbmRvYmoKNDIgMCBvYmoKPDwKL0xlbmd0aCAxMzEzICAgICAgCi9GaWx0ZXIgL0ZsYXRl RGVjb2RlCj4+CnN0cmVhbQp42tVYS28bNxC+61fwKB2W5vDNU9E0sZscijoS0EPbQ6DIToDI rgUXQfvrO0PucLnS2rGtNK0NWNyd5Xyc+eZB7ipxKZQ4m6m9EXAEHG9QooTxWkbjhA5agvZi txEXs/MDpUePUovyH8TuUrS3b/8rVHb8ENVH0f/EWIBHkrekS2SB0MZIk0AAsQVivZ3diNnB dDGBiSKTohOfBanciCi1TyqR8SkoEIgbgzFCE75yFIilOBezc9KMVvQ/yRYDRxI0MGNaqfDP odCmlKLYIhpJdB0/1TlGOhwNSi4EeJmfDnoQswQaRZ7UKrJ9XybwKs+sNII0JuDlEQR6mYJJ xICaIi/IiGZGFFkcAX1iiZG6dwCALkFPiXBZulWkDv1dlF7lUJXZWxYwp58oL2g1NyUCmlyo 5EUG0TeK9bOMtJIuheDxPmUbE1qm+ghUdln0/6dycCf27jD4ljJD5cwY8od9ZtDG52EdRkL1 FoVuBwRVHrK2yg+Xx4XWf63QPoqLe+P/IMKeX5J889CGZxra4wn7N8ngHYVb/4QRVRfneq/A 0yaWlE80mUVGglPJkwC0Jd589Fqjg9Zbb+r9GvmIyhpXJXzyYAS+50XWVQJ4NFQWKgJuW8mh obwG36+rFSypZjLEgStr8aHiDO4tke83Ta1RkJxUEfIerESuFOWpNOs1R35dJehZlrg8Dpvx /rhG3aTaHZyxGGG/xtd189c1fvxs2MzptKCH3b72gJxylpYEn28hrwsh+1NvhsWqiO2p2mww gw8uQaC5g6Q2nIqx34FQJ5FXuvWqzoLWkVjI2D+1lII5+qXhiSMXamd0kuAx6WKQ1kUuWHFW bGuK8v43iY6560oPGQSY36LTOQWg9qVyAi3XazEzFrW0iqFpXCjExNFNfzPW0SzcYQhzuMtL ZpQqMdJGnwLBDJY1wouB+nHnUmgr1m6Ce5i4GU0PNJMsUP1/e73elm7WKOSmeHK61eLlNb42 jtbOWOdZxVjVU9KF7ECsjZhHPLLPfsmZ1Fhk8HWL0v/JdpkDuzrGZPOKhZVXtg9bfjbZUP/J jyYttE+3DQ5ts3tWtUmihiYVJL7llJf1Cc4o/dA/rOkS+K8Szo5hu4p7fqd9Otun77IvFSBD IGxU11r2eOIY1Az0jWv6oOTbmh7XeDcq8q6t8m6yzLupOu8OC70bV/pBoWOtmmSsHxV6K6RC l45KHX/PMnefR51iOGa2sLYPByIs82ElZQgczqamjZXdnnKErBxhrOwmlf2eMsouy7H6bGra WDmMlPnrzcSEsRoeKoC2sqk1x+aPmRgxu9dOy9LD2GcdHmromNRBoMNf3m9erDBDdd7ZMWha rOjripUeMN4Bdyfnxeq9+HX+8vrH7xa/r97c+VXq5BSiKAsAoXROy6ip8VP9pYKyvP3NOPjj w7urzYIa2/zF9ULH+e727+3mr4UO882uyLsyfH/60+sf8rJf2lNFh4dAKgbMZxfKaq9frU4L DihLF5Zxf969u/xz0yxl58uP73vBdrO5/Xh1+aBl7/7ypzCx87G9Hw1letm7px/hPv5q1X/l BE0JYOh7jbH73zg5Ajl0yCymMh3VKXKJ0gaPO8zAmG9nM9+J+TZqjmKY78qzrgwTnMt82M8/ DkOanRiL2HhONXYgt8BjPApGhqRbn2omPuwr68gsjT0wRn+0WYzTmNUnGxJYks05JrQm28Bx n2x4hclGIbhdwJxyrtPG6zmgKIT5SRnsgzIR/fwHUD+KqQplbmRzdHJlYW0KZW5kb2JqCjUy IDAgb2JqCjw8Ci9UeXBlIC9YT2JqZWN0Ci9TdWJ0eXBlIC9Gb3JtCi9CQm94IFswIDAgNS4x MzkgNS4xMzldCi9Gb3JtVHlwZSAxCi9NYXRyaXggWzEgMCAwIDEgMCAwXQovUmVzb3VyY2Vz IDUzIDAgUgovTGVuZ3RoIDE1ICAgICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3Ry ZWFtCnja0w/OUCjO4AIAB/0B8AplbmRzdHJlYW0KZW5kb2JqCjc4IDAgb2JqCjw8Ci9MZW5n dGggMTUzNSAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+PgpzdHJlYW0KeNrVWEtz2zYQ vvtX4EgfROH9yKWT+NEkM01tS7emB5mibU4kUaZke5Jf312A4ENmUkdq08YzFoAldrn77QML UnJLKPn1iO6MDEYG4z1QKBGap1Yowg1PGdekysnN0eUzpu8eU07CvyHVLekur/4rqdHw51K1 JfWPtUFwj3KFvAgWI1yIVDhGGKLFSLY8uidHz7aTAZlAEs4q8kSQ5Z7YlGtHHSrvDGUE5Foj BOEonyp0xIRckqNL5LSS1D9OBgV7FFDQy5QphT8FROmcs2QJ0pDCm3HR7BGpglEA5YYwnfqn LR+znsI6jHFTlzHq9/cArvzOBkaWCmFgegCAOnVGOESADoFnUgtqWiBJGBnYFCki5bUBjOGU 8SESvBaXFNlZvbKppt5VYfcyEiKmC4wLfJsaIjHcHKCML2lJP8jXP6WnaaqcMRrWzuvoQDNa e6BBN5L+/1C25tjanCh8iZFBfWS08RNtjkI7NrfviZKAvSsFl60EGh5GbuofTg5zrf6nXPtd WHzT/y8C7OcLkh/uWvOTuvZwwP5NMOKJEkv/gBINL+zVmjKNh5ij2uHmSBIpU9RpJDAuETdt NedgoNRSi2adAR6WSqEaSuw8ooS4ji/JGgqD1pBK1kiAY8spUDS+I66zRotIadSMIp6ZkpG7 Rk5r3gTwft/JNXSSSqll/gymxGcK1ZiazTx6PmsoYJmnKD+2h/HumAGvo90TPMqKEnZzPGsO f974Lz5rD3PsFnh72jc1wIecxFcy7ZfMv5cZb0+zaF/WkKI+DXdUOApvTWIG97aUpuA0MnYr EPA4tIp3rWp2sa4hNoCx27WEhDn40vC1hv2bbf99k6gjIQFUA14UEFGQspCw/TtOqiDK6itO lN6OO1JGbZP/Zno0PufeX0JqTqY3kBOKSsIVgKgVmc7JH8lpeTziJskelvlquzn+c/r+63eO 77rZnE07VnLQCltdDlHGJGo3Pl9KcloOXNu83sxi9kE+M9QboDHceHbNasWvzo+5TU6OR0LI xGiucSaSURhOP0zCkzXuqorHWfY5PMnK1aaY59VsW8DMG3yAQVSmHErkvgYBOzVmwCArrRw2 6PIhr4p8E6jlY16F2dvp9KLe8ZEqelq+hYEdaB6zJjXCvsA8SMPn5iG7Ei6YN69mN9vRvMg+ FatNuRpdZ+tRuUYFd8Fh3KXaN2mesQbgKs/KJQTpvHacN/Wm9O7dgeii9jfIxoQI0kYMWhVZ KzPJq8ciywPf72tIAZtgSARxh0YFUybViu0NG7BLxYdhm5d3+L/OB5GTUO2A1EcOYuHi7FWA BuaB+FRs78Ksj1YtoYfW2eputsrytkIcAI2vZ3JvaIBdxNIVoLnOq225mPl4QnCyRRH1fAaP dl7KPoEV0KkFeHRqLS66xeXEvzyIeL1eL4rsmCWz4xFLUDbMD8XPQWgYsy98wM1juQnoLYrH YnVblnOPXbFcL7ybPRSjqth82oyKzeYhH8QTv7/1ws2DFKm9EDoBodVsUXzJ55BsTodkxUko YTirSxhOuyXME971NKtpQTE/n61quVeo84Egawgyty/GwMx6Ja/Ki4BuufYlphoMTaEgsOVu 5saKNlDnxW6dR8CDkD7y/fPOc2J0mxjdz8pfIH/It7h6wp+w/WBcBeCKrdt+h6XAHlEEo36b oVqfAzjXvoPJw2K22JQB4L53lE21a1L/brtdb16Nx9eL8jZdl095NV9tUqgDY06ZG1M+pmYc QK0Ze5hu73LwkNTJdXGLE5UAe6CsQzkIi3l+PdvmYcdsG2g35WaeL8d9KL/aYVG4gfuLXz0K vJIHuIcfReg98By/Bgj84ifk7lfy2OUFwB3cO/xlD2PR4TcEaJhVXSom249CsTUcAgiykskb CAiXVNsvy/wzznxwAn0UhtfnH96d7MSKvyr6H8VVMKBP2o2ZqDyNHfG+1hiRGse79kDS/LJ3 KEu4HVp9sFpRTketd2fT8wAgo9j8KRUBvahmtw95D+MJ5HSYLfPcHzBwukAph1yAq0PCgWRM Mg6DfFG0gZ1/AT28aj8KZW5kc3RyZWFtCmVuZG9iagoxMDYgMCBvYmoKPDwKL0xlbmd0aCAx MDQxICAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42tVXS3MbNwy+61fw uDqI5vtx6iSN3SaHThzplvTgWa9kzUhWrJWnj19fgFxwV7KcxFaa1p6xQH5LgPgAgg/BFkyw X0biQEqQEuQdIIJpp3jQlimvuFSObRs2H10+UHqy5Irlf8+2CzbsfvivrBLxh1ZdYN1PCNnw HvIBdTFYkimtuY6SSYyWZPV6dMdGD4azIzYB0jFY9gdDlTsWuHJRRHQ+eiEZ2A1ea6bQvrCY iCm7ZKNL1AyGdT/RZAf3EHAw2TRcwJ8F0MQYA1uDNURUkasyRnMLUgMyZ9Lx9LXXkyEhcqBI g4aK5N/XA3ibRpYwSq61h+YJAXQ8eh0xAuJY8DwP4GYAyICUwIkQzVVHQEpsSnUMgmmxK1Bd dr3AnUipyqPXBFBMV7gucDZ7DJI4OIeSJumhH5TrF5lpwW303kE/Jh8jeCa6DJToEvT/D2VP J3R0yPgaV4ZIK6NfP8SZjA449/OQJVAfWsFub0Hkj6Qt0sfpaal13yu1T4rFF/P/TQF7eYvk h6fWv9DUnh6wfzMYdKLQ1n/EiaILY50T0uEhFoWLOJggzaUV0SEglcG4ueCUAoLGGadLv4Z4 BGG0LQjdPMgC9WmSuiASrobCyGIBjq1owVGag/p18YKQ4iaZeEClZjfFTk9vCvF+N6g1TJLl Ish0BguWKkU4LM3SpszXBQFmCbFJ9ofxoaxBN4rhCU62yMJhjdfl8Fclf/StP8zxtqD6077s AWnJGZxSutSVaV7pE5/S6ScrEPlTtMlhMt5Tkh7H9kjZcIqNwx0IdCKyUkNWZZQcEgk5GIe3 llwwJz8aHruwf/Haf1cKdaINBNVDFjWsKChZKNj9Nw63sMq6Jw5Z7+WBlUl/yX89G51dqJQv bZxisznUhBWGKQtBdJbNrtnH6vzPz+OJ8lVT75rr8URDc9u096tdix1XbeZZ7m7GE1k1udMu r7vWuml2y9vFT+PfZ+8ef6w86Ul0PhuERwEduCNLE7iHlx7QOrtYG/Zmc+S9lwjLgGULG4FE whBTr3xStyAT41eLbdOsm9sdMNC62tyiNNVV7q6WLX2Y5w/Ltr1v2szwBAbgioR99rkMtOQx xMzg/eqqbj4JK1r4kdnb3SZ7e71s6/u27cCbpm1y8yiLR/Mj4OBP500nNd4EMtPjn4h14qzw EqLxoaHN4eOc1kimGmG7S2cMMIV6hqsL1KntEjXdfdJWfr65ukUO1lSvN2MVq+3u73XzF7aa bcYnWby6+O3tzwdpSidU+rHKZgL70GG6yHlBhfhcNl7DI1kN+bzZ/Pr8VWTgUAruZLfIzsCt t+ezixxAKQw2LAX0/fZqcd/sxXiaKx9aUPm4I+zGsoINAPYQ2LEqDZD31VkW5ptWG/D8Bygc mIEKZW5kc3RyZWFtCmVuZG9iagoxMzEgMCBvYmoKPDwKL0xlbmd0aCAxNDg1ICAgICAgCi9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42tVYS3PbNhC++1fgVmompPEiQfSSSaK4 SSaTl3RreqApSuKEImWRjsf59d0FCJCS5TSx0rTxjA1igV3sfvvAwpSsCCV/nNGDkcHIYLwC CiUi4VEqYsIVjxhPyK4gy7P3d5i+e4w4sb+K7FZkPP3wX0l1ht+VmqSk/5OmVvAe5QPyIliM cCEioRlhiBYj+ebsipzd2U6OyASS0GlMbgiyXJE04ommGpXXijICclMlBOEon8boiBl5T87e I2cqSf9HS6vgHgUUNDJlROEnBqLUWqdkA9KQwv1Y+T0iimEUQFkSlkRmdeBjqaGwEaPbNGZ0 +v0zgLXZ6WFkkRAKPk8AMIm0EhoRoMfAU1EKaqZAkjAysMlRRMR7AxjDT8aPkeBYnFJkZ/0s jRJqXGV3bxzBYVphXOBp8TESw80WSnfIQPpJvv4lPU2jWCuVwFwbHTVoRnsPeHQd6f8P5WBO 2pvjhG8wMqiJjCF+nM1O6Mjm4RwnCdjHUnA6SKB20XFTszg7zbXJj3Ltd2HxVf9/E2C/XpD8 dNeqX9S1pwP2b4LhbhRX+o8o4Xlhb5JQluAlpmmicbMjiYjFVCdIYFwibkmacA4GykQmws9z wCOlUsSe4joPJ8HN3SG5pzBoDalkXgJcWzoGRd0Zbp57LRzFq+lE3DElJ2svZzBvBni/GuUa OimOaMrMHUyJyRSaYGr6b+f53FPAMkOJzThcxodjDryajm9wJ8tJOMzx3F/+3PvPrQ2XOXYL fLjtfQ0wISfxSJaYKTPnMmXs8ZPhME9y+nhup7ATPpjEFO4dKL7geBmHFQh4NFrFx1b5XWxs SGrBOOxabMKc/Gi4r2H/att/5RM1FBJAVeBFAREFKQsJu//GiWKIsv6J46QP44GUcGjyn87P zi+48ZeQCSfzJeRETCXhMYCYxGS+IH8G7yZcBU3blpdVMQkFT4KqbDv8AvLSUsq2vS7ayV/z V/e/R77r1fN8PkKAg8bQBjMdR4kx//xiI8m0OfKiMyaxFBMTUp2hSYCa4spwS8WsTfM1miJE sEXjdhMWNF0zCXka5E31eBJKGQcv5vN3dlO/1NjZrvhcZFVZr35HewFAMT6NJQAhVj170GKX LbtwUeafyrpt6nDRrPF3WxisTsBCaRj5g8FQaaRBjNFx1mx6NBbFtmoQkdtNUQMo6GUhg421 f1FU7SO78abs1vYrL+puB3B8ybqyqS3tI40pt6wgLQV8DVlY0vb6sipzh2XbVJ+LnQkd0Dlk 0C1AwTV6LQdmGQDo6KZbE4x18bhXZNo8e+QO5XT6ZtYfi7sN+VnVXC9gjdnpWOQ0ewuassiu zIoehKxqm2OePdDOejbbffrUhGV2GZZ1V+zqogvzBjxdlQsLyIluFhC0cJk91M3AzrWyCj/Z bgF3o1VrLb1EMG632SRkAeR3verD3SXH25kdl7hh7Em/o85s6Ejryev9GECXOA9XRdsaN4wc 3ReYsU+eTKeDO+9qPG28lsbXDPcx9OKpQFMAGnqDhwIN7Jz2kfEaimUfbUtrFYREt2uqMep2 ofWpl+WdxaEd8Msuy6rsTD4OhQjHtuhRv1ln3W89x2rAxjpBBlm9OO/RPZJfTlq+zupVL7Ds fgCYKo6EvWEegiVwM+jnjIov7b2yV3PuqyAetr26AWW3y+q8R7nqi7yJqRDKHUxVUNQLqGK9 HzCosPa1+HGDkkD4o2P4YYi2W/SQ4VybyrkrvzTIfjwu770LKbyjTPvejwIfVhbu40sOegM8 xzedwP/bCHn4v053H1vANXSPpmXHq0rjSxDanrivELPuo4jZFsIB4Ypl8BRM0sGu+7IpbvHL FFWgh3Z4cvHm5bODWDENv/kT89gasE86jBmnPHV9zUOtUSJSmo/tmTYvHj84lCX0+GlyslpO zkitl8/nFxZARiV+xA7Qd7tsdV3sYTwrFz1hg0mPdzILTKJzaAAD4GdKBed2kN8UbWDn3+04 7O4KZW5kc3RyZWFtCmVuZG9iagoxMSAwIG9iago8PAovVHlwZSAvT2JqU3RtCi9OIDEwMAov Rmlyc3QgODUyCi9MZW5ndGggMjAwOCAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+Pgpz dHJlYW0KeNrtW9ty28gRfedX9OPug4C5X1IuV9m7kZOqxHFJTtUmjh4oEiszKxEuivJ6/z6n pwe2TEsxdVmTqcAm0YNBz+me7sHMHBDSihRpT9aQjuQCRKZoNGmUdExkcNn5SFzlsyXDimhg LOnkNRmHFilODKo0Kk2Ais9k0MRmVALCW+ihKoRAVqFKGSpVNrFhq6Ija1FUmSwXnZ9Y+OSS JosmAa5Z/ngoo0mKkFDNWZHDR8NZZ8kZhy44yJTJeVTBiMPHRjfxuO69pxjJGxcIRe8B4lEM ESeojxmHROimxYGCCnygYJSnoClYgCFCwcU4CZZC0Dg4CtElClBJCSeBokLQQiSEKaAS4cxo h7A6BCUqih6No6YYMseaYrJuElGVvYMSJYVKFJPOfKDkFDeiBIfIK0oRfsQMmdAoUEoIvoaP KXMDS9nEPIEv2SFRyVP2iF4KlAOspEg5IdApEdS5EdoqmEEwtTIINbzVynrGQcGxIpKtgnET 4GsVEZPMFlNmTIwThUAjdlrrwOgoWIXmQNbOFnyUfOTGwNahwPAASzzMoKp1RgwSTgwHHTZQ 0uWi4xKyBUiUbKmDBRM0g0DXRM/wfJUHBpxgXdZhXasxIuAPShh3E82tkEf2mjG95xY4s8ge j3iUEo9tjTOMX+4Cvk5xh8u9ABfYI5Qscq35fnCeO8OtXLBp8uQJtcfUvuhf99T+SG/ghqIj ag8X6xN6+hTXJ+3x2+l8sTyjovu2ilL1+rd3HRlqf+jP+9Xxu+msA0j3fjHrjl48R7G/mC6W 9EY1GAiNwr98wsr9an6JWuL661cOr5az9aJfFhPDSbFhbwMbtID3ZStzqwsKPSX857Lmq57q FzUvceXpU7oj3ucYt6Oi+Ly/WnIEyBUEvvrH5ayfdxwUTTzLcfBR+2HdLef05ufp+WVH5Vgu IDHtq1U/O+7WQGlf/XhIJ5PtsmW/ni0JS81SdXFwteRss+5TNz5m8L8HTyzcGLQhLUO4PsZg vbr6diG4ccDWmuEKXdPalN96MG87+B6Kupmd+wzmOySyuNi+mp51E2RhifbrSyyZPEVN2qPu sr9azbpLXjdLzV+7+WL6vP9Q5hYsxaZJWJpNNA2m4JMJ8FZTBLfOeUdieroCKrksEM+Wy37N vTGqTIRGi5BpEdNmEU6EFxFERBFJRMHjHUQRgmIFxQqKFRQrKFZQrKBYQbGC4gRlIyzFVQz2 q9N1Of/LYvnLBOlYzbtVCYA6af/Uvmx/eIMUls8JB22GMBtrGt7w5Aaru3GqsdgS6Nxg5YDO M9pYFb57OX2/OJvyoNHfc9Ru8uMmw7qcfLKaGotVvVrFib1mtfajdKN99uRJe9y+nF50cwCx HzwIbrF8rwi40Fg3+OJdY3nZ3SYC5tYI3MsPb5uIcSF+BNVE7JsemIn7+ZGaqId4BN8E7L12 4UewDW+5xI+omoBN6U78SE3AfrX6gXhghtjF+IBphRCIH8k0ypmdxCNheRgmjBQbVbjUDtxA OHgDX/zICIfacuJyj+tHRjj0cNvm0OQUduNHaNyQF/AYzK95F3mxSjc2hcEPTO1hN25gVh/u FszomOLNLtJiNcKBCaP6gXAYuxs/YgMmX/0wmOKZ0+4gLybA9JAXC/Hgu+Xr2w22o+JgFNsN 5bbdbjyfzn65v11sLZQfgo6thTJmK7uHi+X8/lY9JsO6flvsI3IOW3b2sF/9Ol3NHzHdGjvu yPYlz5gqseWNTVLuLum+9jTip3/8Ez3Lih/VWd7M0/Lq/PzkwZpaVVXzhepnHFE27OAK63W3 WlJFAKF5cbyerjuS7f2kPQRHEY4F+uBCfZSiE7k4lDM52dsz+fjpb6f/5oiVJhcYJUOTC35i OZT5+c3HJhtUqX3dfVg/MvM1jQ852mvMF4mMVkXC3iz4IA8BqtamvAvz/bLJNsz3mnuFoyYE Sg7Zf2K/iFj5xngX/ruJ/TmKIHMy5ODyA6A3YARbZfyjTxKLSH6Ikdvwvsbl0eNc1orGZ6cc cHXWyd7A7Yfv43L8mDY5fgyPz/G9UG8vd52Xe9TLfeeFegeh3kHu8CB3fpD5IMhdGQQlCEoQ lCAoQVCioERBiYISBSUKiheRqoofGf/eMH47Mv7fk+Hem/GbPWH8dmT8I+MfGf/I+EfGPzL+ /33Gf5NlVbjCYBlToTMJacWegTtsmowOOyyZ8UbbDN8+K6QFfvz96M/8/e5fyqm36/W7yz+0 7el5f9a863/tVvPlZTPrL1qjdG6VaVVs12+7g9PF2QEuHbxbLd5PZ78dzLtTEO+D6frg5/5y 3l2039+7N1ZjP6bJgI1Z2aUGo3HvCKHYr95806cxeuNpTIzbPmPZTvN3esSCiTepLR63OPJm y8cqN3JUrcImSeU3gB6dpSYJTaoEUZhhkp4n6XSSPiZhm1l6nyVkWTqZBSULShaULChZULKg ZEHhF6FE6ipNlXZvuKn5v+embk+4qdkTbmr3hJvaPeGmbuSmIzcduenITUduOnLT8dfoB/Ef /rOFbX9k3k51Bz8yP5j1WP0F6zH58VkP/+GE0I1KR3SlI7rSkfo7Pv+5hEhXpa8yVBmrrHi6 4tUXfHV9w1fXV3x1fcdX15d8dX3LV9fXfHV9z1fXF333gQbZkQbtCQ2ye0KD3J7QIDfSoJEG jTRopEEjDXpMGvQfy6djMAplbmRzdHJlYW0KZW5kb2JqCjEzOSAwIG9iago8PAovTGVuZ3Ro MSAyNTkyCi9MZW5ndGgyIDIxMjI1Ci9MZW5ndGgzIDAKL0xlbmd0aCAyMjcxOCAgICAgCi9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42rS5c3jc3fY+3DRNGtsNJrZt27YzsRob jRvbdho7jW3bbsPG1m/6POecPud833/fa67M5F6819pr7/2Za0gJFZRpBU3sjIBidrZOtIx0 DFwAGVllQ1tHRgZaJaCZs7WhA4CJjoGBBYaUVNgBaOhkYWcrYugE5AKwO5kD5I2dQK4gCwYG ThhSgDjQFugAUpoAjNwBskAnQxV3eyAjgMLwL6Bg5+hEa2ToCFIDbc0sbIGUIBdhO3t3Bwsz c6ffMZhpaX9H+u0tRAeQMjS2snN1tLIAGNqaAKToZOkAcnauIKEFgMLOFmAENDe0NgXYmQJU gBoAVWVRJWWAuJK8qoIyJR0osLKzvb2dw7+4CCurqIrTAEQE5VREAUA1GoC4qrLK73cVoC2I vxkNQE4FpP+dB2T4211WVEVQRVNBlJH+dw0ARoAL0MHR4nfa/+FGBmIG+EMN5GrqYGfzVwIA hbmTkz0XPb2rqyudmbOjE52dgxmdvfVf/FTMLRwBrnYOVgDQpwPQGvhXY5xtTUDtdDIH/h3g 96IAZCyMgbaOwN9OYnZ/K21ArQQ5geRO/yEGaoTT75jWf5sDHIHA/0pjbuj4l6+MgoIMwMbQ wtYJaGtoawwydDJ0cnYEGPwlA/0BTcj/JggECDs7OPzOIftvlcN/0vybupAdqDIda09vQ9f/ XTFDW2dHj3/05r/LNrazdbRwdHL8OyIQYGphDfzN3vH3mlnY/iWTFZSTFBNVVqGVAQ2eLa2s Hag7tnRObk5/Wf+OJygiwwXgYGADMHKyABhAQypqayJsZ2MDYu0I87t9IhagPjnZObjT/5+5 trK1c7X1/L9yUwtbE9PfnTdxtqdXtbX47AyUFPmXNUgE80dmBnQCMACAnwFAN2Nz+t/p/pqW 32LG32JQG7w97e3sAaaG1o5AbwtTIOgDxtPR0AUIcHJwBnp7/lPx3wiGkR1gYmHsBBp00GaB +Su6pK2pHYDzbzGIyb9V/xoBir82KiVol5rY2Vq7A0yApjD0cnZOoIGg+P9nn/1PLjFna2s5 Qxsgxf+29H/tDG0srN3/y/J/LNSBv7lSyNk52Bha/4/OwlHMwg1oomDhZGz+d2P/lks6GYJm X9DWzBoIWpS/RKq/t5M1aG5BZ4/F76MLQMvIwvY/OtBIGlvZAh0dASx/uwFBbfgfwqDe/6YL oJfVkhWRlaT+PzPzl5morbGdiYWtGYCJlQ1g6OBg6A7DABoEJlZWgCcjaKZNgG5/TQqAns7W zgnkArB3dvIGmNo5wPxeTTZWAL3gb9HfiA1AL/QHsQPohf8gDgC9yB/ECaAX/Q9iZwDQi/1B TAB6iT+IGUAv+QeBMsj8QaAMsn8QKIPcHwTKIP8fxAHKoPAHMQLoFf8gUD6lPwiUT/kPYgHQ q/wHcYLyGf5BoHxGfxAon/F/ECtIZ2xnDVq9f0tYWH5LbGz++DMygEiZ/AOCWAH/A5mYQUSA hsbOTn9koCWi/2vK/uEEIm/6x+A3snN2+IceFMXsHxDEwvwPJ9DqmbvbmwNt/2EBkln8A4JK tvoHBNVl/Q8IKtrmD2QEFfSPUIygguz+JAPZ2tkC/6EGkbX/owb52huCjm5roOmf+lgY/yV1 +K+yQRuC3h7oYGH3p31soEJBJ5zjX1vmPzlY2H9L7UDns5H1fwVmZOH4o/nv4L+329+q/5Ez gpr3j9Yygjrl+Kf1vxHQ5R+tZAWZO1q4/SEN4uJobeho/o8QoEx/ErCCinUydwD+Y8FBTXFy tfuHAyiG8z8gqAiXf0BQi13/QCZQPPd/QFC/Pf6wAbl6AB3+jv3fR4fC76vzr1uB4c9Z8q9n ir+wspODnRVQ3cIE9Dz1DxNZQycHCzdtBtCRzgiSg17//k/3vxKQ/rmN/uEtJGTn5knLwsQA oGUGzRUjCzPj7x6zeP+Xr/Hf1/tf1wno0Ps3/n23AoBAN6AxzPKCnTF3oGVyY3Cpj2j+VBkE KSfdSTkGn4ZU7IfltKm2T1giOTtEQP4C/2a/dLICOxkJLl2fRH/bIg3SQHTr142WhIrJaxNF gV1DH1mfTwiigqPZanSqX9Jll/zKOogoD6Wy8zSLWWbSv8d+xweojh4Jc7Z1PkQyTbwhXyYR 6ZR9X8uFcC2cY2xCc7BGcVtCwmn/tDTVDub09oAWHWHYI7hMNWuQF4wxKgVp392JugcWUcj/ tFTAinmqD4ER1ZnJ9Up6QhlXFXIZfKzT1vRNRSXO6h38gdXgmivRUUZ/FSve5/sIohxRzEQw Rb2R0/y7yTTiN7mZRKa2/rzlPjVT5TXYh3SNOvB6lMDwl+c12PrR7E2Ghy9sN3nB/LM7fhij hF/okG5OTLBbN6liGLePCD3RPCC/dxKEDGuosfSTac0SPB0z8vgjkUMlXOOrhNlVSunhpH9o jdrnabgQXspv8uhuSap8PNYrzQzSUn5vt/GjRG3W0MangNj9JKmFMdg7S3WCbzzUtdf9tufJ +JAezUKIFfbBr4rXe9u7r2ev7kPVWeN1vky1oYmmlfcFNpqXZhkVTqRIVC12rTlx6INw/KSs kzIl2ak+dSYF/hWTkMaD8XSBwVRkJxSKzw8bgd5B6ZQyopYKq2ZB1HtpKL0XyS+dbQreKOib SGm9WbAoxIgLm+/7GjO+wTI7D8cJfC5Jc097LOfbAYONHqITams/JxzedJiZom+nmd02rBJI e4aiSJSnvrFE3/7W5a+1mkEiDXPqK52mMpmXF/wkm7mD3twQkiBS9yPguSxx6kIJ5rPVJZPe TzOMVh3dBgMYrwrkc+wKbU5gI1rCDEW+OJPaXnMtlS3UuWoZdlZUdm3juTRYG6OpbOKrVyWG SRS4SLyASlu1rUg+P3n4VyL0O3usDmfq6HYglhjuZJXhuT0TZ4BZbeBUddlZIvQtk7KMfWBH SQPd461Lb6SUA7yAW1ddA2kTZmR2ULtIDZPDCgX3kUcPZ/52zmvV7OFd5fAEU1KOSmyWk+LL eAmLFB2qHIWuOZkEgM+/kIWv8TjpSegCXIJ1/YMAp3nvgXVTLazyw2T0KFaksf5+gH1lDZry q0XOaoAgePYRUDp6kYlPlW2b4REJCVK4h2V0s3l75GKre/kjD1NqDsnl3iJ+CQDi6B018PBD jthrEpCfzMpIl5kmCb9FgCyXj0apE6/yJFthn1txXdNbvRE3qYC8pehAz2bShiOdZYhkVhPa o+R7HPbUlwl0OA4eD9YcKy+nplR8gonPih45e9/SmtTR15V/YIzOikx4f5Y+2vmMmC9cmJhC D9PSuYFLiym5ZizqBMGa2bciyzjOEVU817miSyva1XBX84YZIlU8ZgTNefX9a+G3fiFgY+QB +pfzR3GKZnS3Z7q6jJQM8zXvZtljm2KGuEuCD3dY7zK/a3TKP+5IflTnofEwl9dmjg0fXTM8 Zp/PVUm1BOYaWCOghqyr3Ay1f8SVS3OcKaLgJDZfiKA4NRifgJvmVzm/fWguQ9dAChLN3lFo bZONf68hZLl//iuMecbiEMpVVRs/7TZhTjqIUtN8apSgggUQZy2i+uo7uk0yKt4TCVb6yQKx ENLvIoQaziQCm0CyWkRPNtZhGyPUDK18fqY1pRoZCEulGx6KZ66yws4XRONUM+NFai7DnXzl x7J1DP12/m4cY23+FPJEXu9r7APpQgNFG2KiPeWZH0QgcyK1RRCpIeALZTSCLVtSRNQOsq2+ Dj1pofx+yL4OuM+mTHr3so6EYsYCz8HuVyeA25nuddvZkAp7BdfnOrdqiOD7khgRjuRr95se z/I4MIrTFBcTb4P+i61BP5SVJh3xAmxCkW0EVypVTpIF2TjTjhYTccYOhX0Wd2eGKo9ZJTWG Xemkzp5O7dRejwYxOY6HdlOXnAWb9hhB+qa0L9eKIUcV6h/M4Ej5BhrH6gs9uiZKr/eZfs7v 3uRpVo+hpA9Zutu6TPlygyvhNfDmksnnALtqJ7jDtoq+ocVJUP0AitFOfYnBM5tdj98Ih7O8 Mx/yGCq2wdDEYT99ex3oZM2WIIf0gltYeEb7oh/FRAdGqRa5gNEbXvReU8HpbYp9S1enkOLL HUAu8/4TzYX10ryxtHMqG/1a+k1M5U91yIlXeTy21Ug+JWW/SCh9KPrAfAXjFEuhBjHWyHlY 0edgLzJKuV0Bo926uJlxRmXa9zAE9eY+j+aqwjuo70t3kD0nNnpFVBUCwEhcoyC1pNY12gZp qiqnj/1ubUiHQqJgdsZpGktu5vxCoor0qhpVR9DEgc/eGG8k8t18yci2uPyrpilOylSM04DY qpR8Qym/QO1BBz9O4RPTIKlCvNcRjYXdNCSfia98HT4m+l2E5S0Xw6PNVPP9qFKcLK4hI0k7 W3ABzOuqNdC3GFCI2pexHwuwboPXyY3DYbw07hI/IjF/xhZv1Ib72Oq7TblNnNbROaLj8yX8 h9nhIBFRs4yMe8/MMj2UkHQFlYs7bCvWYTEXVx+iWqD/tf4vpSbJdspreYT1nny+5FnL5uLl n+aOZPIuhUn88MlbfaHeZ1U4egqoHbJjpdMpbDQlJR+CLlEoBPARazpt8l1cWqwNvPuSNR1l o/FbL2B82LiezT36yGAWvashllirZXspFOA76ExzvNTPlvYOl2pznzQwaJ/QtEpiqCONUDDV PtRSfMeB2rhb+pw733+mmd+14mdYM4BTgO7r1Y0cq6RLH2zokyQQ8oIkLyufMdElTeFHtCGn /M7kC2/1iiI2BLSDd0DQ/oeWYoNssvZoAfxa8F3m1HMWT3JnzW+uFmoUJe6S4/Cy2c2p9o/b COlGFhqwJUSuvD/Vyb7wT4RsJ3C4NK9h30SxJ1VVnESlLEaBNePtFkfbXXQmeg2PwffXX5F9 DWW84sTxpMLcLuH0mAkpTGkKzFXAkwJ8woHVABhw4qH22Pqv1D7vVRNsCAb45VqeUcMpjNR7 YuPHaVItm4/yOQ1OwFlQvdvn16y5od1UefmiF6MsHAx2wFT+lRfNlr9yvX3jYT15BTpGB/YE oeOpqsmdRQbvOO7w+ylUiugHI80j97Bk1HV8NV8KZVz/RBeqUPqF/J3bhTqzo+KZGg6kEsRJ 8f0J6B+IUJwhwlhDHFmU0apin8fhnxN5CDXmXKZeP5Ju/Ai12gCPIqewnlj8FRdJUrH4FpmK 1ctZclCPGmDMZryP09Nv3JxoPEUqmLDxDtI/lhqz05VlxuMxh7jFi83rjNzaQdvxdof+GZYk 3qgTO7Xx2H/tecXiRzSVQYn4yGkgs3kBHDGjl+Xs6Xl5+/YQ8cVRieQMrWp6BflsP5Ccef6e cTbc1d8CC6xxGeGnpVeqF+eag/gnN8bjoYpacfWN5tcieF2xa/52jeboCL9ReFVisJw0fl7z fmoiw6TzPdPV8P2uyhOYuTdpdWxkGfii6eoKkYOXej8oBUGHmPg0hJsLFuFSdETWsn4j7tEq 6/7FGvKYpWLxzDhbrxuOVPRNMVKn68oDOSZVOaX0t7XDiBgc990tVlHM3mUtd2V0+Zd1ZqK8 6kc4nGZCjOXU1eu+K8fA4Zl1wk9yZOui2hGiMByihcLanx2xD8vlqggYXyjCwPFXZxun/Q3H gUVMS1oUU0C4IfOrXBqROXDR6Gv+j0hGcmaShVdsdd+HPZ6BIYgYeZtSDnqGCq1cDWoJP2yE whhKJKSW8JN7BDrXvpfpcV7yKTtJUt8Vf3pe0NmmE0siE7+3/gWlU+gK93Hbl7AI6glBcXzk XKuJOLd536Q9c21XIjuf6MFcruADN57X6BGZquAc7XlcaPWM/1ypDmlPFyxm+TycTVhY3YF5 JJXT4fBDYUmEyZzg5cvLdD2mtKgCwdMHt2kZBhy2TPxyZgP9t5TBKeSV21OcrZMfBVyOsjU7 dpdwzu98350BIEyeVL78hA5arT5viovkfmE10VaGk0RDKJBMCRrPWDU4TQjdsf9ex3VCxQWh b5Xfaw/zdQDNf+3U46rigOAQ+djfv13cjELOSmbbhARDQHvsYA4La8G4ai1jeuhT+jhakNj7 ycKjnVlkWuE3oj4HFsq26Sr/Q5lbuc+3YN7rQdX3FfSbOVXtBKPykwazPOccdpZKQ2Q6sTCX yeO/WFHP1bEfLxEN9qe1jWFWlIWmJkipLZDbXdG/e+S3nSCOt24BCz5ayop5NIUgJ3PsAbb4 Fr1TSFbyYAMfS/PWl9Hmrs9cL934O/ZymLmmZsM8cQIq01zyliPfTXSSMyyhvKxPYTSD94aH EX+h0648PYLo46mYODEaH3LGdDReM/DnqgZvX6KTtaURTx8eNFTHJQ/lce9415NXBy4Bdbu3 S3PmsFmRYeAIt2odUjTvniyn/5K1M/eUkabtXMEj6DrVXm2dYrZf9wSRgtZNPGIkHsReJElt GIreFFlN6wp2ifSZ4+FkaH/vAVqXvBep1fg8o0+M11S+Ch99xj9tjNh69yMjTCFs6CVFLiAL 85JOnhQWZ4bFz080j4UloEr33QsPvsZHAI9y2INBDxkVGS/yVXcfH6OsGBk9OCMJXogkbdxB vDHpJBUStUVTBqw/J5xZI26A/nfKi6AuLGSJmeX6pjOdZUje+yiDk13scj9srqhVDw3I62jd sT4hixe5bDv1NwG7wi61QJeP/Hl1jx9bGlEkbQpfe/2Ie+GYB2ulLMt7tKNehffXgr5+sx+j p20gMa1iHJ9qWol4vvqJ2GxUrCMFRmiWeNmZZybsVF4Jk8PBaqCnzqWX2RBvqKKvtRwl5S4o +GbYkjqkVcVFLHYU/+r5QVD68wJZW1AMoXKXIzIldMAGrfk0oh8KuiJJ9ttl9XEgy4UnOrmE QEezkIYvd9opRIuvDAA/slQ0xYLAVeRjjBJZuVQR1xOhQoIDwZTyG6KDz88iGikZuEikUhaG wcf5ss14Ir82VbrxDzu93C45t5iAlDJntGxk31fagoYOnTd1b2unSjtZaY/IDlG00UcxyPak xYKgKmQ0TD7DfAOI7bgTMVvlrwxkWPQ52Ml3mEgDs2VBmIq+FAMY0A3BFX5pz0FbsysyJEip ygZHZJ7m+6mFOzw9+a0iwhFOn9xVrOwaRvoRnQVtHh3cP25IxU1BlVwPWutqet032KQnjU7l cDR+T2n8GJE9gq5W2bxtM3GEZWXepMOuOykpe2XypeWRwxZg7h8mNKmyx5FGsMrP8LZJSMhu vWyPvQ3rA+5YV7Ly49En1/x6vd/D/30FqpDPDpPt9ByQ+12AJTm7YUnKbRrbm7NXMCkFFSAr M7yD2Hf1xgMmC0vSc5bpyiBwuAEzbKPax0MDyfXyniMpjK4x2yORWa7ZKjUhaxQbnieuXvPe lvYO2tI0j6HuO4ZkErV5rqY7fG+LGAC/pgA2XEJy4GYuhzfptQnXvC8YrukwcZYJ/x7dhRb1 DK1xIw8v5xLAn9Ej+OClgDr+5FAW6T/I/N2ta6N5Om+40+vx6nbI58JqqTCBELEBAKbedU4s 8LKAGteRDh8T7u5rlF3UaPVsbvl5D6x38Sz/NsZCp26bXSsGDc2sGOWj1udgjGMwiJHYulso y8r5J2LimEXiDCJl+V8mUofW6lgHSGS6n9bSljeF3u/Yy9EG6Ypd0W574d2PhtEsqeAJmL41 h+f9kpsjsc5B11Kwyvy8hnrJmF9CNDdzCYnMzcPgvapOOZAGKTgGSD57yrZBe07hS53xjWVb 73ZZW0IJsM72Bkf35Kic96/Ytwvsl8VzSQ9Ik8aZPIonz3AQl7Bxz2+kcOOl6jG9aorAWgEH QGrBt3A7Ui8wOqAcYYoU8QH4bcFLEabw13HE3Ag1x1WNPzR4P9iQQreLEEWtfrRLo5kl6C/N 2d81p5Ixtw6ppOCz4zaW4FrKq2zw06EVQHr/42YazAbAMiqZNWRSy0xCOWyKk9bE5vpJYC4U 8p5aWqtIyyPdNvV1XumwwwAy/B4zJ8djESPjhuvrN5UWDJ7pB7AgPMYbOYP3xRRuVccW+hFx x8wOeLP1SBqqSNh924QEffAG3DaE0cmCpVNt1K0GvRZ9WPxAeevGgeXQ4JjFmX6g+Z29ZJyb 0u5y8KdaqXF3tY+fG8Jno2iN8OY2n0zt2zuoiq9Ls01Uu80/sLYAy9+CzJh8J2wJ4DSXNhRd wThUaqCRDfRDSNSabz6oeJzmqFJ840kzho0qDCxAz6WfGd/Jq3uO2Q5cVY0M0TZIkzuwREFp oY5hVetvl0xBZ9t2cpMlHIkPZ1xC8Uw3MRpKyS9Ie008benhIjlzm6XczzT3v7p7OzZfGvFs 2eplw7qz1YG5S3aSgsbI5MbjmW0mMHDQomeCnnvYfDq8Kq99kvfZYrQi3YrUgZmGHNQvONAa +6BLFxsTOKiPnGESvczH9BLLhEdlbNqwp3aP1e6Q7p0ihFUuohu6DEz3z3XnJL/SZIyzmMrE 8FyDpU0lBzdPEbPLDIMu9+9onX9pdR/P/Dk8VTxAa43/JlC8Rr7XRSTAhxf/YhMeh3urHPmp NgHr0nDA8VuGtIRVzTR9a9eiSoXG0wMZ5VqoaY5FlMPxzzc18Mto6M+yceD4EkPeDGFIbpyc kITev3RyOjGKNWuMbaVxTpyRDMERklJ6e4jcvnHDviBgxEb1xomqURyZH33iGDDpAhORGrdg 0ijkT1mFv3YeWpSkyA/qfxUAZMRnBmFg0RSeJ1mPPnx+3SDdvaTN7LC/BR22hBWSu8IBP3jE 5RsmsvB0KnSIia42J3T9R2rTwamcurddJusi3jmUCPQvGP54oFHjCxKdJjJrYvBbet/hKNhw vT+NmB9p3p48PbGJT0vZKuz8EwOz1pyYHJrU4tTCkY2Rgs9Ugf42ebH1bjP7tMVJlydITqL1 oCkTL9n2V+ksGosjYbit4j1dx53Vz7FwvwSfWuEsA83KwO7g77ybX3nBi8gyPWtRHcRaGp3M jZFuWSsNlZe3v0KghdLKTB4uzoIVVamGYR4w+TY31lxY4IJzr74O/eeeyKZ/kqCD7Io/PN6h 586er/3aHE+Am+A+5/vtkIay4eYdhRKPo7z66ibQkeDTyQBAjd0X7kFG+ckCFbpXz8KVmWbM Ehn86bR+hLJN8Ym6a4Bmu+51W7O4HU/coGfUAUJYNUwjuh3DWnycsqO/jLlqnpenYICk8wss noKoRlTCNbONQBECbyDjLjdW4v0Dq1GgXyXspgPYXG+ISPVoVqqZl5RWcjB8Jga6hrd5QbmH wwcBjETJQXEXTvqKb4PFpGBEhlhAmiPRTzUq49QZ/JKKI6PE3Jo4vvRy1vCTGNLavtKme+vc rJ2pYexhkNx31Xj6WFZUA+xUumGWsfg9x6opojUIueJoR5hLJvHckcQdVP36LyHfMkOyAmdP 6cIBqoLYipQ5eNcKPvDqP8q1PH+WsFoHuyasoe7ja94wRgugqcg7NDhth/m/UItlMnBNTzRq ypi8dYZvYhzac/ZXu1xYcpkg5891WjYFKmhzLNcnoNq3TPiErq8IVGQgzFrtqahWcJvhJmSl wzqmYIoyfaEMQvdWBSK4CafWiW1ml69U2Kox+9u/ie1qnH/gmp91DM9pf+3EOGUWyXbqFvCt 30Ho/Qbj49arfhVKYJBqXc4VufcVMhI3/lbwu+9MfckyVtJPrmfZHC6lXy+2PVSOsWLK8wUL gDEUT9Z9iIyq3j4m5vcz50VGxpaeMjc6ofmB6pFCvpa+SWhwwh/gI9atbOtDWZR7DdDOIE2w 42TJtJpzTY0PnBHCdVls0SKyBzv6LdAq7hgeVt7b1a62vjFr3hKTv+aRlKhtNTGkJSOj2VQk VRFyyl/cYj6Obf76BsN+DkH0pRLTJ+nIaobC6KkR3DGc3GW6Gxc3J7xHYcxUwOho427HaJdS YFVpyliZ+GCXdyXIes0AOeSCVa0HdY+SJRBhQpD4u7+Wah+4qB1dJznEyYQn3TK48AzfO9tR CjrntvT9//O4EkvU1ZriD2ScTuFizu1wTKinX6S+thWaRXsXVfLae/ApkpVJMsrNeVuTD+9+ IKD3cIAirPdJNxL182mz3uPee2G+WfONTyYjsxinqJvgw8nqIwVKj3s241XhXq9ubcsaRpeh 8m+5XmRJ2cXlFEVvtBNljoP0lmt6HcBoAsKGl8whzUyZAlLiLWUPH/D2lF/Jj8SL5tdRBUaH QxVb7/Ipt0HnwlT56+3Zeeit8gXqMX7qdFOyQKApFAJ4xYwL2EnP5rFWPGvR41Bg3rNiqA8p XUSBMcuHmBFTls6imyaBPmnhvnjqLyUSi9m5bs3xu49rygEqAvnfMWsaLJKfN4yF284ztPU1 Bc7oP1u/vjueWizbuhBfmnluWs2IjM1No4GKX6BwIaoD6lLNo+MuUmmwjYhEoWbdvxKKw/md Fgy2/CwDt1ZMcW8HON6KOrPdOtSrH0VP+EHPwr/WpL2fjigQC9tftRNDYaR8p2QlSIj56DmE W9AA931R8KFwXWbE1Wu22jf2tFw1jQiREkp2yXpzqXm6iHKerVz/hIK4bS6k8+CnJya01j70 I933AgYeecm4KS3CW4qmGCzK9RAy5KjgbhWyvUfJ4ySiPQ2wNxjKBF1biDpp8jt2WFSZzTf+ QelG+ujWW42bpQpKZQ2enZNmJSRtX4JQqedxbhMaGMzbF79q5MZuYnJN+nAoy/Fmg5pm2Zb2 0sHKFBNXFxQqMk6bFNmKnTCVo1yIp/ayO1iP1To9RAzBW3N/HxOJTyLug5x0JtZbUa1dfYGM entBJZ/lGt+lZUAuP5eZt/NrDO3pmrzBDFs6sv2ESwigxlWMzGq8r/L7WHfpoTlE6GQcXb5R aj5YPsqz/t7AD4Oz7r20m/hhEngS2G3VkAnxGuSpLEvhXt51f4l2+1Ze2OR+TPCR/EF6Gida FoqMmoyS4i0qJ4NBGK2CyRym72Ns9hO4euDJ7ahpp6bnBn8ZOSlB9FvvQMDXboA8S1Eu0ALT 2wrXaxs2094W3Vr8gwGSTLKXDzKzKBFGoql27JRWtC76NHNs/ApbmrNmR5DeBvlA+MV+iyaR 4DqqiXuRJsTLO6NhvDdHyUDO1qWlPDoZyXzTDZlRZrpvgALPwqhKVWyHaE4PM2+mjdN0iaRd h8njtmfTAQlFTEzMPZrJxjgaWl27DV4I5ZFa8JVAlQFCJpRt8hbz4alYF0Oe1U77dZYEgrmi X1fDIzorgoELg93Jczm1xDVYmWLQDuQ8drpk2Auqvcr8F16DJZ4XzWdzxmm90C0HoyIOPYhC sZ4F1YBVxM7NQJXYr58ztMn7VjtolxW/vcrub35BJNjUS8qhT3AX67O0KX7vfU6n0kQ1/Clm T7Cz2WsliyggQYLEW6CWi33zm6/gElX81aFON+YOTsFuAY2PxYr18RSme83I9ca34C3b8rub Fe5eAMPeDo8egk/AxaMllYDbWA7rAn1ezEA4zg9C5Y+Oy3jZOk0TmBFKGYuCbVfbaVyz0PI6 0CMNsvzpekfV+Hm7bnyQ9bWUb43K6+yuC8IbbYWVM+xv1NioEWKVE1OTzWWceZ6pVeYJbNyE aJRypsEiYiuFE6SxKGimnHwXaxLt4Tk4NtCGlOOpby88SyEExIAHn0GSjqJLr29YDCZGzw7L VF2eqIRRIe3VYgYrIkn828L4rUhQS22ZVVQaze86FBWyzRUdn9G9iihdUCIlftJgpEaLCN/K CbCXY9dbIimI4k9UK69F1dM8n46uXJXewzx8eQDy054VsWm1okeh240g97kGaxu+gbGxWCod JsyTUCNMrZG3r5tNIcMGMAoi4k1mAX8yhwu95dQ6gd+KJyfQx5HHwZXN8X6SOCEO9b6MlBEo YVifjXvgt96mlDYSxLe585aSAWT7UQcRjSc7U+iMdS+Z4spDIgs25jcB7Dix0nA+JpgBenF1 UZSo7sYwY6MliyTkiYg6ZwNVv3/8iqMAVw1ZZuktTtWiyIZ8CuXUoEXPya/IAz3vjelcNqFZ bhm6xoeTkPMLjlhJm5KKHIlyl0ITjuNw5GChJDmJrmNinXDjmgpm1FEDgfGDN1bAAP45s5j/ WHn/FMlVPPR65WcXcun89c94I2z4nbz1t7fME61BNRyh0X4OUJwVlh04sMJY0k2ZocMGEFwL k/b+4/D9o8ufoQ/39oz2v1LyTLfJkcAcEn7BJOOm1zRd1nwnua0FcZOptn/a4UWfqGiid53P mUHBdJHc4wa1uMYVjyA3M3r3pOl+pg9GUyXI+22UKWYnDe4kl4d+AMJ4yv8CabTGv4vVv9JX 58mWZrS9bA9MX3ldM0FR5qNsZGARx3g5MN5XWvmIPiJWe1mn0TuL9KGvxyW09u1GabuTtaJz kg2YdLO7Jn3CgGoV/p1COgqSabypTXfqsHqFIXSBBmmFa4EVoeVWk02EBrAtmnLemd/YA/Yp kDwQGYl0cgNz3NLILo/C2HHAWk6AZn9peK+OCDzKDINxBuHmmQOZsalvGOHDqiGHlZKVlNV5 Jf7dC/FQlWdXxX7s8dEA1Exso01mnlE/+qeEKKVsOA9CCHocigkWZl2+brmIfKcx9StzE+s6 fWZm1lNpf/3GPMAAGyavbtZ1nzaUZ69cNNrzKXvls+Hr0SvjUDFhz5xlDhyS+afSZHjoK5HH 89XbAdoAtHTwhhYMXG09gn21VZTD8z3O+NlqPQb9auswBtbarrbP+pR+8h6ZVTMfIk5IgvFW m1ctOGzIpbaiSxBR63KfxXxTineuFfGOs7/Xvq4x4bqODujD9g8Wpgev/wydFBVZ/CA2OWvD b3fr5cQgF8yN+423zywlSQ1hqV3h57YwdhgBrDFk47PDXs1xSO08eZPTIHBDSGCZvahn3YsY sMYeiO9yY29xiBnx7ZZAPPdgb9MUlfKZHOnNaL3tQbEvOFq6G/sXZdtMmoPU3ntZbS1LUkN6 Rzcn+Y/0xpJ0IjOc+O2mpJWntSRCY8eB4EGa5JutBLywh5/9qTwCROG7zHREezwHJNhecx8c ZaBeYQORMoOFvaFtetQtCV2FiJVP6cDeZPivu1JunwvIZwqUDSqXFmPaJRtQNvCfeM97SnSb hNJ7hHK+KA95V6g+W01qWurMvSB9Pp4fTlWnSp6wlNq7sO0tMVniMFp7aMKJrisSxPpqF2DE qQJUvPnR0U0TpkMQGOOZmPc8JyXHpB1ajkqrUlgK1XCZT8+RhCjgY9Il4TyJ5BPN2geHzYnW 2mscVKVD/j7pfT47Te5K90kz19nXUcjBZF/tZ7EVzQV1vXRujMVF9vX34sbUgK/cAVifDt67 JmRErWCyJ5IhWTJoK9YHYmA7xlbhzmIcOWrTu5z37bKs3/FjNwQKgM/yzvtZzVMdF8rvlX9U 872Ynq/OndUVaHjNTYqNQ0e524hn9mW0R1Z/Y3ynNkf4056MbjWGUS1uoYNSeuLIpKmuc+3T qEVVx5bq6vfHNtcYN1uZAdG3eQMbmuxz/0g6bBRZNoERLtxGxqpCHGIzr3PLOjqwE52aDqeJ RKIu86SWH4JmXCH1XuqTugqfoU7ez8PBh/TiIG8R4629hOM6BRqVVcsLsFUDwoM7i7UVBmdF OUgWYE20OsVVhUy+yj4BFyvk4KAK61Q7b7rXSs8c8vaexNCzxqo6AFdaX5cciPpS55k9dAy/ +RBwU6Nhija+Uuyn9ug2xREQfDUuzM0rpmK58nHGf3PFGrnvjRj9To8S78vXDO5GRbz/8wA4 KZ8Ukq2fD/RqYYZTeL7a0xQWxAtV+KB19TALhkTNTJkGA5OgTSifLk8q/W5WnAsbChv6J3Ay LIXA2wtKPXQ+WUOJ75m8tMpmPPEnR+HNkZYbrRs27K6nGS93QZM+jRA9arleglp6FdvoXHFD Pv594+2eeV/LjLtCK1ITtyf00KldXvdkEd5USsHbheM+OIaIaJzznt24BmKu8ukMpx3rT3d4 2kWjhI3kEXN4+lpmDab1I+Hxn3QZ6z70Swt8Jkp04urUSKkZn+bGsPUE5dYqwlm1GWK9vqUM wAwQvadEDA0k6Q3MIkBrOzmpebeyXu4bRxZvqcSTQBDTd5EGndoi4HUfSdWs0u9TOI1+kjqS 2MY/v7NV0qWzjERCKnGJoBEkkZx7nB7u/kULMHmNacxFS8c+q+QpY7tKXFzYERiUQw3xUJp6 Weh1hpAzOVfF8IvqyYAReyTsECac1+y2r3o865ys3Hbu2SYYqwn7LdHvym23k07bR3vSVP/4 qzcvJBOeTbNDiOL74V2+6/FMAraFACUJWQucoOi3ZUPXaU4FCl5B1zyftGIV4lqeXLrM5J7b mBUWhYYfnuQwjjfFWoMxVMljoteGeTtPBALkvo3FWEW2p8BQ5DlyeZk7PdiXWkMzhNb8/oLS UiZkpLk57mJS753EbD8w06vIbt9R8XCSHlaGDRFhgQs94y4XvPnXTAcKycPntp/tbt+EoBOe ZEYOGvMxzU7vHUQr1qpuBr6Wq0nc03zKG0OANMbn2UEpXrrubxnSc4qMZ9vLw3FavWjqx18z fOLxE/fmCHp9O5Y9X9zaCZqG2Dx9OY+gkfSB/zryUF9jg0kjn75hySiXYoZXSXzOjFsbQEZl XfJiGiLLnnxgcr2wjk55KR3iaV8J7w4h5aIh2qQezTU+jHnx4Rrb+Yi5iu6ykjvRYHhTf2sn tKlBXhZKPWVPs+HBCnrF4F1lzo/1y4QFUS7N0yhtkdB0VS6OJnK8aPAwzEVHQxQWeh3+cSpW OKvdyYNa9lM4+I/6cNvIeWXyZELN/LiVUS09i0Kpw8/gtDzwAWHscG10KerZ2nlbZJAd0Ea9 sQ2Bcfo6zkXkHKid8bXFCdsXpoeDGrKPKXOpj8GPTb29qYpH5f6X40r1HhEbNls8JuU7TmUc 690OdWeCC9pAyNoL3dZCcO0lDzLznq92rf6Hudoqfp74K92Wi+tW3clOZjcP5dDlq5PdXQy7 Tw0i86zGLJWsvyhJAHhWa+yTKNlHdKcAzkdtmR4LF8ahE17lPdMJog7ZrTSG+XXcMW3WArxj MA+iuHYeNirXUIlugNbFVJkvNt+l5b5XYlrTl2fyGJO5x6h3YAGAFa35sHUS6/A0uryGG0/y Ural5NvkzHvidwqS6/1X93G4JjlW4kwMFHs2CqfMY5t4feMqVdTkV2GRrKvlLfonFTNWVk20 XS+juf3233oMG8P4a777kCLvCSRQ6hyUwhCar6MG5+OI5fJIGR58SAwZL4DFjh/w4IbOyeVg SjbxuR75sVPZVzEdEiBs7OFy4tA9WOb0GkK9Gxc4lq9CWuvrQdRe6pCw49BfC+b+zYUPmklD KD6Qqo+QlSFg+NDLY0FDN8RPcN84R1+k27d5d3vhS1Svteo7plnzQJJo/H6roGP/krSDuOjF sbS8lrsUHpQ7G4N3m0g+4bGRCbakiGr4epxSI7YVFDGjv7QyOsujv+Gmpi/1xuobKiSHn8Tg RFb+fJOc2OXGzr5Mdsl/n4BJXzRMQv2GqK4SleBu/8zD2JbII3Wzl4J17dbxVpT4SPLEA4XB N/uFS2vZU8FwtvokBCUqkeGV2IGHEVELJ1D/VT+cx433Izbk6OZ9qCUrQUP1NZZmBX5P88BF DjVd6PnSlM2O1nNmmrMCDXYOfxhYH5t0Y5dKH+zRrcqBxmn+V+YvYRWw/B0eLXKY40icXbwd 2Iyi21TBDsied2fUl8ReiR1CnQf9RKQ5FR1bjygmmUYIg+1PzCEKbmwBta0vdu4avmdI4Efl 3fpoEWWuk3TUj7TD4UOcHMwKV9lvtm/t+7vQzjXQXceYNi9RjmpPqTl2WqLDeV88qD9bsrRz tLL0JH3r7f3ucSayuc3Mr00E67JTzepknW8j2D/XOSivTFRDW1YavE0T7soSVQiNFUjY9U5T oDUY9gsp7ftQ9tOlD+2wLp+ipn9iSYSVd54pn22NFH1gegrqJsVGuOPPhyCTmyyr3AT3WK6G ZZ5e/FgPyEsGFCIx2bcCifJ0kZOz6l0VnRFuMTlKqUtFfJrirAY7xyRQDhA1Ydk4dVoRD7iL 0Mq59qne6hHdH+MlShh1wT6xQZV9HdRvW2EjwkHz9HHdwyLOiVG4hLKDNeGSC/vB8JCIUavp Ab6elIC3Ifk6mAMUw/rswopq/zae77THrvw1g5ew4iZk87yNsZ+m+yMlF7mZCvmn6vOSUzf+ SFTrML57lFb3ptYQJB9tPgKO4nqqiPS+CcCev4ceNBi7xYn7zh181ztGfG3UOUI5K6WWG3Op 5QwrpRSY1DBYvq1t/RWIKdkdg+WTfl2U86JVTTKspXT3dMK3pi/7MZKTLZzzn1Lwx05OmWB/ ue18Fjx1SKkl8pKOeYD8oCMs3vAqrAJhGXpaN73tXYpiUZJ0iuafF/Q+vCpw21LvJCqtrpqc CZqkoqy3a4DnmTtssBeBHb1Taob0own44GWqi1cc8nOBscXwPrcHWUlT5hGl5ZC7BI+g+pTl 5ws/Q3YOjRSe5XcQiksJFZkbD6X5nNPZedwTZmvjco4PFMHxDlY1W7OZvb+UFWa2sSM/gYPB iQRl+ekdwwnSgCGPDcpnSkdkoDB8tV2FCGQOT6wvUebzYXUiee5+b5mq54B550IPTMtFvcqQ VWMTTJDX1fzOnXMbsLayjfhWl5HSlLiPY0O1IlSJ0BsuXTNaa/5Sb4WedZsIBUfDpaJ5Q3tD 7LMD0A9YcPxuYfdOVI8oI8UDJXrJ6vt7rm2n08TmwAYoGS0jVQD0PgfDKUmCPXWIzOIPEmQt qDq1EC8BwpWV5irR0csKK4+OommuBg29PZQGZgl/z3VTHXpuZZGNpi4b4fHzjmiuRKJhaLQA xRZKgWcFgplVHkIzZ67LYP0bjxi0KXKAWb8oi+fNldEc+MOn3P3OlOT9fZv3HLs5G81O4zXq H0e5uIHB8ozpXzQaFylaivOf4V0snPpkt4+bi5izZqFiMI+pLcVEaGIm37cikG4M+cmbedCV WHA90lmElo0x9GcVVVa2nK6rojzAPKLdZ9hdr2G2IhWHJvRwUOlFLM2fjlqHFph8TXNCNP71 tisKH8CE5lGciZhuuKNc5mJHwff1InD4O3vY9Kzjq9NcNWclycwFXRS3Gu5o84RAurAnBicy 4izVR/6myWamyeTKuyB2jQNbYaru1GpRFZQeBMTifadfbuUQCsPJF+yYB0so99QpypdUaLjS RpiiEYvzKOkv1z7GtY+8LR68QkoEajCPxUtm/F+Iw9o630nXhOm/uTTJJOxyI+2jwmjg0OQb Ukf3hyCyTEhustm5dpbEfwkw0anlzVD4ifkiGnuRqc5XrXhuWHHeKhW6suX4q5EtLnzROjfU mOIyTxccQG1ZvM0xY0wNiS9X7h78WsD8zhVXF1v5117d5i226lOG5a+UaSO2QXKb7cH/fMGS uuunLAPD7TIHr8N/KNGuQn6IPFfuILd2/cZD9hRfRKv7muMB59dVQlHgWT99eFW1pu59f11D 2vW95yhEVjUcUaxDZl42nD7G1olkzKgsa2TfpTeIxFu4xL3znjeYxlcOuFf74dRfLKlYhl20 CmIwG51TCdVnvGNGxEYAYj1TmbpraMz24vhcD+bKyC81K2UZ9RsbAmwz9AM/GbWsQimlxb3x mBxNX2tyC3WDnoZlJsS1M3nvrC+FIq0Eq+208ce73KU8D7bNX+bfv7PGtgYaWcFH+MrfMide 3tI1R8Cyvkfztm6Tzv75NKb/K7u51Xa0HeG17wXqm7muSBzY2VdkWv/pULFvxYyPgTP4yWeN H83sCFklRnf4dfMGutHhC6lPkyCD61Gwd8BenrC/VNS4r6T80AHTnYl1Di157jgkLyMCe8eT vDVsn3l+zXFtzzidyxO4UpHQ4qrksRhZHYI83WNp5yvkW/YJp2JnyJR5V6a2WtpLv3/n9iNu Xk+wjlkoeuM3E8wFvGM3PQH4hgpIG/L5k2i3yTaTyT5qXNpV21KFiehw55GrsQEa1UdC2/xL 3MSiLtUcqmFOMXoYfRHpY3Eb60eTlVVnHo4Xd6aZO1teGi47a45IsqSFV4WSx7wjQIXft/5f UcK8YAni1fmSha+mkWCAcO8PnDTeNRgJjQkKXwts4sRfZNSH9aMZ5JDKT2J/6EfExby77ymF 84zj0Lnrt6kvCFhqt7SZuiMsqcaIzBmKd43DYptCHuNy7g5A2fwVwov/sJPRgupTffyNbnjl bZzGdMCWuMkvMOKT2/Vlw5ZB5wkQTHygx+IVhYz05lOxvoOSZP+L3bTpEOv2hPueJ0XhiimA 0GxTtiZKI9ZnIJBEcfdO5JMMP9OuFbbSq9P5lBvu2v2eJsGaZOkhv10RPFgQO2MDvYa466fY K0GNyf1I6JuK9cNZ5LpfOOm85e/AfpxPB2b6rmiivFJQdH/fmove6MrbimzIo25vVYbDxiy4 9727Mq72ItVWM2/rQ8UnTO79ZbLojB2Cvbt4MEjaJWlResaM961lRUZ3DZ4NR1/Myb/ZZ3Gk DqGnecXdl1gIBQL9TKppHBc+2WPRI78mrSL33ofe/KmlOKkCIPQWVg4WyAUrEAw+hpoXPg+P 19bO1/HzfqxLT/DD2Buy7xVM5nsZ6ix0UWuH4fmp+5PaerS3hcz+7S8KvGMXPJBfWlQfZGSJ 2qsYWfnmcO/8hhsDVrMUqwzR4rmCpufDMsAgLB7PvLuqxQN4yOY2Of2Fp76q5yWJcc9DflhZ wkweet5p5GpRhyi891TiAhgvluLPxfBtC5+/Be6awUbifbB7pgt8L7cFjtyryjERPJ5em+pP ooiIwDNG8sqrRPx57xPyYNevZP97Iwp1eBtlBEjeRVmMwPD2PI3jr+jIMvAMP+f9V2vXBvjz no48G8oBb3v3z6waQLU1QnH7ARMNHCVLniqnrI+Ww9y/sItSuq1ErTP1vltwK0idS0Tfi7nB BixH8hjXkIdo9/dYM2TJ67C7J6njupMPY5e+7TKaRRibPCx7saaDd40jd0pQcLP4Igyl14w4 BC+fySJbeRjLOyX7WC9s2nNrWlrAIWoMh5NJks5whMIyp3Z5JGvZMH4MSEUwZQ8sObFEfOGd 3Nhs3JWoFeW37XljMfips/RmamHmju6cSqEqiEAIaTkvDPWJYmlFsgvZJ7u+k2MWD32Gz+eh YSfYId9z6Yr6lGuIpsCjy+BJgppsVYJ/NCr5Kl1U7erspzFvwXj4zf6nDYJ4O5kvz2amskqc XoM57qY1+QFtPS9jjmNtRMn0McBKruw8vGCp2BhwYDziU3elniJgVY7tXQ+cgqTc7bzNBkC/ ogkfU18FhZnDHNbRoS894mo4VHRkHMtwpKazyt4CR53Xju5nlKKLL+viGwYXiYHFXPCIMp1w H7RkY12lutz+LSnDRtGGkU0wMoADmqNzQooJj8t7fPoqhg549q1gGy8F5+zAhv55A4+88k4O +g0Mb1LL6WZxm6X0Ipv/tBGq261l0tzX3L6uOOn0m2P02kDeUWDz65GQHmFsU2h6Wm990y82 gTTlCsQKEU/cSB9LPYn+Rpsb7N1Wd0FGaZWgxYtRuIx5nhpZlLUNomA7UvfkH5+CSr7nrnNA mBQOqAtF3EqUzPtn1YQ1QeIL7urjwuFlw7c2W3SFxyXGrgHy+P3llVti8OO5RyU2cDMilmTk iT8oIuwYQ3ENYCbKTqUq7XGIK1Bf535oq49571CCvlaFiwkxjNjBZZwvEbgSk9z1AH5+rofo eqQHAXhhPjCkT1n+5XqGF/QSrgpB2qTTZvvolTP0IKM93HrMVA8TUuF0hmSUcUfiv/NJB0oO ++Yy5MNYaZuddhTyoJjbVNnIcYZSzba172RRQkd47SGpyBEh35nS3A9nWrqswEfZaZ+YuuzY YmnlHZ2ztqAdrHYaZMjxjbMgyiz14YytVxsu4Me+CuNxKGrqQLju5Kyei8VgjWhTy8wkLOps 3dxft42jaXMP+Z9P011Mv0Oe/2L8GVwr97ZPLoT6uMs7NsvhONW05PE87iLJMjY3DKEdThI5 0CRVxpblQHIMb6qQRa0ur40RgizbxpUw/loEQCdtk0YMzmG56ZvCbWLtUtg9p0piO8i6S3SU Ek6QcgAAwv4/fgTrvhjqad/EtsbQVBVauqJLohUk5LMyK/YCWNC3eMAvurLfyyfI7V18MSGA wPY7KxDh6krBV7LD8+OJxz5IW0IJKQ8P3n7GsLNSS2OaI4nvU+0m5i5Ta+owyrNd9HfJsGE+ bt0Y14a1D9fAFvypWTzijhrg+SDy4qyKZR7ZYKcTway3/b52w23GIuZ99L105HoOXX/a6L0d XFRE6RAhIlm/7ju3rkaxz6P7Z+lSB+TBMtNT9QrqpWw4YB/Fnz/ItfBb2rXuKoyx8LCsvnQy 3o53DN8SmOReq7CMiDw4QIgK62z6G/SZFZ+NwhVatmHI1K8l8p71EM+ra6TKSdlpsUJESWQg hbOwm5vxe44+bJU+Aov1yFkyV44Ms5SAiJEixS1hubFW20i9HltWP+3VcJcZDipddpUpeZHZ 7dh0yvjbnjYNNbE+Sbhn2zbWTdKZzP0S98rMX/p8/00OVlYTza23dZ+yZpcxCaO6OFdlWd2n 8fQpG90d+QfsM8dGeHqNjLf8TN8PCM/9m34cEsB7ByNFtZVUTvI0aJ4jpiv48GT0rtiR+6mW wIAUSEhdAMt6ZYYnx837Eip41ktp0zmY+kYDzIT9+iHcqzsOKUp7eti86NqL8/Btbui1vrC2 3NWjhA/F52RmjgIs3T4EvD5qOPH+ww50nGSQ4TpfSn0B6jbwQYp1D5zi27LWofVXtsqPwRnN 1DbrspMH5zu1vP7EYmTKqk+X1xrP1DrrpLHqlCOVPNAYdF/lB8bFBetC2UY1Mx++Eva5SzPU RXOGQAm+LOM7ZUye3u6FpzWE38FX4Ewr3EGyvOjyS1Ed1nXtkm1Vu3MlF5pHwcN7TU+86bHq WuBDRxI0ujkpWtGqFf3Iu71DGnTG7OqaZfVSylJ5JR602RCxBhvW43biznXRPxBpEiGUVR79 fIqI00QkLnlrNdwRfKIV/1lF/Nx9mVrBZ/30FGF6UED23EN2yxv8R/rTEBBKscy4XEoT9jue zNAdbCdnMm4nrD9e4ZQoOxgn1yenUyHFpzQAbo0EX3F0/5CH6MfCXOu79EmSfL6J5mgPH/QR vnakNzrbfHOD6OXnPO9+SvA9EXdDduIdIw/jhkvNQawvhwNzjRMaa9vbfMQad3MiOvcpGO0q FwFfakUhTUp6qew1D9aa70guW9lRH2SxA0neQmQJnRNhxdAzZgI/C7PgHFixj18B1um7btLr EDOqjFee5y4jr37l5id8eO92G1tb7y6utPhrAWL/ht1eIIQSeh5JqnCOsxTn/s4TFR11nkMZ HrOjam6Q/VO5Q+xlQ/6NVYZO0blbILw3fq1zG07jfaC33167uJDFA9tMkcYeCaURf3GlgNIq VfPAFtNtwk+1CCyq2M8X1HJf2IjD/Jaxe6e7zUIT4OiScnjvouQInfZGgoNTiqvfAnYl2K2J lXGMLgp+PcCgKI5kfa1yNz1JeicD3bfxYqBGn4N4uCA0PsdQPy6RkGSHSL6ONSZxIzjesAZf VqfFZIGCn+V8D7T9RrrRHjSrr/HA0h/V6ZIzxrrV7n6dK6/2iov1g5h6MKWYXo0cKuFNUAxC 1rE6iiG+2gbWb2JB1tM539xlwTRhd3NsXUo/6ydUwMvPD0lJ87mMF2mewyhH3uVRrPK4Rxku 04hKqN0L78Vc8zM67sAWvSGeG+XJcJZopFGHOsniBLtWzPY7ugRKNWqk6xa/oKOzF9nNFZ6c GG1v1Xzks4O1Obq3Yr6KQg9uyEJMVkN27+k6jwqgo139OWC5dqzseCfQgvtrVeUYikMCehJI j29A50vUVxtRItr75WNVti+XuLlfqKMRJ9XgRAOH3zM9e3qS6i93fs8PD3K8mtfNhAnUlTUe rzc4KG5IKZbF/EyCM86EMhZy94S4g41FoWp5W6+Vv/IjvM9Fsv01P2K3lFLIBSJBzw7hwOe8 bKWVnzFqMi3GYhai3gbzkmv75cnBPa3jSJmixRZU1yVlg9kbId1cfeM8nEk8xAmzKhLhnC3q W2kzDSvFTMxbaSnj4OKJelhbiXuDCwt9grmV9plXxWHuNBP+Rd9GhZnBb2VcDu+2+CQmYMec j5WmBi0T0PM+JSFGyP2F4LhnIVQnkFMz4AJrreJqoGHcfZHqY+1AVHCUt9qHjSXCSpn4dCUz P+kP0AFW5nVxzYkRClbClg3rPX4ET8Ndfq17UW+WUMkyDVgeiqZobznBkN5NzYtZ9YmuLD9f pb3qFUr79MdQkweqS4wC52vA9v1y+6So3qmKmU1W3RdgzohdRvyKUc1dgZt3PAR9SaszTnF+ HwWpn5pcHmpctbTfYbnzSpMeR56ehJC/wBAQbfsuOsM5AsyyTWxW2b/CdKLNe2LPesDPbaWp XU6dAytC/nnBdnKRtdQ8850k87etu7gb1VjdGQUVO6KHa5rpwspvfFMIvsIF1ZrOSQTrBSmL NIxcv/Df0BxMyTj+XwD1FgrpaRwOFx349eq14FmyVF72vmHEQvr8U0NmdY838bTLYbN8MjD/ O25Qzq1F7Sn2wejuq1CmhIgvWvpndr60dlxu1wttXrN8HzSdO++quJGHoo7xMeQpJR8s9Z7y PByCLvpmp14BpodY/ZfFkouysdp3ti3d5qW0kDdAl/qiwd9Zg16IVujdzwAOSKeEztK+6Tdd fdvco8iUoVJ8js6Uzn0cofRbBtnJUvbgJpU5SQKKa3+56O/o3dmLVcrOpF1ARrBG0r0J2Jco ZUcg2suTdtF/xuHLiX8kiLnHV6vCmpYpNQixYLDKOTYZMOzeOxNxMFq53nqvnYmBCS2+xlY+ fwWG9eOJJhih1tUyYNbRMDslYaTQEKOVob/HokI9HhnzKgQASfzi1rTHpuuHUl2yHGA2hQyp GI3rSq63ZzHuJi1oRifcj4Oe7O2KAxP3c8j0jx6mRyuZSAbQLyiYgRJAX4Dyvxk3xe1gnj5N /NXvoI6YaLIPR1yb6X25BnAdrU3zLSDODffvWK7ZgH68AfQL9NzXUfVpUCNu/c3WQpm+VgcM kEtK69PiwYmNKuqGHQqTxkGaWV0RIwVzQm6g+izRxYEfhlePROW+t/mXdYIyt+/hN5oBmxCN 40lTBsmY7rOnDR5FdXGM84boT9Mdvux1I05KvSjUA/dcweWmgXjdMvN4aYuxfLYRjv36Yish kSFnfiigFWhDtVM7yMlBATi3bHJiNf3zTuIwN9plv2bdQb0++JnH7KOg6Z6KtAb7lParWiHO H5tsMSBY3unUi/DFmJugOuhlsKl/5taDLlvrc4PiSVVqfQN1O6U6f+TeT9uUthiJinvOdZFW axiBlxIXy94lzrkW9+3OyO/qf2QQ4VEckk+nazyol17FxfQ6oqUOp2cRJXjh/+S1l2PYmyFh myYf8zYh6wKf+pSMpMX+Cw2uMM6qxCtJc7qxmF4mUPhD/rP9Ph0g5zWCy1Z0b5TgkN7qN8qr vt+Rn1Gex7e+2XMo1RZqwQfzqggWYcuR4ATO5yIKJMC426azwl3jW3lb0sXwk8y6qAF2H9V9 2FN0yWp8fnf7+5IYOhgvmlbEqfQIZ+k7Us0nPWflid44/60mN2k5zIXEuKpmEztLEzxY1xbS no/XonuxT/Z28RpPkLkIysxkNuVxOmGtumOjjrd3zzdOzTg5PWgXJjxU7IXagO7T1fR1VqxL LfiqaI5FTyXamMjo1pyA4RrdbcyLiMeFqTvNmsw8RLV1XdkHHa4eZR7ZS0zbTc8at2TPHc49 lfh/Gs/CCeoWsqal0LqVhUgGuzp3mTXLRkY/RXDMH80hWf78D61F7kvbFo26jifrnaQ1QdfQ nslSBaKTIY07MqY2+2ceTt0IrLBubFtDLRVjaDJpLdH3vLkFp4/f0sMekfQ3TNnBbMb0i6cT f+yg5Xx73LcBY5vKlH7XaWCm/UtXyvFLNPykar2Xta6gKjvhBk0hnneH42/w1+OC6zOwJXjN zAiqDdCSuNJKwuI3BPaZixnCNzYHTiavO5ygifcyDRubohTkPoPB/L7NVzDCkyy0l+UZRERG 8OLyos/5ljxhWq1lRV91If4j9IMO/thpF8XO/5rf0YwP7BYSBmy8uks/zzvI1qNJYjCq8SMl GNRIXygwBdlwNYdNK5r9TT8ptLHm7eMLey846rzvlDRKzo1qD1VxQ67j7jyuFUKv4KsZRL3a 4ftgn2IZKKOlHu9TJoPmXjZFrTl50vSqF8YkyrNbhZY8be0hPt1ClYR+9KbZ/hWQ+xyZq6lM q/8fmEhVqohIYKRf9PKGg1F1fdTbgP+hO12nMtpiHjn7WJTno3Upn6vjP21t3KpYFZNRmG7X 0A26tSJ1RvXTGydbVxH9ayJ56cNjEYZoVtnOCT9lHMtdhqFi64AgU9VlfEKHTra6zxFMlyuU kMyvTKin9DKuBNo6V57DX384yagPKbsuYUaqEJuLBBgGbgAlkX0b236eN62TWDO5QTP9XRE6 hSJ8DoC5cxc/HPgpHUP3JwV1xsd3y4bt87hdYCjPuLfDCHc4yHmHxGmeImsEAGIkZR26DLIw qyaJGwxGebCWPLhNXeldLY232lNTPiSxlHojk0cydfMcLna8OEeLfMT0/3/cYtFS3XYtBmcz opyIoJNVWn01vZZ29xtXYZMkxdyhwQZakr3OE0jVN6TmLOZyFAT1nkpZpyWTnL98PlXHUkjk 23RPkrD3hlK7JEvWut2JRPnlM4YXUtj2V4nDlK3uWVprkrQJODzL9ovTSYG1HVERCR9UgsPO mI3xyXa9WU2+vddZM/VDgDs/DN9aL5XEJZSBmconwYOK0HTaugNUjOzZ0SymadFqDCWoXPWY vtpzxkfmC9bN9CNckpjvehSSDa0OpMftv6pXikFdOQdBG4zPwGLoipWMvyMZlUSO0u3VZA9T aliIzYHXW2CGWvdY2VR1/ctfEjkXgdFVXmbg1nVJ+/CDOEpdPtLU9pojvMV0Om319jTVoXk+ sUfYzrkRPMWoMLXF1e1z8vfRWcRbEihuLcS4br1QeCauPEk7Rn1MGC7cQ7dVGGl/hFzF+x76 D6OZti9NXMMrVEWxpT3LXVWObUdmFl0ZiJ3NoqrP/n+EjTW86txEHR30sW3CKV8Gq+es7ZYA noJuC+Kb/yU7cVRMo2cSe/aXom6MMYPLgpti7fskylmiuQnPtHy0PLRS91I8SlDn5OdWlyyp aob07BaKUsAptWdmPwRy4IXpXXgEMVs4crwAVAPKGO6uIGqvfJ0l2Z5DoTlzKPb1exOjc6ng 3c5uDLIAhGc3I22Z7/35fQxLbctj/jWOcYiDfhWTVIq73kULBHkgHI+wrf7FPoczqF9dF1dv QomUqxfjG1jBXMQ5bOdbwFgPdbO6tB1hyR4NMMyhxvLTA/BOl5PaRYewptFlTQ9j3M/T2bC9 k9wTt4zujGfrRnAySi5hxc0SbDdhAywZ7HI/xHyZbuNR2tVL1uP1olmwzBKbNPe15Mn66Gn2 wpkJGoZFYGvpol4CqhIbK0C99WKcqnRIPId4yMOSoCwmNhTRQkNsD/OPJeVuxWje5T5ay0aK GH4q7S0mjLrIFXCTF1gGqOLQEqsbcqSlmtdY0PcXgX8wB/kYfZa5x8ekv0321uAV+hzIb24Q nIGRYjSDAb3MZKQAbWHW58yjSjB9o3ngjBVra1nMVjHCpNLZ32ocRd0K4ymch6IAxZmMEpBy ep4pYMYIwOmh7pZ7le+517fvjKmbBXyu+bxQ8O5q8bkyUGmKog5tY6cL81xrQ8fIG5G+Z7TI 3D8hy1XcX3D3Ibu/kjXW2LU6N2y8dB8cbyS6wRx/uBDlfpkjg7hhiOJpHev96J72UrhpFC/k iPnqXP8wER1kAKw83T4UZ3qkgWLlQ7Ftsoesg+Wcpst29w3v2Uqr1415/3L8DpL0kDz9BYVv RX3RX17vpfRxLRrhXZXukjaPR+4Wt4ZpunF+tjGRBtZVio3bs9v8XjUy5w4TZXt0KMPNkNAs lv8yhWAzGlpFqp2RVpX5vWuzplIVyfQlwEiuwckp/as3XztH7DWYDKFCeX4PDEDBWQm6AugS ex1kZ+60woGe58ln1vrNXNHCQZ0kQuGA5LIwd4jxkPKJAQoIFu688E8RFzvq8sXUa48OFieT 4CIi6t5A51lVUdWUALkAs5jTtXHOxudxgbyVPr1TQcUynvL9x/5e0tAl0WcTv8lU6QZRPuaT ONp4jkcAgQnUjJtUwj1vfeV9mFK5zsVdg2wYk6FGPJavcpx1tbo9/WXiqrGz6UxM0WDmduMA vLYUOVEBnp8lSq70pR+YD5ayAEfCe8x65O7ZyYpcWrgsdO/J1r6g8QwOeK7vXBmLQf9lJioy autkhnjJ/u4/r0tKvJGYhDK/PiZsfnRs4VIAeAVHDPj9lgOJpzamUcjph333Oz2/9q/nvy+I 4D29/BRehxwtGSOehV2ox6f9LDwAIPxwvtbQTbSCD9rAAkUueumKxPzUBi1sMy0gL2BSnycT 1Ska+nabNOKx0jEn6OKJvfZdmv8ndT1eADVuAyUCRXPFLDn8NRVrFn6CP8AQuAJJDu23JDtm AppVs0+5uSKeXI8ZgC7jmULmBspYb2rgkrYgEfWMoX/xeDcpAmLALZjESZ1Ct6s+HIfLg6ZV cavkDpSjrMIILqPvOBIcbW1Fo78fxLcZK2H3gEWdmTKvgpHfGKXEp0uxyxHq9hrdDlajV7hB 7Gvb0HlocyuUxqnM5LmV7CN1QGH6SNI1kYcdtoZ/sTBBcT5r3weKmd1RbCyQor0ag9CH/OzI SVuH/Z82nXMx5k2WcdZ2UGNajCcfyMWTmw+CpvzBxNBIh7LyzCuLpHSpuwRh7Mi2OPZeXNQa ZDl/6YxGnNsrdnLkGszg4x2DqJjCcv8dJ/IbGvk19V+FASFX6IXsL1UdPyGydtOQ7Se8FSTA ZMr1mM4SVZ5vEziM4KwIrWdnEhaj+zHv1bxxNZYGaMFU5qeNuI8+e+EBbWWeM3k8rMdVrla3 fAcVESQJMafCfX7FrTb70+C5WYyMIh3fazBeCtn09yzV05gbFW5QZ2rbIbAAy/17l6aCwBxq lFsb8w1LWZuaUzvVziycLl3Pw6+yI4UcIv72xLchrMiUkpuyPS1OCnf4yuqWHYYSUxlNhtqo Yj6Mddz4jrIY4k4DzvrYH1vUzJk3370qhckhnBUia06HWjloASswTSmDBnw4TTjkHypw3thZ kRsK6vs4TduhExzdm1PmDwcx+p3w1nlFMyM/b1y99dNLCGinECzPKf7lfbG9AaUWs9InGx98 NaoTefA60sRax9QngkIdzvNLZVvgRoh0AOgHidtrECbglm1d1v2Un3swxheJ4GBj+P+9U9Nn mQOMKMVPAU4ca33Gp9sLcIb3Gi6WrEIYfzhyV8YarQ5cwR7B4pKXOfzKP8TVR7X+7jMvwJTx 3PBgMG5z/i3XL9cuyvjPWgQi8OQXOEJUm2qJN0UE+1s+aPdbFWOT2dJPYv7c6ToXLS/RQ2tS dRydXB7y+wa5cB133KDMP4zYzSltQy408g6UGSdg5YObG7LxjYDEz4Z9C5zl7MGiesU8S4mI 1eEYuDopAE2hCciuY3dAoVoYc6ZyXheVAzyK6XX8sg16P9wR+ZqvFXiO7U/NLJjypgE41pzy MtlappR60LTk4Eh4d/arb99HCSHL4ECirvy+1yE7JXOQjGR6u8I9DFBhfMuLsqoI/CZuGTzv qPRhH3N4Yooh/3o3qe1AkRWl9Dr6se1yy7fBIgxf42dN4KW3yrVAM08zlPoim8kbHmnx8y8Z tIn537oMsJHUtdAPiYl+VcucDZUOWWRru657K/PfZfpDBSas5HQG+9ZKJHnJ9UkmJSuJoWDr b7WkeBbV+GTufMwjeHdHf9J+zME2n20Ue8sKCmg4kZRy3HTWZz2jfY2SRgFoMrM6ChkH4dgC WKss2biYs6NnjKARtyC7Sq7KEXgzvj+DCP+sSbuHRJMymoQot+kysxzKPZMcb0EkRrmradnf iDLEAGsvCRz7LLO8E7oIu7LzsZOqCvqDIBt0ftLmkMObu8eUrhFw29qaw7N/PrLk7Fjn5Ps2 25b3Bugy7gT4WipPIYcbLFD1snnKWz5pa99dbih9G8zong25SxvhZhGGjNSwVQcGhecTFwZJ 9qqd02p2fo/Z/0YzKonF2nGvv6XekJsHcORRrJcEYT84pgfXC7CK2zjFK32tM1cOKYoISQYK nmZo0OJhlBknoY6aOrsuNF6lfJZasBYV63uufI72gE3oOTJB0XhcLiaYGhDMuZ22qs/aETBX 4kp+4FWcARI+ly1ON933uQBxwaNLQH8Lk+z4UBByxYqdV92gcujkAqsSYJcLYie+4upJN/M0 hlAfLPJ753PEctS82g0j1E3G+hnvgCVBui4Tzx3nvHDu4iC36zkobiDXVqQBNpKpAhnhmCW3 W3bpOteYPSAOJPelO+DmEaW07AHGFQNWuzf+bofU5EgvNSWauVGpunW+c4ggBuUdk3rp/9KZ F7+LV3fh8OcN5wVIhFSereQkF+5C+nzyDZGwTmMmoEoXWHg/riJgSawnQYPfJSP5G6QhpbDg Aed/d2nCJ4gzrbV2kEKcp7G7rHyUUjPjqHowsMnmTWbmNBHrSz9NkYtQnslvdtXN4IMANON1 DbRD/ucfz5NZlMJYcS8tO80V5deQrGmiNZADYwni7kFFgNmNYRQMzHL1aLqbdVCdBVEsAlG9 +ofJ1lRRu3qUcXfysf6n8fWx0SkThW6Flnz7yDg9GKRUnc8+APDsbdItJ6vV0dg5LORsTdnG Ob/XQpnmTPn61exPAzfcKwdHZij9hwOp0D5UqTOQvq4/xO0I0PK+B6GSO8XOdROfANxJIQZj J5IiibE94tsTbqUG6cutL2tYDyFH2ZpfLvp8PdtwutEGXYh77mxoiijRQTJJUJ6VGjaNOfHl zV1h3xmLIuEaehArfII/7W3xK0hlAdTRaNItS8yuVQt/SvdBz0c+9o42sVmbwK7fMqPpUJbU s2YH6IZ0rE2HJaRSqcbXSYeezAC91hXwfpiFzGsFBxVIKg9npfRIYtrVX1akIO15sw9UZNW4 pgQCZE6DR56ihT/1UvemJy+jKH4E0h/QnnB1SYp1eRSrPteWuBiaP6VzmaGBC/tWPKy9vZS5 jMasbqpUjMdnCncn2+aYAO8fTnHwtn+R/+nZtPMt40rSvdblnZF42aVEQwz/N5uC1BI4V/rk RfV56h3jszgO2B1FdQ21t0XiIspIDx8iCCTVkfx7BmHKCxa2XfbpGeNEPzMq7sV2JxPEPsDL yhCOkdBPew7AUc3/1nYDb4oJn83foXYb1ifYpqjhgw7bBCR0zIUOCQZNvVl55Zmzv8nS0l5i OuDmHGaiVZXDZer3seTcoPZlh4hRe2mxQpsa/dgkw+qNeCtkEcLml4wDzJ4YPhRkTQGu/fd3 7yLTc6MjpQOaj8xtsHXjyE5Vc2sfFn8997FEU2IByCDi0NhrEuD4dp6LZcWL/07eGOyA37/S 7IcfOOtEzo/S48EyGhQIP1zDvhLOsEvrU3+VKul914hBHEcaf537Kx8QWCii/yWX1S4i9/x0 smIYArKcH15WxaVUVln7HR007pd4XO97s61N5Ob9HSkIk9Bn16ZcUkgtbvsoAUZtRXz4Tjfz hcFHq7UeYlAh5xiszTmSdNm18Zbl78Zu4jYqkS7How1V36bJZOdNJ8Mkbmgcxu0scb0PGy3M V63XNfFL8eSrc6jaEJdOt6s0YNF2LqfyqgGDwCJ0yK1wUSfTjhnf39mapS2ZMG3+YSBHvv9C 2xoKoO2pRRDEHifK+Ckkbi4v9A3lfSIPKORahLD/p8jgpxpSRIQF0LUEJc3XQ6CBTE9XEg2K NbimtXq5EGAx291ozPtdWxqQ5YBgn3loWh+7EObqodCZ3ecDETggvcSw+zuT0JIETZ9u1j3L tp2AJ243j4i6rvkcXi3JPzXIF2+VcRhNdtFKl7qXbbOJg5kCn2J5qBCEqGxfV9PcWchVsawm M3UehE4vTb//PfwaRkl26/EBtUg7Gfh16z84w/WYItLlWHcRYM/Y7ccfhOg7cTMhv7vqbJeT crav4K6SpRv9OpPZtgKCjHKz+VMhrl3MgYCYaHnWMU7FK1hP6ZBZsawqDWAGK7z8YOnW3l6Z pE1dZitlSe4xRfVqBrejKmHNP5nmzmmvLUAe8YiQeUIHVu/c2/BVmH5cXIdmAWPDQ9s7d+z8 8KIVf+y0tioaj/SKpHkjWGdtzUu+yGMKpureTO5a31b/Ths0hMzUzXOeTNXh55Z8IMW1wj7G tns0Eo6Lu5RzOsPL3wplbmRzdHJlYW0KZW5kb2JqCjE0MSAwIG9iago8PAovTGVuZ3RoMSAx OTY2Ci9MZW5ndGgyIDE1OTA0Ci9MZW5ndGgzIDAKL0xlbmd0aCAxNzEzNyAgICAgCi9GaWx0 ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42rS5ZVScW7Y1jAd318Ld3YNbcHcKKJzCg7tb cHf3BA/uEixAgOAe3C04fOSce7tP933/foMBD3PZXHvJrqpR1OQq6sxi5g6mIGkHsCszOwub AOCDojoQ7MLOwawGsnSzAzoDOFjY2LgQqaklnEFAV2sHsCTQFSQA4HW1Aiibub65vlmwsfEj UgNkQGCQ85vSHGDqCVAEuQI1PB1B7AA64F9AxcHFldkU6PKmBoEtrcEg+jcXCQdHT2drSyvX PzE4mZn/RPrjLc4CkAea2Tq4u9haA4Bgc4A8iyILQMnB/U1oDaBzAANMQVZAOwuAgwVAA6QD 0FSXUlMHyKgpa6qo07O8BVZ3c3R0cP6fXCTUNTRlmACSYkoaUgCQFhNARlNd489fDRD4LX9L JoCSxpv+D8+b4R93RSkNMQ1dFSl21j9nALADPoKcXaz/0P5XbjRvmQH+ndqbq4Wzg/1fBAA6 K1dXRwFWVnd3dxZLNxdXFgdnSxZHu7/y07CydgG4OzjbAt6eziA70F+FcQObv5XT1Qr0d4A/ TQF8sDYDgV1Af5ykHf5W2r+V8s3pTe76r8TeCuH6J6bd3+YAFxDoP2isgC5/+X5QUfkAsAda g11BYCDY7M3QFejq5gIw+Uv29gsyp/07QRBAws3Z+Q+H4v+qnP9F87+pizu8nczAztsX6P7f HQOC3Vy8/lGb/zy2mQPYxdrF1eXviCCAhbUd6E/2Ln96Zg3+S6YopiQnLaWuwfzhbfDAzIoO b9UBs7h6uP5l/SeemOQHAQAfGw+AnZ8LwPY2pFJgcwkHe/u3rF0Q/5RP0vqtTq4Ozp6s/2eu bcEO7mDv/yu3sAabW/ypvLmbI6sm2NrJDSQn+T/WbyLEf8ssQa4ANgDICQDyMLNi/UP317T8 EbP/Eb+Vwdfb0cERYAG0cwH5WluA3h6I3i7AjyCAq7MbyNf7n4r/RIjsvABzazPXt0F/WxbE v6LLgS0cAPx/i98y+V/V/4wA3V+LSv+2peYOYDtPgDnIApFVycH1bSDo/v/Zs//iknazs1MC 2oPo/ruk/20HtLe28/wPy/+y0Ab9yZVOycHZHmj3XzprF2lrD5C5irWrmdXfhf1bLucKfJt9 MbClHeitKX+JNP+sk93b3L7dPdZ/ri4AMzsv93/p3kbSzBYMcnEBcHH9pQK9leG/En6r/Z90 AaxiWmI6GlqM/2dm/jKTAps5mFuDLQEc3DwAoLMz0BOR7W0QOLi5Ad7sbzNtDvL4a1IArCxg B9c3F4Cjm6svwMLBGfFPN3n4AKySf0R/I34Aq9S/EC8HgFX2X4iPDcCq8i/E/+Zn+m/05mf2 L8TO9mZq/g/IDmAF/QO+hbX4B+QEsFr+A3IBWK3+AbkBrNb/gG+0dv+Ab7z2/4bsb7zgf8A3 Xod/wDdex38f9Y32baFc/urQv23e2J3/Ad/YXf4BeQCsrv+AvABWt39Djjd2j7/gfzZS5c9F 9teOsv27s/9zw/+F1V2dHWxB2tbmb69u/zBRBLo6W3vos70tGPub/O3nf/8z/A8C6n/fDf/w Fhd38PBm5nqrATPnW9XYudh4/5yHy/c/fM3+vmz/Wu63Efxf/OemA4BAHiAzxMWfDmaCITZp zWEVflJFU5Ww1Pwsx9W4IjryCTCLmVMdRPiS+VsUINHiwJaALJpihw+yAoZ+KYHgUh3qEBy7 l7XW5JrJa3PV99tAP0U/IlQpsbE8LRbNoCzFhYDKLgr6A/m8Qt0yrh9ZbQltpADNsUMJ/o7u +1iO768Yl6kUBpVtKwWw7iWz7F+xne0wPRbQCTuJFqY6IV1f77HjYoB9YosMMyaFYbhj8nCO vd1Ye9VGVph8nPCkUB/SBNCZ46SRFt1qjvQQ1O0dhHJhYAaSy9RxtM6m4Q/83GHQdxzOhgAV OsWowF8Sh1hV6G1kT5kxeoi/GsqQcpa4R5WrUz224zUAYZ2d1kyRjp9eH4wpddhvy/nbB+3C fVtusQrn+PmTy7m9Fefep770OitqX0jwR5iO8lyMBK0jqGe3jJzvje39wKIUvLkboH7oJA/V JeGlqNq7FF2xhOgP5HGj5olg9rsEfSHt2J6eWsLoW55dA+Jm/oCEkT41Y7xft09M4wwxN51G xJso6HbsIJI6i153Hte/t4Y8RfWvXmHLnJdsgd6KxUPgvZb0YO4mzEN/HSVNFY/hTDGHR0ox BNq2Fu0OlUPWnJvkfqEMMR5WmvJBm0qnPUSP+JBlG48mOtC3VA5P2a9GkF3Fxy4dvmlLBVWa fmYQqX9NfZJFlTELYEaMxcQt3sR30z5S+UaVeT8ebEtEkiVPN37gePK5yY1v1/RLMvGG+kJs ba3HskseFAtrYlkeS70ofCYqe0Z/38Neq4DFssEFqqXZ0mC/+NljAszxFKYB2Jdj7rvVNDEA u0ik5tCxHLpclGK0wcbv4MuiVirwR7NxPW5VLNlwCSuhDIlsU6UYrqul1kb56h58yLIiyfCn p2GpDaQAIdfUodchg8/G94GTH5Fzg6jaPUiaCbg2iFgS0totoXbrSnyklEvWyCFo/BOYg30m MqH8Mr0FT4/GBW5pQkfZEzEjiezJP6q4hKptwsRhTUg3m6IM0pTjKpLtLf5AbXMATeqOegGJ SKprkV/EO/Ur734NvbMCLMuute3tzFhbnywqn8OiGEfAUxajZVlAThrhNjMMheCloGNwR2b4 /hKuvHKSJMhct+fZXk2fm/1aLuEH9s+C/MljSXJJuRy3hR+LA9u0z7p0aUkiHSj2ySzSgNhL 3GWDrzEwZnJKagi24HdBrI85P9/7qGP5QDnOEF1f/xZS8UnlUwpJqi/T2ZK5ADJ6DGlqhMlw 1hEtmZTFE3ZXC23LnoAUyRt6/KjsfI9veiEQXNz00pnnYxo7B4vRcw3l1t2dTa3BSr0GMP4r jRvjGdWAFRY1ZfoOn6URuuqbvTw0xmhLohk/ow/iU+3sTKZ+P/nhvW/jsGv3CX5KNOveih9e hCSXHKNHS2Q7DXWpVowoZt+dx4C/ZGg3p6ZC4RLHFdWWc+opCmz2xywbE2YbwazE2yypqbu5 BF9DDuJjk9q+bHBt4aLhXJUlUj+m77hQhQw9Edvhl9ky4rNuQRvjfK8e8FZnYUCe72TEXtZ7 8Lh97J7H4X75CpMHEJS+34baRS8me/X02x+jubnzpejAsyiVcQvHIDRdGdnwp4iadXQkQgGZ DCgO4T4HWYjuN1NuHroEx39//IZ/ceu4BZ+nwtXqIcsaLwbJMB8IZ8crlaiyYBLdEIJumd+M P6WHnfMgreNb6l0GYazdZ00jO5+hfBmEFqBauboZ3XuiL1yo1VO1TuVdV3R7/N7OUh/mXY+U MdddmjmFqO+gfql1i6eo7GgM462Kdp9nKO9xCGFNAJ7d0qjgQHa1AA7xAvN6WQ77eWO+rLEq p8K6wdwZPwHkqe1Ue0by072hBInNhiwXduvQR3YI3Bva7GGNq2mBnxZj5XeDYNq9xRReodq7 nogrY6bm1EFcT3QoTCiHE1ojEvEqBKZscdx51yKrjHGL1VycgZ+dHsodNawGnKEdZ/UteQ+v g43TdCFAbrKNZpIdiRBVmj4wMfRHkpwazOELYqUkyOrj8mTMYVmuIn1TrcI2uVoRf+gznu/Q 8ctSh2RINvlmKGMDbPYEBo8edW6xhOEEMcZKWpA5U8xr6gGBB0uksO8dPnF0B2xKj+BtNXFI ynW3+CzlUgQny1L5vq8X4F2v8hdbXBM37/2aw2i+ik5PtunA3etLsRzSIj5K1COD4WeU+VgW nP1ZMvVDmjL8UlaOKLCS62q1ymTj3E7MJFJYTeRrIKTFO5me4iDY1QDvjoeIXOGLq4qmgOA8 JKdi0h+xvdDZtkiQ3DQgC7JOK7HqUWbxTNEEbob9qEniS+o683uW8Tb0F6Ln7zWmHciK2a/H a9LxoR39+ce/mBgbBgKHPja0QyVZmdFa9aVHp0pqLz7nWxT4C4wxD9ZprYR+rpAUqzh7vcPL n7kCnxKLI22VwohK9cM6fjbPJrDSa4KL/hpCId4pdCiAzLcdM0FerIYXaHFoEqpFyxkkhXqm iAE1Skht3JPcq6VEQ2PNSkwVq/GNxXuRGtf+A8uJZEaiuCXbZjFnDPZFOHtzanBS+zT/Ah2M inhAVkXOfDNvALOFQJBtsfzZvhhbpyJOO8s3XUftXydH3z0PKxg7PKlZy3K/7KgLlMqkiouj G+5ddYQRCLsnG1HlMF2ZcRcmY//iZeyN6p4Q2A5EFi7iGm6r3aHAkQYS6oB/dtbLF9PI8erL kfTE2UKvH6l6sw7hJQ9j/pCcTLe9pQy7slTTruYwMf44uesFLRK+XiU8+uWBnvihev63+by9 iAvjZ4OgTPOLyGXRerkjd70zvFiuYGgkdae+Bwrs32Q+mEqtJZWP/q1yG94N+TRzyF4R68ay kDILvi8v0qJO9M0oyocrIeCAAyRIHHXmLnKHm3UPECJGF7Jo9vlV646us+8cWzDH10KK8drZ 6XdFp/6U03tm8ya1VBhQ5vabGpJcnSvtMxr4BwdL/TI5nAhr1lge0Wj68h1PZh7QuH6lm1D+ d+0fD0oSDc9sQhLPAbuu7yY5SCFP4+gwKnrKYVlNJBb6oqkE3591MCIf4ujI/1LQieCmkz1f aNKIjNvR/p3iquXIXX3cxj8rkv9F2qGkGXFADrFkGb9UbkC8uFJlqHGcd+3bhBpDMoJuFFgY 5oV+c2KTYIF1SUa5NgbeQl+mehCYHWOnnkRa0+h5+xDs6b/VHq0z5K0nV4NvZPRM/9Qm+sUo Un9vsTfTCcYyhco1bbbwwSZvFi+pnE3QtqMN3zGGN+695Kdzx0WhBVZU5hCc5EEZzqXxIfEj UDW6883LRC+Oen+0tiy5vVYGFHfSavpYCxJb88Oj4nfsBnfBR8B84pNtuRe9yHeW4Fq2qBaN jZ4xix5hgDYVS3nZUgJ6SzPXrOLprmPnBm30Ycc8dAAEoZq3nskoOqtaeXKT7iohO8GGy7Lv 6fyKPExqtPVtorlyeaMyvbzn2opZYUOEz+0o9ox9uob/cVU6Ub8DjP/vjrIfDUhmVrwykyfr R7TaTCql2z8pQ+6Pey2zQNi97+YbSnH0MqDmjc+PviSkWH4tmCjZVD4pdTDXkigGy+U5pZm3 2d4BYeA1T9nsheOwyfC73faI9MGOFK2ZJQbJWMhe8jdfziSDN6wVYuUAhOzaDFwYi8rB+ePk kB96B7QJj9YzU9kUOGHsqsoxgZqJmDHRGOWt8ysaVzYPSUrxTqYNKaV15GFeO19EBfk6qoI/ 5KLAlT5ix9WKOf8SH5ToXTlEVaABkc09llgpHWKy6DH9MBt2x965hkRYeK/KTmpbzWviDJLq 7ldaWCBZnAiRhxGB3SM0Kzb6jMzah3U4rKfSTNjyZS0qNFReldW5L+Z1UCGk1b18ooVx9fNU akLp08wF01QedCzq4qc7S3Mwn+QJ4tMXU1xPuuULy5yxcFMoUwqzp1jo1gNxsSJBV4WkCxjt 0962HH1yREge8To7J5kWqob1q5L1xKjv+AY7lcQBrOOcL+HEQ6hU8XFDmhAjepdrVuLZuBrX I8E3v4MVidoVnbFeZhaclqz5I13YqDQjNov7ZR3cREOue8gw5F60KhG3QAo1UmBVtaMbuPM5 6IRgwQ4KtpauSoEefVVzklOI1zhcDxwtM5n8tOvAkPxR9Dr+aT5YgiagraMSRcJ0Q2Dep0Ic n+9kyt12aZ9bngzhyWffoYG6OjW77EoFIF9eyQ8+q+fvcyqJqlOtKfovVwtl25QC3/IA7wxN J2HJbdhooQnyww7IqU5Iv1ajE5x23bw3R1x3YUbjpvj8QuoYTVn96ZYdgxwQqgO0DqSpdLpS 5Qle/11oY3CivnEk3thGKC76lZKfRTRDhoLr/HRfHPl3o8dtnWdQ1/e5/jBr2j7vy7FIWgKL UJdCO05MtU2mZnHhW/RfkIfK0NlyDVlIXnyX8uyTjF1R8u5L6WvvRNkZooX6j3vJi8OZvFjM RcUXSHoir2Z8ucRTCA5H2z7v8skGX5KoqvnTpTCX20ZvZ1ZHr67emBoA05i5T1ZZTdDUhEMV 8Frsh0LJdXEF1fyrqVPpfdyi2+ExG4du2sWVJAdiJnRpE2FzZAtcUwgA7vPfEekWSCZIY5Nv jAsuCWc/cGKMr1taVM+Z2hr1KCvuXlP6D8VURWrzdB4oecscb+qHqUsvaj0k/OiDipvLEYf8 wmnmS6DhE5u49QEjvgQ19vvs4IKVa9pxNkqRLBxnfFPFOyzTLLhTBNwTvBUoccEMnWFhNtv5 CsS4NNVvT9/GazFe6B9zt1nRksdzLLUh2L3gGpwZjFGk1Mibox+vLkF10wXYNgnvstyE4iDy TajTVfmMu07zkJQxvWIZ63a5KpuCN8N6OXVhlii4MkO81oTgEI+t+9L96m7dPsXSqpqZhHQN NPkiDqdszWcOtKx4onxkrF6WwMtPrZX63JQ8/oIKvKGE84D2DztKNHxhz8eEJuOZ+42QEO6s gPiLLCQMe7AupJGlBFvt5v2o22Y0F37zBhoqkY0dmabyLB4iYsTGrbN13nrdVKiDC0TgMfUX bVBCsslH1JC1J5RgItXiKL1UJLbE4aocriF7t+d2PscdWOH9QtloV6saZUkzv8Xl8LQ5a0oz MibY8hANlvfRz3taI4S1ITsqrgvB1pOP6TVA1QLb0SINxNBKfkP95PjgEsqyrzkbikYiufRb Q/WFvmi+W+9cNz+jGQVmTJ22urLU/u4iKcOn7YD53FQwE+I5w6zBsSJm02jA/lNk0egLFNqZ 8op1bqXkGgFHbIN/suycO+QnzhKXUm/yn/I83em3p6cqa/50PvTPEq83ZYjsc/rdSyjRgNGx RLGba5NBaV+YVxwRgmb3Pt2sSprU1XMk2sXNSuZMTPrNOkHosfx+vz7VTik6WGcmmItMQRGU zGXjdfIdbEuEqWWOH8u/ByZ4XIdL/BxeyPiU4y8afRtp7TZAHDK5sntHe6go1IOWpcn0h8Kk /uPn25yQ0je0fQiSNaxU85xkTSBArwZ0vPwszX5ItkADB24+rpTaZ2h7tiRdueVI+svtSEz5 hjpfp/sXqQ+yK1Xco2RDvxQJVhQx5+M+V9X48TuQjfXoIdsPij+qMxfZ8nuX6zsuzJeuJ6NS Pt85boXGLPcVsfEHyoxiNnUF18VVzdBo1H8fiyeIfOb1SxG/6w2dAC9ZpeC6/ORTspuml7yz x4s+zupBoo32zJt77IFBQmmRrN6Ii91yNyak/B2fbFg9mngaD3zoL99scbezvttz0wSmWk/8 9Eqlh9qNNM9VO9ec3DQy6267eaI1v2Ee8rx14PqxODlyiSEWIKKlRcwD56bllqyNTEJKoKgF 9ZH0XuR7haq1YUgmVxlYRKTdNBs3hDK958Vkp+AEaZkaRJxr0lAyFf3e6mJTDdNrTRuRvZPj tJQIl7t/1zn4VvSJjTkBGVraKREdy1Mg+OvE0O751z5dRWhb7QZ0tOUVfC9ZFEpY/Jx6JR7A 0vTDp/F3DcDo4K42yA40TBkS/b027galFoW57LgRCAMNhW9CdzLgzLSu2X4eqz72M/biOTdI 2Jfm896LrbD35f23i76DB7LJm7sCvgEmSMm6dfvLJu75CPkew8d10rdTsin6pBiRHuoZccmE psl1ekMpKGnNSroGRf73HFED7wMEKM+qeHR15YjuPhqt5JZJBUNKLk3wKaYEouSXw/bPHwfZ 9fzE/b2Yf7hyZ2gZAP9Qy5G1bHN++VlJTMqD7W4aJFeYfP+hXfOpDOhPK8mLInGz1Xqqf77b noymkItnbFYhe7/v4aM4LnzDESM2ilVEiilOsbMmv09IivuFU+NSNqwwkLezq/W2L8Gc1IIa a6hEJPm5gCXsGz9YSm8+l+oM66cu2YkUIZ/TmhTPiXR210v52AuZ6ehqXw8l3g+wd81IELHi yrgEBSk36z5u3WOniT3LQV30Vs7x/Po3q+wGvmSHxhKo/VACpke8yzPdxUUYTP4+/oFUbCPf BeUlZYzTQ3R2XmDQ6ecvFjrQks8nE/dDSYN7HYFEW2Qafr5+/dFNVUu1qNoUW4yTfIx3icOW kR8gypCfy/VFnojxnyVfGUeSWqLzljKjBxWNEn8Kx1y3i01y10zoqG5hr8RXlmpM1AxaC9Ap /9TbEfyWduxdKmmhdVnRiNPbXP04k6HZhqvd3QL+Vv6Qw7L2pKgvP8zfND3FwQg/hO4YhnfL wyOMUzI6I9aAhmLgYgPF7vPpXV8x9Se8nzo0bfUSX4xe8i5chbi9EB4UV3Uz+Rq2U5xubPSm KHaEx9wCl2ApGVpal8Q5NgjFn9J2UnkEWs5pSky3DKngiZH0Xf2TRtBBMakIZYUoOcghZvIf ikIqa45/2SjLjdAcmcroTc/cXn1wjdl0+FghYhxYJXAbRIrLhjV9WoFrAz0s4zLuR84TOUdO tnnVvRW15rx5+8tQcxTApUlj8bOKOitBTM7xa/vzqoeWCInShOJCLaiqUUxm7DHlhxvP5JSz AP+IsK0h/J7ubqs2E8C8uLW6v+CwZUc+DaGt3rFn2OMQy1/0HOFLTLWViZpvJ6OpGzKu8Pj3 TxYRu35e3w64FpPOvgzO9AUMwRl8O2Q/Z2RFLsJCpchyLZpM2NLNYnWQFBZdPw+y++WwVy9u gzATA+FPt3WfeM7Hfh11wd35SY4kzgnZmJ0GWW8euLsu9HQnjJdB8aOy6oPNHFAEvcLhbntg Kz7cQ7ILvYV/HdWoigjajmpDIR4S8HRknZzOfzd3NHGeaLqvCak6zrKD8GtX9jWgm+VbrBll pQ8zKPTGZ7Oijs8iaamc37BUI3XUgnnu156AyGSIU8k+wTjBU61YyEvqLgSGELrKFsg4krbt 4HKpFby4+OW1pzQLu30KIb/nnHL2p6PdOKxERQC2s65h0i94BEZD6kGr0ry8l5+PPFUEXs3U FPtbYNn9L6bPoEdtE6rieKyjamUyCO5zMie0hIuNX7mOL9Qv/u2BSoxZQNEKxlmh199TnyWG eM3RVrHTApigmkvqq36VNylI+d6OSiQFTe8kk4I0Dlekiawa0q53uz4VRj26hGdkHZ8g4BtV V0a0vRz5CQVyYDIGAKR60EpbLLu/NuLAULFkGtGp+fFsQw5c3pTg3x6cMnEMinrpo/JA8rR9 yJ7xr7e0rinEkieMjgp6gQ2pqgvgdvHtrGB1AJojO5G1Wu0j1FJqvL4LnTSOWOz1wBFBfnH0 8Bs4Zr5/1WG/FG9pyn+MZ82i1Lxmgrneggw8PnqmKdPRznGHztiC+EhmCkn2k2RRUcBcmydT +7z1eNvHc+2WizUgXy6MmzganiXwFH5/Zg70iz58tYYaWrqkkeBrdYXtSxg5DaZkOtZmwgHw fb170OSNq/Old880hiyTEdW7c6lYOn4u4NrXsv1D2bfS9TcmAWm+l1jQ0P+0jezqkrti0C7+ qIScHMC1iBbXkjqHIzgn8p1V/aCbcQwynjno15Ft7w+zott0IhNq67iIE0kvObbdidz6tdFN MgGL9i2IBFvI/lI4Vi/BQXGVZqaz0B5R3GzzFwWF5WZOcc7BT6hW4Tb2ANllOEZg5QuZoQXm LSYUC/WdoSSgeTrU57EFNXYQYe1s6QMXgs5sJnK0kqTu16GEbnBVTgPT0gMyhaNlpukqV3bz 70JUT7Bb9Zk5lKHTx4IlzMEL2l7aYd3vRuE9lkNioiHviMZEy2kDrIla1X5kjgPZSv0M+bL6 Zmti6Gz2LxU+EA47zgzaTGpozUgkMK0z/yB69hnZ2avnmEhxXJtl/tLPRkUqwipTDzpWNrAX 9mfAaaQCNr0fnfa6UPjxYKqTnAeK6ZTElaE9Z4As1cc3+KYnEXwVMOxYQyqZhmJROuBySrhc 8aol9uxh8nRwPkwed/erhgywGzPKN/jj1f5MwqK35xMSQqgRzLFgZ0xznc5ZIbbNUKGonV7U 52B52PDFeCiFrvAljpL3l09L2kaJthYcFJ5a/gWvNq0H6LHCRdj9HkQ2C6VuDemGqavs3zga wzBbkxzuvlm8dSHkazOeroW3v4Pajh/JPc3gZt4ryv3WLw7zIvX+ocrdPBct0n7m8FJ6Wh+e gviO7X7MYI+WV/Vo+5yAp8sGFy9Tjl8eIo3ln7VaROYtsHytmdLZfJXrdHVbMO0TjH+f958h WeRnBgwe9Nq7JAydo48qh9TS/Mqq7QgthVC6GFdy/92+ws28ChYQ2Qp/pf3qAk/KkCU+01O+ whY0o4WHmVvjEy1w91S5bTE1EMstOhTlDikBeu8r28uNqnNcPszGbEFa0duqwFINNJUVfLJ5 pxR/zq9f/K1E3P3GIJMhX3bhFV/bbAk0Z1/rzn/2JLvRFv6ucf72pl8lGwE+fwqO3RUQ3Ajz K1pfCqPCAYmXI2PEgFmFLEqYFYPDL6yLk22C0Oj0B/RvRthQe8NnO/Oln0eyTWegPPzE8m+E TwWyjh962dnZrn6S5ELrkFH0zFjoIu2cY/ta9X+xegh4yN/u5yJvgbATWuTB262t21g/cTsn 8IIlynELaDTac2BC8BZOoNzCAhqrjZK9fF1n8CSf+wjdSJQ5uPFIelVLHW026UdKO4a1sF6D Sh0LbBg45wuZY1o1k3GkamQccW4h3JlP8i6M2L29OdMnwYbcsFcSMMzCiaFTmQmQF521twso 93MeZdUyzMnGTrqsqIiHCV9j5qvyrktHYlzlYhMYQnn6mZCeEFfMhVQJJ2QXkVWe0H1JqGX9 lV19PVQdn7xPRHFzPkW9jOUKJqCT7SaLpU3Q56E8ewPLtI1j8ZUgLmvrp8kF/zDKmceqVVMh qTYalhuxq5etIf2H61mvXlaSxKAfa2gBkQleVEXIskrHcWc04PWIq1/GkvtKU/YXPBGiI+he C0Ocxx0sw03G0v6Y7cAWrgpRrdMxqLikJ17ViqPpRR8ieWE8xk8IAd4/7M8fu66kC6mmXApI efjuDWE6M/sPbmFCc1xTFjdrqJANSEWgGHZsWra/c0KBFvaO9GkLxbVKrsihwrv4IZ+puFt+ A/Kxcj4yf1e12L6eUdKav3/FCZvqen9H0UY6nsSPRfjzNzKzudu2MJHQcw6oxyGkMGHssCWg zt53j5vx+rjVfunCqmU68JzJ/zKtHnHlgbdX5NQlnC47QsfFR3O/D6/YFFMyZWw0PF0wtrHb W4dTOX0+ErL+1FeH2RztE78cNSjvhvDH8qbywalw8NcK93Z8F9PHLgvAzSEYrue9aGhoUJnG SneE2EvgTJLuCl7ycmE8V2RVc/1RXpq/qKI1Evv+723qSnfNOyIR65cQ0dPzyJypu757bf7M L1HbRWosB0R7REOachGIQwve5z+RZQR0Ck4gIOjzvctH6L3vamtxT0bvkOKVYqztL9azeF6S 9IZPjDv6JHWoMQKZm+tDJExrQQxmUkPHwetnGxlSahxSep5SjBZB/a+qP+m6SNoXMr2qkm1u seh+KE5yXfN53M6D9d9JlvUykaUpiXfUqQZUMIEvrpNINr4ObzHwf1d/aJdSqp74IkVq0iN6 hBG1g15SHCxk5YEllB9C3hiHqHmTzNDeICCqQfGdd0ynxW9MUky8twgh8+KwAUSRvvt739Nj ID6Kl0Lucjmdw4WCi+VsoAqIWB1Hez6Gb/hOFCXNw6ypw5hhVXNY8euoX+7Di2SbRxKUCOnd ksxk2mx7PpyCC3+470HjzF6BGuKGpffS5EeI/tmYS9YH+FONLbRPTwZSTzuh1NaU91GOayo8 ndkaa0v2kUWHSEyIB9NfpLyLgxGvOvT69MHUKIxxiibZgzyzsqiCWhCyZK+n1VbJ50KfxJ34 bclaqj+jb50GMvH0bjWGUufmu2vAORIaxiMofc260C3Vh2RgqX5i/Sl4isNGFa2BPjwUO6Ae XCqDSG4emwf3JdMh4mElucyJaithjLYb/dfZAN5zHVkMRKBg0YjwTE09xFCfvRsP+/PwLN3v j/Mc+KSU8aBtRrzPDTQaUO9+lTC66QZEp4JdiWF4remuDaCg+sqWAI4otaEubFbxCR6LJZIS yK9Zk61U5s7F3ssaPgbXncH7zUimjP4XVWrGL4XG1hnDXAW4iGpb7H2WMHZKhc7vf+HAzOyr 5lsiPK0beHBhReEe3BmNYLqxXcRe2IxGpeG2DSPCjDf2JIXKD4s1zbdzN3+Gv1GUG4w3xUpx C2NZTk+T3AD3Ti9wqVZw69oaw+Nzp3zbhf69aqoZ2733CXk/BzSzHiVQ0BXnVbdc77PQHY3u T7FUbjqAe2xqGP00Vkgf2XTG4Rj2zr5A7yro/YQqbH2IU3PuCU/MAytS4OkpmGT3BXiC+C0Z 090NlxmG7y4oRD+KatXZ2RIP/fLHU7Tdh+pZrwTvmOkgT4pu/doEbevLpEnpaaoutDDzl1In YUU43NNTQVnkwtJKZh0n1WT2ckNdLzlOgwEUPrNc6tm4iAsTgyNXqMsEJ9x3larfkUysv2rd C2zOy/pRwdWwFe43FxQsh9Udcmzoq30CM707qJGhVIVFS2aWoCw5wVijUpFYrcT9VgSSJQm6 mCKL10m989rqj0Q/86EaiMFXYhzgRnFuTrFHZtVIJYQAZRxHVx2vYzyRvVjSfPbdpYKw241C Fk2ucDdSpOlCXwIL30LM/hAqCf+QPrT+eSTlQxO+l6oF9iuSfGh86rvdAFklsE88aEz/Gj7U 5rdUSsio9+QCbsb1bXVvjZhXBVad3K7wbOvl6fAHRO+MDtAPErN53Bry+EX+TTzRdWYbdNVr BoahIPZVhhvXNKF8nx1qc1GPKSoCYI5OqB395gz7r3c+RS0nA4iQSwRBtG1PUkxa9YWWmN/K 7VsasWfxLynMh3JzZlMEualt/VrQMBBom3cEKw+OCnDNnJJGTNzOA2E53XkUTwOrTN3dYgjk kkvjX1HfWwTJR1KwXWOxHpMPY/avLpo93Gp9VuauKx3MsHNAtzZJbyfIOEqMSHsXRm6IuP9D qkfTpj5DFpLU/R7ruvDZWNHoBPAcMw0QoYbuVa83LUb6nrm3FoE8/8P/7IdcJRqIy4LfbpJH m/qcHDmLeCBfSynHS+ahQQqHo3XPSC5TMqOEwU8j89cqWUHT0/IY+ebMolWqF7bMzsgcjgNA 4qDJzZjhCbXmfopPrvU7pLYKdGBWJ/Z2GkXNC5nK42fChvdzeYopxAi5ioIC3DjwER8+mJXN 35CBgkmFIr1nHZUW7aa6Vw74R2eWjEcTL079fy/+gNTvFzyJZnwnj30hnl9WiNFE5ZK1j/5u DWapq9G4mbXAUAsWsrgok+U10Adeh7AyXyM5sCOOyDMZmQEy0mjbAV9FWe5my7vHX25yT68I bWPEmn4yNooQ2QwJZqI+M7lzDyl10XT2t7p0fr0+xjMhvNE6C3mUPtDkHpn9OVxM+sg4dFS0 ED8JzdJklknDNjdW1aBZqC2NpIbg8IywLZN40dMPFlhSK5WGhu5LSW4MUSZJrNT31HKBLCRF lqFozqvztR69Q8lurhFiURKlZYUxkyvFTmQVtst1XHu3Jqm0XCNz7RBpMuoenx/Nshv3vnFM ot6mteX4mrVEh6DfzZOuxKfB4x7iTlgqjOpot2wKzo/Ny1cnB27mYVa1dRgR31FDUPspqvtV XBOnPUbvwUJWjMjwiBLl9G4jpyue7IJC1WiZDWZA/vCAyRcsVxpH2WFIlS2rx7ZJEpfRJD/n 0sMHvhfyBEtL7lqYdN5HfPvianVE92yE3Hm/JUx2BTi6yPAxJU7PdClXcdKMQvsYbQ6hwfZz qajgiXw2XD56NBV6oOQ4ytM43srOzDqgeNnO73t6tn9WwU/xUiwj3BSjwmQ5GLe0wz5a+Jpi SqkPiSGl5aFoBfTxEJKLsoEffuOVd9CEv31M2zz3fAjs/pFlnxhRpytbJ62UnI/dFmuXxYtn 7ZlZSzz5rXJ8oPBTxOtdbUQ72uggJudZp8pvipLSKIoeZES1ad/l/VtnEBqruj2EaOR2jxrO GDlMkLdJy+DJLhSsXUbuvfJu9NaI0ppKqOD1pxv7yiRJ7HNOHiEaxLYJ/bpqzT3SJJLQxuWc G8goPztKrJpRrYq+hInAadjUEw3cQjR0pqCWqKXdRDbr1p+/xVH8Gb66sT5MzC0IGWY5Ziiw l+4htQatMcWkW9S6RY0yLhObHeIlszrdIrO5aFD+vhAevoE0rIARnlibbMJSnLULf/++pXG9 Z3X16qwKlgjK2fcY/zD7CYyK/bnBdR8q/byKGdf2pN/3Qo7oQPdCLE7DMWjaDYoSQ5dgSVRA LkwbyQHrKxK37WwRcehtnVtGLy1aPapTFloC3jVgmBWJs6RKuQRuKndto5au3Yi1G/wci1hZ Yl8zqMFvRlzwdbf5J0KlKpG8F9EG/+KK99VoP1/8WJAQyVLUmiWZVO7rlx1wLYfslBzh03f+ HrW0uyqL/OCNuvzRVJ/JfHGFlFpK9mFuheHzervWpg7T4lDjOrxuRrGVipl17AKXFPJyrtSw 5/UMajt1reM6yCxJkc8W7aeem1nP6P0gBw8dVB9UiziI9RyPaWrJ3FsYVx2Rbb78irkkaaZ7 YpL+H3Qdtwd5SY+R7ejKfKkBNiRSaM5FkmUiwqge/NrqFGuUFb5uQm2vcTky+h4E36Dul6vv 1NruYVeDxkTGCcqzDnjqNbyvAKWlXh0wc4zhKfbonL+7Ktyrib0J4HTI6VAXCKcXiLBJvETS MMDEossW6a4KMR99F7/isA2eE239ABLfm3+gu7qNwbpPeLsG8re0v49wshXIDS5qMwBq9W7P B5NSPrIwFeWNPAT7kykBbrYVh8PUrVfkpy1M4mntoFD0mL9zdsUf5wLzLpGSipo042cXJ5aL RII8b8uLUZ7Z6l7gf+rOxrc/CLYLpS4KZqY30DAv/j7JV3O6udi/oGAdkN/QW+2PnYdKhI9s UBNRaQsDbl3wr4wAwF3RSbpopWEWRH2Cv372MoPEF49KLzBvNM0klfvn8xQEWHVcwBw7vfTd F2iy+kHkskIMs96Io4T9Di+NBTGfu3ykkNoISl5CUSzPcrM+qklp4v2yuT5LF1532D1V83+P Ob7lONIrzrIlUF79sfiXgyX/iESKa6XHCqL71uGwO3Y2dJa1S9lvTscIFAX6ZV+nTelEKtkP Lj0GwP7vOG0ZfhhuiQmM5ufPj1qyIx1MuvjWP5YLSpLuNvyt48F+46MKUPu5MmuORq/66Qg7 WBazH4NVEnLtUEbFvwxvnD7vR7C+ttqwkz0y2JCyUeDfX5mdhktm4JJpHHZonjCnL8F6hTs0 GEuflVbIlek0kc1GZX/eu1+/05Yqd7vqFlKIQUuLNkTpiZJAMhcEz9iP5meJvTy3oqJ/+6xJ 3uarvZBpTcI6C9MdP8Wj/Xp4FurdxR10+bv2l5HC9pbP8TZVgo9exnURjd/mKaCFtmhPL/ZE bdb6DvHs5Y6SOqqnKeKyQpo879fyVbvcO35p7NWaTf6kU/w5WNn9C3eFSsUfniZ5G/gR8bk2 kifMYLPiX7BZoBQIg96iCM27UmL6XopspYUGejIHhVlHCfvoj9uBd/CHHFfEutIukFts9NCO oTaRD7FaannULD6DfM9aznJQnIPLfLv8HFgwD0QAiy3NL+wYchqTzCH5y/g4zFplLN8pHWaK EqRc2XIUpqQzefEcHsc2h8Z0ioIPP+dfZ0JBWYpcSMORx1zy0CrvtASfhjxfY/LUCDSi6FKS IBN5bxWUUzP/wBc12WcmqHx8BIPW4WupJKZ7w3kwB90An3iNnMN8eg/JOvyLZN9lRwpeLgfQ +7PYT9j89oWcNIdqe//Ot7mYa6ck5XEMQ1PtoCWJe/giZ0T31rComoHxruJYuiJ9Kie3Ecya GqbMTjzAOsy3QcpMKIo4nCoqUOMnw70lRz6LncX5K//iXlucMP+C53DT3sZhK0n4oOijmFgz F6uvt9AQM0vG2HQ1IXLdZoSPnRyzrTTjcBc4dyrpW2PZVzWESnkmGR0hCB5EPpZLwthFAL+D v9rXOWMcVExemW2PE2QzCcf+ttfCi/t8oYkAwp0gaNSfVx4Dwl17pVLIwWU8MjmX4JhrPzqL 6YDPDG7YLb/NOq900wJTKQTbYtHzTXpSoDaDDmv3pqYIO0jZ0XwZWMBZcm61plbNzgex9gKT eycZ/u6ZctAOY3hxdUM5hjElwiP0Z1udtJhxDxQmkWdzuiZu0jbrHa/S5Lksq3xbNJEz6R2v nA48BpWiHY/rQF18IlnPPHBzwySLpa8WXSWExylVBCnmhdKAGAdSavl4ba7wp1w8sNiIZrm7 UT4eXyOqmV7fqUY9QWWW3Xf58SD4S9a8dkus9mC4naYCKYiPOHKnm+gU2bcENleTp4qKlw8h m/3jFtKusOJMDYwA/nj/GOOQ7T0PIqNJnfxbpln0jZQcoZp14sEPUm2spxA/AYyd0GpIfClJ Ac3nqlWdCJ3ZcxDKEq+pUY9ojFWL/BTDyx6DSoF9v3rRw/r1Mr5k6ksNxKkIbygcXaJuhjgR bLBN/SbjQ/XAQt6XHU6vdEfmEYFeeoiP9sh6Mr0+HbBqvVEX5k5QszUAYs19TXCpDwUqEJyc 3zE8pUic18IR6AnwVlg6TagLPFMwsCqHTCYOjJMdZo0bzw+qnPNnf2/x6Cf+0QJ1siff5ah5 s2mWutzwWxJjFGdxKk7T/ny67HtYCBYk8nBSe/G2v+UMXuI6m461zvC7c4CBaLqzjBVnvdoa NQspiT3cPt8tlT6WTCJJbBIo91u3etqmXBSfTjunP6qV+LFhNoohdWp1l98HIJJ9m0BDXo9x aW/CbbkQh/y5aSZNrn1mm+JnS/37A7hTHNuQ3A8Nhc30Gk5Q1yyxySLvuicknZPrWqeDFUft D1YRbRCJI0WvuEPx5y6p2tqcMDrtIoUOQbVCtlQk8DnvTPLHrhzfKXxqcFCqkU51tvEvDNUz bBtTbV9gXeZWhAYWwSo9+sB0jM4z7t3lkJU/cyqZllaWY/nIyEao+3/dHZFjYh25aaiLUS7p 3i/pw6hbZg7gWbiTLx2SWFZXvUVj27vgO/j0+yeez82lXpWvlCc6OUHWFnNkMtKM3slzSDs7 SbMvJM9GuvzkRQ5D8zMbRThOMbIxzGpjvadav6v+x1N93DgYP13ebxRuYwUHxKulm26mr3Te Ar8f6EMz67hh9OShmUpPTacU4GDU7yXwpphdt3q2zBuvY5B8O6MWXwW99eWJfPI1AM7G6Ou/ Cxr9uVfqHSMAE8HIrehYP0XUX2VcR0L46aeh0+mTPiXo1wNKhtSP8lZIlKIbmvVeO003j4aE 8FleGsPzOTOaxCI4XqlOe7vv0wcjP9+Vpfolj1XdXSvTYtYN5YqX5pg3s6L6xvnpH52uIOw8 w5V0fu6DFnYPgWf/orGkcBh8ng4u/cGO4ELB+W57OboYkobaD7YeRU55lKEfR8HiBNmyjXvo 4fHZ1sw5WzxHIEKDRzZSS/lXE+2duOJm62ASwKw71xve66FbWzNjs5y3wQBDdDJ8LZRJax2K jcQjWJKCVddZAUMlrGv0m1B9PemNZ0z0u9cPiceMaDwh4ywCzfHOcHX8fhxbP4W4YcS3MPRj Px35wG7YXCYqyc2lQZU2bCcPxz8qN6dfrkF8LCmGfxof8ec7Ds1qTJaG6go3QI0VYTrMX6zE 8rXUW5eqNNRuWJ/2/MQ8ORmAAw8zL7HL7SK4kb38/JQVWNNMA1lIEZaw6XB1I3zfieCid8N6 5x5gLk7gm2o+jAEJv+iGM2Z3gSmim02p1eRoPUoxQ70KHoXSwVRE/0Tg3G/Edj3kuKoyWqjj ZK0IqJmJe1RkcPwgj3tQpZj8rCqZh/lorr2LOzYj+d3XSeFwywmtSKIkJZ0VsWYxfC3KRiiN EJrD/1j94pofi47Zd9alXRoeFp+XALPQqDVRpYaTaQGe1Imz+BhtO05LQowp3gsKPxg4y7By XnJP4BE3lqUk+fJy8t0baJL2af5VXjWjSUBUsJjjsiF0jlQ3aoPchmvOKG01K3jfi8SBUmZx GXmeXqRmlRpqBGcrSOBwowO3b1nh0sD1BwOwzVpEQlRkPM6ISbz/vHS6kDGwP4pDzDVnvXw6 yfe9UHXKe2/eWvWdj7Pv2+9v/Zs6mL/B2IGCx7hgAIcLksPbPIW/nKl+ZDjvy4QkxtW5BahV nSIXDLR/yops1hMRc1gys808X3X/aFGn9PUb8qnOMkjg91qH7vRoK7fmhyz/ALHKwbMd2qzu sGYAfbgqRJrDkqHeLdx5EWLtmUSg6vBMatB3qjxHFwIkUzMXLnVrTYbAH4afz7rMfiKI8/8/ 3sUDCrcTcwYqbuqCN+yZ90/zWvhDW+0q1pIysNfjDAtQ3ek/v/oKXWcuaV5cojrDjdo3ucMt USnEPn+zwMGe2KA/LOM7lzUfEhofntUhIeH2U2MnvKRt2MZtZPUKKrFlnrk01MszhaLKLzb7 2sEkg9TGUnPQdGJxz8qPv01PH5tnmrQPlLOYS3AM3evpROxsLoG2vnAdOpVD8G9BexVCwmDw IG4y442NMfh655wjYQtqQRIEPnXeHddpJMI2HYfEdfcvIHbUwnHzSAOL8ch75E2y9/xNFa6+ jV5SaUZP9cA1T9p4w6PHZGc2hii6HBypbGEebmE8oPKP1q6gZ0GVw9FUVM+Hgr8rgqzvsb8p tAqSulgnHqS0FF/F3e01o/Qek171ueL/xGMHw2pBe3B4DB038dV1Q5F2c7QLVGWUoXwLCVQ7 eDiRZaUKzzDsvMOmTmqmDJqqc63ND4AZy3WVhYtTlRMIHiLlW6An05KrDGs/Rk+D1EnaUg0x r1hGuKWTx7emupiB6ohK/wCfkZxQ7Tb9TrDDSKv+4ZRNQMt9V4TD4/YjtGkbBStnRX/gelwk 8ieU1+7gCiyD3tQMJUYWuHeOv8ZaHaDQpuVoBZlQVTS3addvNJWQKini6+FZM0xoagYAQx9r dF0lkCnpNhsowqedJSBn6qTUx1Cy7T4LKtvsvieNsiGIqJUvpFDIMLStwZad1cljSudpDYZS OtAgMmGnGJHWbPpS0O8+kxva29YvB0sH7zfI8qK4eCrtv95s3OxL3nNfR9dax6y+ZbpXbysr pzmNY/9yx5vOx4mwZkZZQK2qvb1DfOsxvn8/EAR3Gp+zPwiDtsu2+fDcmvNKzxWVcZ2xJGdB umoCKSjILx4c+pGjyMVHneZTJtsiU/vJhu4UTUnhYrOa9KIITxkF2Nmv1xisXxp2FJRSGOSo fyEmX+6HkfIpzBi8MyJw9fm0cuU6168s4hS8sv/QrBQG57/xSmp2at2O9cqeZeOd/Tz0etdr vezDvZwqBfR6efcJujuT6LuS1EcsIlxp2RjWwcEBxQbt4bUsKcOxxIrs7Sd5c7ErAc20eaag X52ZoVsQ0twFH9v/H9+2edj4x8xLGACKlD0ExF2oFPN/VWH0eDRZ2+5e5YjZcmijagjxrtND NmMs0ssXTbThgMjzk3IzJZWkY6/LOVdVUUu/Iq8OTWumKzOx6PLfPs6dtb2L4kQsmvWEloor 6Duy7SJcoFspP3UUJGr9/W6HqsiyTr8aWtbRvgbtbDK4DbvRCV6sS6hxaarQiQ/wE6ct6pf9 xERSNz4rihuDUFndwXbVtbY8k6ymY+DE4wKWklccjbDFB5zN2NxdQ5AfwbZmp5qee3quv18s V4zit2u3yds5sqCXCx5jf7EJO0MDaDxmqfo+CMNVik3YguvPitT0I60Fk5Um8kWrlIY87XPv 93gPt8ShwfIFFHB3CvjOiHk5jj45XLjpZerYdCwyji5RpyrBZu3ZvkdhULxCxQv9Nd8Y4XBR 3ZRq5MOjh00ub1HEM4pvgTinQO7zmqvvvGfFZynlUIAXZ6q47eRX1Oy+GrHjd6yPd2WTRTg/ CmofVPH6yOrXMlaZiIpvJWUe3IiSne8Z1/V8mxaFXDlZVBragHOIL2HS47ewHCxPslBHJ8+H uU2ix/1mGGFWWovfEURBxGOGYQWmRwEA9Sn7owoOaZRxYx8tvUoUrYNKDjvtDvTy/TT5uiA+ 1PDb/Xn+IIyp7wG6fLQo68X0DZmaEeuePzax4Lq+PiLqf7YHXH6zo7+CP0M/GSDoFtCgBvOI ksI2fWqP4+tg0JiDuVHRfUhXil6JpcJafu2BAj+uMNtC9aQarKAkrBPKerW3b21FOpD+zA7J UOsoM8xv5J5C1AF0gk5g0PFQnWAOzEE4R3Fnmsv35iV9lamULZbyNKMxlHesRZgc3TnI94Np P1hvEgqj/fbMttHX4k3Tla1VmypZOtLVQZCJ5OjRMrABoh900AI0bJkzvPGU50SLYYiQZZ15 t2AZciPkQo7d5OdeCwuWCs1z9tNWd7pW0yQ9wl6olH7x7NX0hdkbbHbQuGjAz6dA4Fwejpcl NTzmIyEDRYlf9cixsxfQrqNVN4rTnCOwhKwGU+XG3VLx9tB4uyFTibmWdVNgZ4qOU4MzYA7r E3d9j35/i/Rmvn9UcGL5XkCo+zU6fsBscv65W5fghU7x6oi9425rXvaMrbdGVrHJGsnYBBXo 5QBMKrjHUBE3WUThoeVR0xVGLjLb5KXv9XHS9S/ckZ7UVAcXtqRhDmDgmFXVezXvSX/vzt7H bZD77kdXr+j4BfbUfy5VrCKHm35VMIhq3j/0slF99LEdB2H+HY5jzoVJUsHnJh5tAJaM4e1J v53HNvL4d6Wjs0LcvDK9HaTR9RV/v5yWMEYUOQQ6ZrnDp4qPWz8MBz4RNk/LywZa45TuMjv1 dvwiDgX21CrORetlBx9TwSFuzdtZ03iM3Thlz+5fIIfjhMkGupd/u/84uXJ81ILDGC8xAzyM HmrpUG+PWYupJ7sQouDSDhSDjuVRa518Tsq3xwik1QK6ION0+cj6qvsV2X/59ipSEFS9AzmZ 4rO4+uRaguXrd8zXwwFEHajwEIc8DRHMw8QN71aPmoH66SsQyGGJNnQlivrKJWh968VrVE0G 9oAzqCcYoZlVNTv6vU963h/wMfgHtuNue8kYo4Ix2ku3nMMl9hf9d+SmSLWfZ2fWpzgTb195 1M49S9ZAR8EBUGk3wNaMb3pfBCilD5NevGHEFJx+0rQozZXo97b+1MCSgzR6dBGBC7cOODbA ZIUrNh56b9+onJMBiyI5YS9zGQP4/tV4FZ/8/hsoaC3fjkyZ3LihP1HgMKNffOs9ZYI6Vqn/ c+oaeeL+fFZuBTELUN2d5uawhUtUd1ndzhHPeWr7ViZ4CBD5+4YqgOIL1JnaXRePlQBomfyx 1bYL62Z2i2OWwDFZ1dX9XO4BdSpi7HMY2sldGiJRmiCcet55YALpDg3bCanWAtmE8NUO6kno 0owbcJnq0ed150WflwTQSIqcWsJL56ClzDVdUpeY49RHJyuyoVd4byWdhqdwxqIJ+QV33P+s r9pupLH5zNXoMklz23/YMwMizd6MVwLmrIX2vrJRP5WPRZX3RcYo/FOBrrCLVkib4JLnelpg aCrGj1Eqavq02zXfzTPOtE84YkMLJzCNpew4ERhJ56qMJS2v0HdnVEG6uDaEbGe3C0ZGYwZ+ LAucc7R2dvNXdfYT4yaX9IUyCmuAGUmfF95ro/e0uzMMKrxx6MV9h4hoEcFZ3+oYGMGp4aVq MR9ijaTCoMnMaT5IN3xdHJWiUrfgZ0ZUU+apsv1yYVQnJFZdTkmoSqjabLh8dt3UeByM+poD Ff+OgoBVa1SYuwWL6CZTEJiEgNiTod8FCZLKM7g/BO87LBD1MKdrR0+oqBzJyBBm2wdAFdrR o412dW5LOny1cxzgMFJHQ3p7V5D3pIdap3ScJtXZFzGhuEMheiR9rNoWAwLKygpwdVm4nIxq MOZ1evi9w3a6GaXnkOBAviT8jSniVAd0JHWhVPwGTdwmSV9ArGdLkQCbGAPIFT7KV9NrdV3M DcQllyWmtI/qOg0I2WpBRLPVRKh0nRdGHELwl0oz53Ejo+pncdnSUELn+B3TfE91SNNBWWyN vZluuZDSxVULpdSp6ejGszwwZaVSgPkKW9HB+NVDJPyqAdJ/2o0fVont3CxCrO4uSFVlzmfv crGm9/C90sOXaM608SGtUNW7gAKjnoGTkczahNKv2kQBG4icOaNIfs0tF6WfEGvgPlVQdtlf KlqRwEkCsRhQOtUd4aEGExTVW86uZKR9RbcO+EpHsjYn6BmtIXysHeJOHS3Nxq306Y3E8qa0 dYkoSOvY0WZuEFUqIpg8ELb1B+jPdKiNM0dOp8a76vX2LTkNVUitxF+w83O93KKcgTdqZXN6 j7kln9hy2FIQMMVh1wAQvOfGtf9fAIkBdv4Nb4/NGHbdt0ncNjK+lvqVp2ZSP7jxvQxOqt4q DSLuAXi0DE/1YC1DCIFXI1ap19bONefVRg7wW7ev69p55xV4vIXAfaVBa8CT2G5JzyUAoMee fkNGi5M74LwQBT3+Wf4EMsA3UPR6c4l8q25yYLcc/qCpt+lY6A4IdMHtNX4iLEIgEwe1QE/I jNe1Ch4GMExUoyXN+cdEnNiQGOPxlFh8+9wTs02f6GQ4q3daKZJxml2snNCw7v0zK5ptp7uE ZtwjMuuRe0EiB1vjzmA9CllnZ2DyXoqXLVaw/YTao0Cb7qObnvMtgZUi7cMdFv10L7W6MBgG /89MV/ybk8frXUixdJy1DZVJcdc5SHfIikF6nGusBa8J94fI5A3rEu5FYP41CS1YviZBQAK1 0YgLXm66pglwv3rJu8tlqZdtEviNGdtcyWf0s+L49sQe879p8UcHgT0ZylZYj/86VLcfbhlQ qxkMQ5sOSXWF6wv0CONrLw4SsNrBbfG/gFb7K1U2IORGhwFa73j+DTYC5n9WCmVuZHN0cmVh bQplbmRvYmoKMTQzIDAgb2JqCjw8Ci9MZW5ndGgxIDIxNjkKL0xlbmd0aDIgMTYyOTQKL0xl bmd0aDMgMAovTGVuZ3RoIDE3NjE2ICAgICAKL0ZpbHRlciAvRmxhdGVEZWNvZGUKPj4Kc3Ry ZWFtCnjatLplVJzLujWKu7vTuLu7u7tDkMadxl2CBHeXIMEhuAVCkODu7sGDu31k7XP2Wnvf 8/cOBjTz0Vmznqq3e4ymIlPVYBKzcDIDSjs5gpjYmFn5AYpKGqaObrxM6kArd3tTVwA7Mysr JwIVlYQr0BRk4+QoaQoC8gN4QNYAFXPQe+Z7BCsrHwIVQAboCHR9d1oAzLwBSkCQqaa3M5AN QGv6F1B1cgMxmZm6vbuBjlY2jkC69xQJJ2dvVxsra9CfGhxMTH8q/ckWZwbIm5rbOXm62dkA TB0tAPLMSswAZSfPd6MNgNbJEWAGtDa1twQ4WQI0gboALQ0pdQ2AjLqKlqoGHfN7YQ13Z2cn 1//hIqGhqSXDCJAUU9aUAgC1GQEyWhqaf/5qAh3f+VsxApQ13/1/+rwH/klXktIU09RTlWJj +bMGABvAA+jqZvOn7X9xo35nBvib2nuqpauTw18NALTWIJAzPwuLp6cns5W7G4jZydWK2dn+ L36a1jZuAE8nVzvA+6sr0B74lzDujhbvcoKsgf8q8GdPAIo25kBHN+CfJGmnfzkd3qV8T3q3 g/5N7F0I0J+a9v8KB7gBgf/RxtrU7a9cRVVVRYCDqY0jCOho6mj+HggyBbm7AT78ZXv/BVrQ /IsgECDh7ur6p4fS/7pc/93mf6mLO72vzNDe19/U8793zNTR3c3nH9r857LNnRzdbNxAbv+q CARY2tgD/7B3+7NnNo5/2ZTElOWkpTQ0mRTfB8+RScnpXR1HZpAX6K/oP/XEJBX5Abys3AA2 Pk4A6/uQSjlaSDg5OLyzdkP4I5+kzbtOICdXb5b/Hms7RydPR9//j9nSxtHC8o/uFu7OLFqO Ni7uQDnJ/wl+NyH8bbMCggCsAKALAOhlbs3yp9lfs/LHzPbH/C6Cv6+zkzPA0tTeDehvYwl8 f0HwdTP1AAJAru5Af99/Ov4TIbDxACxszEHvY/5+VBD+qi7naOkE4PuX+Z3J/7r+ZwBo/zqm dO9n1MLJ0d4bYAG0RGBRdgK9jwPt/z+n7L96Sbvb2yubOgBp/0vR/w4zdbCx9/5n4H8F6AD/ MKVVdnJ1MLX/L5+Nm7SNF9BC1QZkbv0vWf9llwOZvs+9mKOVPfB9S/4yaf05SvbvM/t+79j8 ubYATGx/RP0P3/s4mts5At3cABzcf7mA7yL8F9935f+wBbBoyilqaCkx/PfA/BUl5WjuZGHj aAVg5+IGmLq6mnojsL5PATsXF8CX7X2cLYBef40JgIXZ0Qn0ngJwdgf5AyydXBH+bCU3F4BF 7I/pX4gbwCL+N+IBsEj8jXgBLJJ/Iz4Ai9S/EQ8rgEX6b8QOYJH9G3EAWOT+Ru9VlP+NeN/z VP9G75EafyPO94X/G/G9czH9N2JjfU+0+AdkA7AA/w3ZOd4LAU3N3UF/27jeOVk6ubv+I+c9 yOof8L2d9b8h57ss1t7O1kDHf0S822z+Ad8VcPgbsr0z+kcw2zsjp7/Lvcc6OQL/4X6n4/y3 mO9U3k+221/D8nfMO6O/+XK+C+Bmb+pm/Y+A990C/b3C944ga1fgP9b8Tgnk6fSPhPca7n9D 9vcM73/Ad04+f/d73ygfoOu/sv9zMFX/XMp/3Tisf0/q/zyt/sIaIFcnO6COjcX7k/ofIUqm IFcbLwPW9+uC7d3+/vO//xn9RwOqv2+6f2SLizt5+TJxcnIDmDjepWHjelecjY2L0/8/cs3/ 9eD466p6P1L/i//c2gAg0AtojrA072QuEGab3hxeHiBVNFkBTcXHfFKFI6wrnwi1lDX5jRBP smCbHChSHNwalE1d7KQoy28UkBrs+EWXKgzb/nW9LaV64tpCTXTHNEApgBBFSmwkX5tZKyRb aTGooouc7lA+v1CvlHM6uz2xnQSgNXIkwfft+0Ms+/gb+mUauWFF++pnaM+SWbYWLFd7DK9F NIJOwsXJTnDQ2wNWfIxpj9gS/cyHwnCcEXkY5x/fMferjK0xeDngSCAU0/nRmI27MsOXdGGe VnJnCbuGDiPdLYQlZjPf6nfjdc8CSzIkWkfhmWqbPaCWfitetvpNQ5DfrmZEB4nFx31rhzl2 91w1mZTh13o2a2tcqWz1tBEzN7MemL2Dqr0Y1KPZnuzm+tiMbLQ66UP6CyMSSvBVxvdEhACx zdJyViUkXEYsvBME6Qf4SINpCA+dvj5IlJ9htKgYmcXP3hBkkAUUDLZXF8K6JTOIMtZBQ2CW qAZwKklVheEf0u6upm/V1dNqQ9QL3edhZeek61fq6ON6Miksmg4uE90mV/G064yqtY2EaMNO bIhx+k6mye6nS3hRfGYqqlw+FRZGE79u/HaCkFOv5gcmc7KyrOoBduN7/iDA4aEs06RD5UYl gsXXk9w3MnWO9/yQUoTJ6kwo3XYgIIiz5cx9dHkOy2Q4+qk++QTbxs+1O13bKOj7MkR1so5E wIcnnSvC+S3XKCMUDAwrRSzwonGqzP3xmTMEdHcUMzrdwYi9cDAreoJr/t+flzprbbACTAVN UTD8coITShpuHopGfpZ/IcZ3Pmc9RTYTma/YUZpiDsT4CgEl3sMXFOKpBZ1cfQCmoNH0jFhH eRMFBOmHYLNkfHh0ekv5vkHrE98DbP4qRjBxVgLYhVjGrbBzgIdaXK0rcUx7tiVyAyuWMnF6 +PSF3Jxn7tkmmwAe7FxOSmhCZGywaCe9G31oes8IiVaKzldRVS9Qd5ABUraKLtF1DR8X+8dz 8HZ7Pti0nRBrBpgl+TQIAeUrSIBkvPrgwcYv0IscWBKj4B+NK615EijQWjW8QIeLjIZqVKXY MopyBpo3+/0gA7GfxDPWvLN8+dNYH21tjrmeu4emd72Szdhw1zsidh5xGF9bqdh0+8Sycn6/ MZWRrGdmx883HddQ23pF0WKMqEfEhXsdxUKS+6dnWNHo9tWy+qVua1Uud3Vcis+djhbV9LwU LS0yQggeQdfYmbDR57xPXL9hX6RzM9KwJYEdstRJB32yAaTu5P7ACbQURhpczPr4TJQEJLKg EIXazt0nj+Q8T7YxmgyKnL4hZVOx4cCqJbuVZx5hEtKISNKFb/y+GVenZlVsGE3xlVJkap49 QTppLz2ipW+5EFk6TDtGQrnCwlpZBorFzgguk2pIZzO4JmX7ZbOtdBfeWsFkeNgSJy64R+2+ ur/yn6tTqwxEJ0XKMs4faaE264a/rmU/zHBfGutkdnASgXteIKcL1+7f3c/T+kFZ79Rk9nie sFRyFrrEelJZNdVl+ky/woHjEui2SWyglNTqod2yGUkw1XTrfNw0JQ4pcsrvRkZKuiJhhEox rwm+09i+N6+42Q53w4fh5WQC1RUkRob5ktEeR2NmmTScXgJ4nueI7W9WSRiITo2ybSobQNae nnhoQhE/tPihMRPPKa1szjK/ZDUmdPvkr2r2PJGaaxyvddPMJBnMMEWRZXlGCyqoZgL5i5N8 JOGXqHEHSDt6Czn0TkKqTPWwiDtCIw/NhKa3TYiWs/gRy8P11fuvZ4jkhMTjif1y01TPsi2J +Ex22hCv9usmrwDls/f35c6sxkdoHJKnkbqDzyiWKl8CjJ++JIYiku2kGshJOQaI0BXFpdUl f0z1rAz3mkUS0F0svTXKLs6DkOlx3z4d2v7xppKnhm1HwF0yeb45/Nx+Kf6JV7eDIxDFWvzE KAfZiCqtqitAPiJ4shFNuCOp6B4c13c9e810O/Kwe+qlx+8ujo8KpuKuZLCQBAYy0CYMWM8P 1ss25iPR/SWAMvZD+tWSOMcTJPV6qPqHQe1sCd/kV62FnFRxid08psDOngkfOZpFMS4J8NNN hM7x6GWOLt0uloBebFLVjlxDZNuJ9kdM+TNsG1wlzA8D6MWo+6+qMSve+gIvo1ZeybZsCP3Y 5HoLG9UdTxipA7h6dEUfnuVazmdm4axrD36zN8ACJaRrn0wp4hcRbzm3D23hOLzQ3CRfTugx KU+9sIDT/XKoEz1ELRDKTPGysJM0Qw42T/3U9j95p3t7GcSM0+yr+siWNucJZqjIKyAtXbIV SpmK6B+hbBg2VLOP3xr7ClS8CviyprjiDT8FKzZ4Dj5KBg0VKrrwhLZB6elaxjgFLuOVMqFh fjycPMLFr1qXAKenryB10YIAfOVqLq9lCD2jpaSbZR3nqsBGtmEULob2zFlHlO4InxGcd4DJ aZUpwqZmiVdBl0VYnSIKknHfbUxPH3WB4cWygeCwpk4k3qsCRJ4a8VxdeBXpkTA438pUZ9K8 mJWXupVQ8SKaDqxHjICQETd2gzQPkrZ+/Qqd1jRA2eQUIr2zOIUyOkbMFqwoS+C7lFMQkITp KfYcmTpzr+ccnZFCY9R8JYfDpPM+ixB9IL8AVCuStGUrIqFu5zlM801fci4QV84KSmr2dZG9 RJaz+3HDL0bG40pRJvq6m/ojPLu31ykE+21XJ+49xbgZWhOasiCad0zoTasvRRXK/RrJm70r Xgzyy0/zO8rAKbN7O+qhsLNFN+hQVKl3oFqBFfRCN6sj8ZbrD7i83uqEPx/zq2L0RVh70x8k 0wgTdPLiqWUjVbn3qC47k/HdEilYHPwqGJBq2h3j1UpL6f7AWlHgh1RR4s0+uk2TEexUFYSa CbeWP4ZYocceza13o6fVE2REX2YtF3pmPUkHYKy65F0qhtti4Gehc465rlVNcZE9szL+EsLP 5hPRmBuBuZEuaF2lY9S/wfas+pxE3+lDufUZVZD5HlRIfUrv4zUWc2uVm4FS8RMTf/xwJrZv 0KzBF8yyD1HYttIASnRx7aXvebbOBiRRnv8omXjZasT2iC9ErwZzlRfr+N0SZL8MPAST7x/N 38VqG++goJZC/Qo7F3jW8y0nXZdJ64sWXCZaY0vfW9fBkh4PDMm371F5BPGKD29Wv/Ebn5sJ iqUFTWBEziGrfJ65iWtYXo349QnIi2LIUs7aRdCsyiuSs9bTDYP6zBzsXvOXU8wyFJNgsTfg A6sC9TMckjzt7hKqOufiHTP0VdL5s+RRe3mdfL4eeBp4jArYDeUVb9O/9DUYY+UHfNXv+fYa MkM3q/7yQGOCD/dVSgC2ER/chHDmrGaXUsFFTQ2ipr9b0dIOMWNSglTmosxAKc6YOj7ZFg27 ltIIX+n8U5mjljzjxxXnS5YI3lf1UipGctLIizCz5OsbO/hAHbrEiiiEaPsWQNmbOwkMdfup t9FEcgQdmaL129nwUPoJrRNrNYTUuWxqM+L1YkPtZAFEw5fdR3QxNjFkzdNOYhv3bAtq7SWt apy9mgPZX+iMgMPPbMLyNAQzkerZ3XcRbXu6FX3Ex1OgXU7jFSpLTXMJPg14ez+kbk34Ybuk p+fQaw56o5a3j1Wbl8YTrEVDyKzpxZxjl4VVwweevU32TYX5iXkbVCnl0eC/dEh7NNx5i5cN pX/36L9Ro2AmmqojGeXUzPtn2CyMaod1IazQKvK5zJQIftH4TsOFYXjMhAPdbKCl+uYe63OG Al07rpch05b8I05scuxMVODIAjKhV+Pa4ugpQ3lJw/gMWhVORT6JW/a4mmzugYyv84L4RNUA H7D3NZzCzpLZ4bXmeQb/h/Jo8KKl6IJ3kskL608omaevvUWfjVftI7gMTfziQ8iUcQk/XViV uupBPPCPrbxt86o7R7LzHn+1rBxVcbqce2TTlyfK/mA1HSGjUgN10PeA3iDdeqJTvEy9iMx2 Up+bWWjHcjxnPZLsSEZlvzXe26UMG721VxbSw76S+cPHEeR/wcmdRWApPBLkhKT6Y00HBWHs WjNfUd59C2NE48GbwrQIcTPvZDG6OkyPv/I2yo19u4Bpn25De7Q/pakWX2j1S9QL3rbZOaBK ogp8JXreBWKLnWUy1haL5mzlbttHZ9yUjr4aGNLwxfR69tPtg9pdYp1S6MVGqk5aJ/YiZz+X mYd6vrEwNXsO/zE2AifS5c/mAxkYcucF8ayZ+69mEG+xYzbR2poyapwBWUXq8PVKNG7t0Awy RvDH8NK5DK1Ovj3srWIEOr2iFpxw9WO9CcE7NmE/NfSlVZvof3IHZ4qQS8V7nCaZxd1qITW3 3HYsF7hjfxr7BXbGNY2wPz6A1wfus9Y78y2QRG9gH0xdw7Vzm+6C2zkAmklaEoEXTiDnq24+ ecvOgnL7/VdXToNtx8oW/0XswoGUTqTIhYHAOng/O+55OT2cF5s6j/2nEProWE8xTTae3OoP nQwdzFjgumfwOF3Z2vPgXHctKURjR4jdOJ+WDz672A0uQXpgYU/f8Ifbp85+CYtjaElHxrV0 flFtiT4WlmyJUWWzN21+lVXcCzkObAyVR3Q9gS/PCzMPC/4kuSe2uwW3sbd1IAv7PYhryG1v eC5PAazAUGq/vCMnrZYu9/vFhGTEZjn7Neg08WyD19G/TfF0oHnntAJaWQ+n0VqhUOLGaRLW U7BIs4hMIIJEScMFrG8RT7zz/ppdwUElGAYMJ5nVEXeDKS385eIcgz7SgX9e5CoI58QSyz1B L/RARa/1xgXYECj2Q7yEE37NSk+wO5tDdRcmqqTdSb/yah+aH2gZLMa03oeQ0zVy551cH0jR 19YNp6MEG/mwRGNawmdndTBE5k76NBnC7IOC4FZbQOikkCkBHi4n7qbgZLsw8+ZHhew54CVq wh//m/Rm+vHcMHeYU6R3TMcvCNgNh50nGD8leNic52OEwubq2Ps9fykGYa+dcHQI9Vf0SzfJ RQ7n0JdITcipGNwaQ2rKlyl/VYcxc5F7/VYOgx1Xqtc1eZ8YccR4HaHg+1QoZzbVaivBmGsB YopTmjGTwGQ4QgZ4GspnVIzcfVcKoHbX7662bBlDfcCGDyuKf7u5c2OweItMI48QQ2DMz1NS GUFn/Xptzot0Zw7psDFnOPlDZgH5pAaVJzO3M5Vg2uc6ehXGWEyPiLOhuUHKwyrCIZMJt9Jx h/QeU9brXwP1uyn14GIfJj5CCKPi4mnT5EpcrI52JRSQWF1W14nnKCX/bh7olbF5RrITLeAL LdVUq1N/EbKhfs76AKK9I10w3XcxQUEUDntVg/pEmvrjkwpzr6ipfSgiJVG1KUqYcbqR6KPb jY0mWsFSJSRNN7ye73rxPonLh+3DRdWDL+U26+Zo4+QK9mD317f4grDlny4KGrrcD+MdXehw u/yVRuNM/LSEShCHR/INsqhXIcVxFL+K47yscIBAk3utabJe3RS0naxhlB/lX/iXWGvlAjbY 3KRW5lSvZ8pMjgGwm/mi0U5fRaPY8KxSR54UD42sdwZGiOVjP0/W7A9PZZ7+pgFyUJIZ0Wo1 p+o43xOpU4pVOPWAociWho1Pdx3yGPmvrBYNpnxW94tuBciTEEOVOF7lQ8c/L2xFAZyA1rgC MCTN89ARvW8E9ui07GCt/GF5jaKjHoEdkrFEJyP2NwS6y3hifTz0CysCJiF+kTp2RHpalB8k BoF5oBtk4/hVTszI6magwRkNWknZD6TGWAfuI8delIqKi4FzzdE1XaxqETWeuxjcEQCtHBYB qUl3d/gGhMEsekV4E/JZN7GttDVTEEGNR/b+dfa8ul1eNXnvxy6zXyfrwrsR27ujpXRvKX1E 5x8hjyejRM7HpXS2t6CXu8jooVCHWUvaoHho+QgLacmIYCrQ0iiYPCALbNfVjyHrTCwOF0e+ 5aCuKhNdNJomsCwJtfLEYBIt5hF++Nq5acE7rsyMwT+Yn0af6Vq1Hhr34AAljHJCmBuC9CBi 0t2OewbHL0WcNB3BKrfoGlm21rPQiby6rTIOmZid+BF90rvm4/mFOlyo2S7bnNduIU3uIbS7 kG6p8gc9/Bxl4Wc28IWxU2kzt3oXIx7DWfByyW/EaNgvtqm912Z5ndGE0N+WDtygidxQRhxR weH0C3f8Tl3l4W7QPEGxpAiphHcKHnL65d1FeHVYS6icXlwbe6g7HssJ3oXCER58TIRXpU8T zCwndzqv/tcmePvbo2l+qZfE7bCDbQvz7YgbdbyWL2dIhIcCZlVy5gLasVkFK6ffTrQyfyr1 xzSx2yAqtJ2IrjyTjv0SXaJCMAsuz0zm+zAMv5PHrAlus4WRdc3rbAT3DQpXiWgOgWZJpeGD bFrKkMc+cRJWF5x7WBYXnFSwrtvujLSJNgljFTM7tR/cYlRS0fwdv4H0rUW5g+0pU489bTFk xzAnV++Tt8thiaU33G/wdb7X0JUfBXZyq8ZZ+S8aitOzhcJ+H3lKniczVftzEb2l/U7dHPK2 XgfK3miCvhf4e+LGoz3LBNAMBFVBSGbNUGNFwWxskvf0nNtT0hU5nzsX+0l2OvyeBJm54vFG Y9I019qePFolMIGr/vbr1sQa08oH1rnGvi59FuZLt89sCPqFYN7BECn+qINV+7B3g199nezA hEQ4v6F+82PxDIZ/2fyKi9g4mt5gdDpMFqXKxS5ihg6k3h7weTiv6kRKAuOEeBwRN9JXXpEJ QHaawVbZaWP2ML2cZ12sHrN4rKDA0/9DI879h+RCdTteCOrbhb8wJvg+Parxg95gZi7FbJPg YGBKZTViRIzB7TOo3gwPoj7ns0P7ZOH3LGyC8wGtVbexg4dWQ6w3PLK2KwPas/AeNg6Htntv ZJUClW3zw4VrNl7TxkX67khX4kyVTQk2GrdQJSZSqL0yqKiVR3EO1egmy1EoCZkd5VL6rrA9 CdHXkJbNL+QEyFq5WpTur1YkFgVwg/lXzCrk7q80JzX74591D/N4dj0FtIkMp3+jBSv2DDDR kXv5yXXPJmMKYoovVFv9WCsv92abjn4p1osS21+J9Z3FQG6iZVI4ODoTXyD5pfOYd/Jd9C4+ P6Er3CSoNi6FEeGTFQeTe3UtvrBxNusL+rmS87b1xWxLIcc2CLV4i1CPOshaRJQu0bWKX16k 3/2HWWxpd6lpKM0E5LArg5yoA0+/frZc0tlTjy8/nHQA3VSAHnufhgF/X/ZXDrRvpJ9VSDcp AsvF75zQdWRROZzcJL2xayJ5zzpLFpqoeoQZvfAlZXhIE1gV+sMxjLJEKs/DgubbTAhc9V2d tKRyt1hoEfAWuZTl9Rrvno8H7cbC7VeweQgKt8VYxGdDvZKnvwNwJuLBlBx4ulkm/LgjxxrJ CKZE98j5XjYM52NvCivgks/yEwM/eC7p4OxVwdqap6jqPK6TK1G9CcTd61qFM8Q/ulgV5fGE 8r80dpSHgUUbHy1uUhLwHib3Szt9hkpTMyJktEjiPhaZiaC7PXC3ovTRaU3EXkko7YPSrS+I QrAQ/PRWIuKl0et5koXAjDJdpn3wwVox0v2OazWfzf7otj1SeB48M2sM9fu3Cve0dIzW62wL CSvK+K6rpCIvQQQBz4+TSN4uSk6nzhZGTNC72W2Pi8us5gIOhp2RRkMCRDFx3tS3i9Wp6djB bkmNc/VJxBucamW2x2Kc6KXptrtNWQNVTi1Eove/x4q4qbILJrGJR0Roi0JzKgmHCHs6dl+d APZvfBDzcnTfO0AjBD1njZR3QkQtavEAdzCubCCxrC5yudfrd51Qbd2wBl72vQwuBBkkLuNl XOC2UGaimXw6nZU+2HfaVOHKVrZSzeY8j8C6BOL9cYJP4NY2COSS235WYCIl53lQcA7hZ5xr 1o6dMiW4HcHZux4es5lu49Ta8V4ZhLKo1uHSJYP95q2PVVddALdRSLvPq7Fe2eHkjrxfV/hf 8JJw9mnRZCyX2xE4lfr22PIhofHzjdvAe4J1ZX4CoIyQRycmLnuVnfUICLCWbM3VGMYG80Sd ihxOpDjGEFSPwvKFnzPdnDRIhVmweN8YMya6lqZafWIHiOeDWluPB812QyyExm3jGjczZz8b fMhjtVgWgaJbdIZKu1LW9NC/SoK+v80SBKVHBFCIY0Bjn8m3jBEhp/ss+BTVZVWXVosxd+NY Q0YQrG+P4Gpge3ztJ/7m54L02ajIE0nHsI49sIhgRWljjTH9o+mGazLd0QcGZEYSFa/z3s0w E7b6QgfnPb+n7O+XxwmxifVS6FXqxthHzA1RFqg0WXLu4+4sTIJ3lrXxVrLzsmTHTEfTt3MC dwSNIFOlLHEs1BpMn0DZBvZZBv9QOuSR6G6i71YS9qffVRlFMX/0PeVM1XsUTSOiH8It/cQ3 ihXOXn+yFII0bG/wvVFZggOiap5OnAeSrsrwd8VjaWBrcOVcwMT89jWmo90VkvdQvrPFiFn5 oHaTpFhXbhHS376iQG56b5XYKFGdC/6F2frJNnHC/G2GQbuvLcOEOBCyDktU29LlXH4Nrc+r 5X6pxEzWJ786ltHjAVOCxCzbTHpZAVfYNCJH9rZBCaYOHbvnbWfg+ZQiToE8KMS8Zda2k4rV HJUMS7Kgeaf8s7No6LS/dkJdpMTJLMBvsh1en9DxwpJAqdTXVfh3TdyD6c5YHSHPaSzDCT8D OrEdp7rIRbxbLL3plJZ+Rp44l0YPtFtSqKvsZhs7UcWi4GCReY8bWbfh0Gts1pQD1DpaBM2L HxhpP4RONa96sSYDpcIAycdb7RLckesEGFeNALfOY6RhluW4lyFxZaGUQOHkfeu9lAppF/yL LS0rB7SyIj2t9hVL/zrwoKWaInphpR+bVxS26DBjRNf2l6BPQmathauC8719D14aUqtCPiZw xneorcvTO1NqxIMxVnVKGjSoaaLfn+vIvkGq08Qnp4XR3yB2TXbstCPD5aF3Rp+kun3E3jwj vJ8FE069Z6shDixkwP61PDjQ53goVMu1n1o4Q5a8yoy+R1JxgurwyjQilVlqVAfZW+PiTKE6 D5CdSo3l3vLgnCX5sK1vYmhsXjYQG4P0cxEOGi9F6KLD7wQ/nH3ULe/4k6h7KiGew215M7P8 K9XpwjhKLfNPj+9gei3Ya5pm7axrSkhYumLwtLsRqUPY6DmbO9lfzcviyvqiJuhwDz6U8OXR tzobhhomd5mUjhjAPshIgRBOSUskHFktc5aBIObJOGnN+zyh76aKKcW6tNrtZLTZF5vMsLKO qZwOWJifhZ0DIkf660c6qMV/bSfpsRHj/a7nDzfDItv+us7PbZIp+xmbIr/ViY0z9ugUIYH4 fNTtYJXfMPekQRdfcnSCgHJW+RPUNyE90a8sef3Fnhkmz2kjOBrIEtyKDFE7CJV+NRi/Yb/O w9zF+Bk0wHHzRq/6nHSjmVWGz56ZHilWUuQ4x1CMZk2Vg887GyLGzZyzcaddtJCYZyeI3A2j E49fMrxUbJY+QkIWUGcjXghYZo0GtdC2+MCepQFIDYbwfCNwaFAdfYryaRPSJdfoUT4qufbo +tpX053oU7Pf74eGgztnyPH44Jan3Q4fpn+IRUXAvgqivxPtzPHQNS1XTWoZn3a8MM/qqf+/ TiF+zZsmQoRr8tWb49Kmthg25UUVo/A39ggI9ND2h8UCSGeednYi2HuaOgsJxiD7z7L26+W/ UQ4b3eGiPrp6JPyoliTZuS8t08owBOfVkzQJWIsap8fJbo9Fi1DPJzJKUc6cfumPd8z3HCxQ UM/pfw652EmwRcdYdf8p0cktKZoyEnAyzNwU9yW3puI0oAm4AWfydatLFLIcBzQRls25GnzA Bn3ZllqZfanGXtiLDa7wsSWC3WysLo8LLccGr9HczW9O9sm99Eqjgz37yfOpmw+G6ISfxebr 8f5Ek66y6I/C03yz80yOnxdr+OwlU9Mxb1HWEBLyw9+rZAfVzvt+r7kOk8Tae2kXdVF/DbHQ EKEtJMbMhf42P2G5B4JR/twf+9vGrCY4DArhCfz39wCs1OZgSaHXO3u/wpYwj2AYpcm4ms9Q lUeiKxH+g1+UoStFJT4m/sLzf36qHo4s/+AbFAUkdlXlmwyVpaTe7XW9HA0JMjsDc9XidJC0 OcHvykZPHCc0C1OVqMY9YIzpKhoOJwflLMhii1PYcTZJBTjKYhHrHjBRfgI4Bp32f0oINm2O d0B2RG94pY5wZfX/Yb1J4q0YVj/KJ7leL3bxkmXStVd3aYYYrFJYSL51uT9LWmGETye/YCYM A+9ZmcTBEUUIytlLTuSIUQP4gp9yN4mQkBZAnuOLtCL/0mcnW/mZIP9bAVzrs/8vjB0N8tZR eYQiS5aOhw799oZMlVnY2yh01+Afb0KQa5wJczuXF1tq1/5MfAGJiB9STaRrd9C86KBcNSQ/ 0vAFoK6Whyi7QEzSIaBogRkiGtgE7ztxvpkHx5da4SJHXFU06N+Eie/U49XuXu3S1ICbFTm3 DSZCzMmXBEevGYTgYZhG9qmRMI2H9P0Uk3mhvz/4FKWWWsgz6Vub8jTtq3N6nXdbgX9ileqa E+sEFXoL9ZvTWJ3+Bf++r3/F+cpcdFHMn6ZMCAyU2C+uaiIwNzN6UEu+NSgSNbdmAduRMaHN z4+DHkedKYiswIreDO6rPCaFwbWA6wyRYU8NN/Nj/aEgIlZGPocj6XCK0LBPc5foJ8mvcz5E xt6PthabXY3ZLM898GzRYeOXev4M2rGU19fo62b6m0tfBVP5P70pE36+Cj7x/7ScaSATouGQ 4HSIfih9KLkwX2sbx5OljVibb0Ew+wM2z/oETHQHkU2LIjzgPNaYeo1EYFG9ABczXjHnXpwy Z2jrKuUe6HGZ1Bs/z8Myj9Wwspw3JVRcz9QTb493jYY29dPEduGDQQGcpOD7mG4fxXKehuh5 1R6F8he52EAwIzhrcXcQ9m0U1yz1+WLUyArzHFHL8DJBlk6Y7Tt5o7g5jKnwPK9pjMPJUR5a kn3Ui0Zxv/BytE5C9theWjzrhEIkHJJdMVA5guzgaVK919Pw4ilsQe5OiApbyx5ASWsgEtzt u1W68r49bO5C7Kh7hQa7vPCARH375GiVrqftoBvWTcR9tRrxpnReQ+0LVHZNTHWL48Kg9d93 pkbwYKP8Rh+U2dhZ4ReDme2KwGhB0RshmowJCM+YcE64rexeGMHe3pi+VV7QxyJc6ncTJY/W 0X8LJF4eS8Z/vuGTUBEtY12bSXoQsd+iUzATI3G485dXmmfP52CjNf760QBkk5HbyRdAoIrc iOtm9DoJXhaxk0v63J59HF1OoUoVo92UiLNXUFwDDuPCWzA/YVGqncJ33MLHDGPHSN37Cjft N2FvHvHWv3d0fFCVLPQmf4V3Yk/B4sHzkcq4tKydfr1H47XsEI44z7HWpuI7lvBKQnM6cj9B ewpbiOjFuPpzpwX9o9oPhhBDM+WJ0V7EarIUsZegOoaUnjdNwZNJ1bVgMg+Uu9pwLPjrdb/A nZ5y78mfEeKUY8obUbdwByqjaYoIt2YaCt3DNSlrJzshU2Ubt2qXq+gIjatPHLnnJmfhbqua Z0D4SUanM1p7dXvwVBy5w2uhk3qjbEJcRS05mNNvZWRY5Qvottiksfn4Z+0/FjyiOuVfqA0C HZsLh804nyUXEsQPsSyxaD8md+t16319sUTzKIa1O1MR8ZRykNnW6XsuuuIfBSU2YruDDZCT tyoqevfMWXULItFaq3LIHBFIcTbvxbCJGEEONGc+nKL0WaR/VZJSjsa5gXt6g6Gr+qBOk0o2 /UGXBKmGdnlMAbJDBXXkuOOIDr5IlK7kjOf36VxvwsOynW9tOJGVSN7ZaGNy+e6XgC/9J6yu i1sGkDCjP4+T9W2+GFd5nPqJX8f/kPzN4x+MWJrAyNS8OnR9cAH2xL+PdpeQeHQ9y3hbtsgk PZ0wFu9zH2Z4F6twOHC5uwrGQ8XehXB38YoTvZS3Slrp7NsQvD3Rn2uNzDTbUOe3kvJVZ7Oj kRi3Msfy0VmnNRbim+OkiUDI9OmJfiPNRxelvu3BtY/l/MwfTNveH8pDQHdBKhfB6/nIQCjz o7VF8r4g+0w0CAzzE7HsceJQdsPGPV0KhP3I2wXqAnmjcJbhzz/AqwONEuDH0Tbl6AcQWyR2 IPLyHbirK4pgoKeWNteTOxhQ92IxRYzDPgN9aaTBoXIfL351PHJa28auGT372TZKKygNmir6 hPCKavnMjSrth0e0fQSwLK4bqb+FttOZWguE4aqCSfg8ZL6C63n73JB12+WUJur32udtBlFa YoNiTMlcLRGdBbcJP906zLG5OahMPWClH/pRMVFwcV67k21ZT1NdWcyvpn8haTFVjfQKbRiq ojC7PXzQsZ91U2BQHNfIPa5i/ICZZel3dIdexlGcLyJvTZIIzjCAudJOY/AtnBNH1YbF1G9r 307QAEZ+fbQc8qVHHZOFXiy1Xna6NrCoixQhcmDCYTRJngW6RRFn5Gxg/Ausya5tbPiR3n5s OJnYtywPLDs2RFIUBOtubq7sS3/NEgdKU5+8B2TQl1m9KaR+udWHJ+vAi6RsfE0dajvxHc50 l0D0Zw7xJhJE9TRXNm2yTb+7oY3WquQU5AwFi/wHuEa8Z7Rcj0wwfG5hMe0WUsi68rQ4DTAl I2hTNWSz++Cvvgw9CPWBdO3Ga+dD1n5bNUiQ982N50seLM7SxgplqTThgTAjG+dF2Im1dAqv Nj1+ehMLSzGccyAq9VxFviWpHiYc9s6vjQm2N/G9GkFwFEZ9qxSrv1y/NrzkkMVJdF1NcOzp GutRPIQW+iKtx61xEOBOxcczWjxGCqd/ix6Dv3D2+Mgh4PQBU7J6tIKKDwtVYn2mjz0MW3CU GU9DRqADU7TdKEu1TgNfi7vG1jH0GRlqWGtKNNoZ8Nvu5+rUm/F6loEj77fegbhzSOUxKi8f T3TzWJ0P2inkvyBxGfwGvmmdTRuWFZFTng+6hHdyMXMU5ThmKixaQ1B4YmYJo9oiUIamyZcD 3z58nfQsMHy0o2+peL6wHI64pBEOhG3ZJuIWrrJgCkZZ+Pxd38TifJGiA1wAUaMBLcV0xmsu hSlvHiLsjRGNqHWbUnabXnemAgyAjJI4oNfWs5iivayVclPjzliUCu7zbVB0g0YRA8Y5TfR3 SO40J62izh0kL3NZDS1m3q5owj5FjBNUOMX38d59EsCvpQiaY4oRY11Ep58y4NTZRKR5nCaP XkOvX+xitF6TXX5VCLo6E1lKxpuFjUwQyAGFozygf+MdKFRIzAv4PCd5T5EiyV4lBs8czxKQ z7domA6tS4w9dcUdlpdzMsIZmkwPhElyh2njGF9Bwd5xbJGVl5E1H9VLl/CKqsYTSlOImWuP Zp6OVCeNU+gl60LFRhgNHDhliJz39YkgRW00qmwPZG1n240K3vJ+b0JC1DZi9AikaBHqH3xs 4fmVZXCr0a56KSAY29NeToEkwDivWVVWgnmlXi8viHwGRAXjpdGObHvUj1Jk5eHNVMSGz91W si1ibfN9krf9YhukP6EnuOikBqtqfSLEG+FwF2BSnsnPisQXLOIVh8tao1hWnAIA7f2qXxfA yDz//KuRM+hJl42ykHAbOr2ZleLx+24Lge/hqLolXcZmI/LvlNL2KyrHtec9pHU2u/MwIeop 6J8FaQo9nheucYUwFAeuBUMjJI5UrRrUZ+cLVDpPWYNyyiKSXCcG1LlkivY9gsQq/Dt4z9dr UgRGl5DDjaQo9rJbzipspGpSxPOw1cmyPKjeVDuvDIG/KHkkCTrDn8ZfZF3NLbzTXx8PxWpe AmghO8ErUuY//gJMZV2DzzJRwC7pwgoVtRZO0iJxVbSNsRcXq1lrxKaJxHZp8d47NaFMfMjN hLlTEDFeXa4LFjOIXWTAJxmGIxL1M//o8k3j47Yc/ksOKjd49HqOP8qMbRd+UUdfuyC8yxFo g32BdQJ+Q34wmwz/42SWENF4jlAuk1MrPLhD16hNfir8EA+7cFN25cK+7K0CoEd+vaIxQrUo MdYegTfKEN8FIqiNH4ES8JRu4jmu1hvmZvslvfohbN5LJN0eWZIc31dz721/3GVd9PLiGLQL gazssdsPpVFaZzT3RG9fitzzdf2WZFejticsxZH3BPlUZOvgkSR+87dtXLDSmVfNU1WaLqMT y6NiYPHxfmeKMZRHRMNg2p1xKKJ4PjvoCgVhNJjdE9UF2Wj5xxf5JK+ToDqE7GseomRhxAXp 1Z6mss7cDF18gR8wKS6Tw0oDFex1/savM6F46gZH5uwIz52eJh6bnUJbem8qlL2xlFmRZmSe 3hi5t6tVAfm0CIZuAsmaKJ6l80RXNHvQUYx72vc5Owi3eQ6HZ0SU1Tj2dazVnk6S57WcUH5Z XqgC6ghx7hCsczAcSOWpdOZ5VahtzmhUcwaTmpu6M4fEit+dUKvQjC9fFIXdfoKJcGhXShaQ jOlUN7md1RwZxejG7mmDjIp2wjsmqaT3AgjiWX/ak7fLmaRdn0wLb1ygh+zHjO0zLlz1dwtv YdmSirm6ljEPQOsaZgAVn/oDCREC4p2a+0JpmX5hbsch1O3jMvdPYTrQm5vwOssV9OqRxatb DxVGpayaFrfBKIGvmaEE+psfYL2VzmGUVFK+OP18PYyDsOtv6CdJqvvpwCafJf+Q1O73bWG2 9WNloNEUjPdzyd3ZA7F5tfbVGVrkCZ65RltfPbFP+C1x/9OGiCEx0z42lhSZPTWtLZaeGUKq e0zEfMwH+wCNJ8zuIzUyqlWIH644cFalmS2ydclrCZuIA7YYzY+r99k52NANGFrj+tKTSXyI s3M8MPgVfm+rQeSUqBVOpUZrY2qgqyruG+Ha80TSi+e6A4HBsM5qZi+Lyz2y6oFumz47aZM3 4jrhACu5JJBbA5KFGVwSmXfL6Y0OrTz36+cHN0W4V8QwtNxwCX94hx4dWyqJF1ErLUQWpYoP 1R27ZdApHQozanzA00pTpgh+roKR0SEu63mwDoBACtj4oRwDWxipGXFLFXoT6XPKfvHPKs8x jtgIM9/PIcAE2tD0qNZdH1NdLCTGFeLNohX4O1p5PBvKixmIb58yFOEyUxIrJSagDy61R1KP FFnypY7Qzw7W8t5qRSzOw6iob6M94Sn1CIClXv0zUHUNR7mfQ8yT18Nig19HOjEefGx/Igq9 4MjlEK98D5xIiWBKmLDY+S4GLuh1XQrx3WTd6MfdFxxjU1xXJPloYqNPGmVWSyAWiPyHL4pn 9lUJ3Pl3BMJ1jo99xORT3xVIBVO5FYqteHq+EAjE646Zg4tprUAqfHoaVG68J4mUHTHSWLCt cQ+p4N/NPU+wUv9E+XhEblGd49MS3sHaB+bOax+P6Z3VlIIZURpD4safNNgWeOkmWzd2CJMT pVIcQ9CKK/bo/A0FQaETTTFAv1u7t6FmdmZjkiPp7o1b/dy7ZB14HBoEBXvSielyiUQrAbsn G3UE8kDBSXLqQc4erL8ksXHhxBLyGKxPMh4UANf51R+lzC6phjW25BEjBqVPssWXSD4/4xs8 XaYqdcUp3vsad+7dOBsxMYa+bl9epuX/rMNPHuplqsMV/Dr7mZGm1dABlNXK89yQ7xljzRP0 c60PZWh0hDGAuugE19Q1B13B4H7zsOKbTLjCdgmhSzynS7ScFe77m0Bp0vVvJhN3bbp5F3EE 8lznMqzIH0Ce+M0HSOBqDhmxIj9rfXZBq7w7fI8fBkyyvLGeUvF28Fq7HczjIB7NS1Tj+ubf 1r1dkpoKH8IRAXNkCqZjdsRbKSvwW4tfekwYHvdFz1xyiWjuCFVZBZ44utQyz17VIsSfGiy0 rYJIp2STIw5LFfUVH4TUTsz5rLgY3dH0McjdSTY6hKNdUz8x8muZ7/agKaJE27J7e5KWEstG X/3QV8xLoE791cbbZMYoi1awmi9yiLP8OMhOW2z42P6LQdYIpf7gwrp5Ku6adIzVoiaN8Kcr dB6Unrvn98uQEHx6N0oRduXEr+LKe6yPX4kafccmPPKtLsXbWFzwhQCK6N77exioicTUz2E1 REJ9worMPDl6HtUFuhZsurHM3mjVgpvGELre5z6+iS8wADHZD6FMFs3fhbE1obasI5l9YvFD YwWQmUX2C4oUzpBOr4U4qtS/RP80khNvasIL1LKIPcYMZqJgMTnf0g7Fx0QKtSlaE99m0VWb i3n80swnF6XRRJGwuJfStt81NSWsIX8caY0Iw0OOfmEgvMAD/ZGwk35pIcZyxrwz8VNuG6wL XoH4sfqxFxiNozvERvIdcySpYXtiPF1WWL7xJEyFeiEb1uPCNLZYFaneJ12JqeH5/hKRhs6v 0EsjGX1yjpVx51nwo4Ed3WAxl6VIYKjdxGxoIAQncu2s7CXxz4Kkl4zk94qyX71VCcG3fktm tNzXfLf+AmajSKlt1eegTqAO3Mnc2hWBPHGIT9SvTdX85Cf1SlT2Fjmx/paSidXXnK96axaf d2It3pKRiuKSu7UFv9f1TC+ase8MQEfiKUc0tvQJJo8J6a49zmI38tv/nrXwrCojmG576fJQ KMbNphcJt/lA3O7+iWIP+/AafYTJrlHktGWQeIBBfC0TTXRDGXLCMpBC5lT6FwgNS14dNdCy WT4pEMGqQ6vLRt45NY1vVLlXofjIpPP10X5AE7HZxrRV7s5S90sERBQsfWqL+rVf5Phk3S07 lF5Z33KOdsH+y02l0U4HOL1CE04n9EWDv7DVnij60uo9NIQURYAEqtYMToo98zXKwyfD/LLg pU4fvQYbDIdCS4ND13y/EGd3mKC9s2sXDLrtUcNQ8W/90/mRNYdqPVJM5BVp/uy9Vz6JXTMa Wdsss6rhN9gvy7j3doyCZyR02Btt3hClB7VCLdtMStpvN96eS3SrOX0HSpKC+9nH5T67wdXy davhi52tudUFDlbYJSq03h2QvaoFzf0nywvtZeNj074IYZGqT9kCEB8HHldoi1yIYGgEvF/N Zy8Jy7snWS9vY6ROfdI3K8aqpYfMliXYtdWFc7vjgrqWu8azh2ox1T0GiT7ftzcS0Nqhs3pU JClsfwh5xjgnMGu532v6eHPCyYWTSeLF+VJwUSv2bUwPDkLLrH4hwmxXeInVYokOp6DNZwCx QZhism7ASBOaN+wsUtd+BPqtP4rkKB/C1jpflpajOZ3qhsP8kTfNO4oP2s+MOnV4UfejXYEW OQd7HNmhKxn7LWMXHp+KuH8ZMca6p6JXQfsN8/ji/qd+Lm7Pbs0rvkmEy5fG6OFa74jSX7vu HCs2w5ZH9OyRx0+CVrUgRJHP9SqWrFckCRZOZbE3ON4j/BfAujyauEXQ/a652UwFSY3Hz2o0 ozTHKx1xObfdEefhN1MqUEAGlehSNYccubFdXIvuyekBrkBEY1lLUyd1Cl7d4xlWOPZCCPA7 CrgqtKCtwSO4w5ZaXi7FqRUyE3yx7yTlnWytIVOwId4RBKGfbsrB0txI60N3AMyc3JcZVKLP 0v1ifhgC+aW8JuZzwVA7OYlffG4MdA1lnAczMnnsuxSFUmdrm8hl/Ko7yZ9DqSFWVWkax0qi ZgHy+saw5NfHyQPlfC7aoXloDQ10h6hCV0wD1UlscgMaIvDFDfZfRrJUErHYfnROD2IxVz/p /h/f/U4FMsw97gVvKizxrCjsiL9RbMZj5eYPqTPywlwhY65GE3wwtW/kHNuXcOoyslp6aZ2Y Es9x3bYpbH0qmIZtMYD2VNiIElT7fRBKRNuFbsRjuCv9chQAl6CjK3/3jGMmxyfeQ+o1yFZd qyxqig39eEItDon71ioYRNw2r1WVqnYBT87HQjg39FIfLCIczLrDZ/qqF2pCtorRThYROmQS G+aPoEhBugkPHa8rO+C+I/ETj3V1Ms4lqGodeH+tK52cn7arfaH4oE5/MdxSecvkydK4sUTO rkaGgqTw+zF+kbkPs2ZUpuOAJo23gGJc2uTFIkfwY0ul1AASuXaU3C/KxVcvZGAihISO/jDg h7G48iUqCZsqISCYCE9XPj1thg3yDrLdDEk7XVitNeQHz0d1AXK8DfigNsXbgcCxOIit+J3V W0rz6iA80iBOPn2SESayWRVMD3w9yjw01WDPurdosm2SYi9S15A0FH/H5t8Fw3mkUAi5/kJu 63yRv+spLzwZc9LYS3BhhZTjiABakZ1zDBer6vG2bKHfcVLfhr1wtMlOPtVpajub1zzB8emJ u4q0amhB8K62sXSAfa4n2yyLiIfYbMxYzyEwQYeUaWnGwLIz3MFb7Sg1W8P3VODxW+1zkFHN 3T66IsSGNMJqL3ie4YeM3vCWlLuHNFbjIVGsXl2bJoG9oX7qud9hDHOPkcJOtK+Xu0Y6N1n3 /kkqpqgIEJT+9eUrdT5YWUHGIUocRpKfq2t2kjNtOtsvbIP9PPwjdocLFFRsgZWrPWE1qBWp kI86BwJQJwS0UEpiB/75UNePXloCij6IvzZCeg4x0pWAmxHkq79KPJhXIo7kFwG9egA0/dQS thYtibgB0TXDaIguD7atGWZzlGwfGlK210dB2s0mKw1Yf9DiwOr0XfXNZVipRhNmYdRT14Kx 8MEPdG+M9nt1bc+21UNC/QPG7yHESIV8MtgjNxbL+fRTmjdzBYOEaDCXVATWP8jFR0PT2ESo xClzhGAdK8uH/MFFuYal578swxOnDCOmvF1Zmf5gBJffWQzY/V0vRtlu7JpVTpV+lEswqwrt Ho6jyKUbtEaNGmGsujD7CGcHcc3AfIumAsUzp69Q/Bqd1DHTVciMcdiH74/Ky9WdQj8vG6g6 AA/+GwDfWtfB+E22ikXcOFh1s7AHY1bg2148LG86XoR/qV7uZu1tZROgxzd56hPqhlU1S7bZ 3un823L7bUGo/CdOjQiWB54a9S/338IreI06Krh2vtXcmcoX9za69Z8Zl2eVkz+WCOVC9svA NB1XFIq3tUhbE0GLaejzm6yIu3SlCbT1qF4nvkzEmj9CRo8hQgwNr5bZfpt1mvslM4hSSqDz a4N7xtnYkyT5gYLlmKusyv7nYJpwq+Y2F4xnlNHPHRJb26z9HU+aT+wzaweH5wQ09imcvjgc 62CWAkOA+dOZnra0cVi2bSgDrxAMGkSd8GotTccS/DObYZyu17lhcphaWK6XzyezTT90fzr0 tf0fn+aGx6O62l4nzt6qO395LMXOAxSEq1Uh+hnXn48IBQlEkshMzw4/qyKwdjmYuoedOEko JfyCgs0vyvceuc5Vq4weHaf9WhMgUEzSUp2gFmHerIAoznSx4RtJ5LISb7IeNK2u/VrSIlZp s64Ozh4e5sLP5Oye122yFIGk1ZLpAmPW+CrUSCZwGrcdpW9jW3N+bJXAUiKUFz3BoKfykt6k +TRi9oCAEESNNGFesYdv6kS1kPxyxoOoSL6TyrjajHbjGLgp4Q5H0piOaMNVtgMx77Jh1lFS CyisqEifNZtSjuk76U+2i/iOY6D4RtM0BPPgs8MXFhRcxPDbGQZHhOaHBhhKurE75iS2vbuW lL6irhZlNVi3wueiW01L86s3LXQdWMetBpYW7cWldqlPqL8djh30LEzFxMe9qyGyhjqE4YCy tW+PaunWDhzTs4350FLBI19Q2Y0CwpR+fI4XkVXoye1MH6hSCDdkK4+eHT33Hwkbj8Axmau8 itZYtEi+36qbb6Owg8+tDFI3Gzna0gs7BQ87ZVuJre8fKkDPGqFB1q2qr0R0ULfr4Lju4j+Q me1yvLkmyBWHVMpf4OkpABTmXcVglc7ME0awe/yuzER0zcJwwUaj+o0YESAnnU3nX4Oa4I6E OoR3wd/zubzXdVwYEhQ2AQ71/gYxyx42RSkaz0+shoiXxqD5R44bdkS5VINndTX5W2hn+LLs zmcFRIRkYQpngrVjbZoYlrl2ry+JRxWwM9/HoZslv7q4dQWvsfmH6vDhf9NN/O7l9Nmw9TqZ f4yOl9WkxUaZaT2rTO/VkPcrB8+0G/Y8kVK81LogtbvZwKVsP0Lmue66cxG1eTHyaq4x4FDM Va0CL7CjjlTyE1lDQ0oie93PKSZ+e4SA7BPx7zfdvq7Mp5vcyRlB1LQ/rx/0obBk9CTJf+N5 oUjHdVNiOHVTk8lCnptVPPT+5nNSZ7Y7sXZ3l2740swwi6M4X1mxeMDWaKYdI5qtKwSJ2Tj/ 8Uq01OY0/kM3w7YtrHHp0lj1Y9H1Cb4HCwtIubNGlPDVfPr+Quxxy6JjOYU9A3QSlqFe0RC8 sB8juV5zXiJsSZUmqxCVd8gRqLNyh6Ksi985KEDjGHxdf4rfsNCEZBUU+jZdjKguc0tqec0G U3D5+uE+TlYjpIIuCeuG3RsreFTFkTnPbQ7LxIKr0K8n8Ab/4/IDrt0ng3kWKoLejngJ1+5V e8XtLFXdYpz0p4PlChZ6S8Y39HN1HH+SbbWzwZFjtW/hxH3lYZjwlSkX5eRy5BoBlarZwi5Y Ily9nGE9TzF+umyIFSayZj12hBtzh9UCnpFYNsHnc5ZuaD4yiJL7eDuZ/U5mJWonF0OQMVDW 4lJNLCKmlKc3ifW/KGWZhu/MyKGRiEGB9ni8pWyncXMUsivW4+wVY0655CkKN2K03WgYc6HR o1Qfibc99hosYOJY6FxJ6YDueV6a0RHleP2yKbSOw1eL65EuuzhEoH5SvkTr5uG+nTEm3jY9 zJSlqVj2kLwIEeeADcUPFQgJU2a6DWoHEfxK/qMMdQVQNQb/L0MDvPyZ/gCH3mNNT01uc+3t aoVGT+YrlTQc2Pv/93APv6SLcDVEqGwXLRMKEFC8dJPaPeBGM5Xo1mAmGVb9O2yGHhHIk4Ip wTQfYwNNRKcfbth8baRphI4MGaQWWsc/MtAgqQOGfv3X+ZnTlDf4Wakdjph1wBKX50S4pplc oe9f6dJbKycPa/z3V9ieTGackeEuaWWP2VkwKVFNZwMKlRBQmkXeMUC6IS45sAGrRpnKNzTX QXuVeS49+1rEDqXP5hveOLrtH0C1FhvA6z95+XpPyGXYQ+ij+fKJudoqgU0U3BNhJ3Wxkhu3 fEa2toSP3y88nbi2gLdbFCV4HHp1ofad5RybwEowALuZr5gGTDOeXeuXpnK5MlL3P/xguWBW fzB9bsRxNJO2vAiN021zQBdckQ14MXJ+AjHvPJW3M0eHyx7OL/PZFVEGgGzGqIrSH9HwreTG uXv8ZFsOrT4N280hnIYIM3N/HqiICnsXpbYRyR7/ohDVRrBNil0ak0VWROz4QfV7BOede1YJ B7nCDbQk6B0dQ7z9Pzo6prz7/r1dMzN3hfJ9U451R+JMsnfm7sSUWHXC3IFTDbUZ5Jf08aBY g0r3vAVxRGBcHKabnigXmud0BHcl5sqJUAW1XMbYZc59eDf/Ht+lluWwIUdhlwVjJVpLfElB I8dPVQDTisAMtWC3lvDysj3XcZsg2HyQfz23zIXIXZWYC/NjACWRfRvbfp7ilhNEIXWQLm4p iXmIrMv8bA2lihrGMTt6ZmIMJSxaUqjjndAWji2HEqIi6W8whsl/YmEWrlSJp6qayLaTCkft kp8QDTKFr0jbZ/nj/lTlUFG/f+CMXHN+yePwd3NQvpJArrCnNCl4fI8hO2zkOafm6DkLHQod 2osGJ9cxmIX79rTwbx5mSqn89F8PlgnN0CD8TXj3Yb7aAwKIdYbyzzXI5BLfsuTCFMbyvOl0 rqLcWzUJfoF4W37kWfm9V/d550vqz2JDK4kmVuz68sM4+8yjz7PkFxAJL9h9jt184aXB4zdu dgL3Ft7A72PkyZ/syhwiFv5dEujpZOlXLNplRDOza5a1LZZI1/bzbkyiQdphFghgErfwlmoq 2iVPgQVXGZL3Lxd76WVCLgplbmRzdHJlYW0KZW5kb2JqCjE0NSAwIG9iago8PAovTGVuZ3Ro MSAyMTA0Ci9MZW5ndGgyIDIyNjMwCi9MZW5ndGgzIDAKL0xlbmd0aCAyMzkxNiAgICAgCi9G aWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp42rS4ZVQc2rI1iltwdxp3twDB3d1dGofG 3d0tuDvB3R0ChOAuQYMGdwn2kX3uuXufc9/fN3q0zNJZtWpV92hKUiVVRmEzkAlQAmTvwsjK xMILkJOXB9mDWFkYVYAWrrbGTgA2JhYWDgRKSlEnoLGLFchezNgFyAvgdrEEKJq6vLu+W7Cw 8CBQAiSB9kCnd6UZwMQTIA90MVbzdACyAmiM/wJKIGcXRhNj53c10N7Cyh5I++4iCnLwdLKy sHT5E4OdkfFPpD/eIkwAGWNTG5C7s40VwNjeDCDDJM8EUAC5vwutADQge4AJ0NLY1hwAMgeo AbUA6qriKqoASRVFdSVVWqb3wKquDg4gp//hIqqqpi7JABATVlATBwA1GACS6qpqf17VgPbv /C0YAApq7/o/ed4N/7jLi6sJq2kribMy/6kBwApwAzo5W/1J+1/cqN6ZAf6m9u5q7gSy+ysB gMbSxcWBl5nZ3d2dycLV2YUJ5GTB5GD7Fz81SytngDvIyQbw/u4EtAX+1RhXe7P3drpYAv8V 4M+hAOSsTIH2zsA/ThKgfynt3lv57vQud/lfYu+NcPkT0/Zf5gBnIPA/0lgaO//lK6ekJAew M7aydwHaG9ubvhu6GLu4OgOM/pK9P4Fm1P8iCASIujo5/ckh/2+V0/+m+Td1EdB7ZXq23r7G 7v99Ysb2rs5e/+jNf5ZtCrJ3tnJ2cf5XRCDA3MoW+Ie9858zs7L/SyYvrCAtIa6qxij3Pnj2 jPKg9+7YM7l4uPxl/SeesJjc+yhyfwSwsbEBWN6HVNzeTBRkZ/fO2hnhT/vErN775AJy8mT+ P3NtYw9yt/f+v3JzK3sz8z+dN3N1YFa3t3J0BUqL/Y/1uwjhb5kF0AXAAgA6AoAeppbMf9L9 NS1/xKx/xO9t8PV2ADkAzI1tnYG+VubA9zcEb2djNyDAxckV6Ov9T8V/IgRWboCZlanL+6C/ XxaEv6JL25uDADz/Er8z+bfqf0aA5q+LSvt+S81A9raeADOgOQKzAsjlfSBo/v+5Z/+VS8LV 1lbB2A5I898t/W87YzsrW8//sPwvC03gH640CiAnO2Pb/9JZOUtYeQDNlKxcTC3/6uK/xNIu xu+jL2xvYQt8P5O/ROp/bpPt+9i+rx6rP5sLwMjKxf1fuveJNLWxBzo7A7h4/lIB37vwX3zf W/+HLYBZVlhSSlqT/v+MzF9m4vamIDMrewsAGycXwNjJydgTgeV9Dtg4OQHerO8jbQb0+GtQ AMxM9iCXdxeAg6uLL8Ac5ITw5zB5uAHMxn9E/0IfAcwmfyMeALPp/yLOd50pyPa9nn9LWFlY AMxm/4CsAGbgPyAbgNn8H5AdwGzxD8gBYLb8X8jB+Y48HSyB/4z+LrP6B3xnavMP+E7H9h/w navd35D1ndnfoTjfXe3fu/4P/TtV0N/Z351B/6F+p+7wt5rrHQGdrED/qJX1nb7TP+A7V+e/ 8/1BQLd/FMPxzsDZ1tjZ8h8u71Fd/nZ5J+ziDvqH+t3D9R/wvVy3f8B3xu5/Q7b3cjz/TvZu 6wV0+lew/xwqpT879a91wfL3lP3Pl81fWNXFCWQD1LQye/+i/YeJvLGLk5WHLsv7XWd9l78/ /v1J/z8SUP69pv7hLSIC8vBm5OBkBTCyv5fNzc76Z1i4fP/D1fRfa/+vNfN+G/6N/+xcABDo ATRFWFkEmfKFWKe1hJX7iRdNV0BT8jCdVGELaMkkQq1kTncR4Irl/yQDChYHtgVkURWD5KR4 9f1SAu1LtShDsGxfN9qTq6duzJSFdoz95P0IkMWFx/I0mNSDsuSXAyp6yGh/yeQVapdxzGZ1 JHYQA9THjkR5unofY9km39CuUsn0KjrWCqDdS+ZZWzGdbNE9llHxuwmWp7vBXd4eMeNjjAeE V+jmjArDsMdkYBz6e1F16NMK1bSO+rzT2y4rR4nnIzd1OBCy2T+V1ArlqpwRlJhkEn3Rjc4t wgJ3LoyysrVJnzaSW64xhGQe9a4gUU1uplpVblYhMnpQJUbWEfU3APvVEiwId6pnTWrHUN4f YH1kw643/Sl8jBNNn6ZWpTfF0J8jc3RAOa83J8zap6+Si0P0rTgYP69WGJdw2IV7llU3XzSG kTx8cimg7lsaTa/S87xCbvDvRkmJtnISY3yfIELn3RwH45bAxi9wdlywVCZHnUjom/gcCsjG eca/lnK17y+ZJhJIIRcQKgT0Ukh6nX7Z41yvrRDWy/uzMFfBbajRmRNsuy1pYV8Jbwe0n+av M7r/XkF1mh1TzK5HABPBQf6+b0EjIzp0KP3w4ytQKeWC58fBb6J9r5xO3MRF3LejN4tXjeAq stnvXiB3isDz7a5vrF8KRvi/ahxq4Tri2T0V11VrKbyGltrkyruRwvKCN03vKrHHJLiXBgRq YAsW69yaIZmJimx2PrBiOMdH5X/RyB0URonGgmoucfqhpT5aabse8TlboHx6dftA4JCvJDT8 dEPihWOkeOt2EqNidF6eUDumXL++40YzCIlKxYiHjQmOt+KryJZIwi7v1Ihg/mxkhTOlGPfj ZOZF0kK52w6NItg2Pdj6j+++mXMf8yDLP03zxi2qe9bbwHoGIHTAnQNfZHAmqAw0BhivmS3c xCyU/C0O4BewGxgmhNFaq+gYdzEiiLkdnmFVwQnTS+m9dDzUl2j1Pu0qpwsPr3DpZNFJCoWF bF9DIA2WNcDYR+q0UuMTouY7zIk/RKm1EMKv3iQ7QKy1TwzxNEld6WubXsD5JrkNAs1xlZbs ULKK7ErTb1sQSXocfQTVRHUV172mCvgM2EuXZyJJqee1ZhtVo3F8TCvICuPZIGauf4zEFiJc +6CSHprXYzTJvZR+VFapjEux7k2aohoJBRE5OrUCoFSR453KaGdMnrUSMqIyei3INlCeI353 eHwZQCjHkLsSSCxkhmVC6Z8sdVkw5+aQT9iKzO/YdPSam4Vp9ReBtT8LpDHs/CQ/a9dHVgOC 1hAeWoBWSzBWpamoI0dznlum44fhHI3SbH6Z8Y3DZmoqE961XspiyQxGz0r4yr+eTOoxq2Jp xXuk8zPiCw5E80LjBiB6PHTN99k56lTjWmYXE5ISTU471F6EZFW0IH6dR+iYtzNk7wgNoY4P MdIGWq/f00HozOMXL3QNlipjDynodtN1FgEpyX8Ojcq7kV8Ul0t6sgSsADytktie7ExHa6Sx udg6DKWwFtJQPZZeNw1xROYwP46mKECa463oXAY75aai486xjiHsm1CIsou2rT1J7roXV1YY pW9WsfA3eiaHniTbCSdoRsXghATijd9gQve4yn4NBd95Z7YuqJ55Z4XZZUuPFXwKJDWyK431 jLff8qs2Mm4oSXrgnmJkp4W4+qyLXelhQfIJyOm/TqiIltZNBFRGcmusxsrXaD58+oQLn9d8 HWkZfvEDMfnDwjaC4YGCWSphKN2Nwze+s9uh9TcsLn+tVaO2p4jBlW5aL2XDnxFi7KDo/iaY 6/Vm+dDjfU8w6RjmdA7PRJpNekgplWHnk8FQfb+fyGUFaMWi0gpbhw7pW5mzRjG7ABscUguN KtcxBJv4+U9a0shasJeWcMmfd1pHinoyG0lekJKoj3qMVZJrsa8JpYcO5TEyovkhgvz7Lflp rT97KiR11pXRxsyR4RUndJ6Eld0HiviwPAm1lG+KZHLLXXmSD5dhZY89IMZv8CCyFcCj7xK4 DzD1zdRdY6TX8wkWeT9LIFza6tQF82aALFMGGjyglktUGzO1UmXliuVqxe94b7LYERrXw/i3 oLKQNpzaLz9cJ521Hked0quWXu2gedVbHyx+lngUthj+MPxAMWPf86trNqvQVIXHh39IB2Ui hRqI4xGtOciRT4QeOyxysFpeJVw9ULcWaxCtl1kwwq32PZCQyqI9nPa8IeCL/ikcs22T69yY /815FRG6vU4BTXMKCLmiNXEObhSI/ZbRFOLpU84EPPoiG+JRDOyzVSVqXzopDgdvnlcmeTAX q9G4MU0BAd84EE/AlIvP7opTgliTDgKAL+aon3vAS1Hks2GLfm4Fqvuc4FtFPZ1R4C5qirw0 IwQTIiyLl5qgFczyCia16dJ3ZSMGgEE0uVS+70Lc1khpVFTPxRLfgtbvIWcXv48lLpraApM6 retdo0FiDV/3rApqvTP8nSz1K3p/OsXFhMbj6rpamWTeInfdYzFxYymj9BpdWigNJoGgiZD3 ThcjhIYxFNoyQkov4SyEmHnPu+s2CngWeC4l9JWGZjYdR6ycNcRQdFYu291Q4SRyp7j02Ya/ nxP/JtX1kIx6Mxnc4WAesK7Qmrc5eVPv33ye5W2I/cx0fqWr73CjhJuEvJDIjKCXSUjA4x7I lh5vUqvRSYgJRnY5wry+t0ad7OA7wlQEMjOQVt4pSy8iXffsk2rpgimWF1dW7Wrb2UK1aIRw 0wuxJbn1SEjSwaNjWCV4WSbxYh6WMH7pK+vV05kpHRSdszg8IgT303xc98yeiPw6azjR484Y 9Eie1E4mR05/OTiDsSkuFWMyfaWlpd55kCxaHHkdv1oXitHKLy6ODFQqBxDaqF7j5kbDHeCq ZkZxBUfumTj+soIr6Gg7EScMutVb+J6uwOPibkFZQ9C6p80/XN8euhC6DGO1ivZAcM0MOkPM 4nOro52hoxPpY+InFH6RUGfyKWi0gRgGQk9H76qHnMZ0RsQjAvLHdzNU6RS1FNz3YUNpN5LJ hYoR6se6JqouoIyoyTF+YjHX+hG1gj/siB8ovu5ekfvqrid/0RW8I9Qz51ON8NA+w7cQ7dj4 DF/2/SZ+5q74B1Z3H9X3jjpXqovvadObfTLCdl/IhLvbr6AsLVMuP4N+88YsDtQKGUq6z4l9 rb4R/3ghDo9mtDlf49Aa0GnntUpMi2+xmvOtH33uE2pFZGMmP8OF3WGUu9uBECb8zHo8wPTo oorPlmhXFS/gVtJ9x5lbVfbwiH0lRf+y6FNyUfsPu6XDnJuhGirZj8UAzaBFpl6pAaSxjBf6 GkvVcM9E6Nxibpw9zz2ZU0WYxssnGUEkZP4yMPo9G+PmG6mbwGQb029cBtGIEvv3Z3WH1mft Pinwo7Ry52Nx5qxK5nstMezKmQmSV2wDoXWwMxj64RzJdoK53m5mjIve5KhdCoz6hhzwUNL+ Ld/FO+e4FyeFzJH2I/t//JJeiHqgeoYHIzUYlP+warOuSvVqfjI+TnaSEmThbC3BsGNVxONm +XlKzu7AADIguEqvtqywjoZH/7N4eaTzz65RAT3aBu4Z0yxj68CG7WDpIUNP2RQThscYTTKl 38yFXI/H0lKNh8RFtfGs9fWLqmkcnAvavK6wJJ5TeVqXekmlT/etsFIZ7Cs5X6WlcOKVkxD6 ssQ8WGB098M7alYkJwx9l4PMFK42tDPEhGTdJ5wvcyR3a25rCq4Ach0Ws8dqbz69cvYXVRLc 2ux81JsI0lhpsKOZrowclNwMl07zNjbJwkw+Dw1DYpH7i18y9gxhVZ7mL/WKPkLwfpWTP8dc YaCDOxhvxly12zJijS0O1yleWHZbIxa/UIcU+Vbqvd6t7V2BVLyNBClZVduZro2M0I27Gqq9 ZEo/T0QQVBgtteNgeeXxi9LoyZIenBzTLzdmOqd2Wi3fZtcQMgt+ydvTsCI73YeXQHZgKXFZ 73y8NaP3y40ia+5QTwcuRTpj2pL8MG2D1MLdPIT/uigF83Q/odXekOUBEWH3CHwvM2jggQr8 xYQOeiIWjMYEQ5Ojw2fBmbK5SG7wMQQ8dhTIJe1hi3Y+WGA4OFa/j4lrkjQvP25t9SiH1ZeD TZxGuz6dRhojtfsSjxbMhVJEow6vDE9h6TxpfQFBs47i/LyMbs0Y1Hm6vIJbBAY9SILjgc1u 41IbncHa0zdopdeJxudjiyrJGZG6+V1LjZUwqbuXzcKd1Ilf6thBkjUoMCrJI1Thy8v210He yV5lfOpFi5pgmdQkjXQwc/AAZs0Su9jqg4e0zcDxlhpvdFvxtqcweMoeg02kj9PbzqvGPHAD 0LdFs1ojPumnODOSu6LKxyXlXe6VCvK082Ard0MFPpwQle3zjcJcL49cj6DnQMFtu5L7LBR6 VnQCnokGMdpd7fzd+x3traG4cpoiElq58GuoID2TCk2YJadv9j0Ny1vWzEl2K/ZoqP7B+HcB 4KC6Chl3E7KzARpi+ZL7dEIYZAOqnijmJe4cIRsvu1RlJHemhp4lqoVLerHwWgnEKLkPVejR vvLGAxXh8IJIiRGccBr1b6yFB4ihbtLQisN5sbJ3Q78IlZ30RmVH191DQ8ZcLSO8lL5Yd0+l VfW3pa/53dQdlAfXwjxf5HL/Wv5INRIYIAUTTiqN6xAaTjAx22Uq2w8We9Yu+C0QzHrVGAD7 9FmI/Nq3ksSAJkL72AojyTJO7tsYxvgwyeTBiIP1vHSO1zfs9mDKACHxUAkiasw6J4mToyEd j8sJMCzknTyEmkVaz6pJQc2oD6mBLEcNlnvGRxNc8PZ3YQCodKx13JMpT6aQwuYE9msCXyQw ZcEEUr43xhbt6plfGQKUcNVSCXQRgrKZeZwi31RpyX/CH95EhRSYTp0w/HQnAm9ZQT6w9snw 4VlzkiTwYD3+Vt0EQLnQMpZ1n0ajpB5lfNBj7dFtJRMnDQ3oOQMpKGV4wXc94Cno8WW46d84 is990pF1XWUFMlkFcLT9Cqn3/8UiiNFg2hJRpHqPami/1xUMgNyzjAME2D3V2Ba63xl2nsqx gVVf2vcWPGArRdAKisRDF09CkRohCLrd9nJSOdAMdLuMzRNB7vueD8nUQEYMEfZXn6T523tI LAmC1VyTiIunpXyoQgIIiDPR95TyD6f/cjh8yRhbhnshxIP4zuR9hm7XpqB8bN80zinLHhQU BpBXJMy7bsxizWcUcNDkvO5Yms+Na9jGDPajVSJ0//64p+3Y4MvRENDIWR0gzif2tX/06XQm Ody+9Wn8u67jXJK1VsT8mfhGB/FRG8pSfvXmzeDJ0jgcvwMlGXWwqeNbcPgyvl+NPc24pUDQ vdrUQUq6uG9y9S5lCfr4poV51YKJjUGfovz+Dbn/cExlpLpau8sJ0inBr1SfqHE/KOHhCcWj OKJjDnIeBSvzTqKWgP19Ftrnn1MQymeEVkKzySF+1I1ooxdj1sN8XX3bXfoH8mL50JS49B+q ohoDgbGXcJjLA/n3vBBV9Bq8AaCmkwhZqrUKyp95wp8+Sp7ScRkuhqNQxUMVhAEvCDPNPEX3 6y8NL78sTPjQChpXoKKHohoWfxnj/zncybBksq4Ts8fEhfxkgDwViPJU3r0T0BJwoBKqgUAB zNcwSDzMweBkj12j9hMGBy/+yp70pMFANZAYiLTF2a905UYLDl71K+Z0BL8iTBJylh+2WX7A cMTd6EXH3awZ7vu4GdeeI69xdYdpUVyr+xS3wuiu3V1gueyGzUcxW896NHO4/FI8pPgC9dLs Oec9j0kehbeCScNfeamrulYeRpNcpQj+SHa+/dzlUKP2rY3fmYB3CsG6Dgabh/5uSE5gQ9rJ 4uFHj1+aSW0Enb0509gSN4OhfjeFV8jKFXp+15sYJbCp+cz1g/tgpO+7fPMgHhoY9+LBrw5V pOUo9jkK5+RgXIEJWXi/XR9YVzzBChzj6sUTUw5EY/FOEG3z8k/F1xk6tblKsAeMheHbCAtT nsCgWGJOC/gpnODBsCpyrWssCxfPH0npOY9PUJ+Gzzt0ty9Er2OI+T414LCqkPLfx9Gr8kGq lm2zk97vfviq66arxoEGlPjpWJp7vSzUYk8nka3Wj712x8X6c3CXKVQPvyEUK2LQ4jjxZesa 8Ca8a2jkvFWlAWNWnvBxMUdqycytVwl176dyMamW15JKUtRZwT7BaA3qZzX7U8zNw4WsWv+W atoZSRILb2+1ojpFKq3uQF9MXi7i6xBmhs8mwgqQw4Nn3s+zy8NfqgzfDu1hGgulkPJdK5Ky 5bh60ag8wvKyuoXOxlS1sNJacl2p3orqhnuiiG1p10SBa8Rfh4vH+pTD2EMh29EyPDO/j9GU AggTGt03204o6q6bCIOiU8tfT2hvE85CPQzk18zNO8mVyLE8D+lk4k5PmcA+PBinQFwS0Tk/ O9EvDJlD2v4e4vGnU2b7ce+wpA3b6AtlX+qnilMPPr8elzHZQtkod8XXdMOMpRc4gWClFScz 10+ElDT7OVsRiq1SoOB2WTO7YmvsBaKCcneP+veiNTqdw8aydiIBAhyUdizyp4SdGoSus3Pc a9aS6F0HBWWWJ+mQwVcKl/3xJ1s1x8FTJ++DPe2WPVlEL7P5wm82Z7Nf8qXPrqdsHyTSXs8u QWQJvSzJqnmwJU3nG09K5ZmqBP7ByEscZPe2e+DG0Zc+Dp7ZkZGw9MdN6ctDP8dYMbyRApza 0QpoPqKMmMfu6Cy/eYLnOyqhQs3iXSyKupKFavWzZCGwu5HEXxdgeXyQ2SbnB4VzmW+Al3HK /phrFbRS/nhd6ajCFs9A2jq2MbkaLaU4v4pOCI4gVLjojkUr6ImoDnQaki3OuEnWLt9GNdcq q4o5OcU9riMK4z46fHtp5bQjpfTbiV0l+f/4VUFwDM/4egNf5dl+fvUio+c/sXGu54nPwoOs Yvt5SMvzyxEERSIJLM2Tc/3ApjIqDQHZ7/0z3gdNk0Ez0qtELhgHMXZyNOpy5MOyLbAAFhQE 6FmgWkbQgjlm5DeVwoHRDhN+F4pwBfVnVa3HK5GakMoIlIHBaoyacm5KGeofK4WI+Ti/bRKT g4L41yawNFWnCfVPUOyyC/EyINJn0bi+BiDxLcTri13U20bUFhQJZvLH5OxtdK/lAmqk5169 JS+ahnq4aP1ySn5YutTk0kI3DpZjk1g+s0RNwGEubn946ifkU6W+2sxcfbKr/kh/v3t2NfBS I9uyLCFfPsXbFTZaenWRc9xuwEOOGImUoqc7669MQAIerP9d8EuUpMG0/PgvueZb01McXolG xxyngHLkMsgoZtOELtxPDZqzvuMQmmBgSFhMIj8IiRfgRWNEf58gP0H2ifCkVQgdvly7uGde cbFbPK8EOBSLeCReYa+VlOai1Xmu1HoUj6YXuWJFfbeFTMey3nliS25kP8RnSkwW8718Qa+h 3VoMY5kz4RrRVTCmzDbymuLZ601ySLfoVKTiezyXg04/OrVA0FCy8t7215ho1Zk7BCSX0n0l 3o/AlX01F+6bkx+69z/mTpFsL+7s/cTHmlzRe2TMQajdgo6LrEDo6mpPPS/ACjE55B2lZSf4 YJKRA5iw6W5lvra9xSeQUVf8aFLnO7pSV4qogu1PmluNsYirqZzhvq7bzerNATFDOB/YhgOp 2YSLxjEWIWnPtipvno4RssZk6kAnR4Y1G1t70Wj15IdZwNw4f2DWSOXeQuTt88VXfYiC1fd4 tT87jLPOLadzPHLJGyrD9ax1hMejP0UeMeYGHFKmaDIASX0izTRIAeXSMdpQfJibvhK8gDUa p2yjw/FsudtvyoO2EVXkc3CztP91uhSe1spzCEKzwPHcV5y9oauDhuY4wdZAj58hksciSOgT 98LP1EGU/oBdUSQl4Opcj28+Es4HW9mDoIKKiyWVg7fHuy9j5MreWr03FZ0H95y4Qie54qqN fm9cfTSH2arqV7l++2m9r+M1rgNeR7aOkERDK1FA87FEd+SRBzD5Etzb6tqueHXVltRUCGzC +KK6L+w68rzbgzE/DFFzOT7NzPLrxeFMEYgWB31V3GPSrJVakDVCX9WU7OdQMcdky2v2kK9S 1yyFOCqaCI2LxqicOGAjJ28szKf7cB1xmKVQetLn65nHL8fQkLwrus38shU2hEbweoTEyzLr NhQKRk6IRpA19LLLCS6n6ePuv1cv58oeH3DWyChUpld8h9EPt78mrUE6Vh0BV1cDLTePcqEH 699dtosnXPTc2I68Viq5bxNIEnQR+3s7LTfzRwaD5gwd5lpvpZXp5nii3afl5uC0gIUYGp7o g/3cEy++0p22Li+jELRihZcJPhfOVu5UgaRSBQ+mBw6dCuQyhVexpCqUZPoZe2m8InBcDeus HCE7vp/uqXsE+8n6eIXMlwGhR0d7xPLevuZNUrjkLSiRPvoR6w1PJO6baZ79NnQmRIHhKj0C 0KlNQS/TFBQXnUqp4XXDKZEWU0FDkpPEKiAEotNTEMVUf5Wjk7Lc5c14MrNsNkUeVZsuCybr ZVKXVVBYY0/sRMlk3X7qQZLp4m8UV5JMW/s2zaShJAA7ETzl8nqDNnU7GLH1amVYhw29As31 sLr5buOQY1sjV2xDmUTx1/UgFgyyjvWEB/2je/G2Htrn/VvQ53HwQLkdPU5evx0+/QZmGjlE 5lO+CVw9rkNLO/L0YU4CLEbfHuoRnluWKD0x5LhZgiNnZbJ+rkPodPn0WkRdwoB76RcT7kJW MSkc4+lxaZc4PbOzFgQJf98fXdK285MXWcjTr8zszjR3t94YRc7lW+uT9ogNYCEW3BRETxeu jEy5Ib/lZ/yQW3LceOhDpoRRk5oMxZ6RsPSIoaD1QYE1BoDyX1HrbmLMp1R7hVqfYrzkIRDi ThgDni2KYGbMONgW7RtrJIh/+IwUa2t26dngJTlHCFONoYqIoB8lYBdJcExFRAr0qi7PBvbd 34xC3iqQ/awXXhD2/7pnw42gChCr56rwEyT8qjggrFK7fJDXxZWPPYWoqNAtpmRVp10z4zUn Qs4Czf5SgMPS7Y26+x04inL7maj6gr846inU+JnJESwkW4v2cgYiDEFteV/j5CjCLTj1/ISG roeGaVt9uXi+fcA2gUfoXv0j/pQ54Yz1Ywwb9vDoZ2ntnz+3A++gw/op+jZKQzbuMwcAMGQF fF/YcE0147BGmnNtNn8477xmki19Fk/pzsjmZV0ld3/WvTPtnEAIo7sp1KnEePlMVWi/GVoN U8NeTiD15avE2U7yCjHdbLU/xQVCyHwq/1BTBu/sUgXGywwb5/AMXKIprlkobAMi73iye1V3 0kwHxRa7eCw39alsKsGFIqvxZadKdiJY/bLHWiasL2mAQeRy3UP9V8de8uZvLJRgc9cisRH8 2Ja0DeTJj9gCuKPFE1VSpVWGGPmrqSUQXdoM1jkW5yDvN5g8s5tNmcesHid8hhn0b+s6GXPw bVhRI7bUdQAIufZAK2k9r8Lzuib8WCELR0GoxnwtM1atWCZPNPUgLw6hf/xbTzUhTRKaADqF vGO/fo5mlr8yiYUi2Dc+KFZzg51r2UHIuuEm/CzwYfGzOuHkOtr9YJabbrvIL8+Kgg2O1NWK SNx9Ul5D7OLHrMKvnY22QldnjREwYc8i8p0XoSIQxqLiVqU1ULG48YCArDoFBw8UFgFGI9QH 6dfJ1I26aHFv4Y181XGBrw6+Fot30tA/GqHq4tI4wur6oh4KDGXkrzGW9SQlA4bldpiOohqy VqOzdD/uSWFThsyeicOd+D0jovnq4Ppwc8/N0JzFinrRPaEJB6+Kt5LGIzjlH5P0eDt8m0TY c6HSpE6pC7KtGstQWZJPu+9g6A344PaEhEI7K1rSen9WSqKx12RqlgsdhyoTyj23jKq6shEG XyBf0p0L7mv0DI4uW/lT8I7J9bnosznaVsTT6iF0pc5GC8oZ/APV2oWv66C0uefqkZYvVyFG KIRIkzw/LzjFDVH4xwsBnm5pK1+Wtq7Ddg4ixgqn+5etAejNhkexcdi7Hb4UmvXa8fK5zgB/ 7/iuDmpsdEU73v6Q7raE/HV5H5N6/ZG8sijMuP25j/hGo0edHooHeKlqGAcoC4uX9+Bc8Ov4 FovNM8UXjfDgqgZuOOeB1EYp8gxbk5KyvFpUG1DNhyjdV2hNrgy8gn1BdZtJ9TiGGNkTVgzo tZdK1TLbxqfObSULtiHbXSIRMMhbeP5DsELte/pn+LcRKs0ocxFiqGWt/pLTMPu9tnmy28qK r/OfzWYPcbAOYh8210qCuNAlHmsqm4TJL35/06be6UCeGbezYTNzWphm1MXsSq9PAHdWlj9F wRyayK2LlZ5NO60YYn4Eo8kI7L9c42rTOCV7mWXwgPBYcR4dOWKi1bOk9n+iKoWy8/WdVy1U wqUVMtFifIqrSy2URhi6WsaOyf1J2WIQKM83iEvB0WFRcOtx68e0EIeUgv2hs6WDX4GsXvQ5 eTsg4WMiQFGhJxEr8IjvMFdutUgawtD1TuP7ZfolLJ/3K8wRundR/emNFxUqvNfFXDjrOXFM XWJo9SfpcIHfM1r8LQcg6+VRCmWRrYP4poYaCdmT2zC9ddag1lk8EFU08XIdjA000coviEMS KiqI0WXPj60G1wjcHkXBXFwPjXyI5qfBjm49+/tf7trq0eJCfOyZrHucK3b4Ts8hDlObrinj tAzqrHEAoshI29Qx6jkiOHZHCqjIBehZi5KMEYaffs9nmbbblaDqneDcbIBLTtGfqDR5AOxX Hn7f1ZWhSIR7uvXTDtKKm3PxBSGFerMrUi3oz/7yarHZus3kDvGUhWkI8qFQh0GIVmQsDtD0 +SDTV8ea2v+448l4PrL7Emlt89iP3wYacpGExAq/Ccy/lBg+BQnSav7Gk/SH1bdpxXUXkbSq RhviO4VnmO/3wikWsoyiTaQ9MqJHYiBW9LgY3AoxZG0otHPYrR/5Eg8T6b1AlSu1LFQr1q4M hLW3pXGc55QGtCOV62pljL4K5UgTNZH9nOLN3W/ggz3zze2UFSad9BQU8BQeP57ZxPtEVNEX m8lkTu3ufrkKCTMHs5MtticIlpY2Wa5GEyIzv6sk4pX048nI+KGxh5AQUWdaj5prT5aQO5Xe +pksa/iiFM5nqtIm6lvy3IYOrBi+ZwqNRF11LkL4ExyNWogLhiTXWsC5eieRDpGHsxFRP+bB geVwEUGJcBYXsivsbI1xATzrVz6izXNDi3CS6gwKyXvbS1DodL6wUN15l3RPZRed3tJ2zdU4 eolVh3dJNgTkKU0Z/1oAorgLghpv4+0McJGmNvomUj31BfINNctGrfCYlx93K6b/fs6OBELT ZS7rk6K/xJDCR+N5qOyN/H3hK0lrLUL8AHiGzB7VIbENiNXeNUBCuqQPaaoUj1ZEVPtNOQXh J77PVLJRb84RzSGichzOS3yhR2hRqFzrdwTKen6xKz/cBEMwZAlVa3EhAvhq1dM0EWJsPsgY oLSsz7B2kTfubthMq7yJbdCo6pcEJ2A/ITRjBmUXrdj2eUrIEZntQOBJ85HZbWHHBcLE9qrE BN9DXJ3e7OqjHPvP85Eg3xDn8cBHA3cFZ8i8qO7eAhl2VR5NGGvURJvbDrxjsWWZsWiRVZwa hmVRV18ptK/228FZOTN57B9w6y9LEzYHhI+udhKZHZDFNL3CCJ1/hiR+Lq3PXVOoCSVINUUx 1l+hcz6OizwLYEUyvnUYmSCp9vpYWCbhIMFU5Fv2fRHboXSrrzWbayaaxFDrxhjhCvVJNEqn N6DkQ9ssV+YSIgt/si0mGhiXp+VUF+NUAg3jln0kYyKcrgKUj39SrYtxIOGqnQlWDz38kdQ6 Pl4RBLn+L6pZ2gePttJ2rNIgkGxyXGamk9uA9A4JURPS4/G2urm3cz9Dh5MNi1dceSS8iTI9 4854SrrUXsLIwUEsM43BK0uXBMET8wcF40X6W5nMcRflKgg+TrnhlqRIK8erUAxtehrcOSqG 6Wz+H/7DhdpuJ1Zvj/U4fYQ8iCwIcI/fIe+avotHLIgirSQLlp7RZiqumykFIfHK0bhdJB2p uYvCfL7qc6s0YftmtrUdTUCmmQd3sx+3GpQlhxLEGTbI3XG60M8J0StYxHZB81KSKEYf9FS5 0ZMRb44CwVu9bANhuEcQmxxYob88U7xsQdyk08m2qPi0I6nzFaJxYzB06DNPtF/MkqgeoEjR g1fEmUI+f7cSrc+jYW4ch2s7GujLPtAeDGr+YY0U8PPtDjU6BL/LWP7L0AaX5swXSCVIRrww KvT1omY4ro/Ra14nfagmlWHz58ZHcpXkOeTImDSC9sdULwir1pfOZKhuU2sniQpNLWdelw2E iVBEQTFOP8PjmS2yecGYKilQpo+D/NDvs7M3V8eLd00DCxpbTzTwQ0ISBKkG503vHXGehwdc G2lEHD35RYCtyJgAk6EgNokGy8tN8xbq9qTRn2DC3rjm3mm6D843PeUQACegwZho5lifb1SV jIuj3rNbvds2qtwejQTSNK1nvcxU/avjMCYrwpMytsCkpkBlzgiXU70iHbv6dxu79TcBhvLA nQzv3pbKDPyPfOjLeTFALRNGiwClAX1R3EcTMDL9F/8Cvtc3BO2ApxrmncY7ZkCvXrQA97gC PlacZ46S8YdiQwCkRtSNAtPuhl9CAq9fqzhCYdfwx66WWdYYe1BbRXeCMv/e3QAlSjcWptDN 0IS44rCPnRCuDjDioIFLdQtGABHrpXXJ9Pk5RYqvCTfdzr44D/4E38PtkBHCKocDZPU0UwiJ mSHy8boF8igk8jzjwOFsKSo1nmiYWgF0/IIvzSAcl/DF8wCR5MCVTQek7le9a58oxGgQo414 m7e53Ek4VH7NOI/S1InL6sf7YHCxpfOjjey39SH5suP96u7nKAfuGDj/GhUphGl4DksEPVK+ rjxZyttoWx7u+6JlbINNOZexFhMagaIrDXfvRwRXWHaIzkM4+PxfHIuCePzPDDM68cefUNr6 UmE2laQRfWonQ4QlC1ayIzML9RiSvu2CO+iGwhllhsrO0lCXJmoBWN1e5Bix8Ygi3JJ8VlC6 aZXT1OWXZypfVnelXy1xValxPkDZUN/mXkgHZ6qYnXkT9XKSrFy4jMbYYaWb1JUHmYLPwWqj bTL4uwwiSEgsO9ktCT5/9V8x7ECw6BBdDMWfn+Ab4alhIhvvDw/73RVWmpK6jOcPa4aLJpYC 1V7mMr7Yce8e7adY5zdp1dInudEjkKB4efe9ufS2iixQ7cS3k1crBIKrI2FBddn2apO45McP vBhfmBLZV8dWTXemtRb8SlZ6gdAJ5G/ADKkHIbgbExlF4bb1AvQmxhoLHXB8LjS1UONJXxuU azvwuWNNlcmcV8w0LoY+LisdPoLx59NyTf+m1GvnQ+siJUBjAqtXPAG84zfFTp7bJ3IVG1ao A5LBI6U2sOTPSekJx40X/ZaSWfbhjO2n8E2J8JQe6ZcBs+fq5NpOrlzJcdNJHOIE7U7N2lVK Z84cJmu2m63TMwRTSspwhFY2sldgqhh3iwuq4X0Cp2hSdoOMptHdVUOEV+Ses3J0sAHsvI0T vLnqoqhOEuQOFraURjdLvatXJVjYbIbtycISja0r38UpVL9RtjMZmUjuwT9H5/W1cWr3XscL m3gvP7Ht0wccjUakFaqfktQb8Oe6Mia7OCkt5XEKb174kCjx+DIpAwEjpCrQAd9Ma9qv7JAb MrKv2HL2xNsZeQUfeX1+9D3WwTGfvjhGlciojZL6N/9GY26PZ1HtMPmghrKcDnk3AuNpplyW JyTccTXXI/rsF7Mtl3eJCfHh1ywV7mt2VBqvImiOrTK98sP8Dsr8BzJ08wWVNStCj58CoNVu 20ClJ+kepWipdWlNv6strMOVvjshyhF7aKXOKhvk+YuSFY27LFmmMV2nD3pHuh6n/MFuZtyO NjTMztZn+IpOzmJj+fL4Hzb9fpPq0n/A97EYfC1malYk+1XGUhkrpcKc97FwNrhX3E4/+vV4 TNfK0Z8sX/ln8zp5wHhqM5aea/riEhrmjPE221fitxFFz2hqvJWOuwBn7rbOnWswGhdlPEVp bMq3+Gm4bjGIxADRnk33NqGGHrji2PbY9aiwxOtXIu/UIexV31epXjsdc8rWAePxI3oII0vu Zm/Fj71syvwGBQZ8cCcIhJnVNB/hyzk3IDVGIG4/Hn/w5kInXOlw+DKSoh7JrK8of76ivW81 Mo51II2tT7PqR/da/dl6y7zybfKoNDqeDFO/0wvx+eSwwlK8DRJIuEEv4kAwDodzQ6BkmN/8 CDPEfT5xJmdV+/qQM22zVg2Hoks40WERBujs3iW86JPK2Pac7orbyM/u+HaKhrJHTkvM/yHR 7oekWZpY3OzpghmKqrVWxETgkq5RmM69dlzjlCVUiy23USfvDMVbsI+vHJz8VepxY8SCLnV7 slKcu4RcJfHCwwjd8sZsQq5b+dCxNdbE4UIGmfo3amluFIZV6mQhRUnc5nVBF6rIRkuWCqfl keAbVCkEJ9ZpdgJn6yetZvcYo91NYvXManBDwA0jp3fnEzL6hBRJKiVdqxAZxmZWw/YHtTYL /eDbZeW5JA6EUyGmnGcw8WfRgkAoCGJ3QH+5rwoDbN2j04/UnFb3AwGxdrBVbUnawH7upe8G p8W/WbSx8A/Rep8LxQJtW056nBozoeZgRK13k8W8CTZ/8nGt1NNBUuC2s+FDmzuc5TMsYaFo K7m8TXNv6euV0ATdAxRyHggY7klalJC3mLOywl3I/S4jM9lsjh5ODybBSh/vz37Rl1mt+cnp NN6ibOfx8kCd+ujiJVV7Ctdgn8PukaOhd3CHItHtwpObHOFHKEpH9gN+dxuf4YwPXRKp1ER5 SWBTNZ9Irm/LmFuJ1CNjPaiOh632lbD9iPn+lQtLc+Xjs8zRUW5EBcod8Yx7TRNRV2j77dB0 BfElTw/Vi3ee50lyAiYvhcfd3ehaN6RRTIDwQ3cxK3M1ZZqGR2w9RtGOZLOnx49BsTfCQC8P rop5b7+KFhFA4T6hVDd9zO9D+77iF9+0q56DIaobJ2cQfRbs9Bcg0Ea6cNcuZJnxnjo0bQqg EWwMHfalpzjt0EKLDmvFsLAf49vsQhdoAR3bwNqdBBfOaSZKzGGYV27fkpTpiTE9jOJoDbdE jawCcEBO99yrdrrP0B2QriGVJZx2h8SRsLL5bQ+M35D8ftw1kJF5jML1wiV/XrF+Re8kyiM+ BJ7X9T4k5T71ZIMqBM0gZXIecf7KR0bwYkYmzPWEx6gyIrNuI4UGqc6TXVonRdEC5Ptb+oGg tIH0d9NvI8fXlqepw9tpbxXiuoswB3lml88BhxZCflzQGxM5krvmWZSI30UeROKof8g+M4WY 8Bx70uy+tg50tzszfLhKdhW9a7Tqakifa3acHD5wrCNDK3ALt1xkYtnjY+S9QOgTK9MeZk+D xkQL/Dz0M3HPxKWV3f9aSiwb/FD5q7Mp6eLmJACDd2MayVvTJiU84It95Kapt7s3dt91xOIc wwt3PgS4zqfyuB+xpIdrk8emxOiDy9qvYNCdHdafOhO5GoIhqFeaAT4EevLK4AhGU5HWiPe5 R5Tiy7pevwuZghO/xioDRBW3cHITADBUZBswCv0iMlzqcaAyTHOXwHAycixKMjN3wdUVtRlM +PlLGKSZ3Du7koOAte8slwEPm3WTX82X98XwSgtiouMph6CvjmjRkRXn44tBlJgUx7vCGcmZ lwLQR0xj1ArjguNFW3g0S59WjDSl9sm1RTQKuvrP9Z3LcCpquT7uhLnVTvyq1gjGWwOF7tda nlqloDCrf2X4Xsh/oDpSp2JZ1bSskoQ+IZm6npdZpUXUfyHUcUXxpIdSwvAh8sV7UNRpr+XT BKUPJOZjLjKyi1tqaLetxa63iIQ3N7dRl2YZcwXhtKW7L4dXtGm18k8NHxftZdYMKIQWhWNq EVmq7zHWWdy/c605VdwQ8dI71V6Jtk+aMVOarSRqsNIvOnRCjT4Og5zgVdT4R7qxQ3QROqov VlIQ8AzNXtjgh+e9JVod4kO1KjfKTArtBb+ItG+aJduTzbI+2R/nxLWoxhYHpItkeaj9qPnW JK+o4Qq7nCUESICJZVqqqopKEnDQTEqGxDeQjVKgKQsffl5yacNj4IynnBP6hFpomEBrj9NO 9WYNpc+D7Mx/udOEJ00x8rn+2+URstMU7vlgfahLsS4ycRGbypEd7lXbOnobsqwSXKj1voKw r7t5uJq3/pWf1uCHuuAxXUQ2FiQlqB8Esx8xSexdxj9gNJN1IfIH9Bv4fhu00LEQsAcuS3i8 KDuL2WXh1R/fOgYcM1Sa5q6Xctc7R9ErC4yUZsv6vVgrfRNhkAYxQQPI2wVHNvgxX2HD9PS9 cuzNpLefDAxaHanH4nGUcx/hTsrmJ7GmGNsRHrJgFNZtMlJWdrBOgaD+oTKsst+sSMg/tyGs nQcgZIlQrKQ81sYHYam+lXLIR5hNV6ziiARImFxPCirsfiqfS+RDDpVkW0ahtZA5aF+UIQ++ EdOVrBoyzo6xVeYSDC5TU65XeeG3onrONHKhuSdZMv4JGT6M55tT+LJfPtk1zH49F9tT0ns6 SvvRuqsL0yUx/zi6Jmj0UiGPz0VWeUVczd3LA8n6p2TTXW1bti0+rv0RYUEX1/0Cn5V8ERM7 wrcR+9CFaL0ZyZ5rhL1nRWSmzpOQ0WWeqSTW+Y1kek/lTTwep14805asx+ywhOI4KS1vf0Wb FvLUplcsfSb1yw7tCize87KKO9gLr0h1Q7NlVeakWKpoCP2NOiHiDGiqz9ZBJ2eMKC+WBG8p K27ecY6xNeCzq31Kv8l30sAt7bASisfEZF0mBr42Fkaec6irX7k3W33dFefDHs7zzamYiVpp 8LjEI7ecV5o/DrqL3PekYFhMPTckwfPlE0dr1IY2PUp+ZAEQrI4ux0Fa+vNXHS1kdnu8CP+s xYPNXvq0+wsOmHimEdAe51TC/tHoS4X4+SPdLHYlLdcT81C7jXw3Tfhm7Uu/9Th4ANrqhbFm B26Ypl4glqetE949Z20EZmAuEy7aKgwIW0uA9bTjToRkAT7bmk6EuPVh6qg6sPFGYakbFkV5 cKSZxSAij2hwGxvCwrxi4QivciNdp3f6Zl884Xtc6uXtaDz2ydwAIO9bywCPZPUv+DTBWBle 7V8id1WZdAY/rVvDqZKOFUfDwWwZJ4+var4amaettHUlxbPL3QglJjgEzCPqxjUnHQ+gaUrF FhsQpEhvGTBetkTX4ExtRxgp3xNjM9NrpYUkYjJOhFblWrKPa2FwTNYSHFuyQFq8giFFsYcd E5Op3SbJ1ZebBQ11/JAlM36wSGwSrc783aKg3o9xTGb/47dRrejInDPabyudV7O1D1e+7Fcc IuIOQ8HU8AIEvd8Fm3FV4+tXv8mzgwGYK2kQP9iZ2Mh6zy517v+KOnbgG+Gy7lnDpXRF6oV1 FaBBzEhBKiwpFTbHKV2s3Qyml+88AwDLBhGaFcA9yZRk8nfULXitvb4ajrIYWrisiagJ5nvE xVKj5GBJdmITwRbhJzCytvdIdlbWLHz9KuwsGytHQG1ZHSppKgQ53I1VKx2RLqrC1ETCv5vO Q3OIL8ZScngL1eT0LTiyKWxjmMMR9YsONfKiId3hQC/8ouOC58CEZF8wsm82lS7UgUIITWen lK9nHk5hONn6TZRy0FPdPQOi1G/l0LkOv070N7NN1oya/gnklVWNycy5yjCr0kTSelv2ieSc 4d1h9B/PhaQzHD5vymjramg9J062qwQuJ0NsVLkjr2e6sZF4WzP7WSQ/4Yfu5cRjokckWwdp XgbpPiXkzOLNFxoeC4iyU82N8Xt1aLSdKnhd3Cy7IDpO77OowF7ldtAeftjVKDIvzNqrPHAZ oFxWwn/On37gSX2tnByZOOMehtNUtZo4jhK8394VySfV07rNOtlkgPpFCE8FHTxx/JEFEsVP cdj+csSasi/aN3UM0nFawQKr74tcT6yfvAuvVNSDTRg09/6GeQtHVr13csuYxXlrGu+iPujI 5dcRx4JO7rFUoJS6RkPTdqPvrpL1uAjFVB9CfDD7Z3sXJF0591mdHUIZ1+4YvzpqstXYSFEk bG7hMorJc7j1PBUUyL1bafCDmURFWl1/MegPpOnrDd2fo8u38n048qxprVToiiY4TkCUx6e7 BziMD27UY+X64DAN0GUCSRzxBzJ7bZMzd0T7TbcWap0CPO1b6xdu4Ehe9x/ROZqIzpX5vjJm Qn2Swbkl/S5GwlzvrZFgqmsYL/Yi/WGQi4w3J83046uqEYUuWcvWFlH9F5l8LMjuip+MnNYH 60P7TcYOqHHlEDgcmxing/Q1hQnaJQq6X5p99shcIyz3TxPKbCyh3xTzDzGpDq5q7AYJKyGK LTTeoPMybIKfZpTRXQvzGkKuA4WeqXIrGhu+vbR/8Y1YoLdc1YT3iVtPKSi8YD6BCLmOVnvb dlLEhNlmBU+Qn3IUDE4awegkSdjvonQpcBuNFp4NNYaGHM3jR9FtwygAIB0jHlfGAB6YpWXY RhIsnGg9iIgl98lDbvgjKUO1fVpAemNgA3jnFc0U5eLu52xQiUW/YxqWWGj5kniGKz59bhNd nogC0pkbNBLZuC6p7ND6B4yKvCbKfvf6sWJexUCaNju4OA1tGLo8GmlbEpSwoFlbyqa9Lmn6 2dUHO5AddVNLhpIxDYRWtStbVXY5mcAdB2qoJlehqpxsj/gdXbyiovMJKWQ3J6+B8y0n7Ezu yltJ4MMR9M/50GNaKCZ70YMhpOlajtB+FtPWqecDZrYbMQHcumBgCf/XCdLfZON5RmaZQ7Lt N31dEEsU/g1H7tiKh0TzRAiE5G6cEfg/649QqaEqlJKHeUO953FcwVjutJh+Z3/bOOX5rrGc mhRpddcjwBd9hwy/Q/dY+WYsiOVtxymVAuuUw8vnQ9NK6T+ZeJ3gdgbTO9en+Mg+KVVjfKrn U5z49NKLzac8l2hRLmD8kiUMzd/i/90oi3p83eVofdn2cVMzi9+JI9uMmwzj2V1t1xVVmoXI zgiiIvB4K4Ok9VwOvjJ6ILhgD56D/VrTAGI+RSwZ0pSGwfTjHbDa6wvgseSmZZ4PUscxRDhA jVWy61CMPYt+e+1zFwWywK9BOX+SVkG9KbXsSo8FHaGu0u6u/QUhjJi9RF9gkKIqgt2T7NWO Wddkwbp+YGHKxJE6Qkg8uy4POOLNj8Zd9mkK6lT0VZ0temXukW8WQLbPLzDzT4iiIjR+5RHt c/nS0cvJZzrk5iqYrTZlwaTOTbXrImbo3lIHDgba5LuSuGPFBcsSRaNpkJQlv2KH65ixJOsY cbshLurK49uwu/IUz6Mz1p0cwWcA5xzblKtpUUHOnoYPJyCeqddl0PeeitJlF63xK0O8qBL9 LsWoJzJ9bFshjubC4dcSX6XykxuVrEfYvmTRTTqF/F+M8DsNhhfbP5AgoxyxvmAKCsrjMm/i vOB4emF2k8FdhBONBKocdQKlS6GYp5ifsvC1jnB52lYAuFW0brXExp3KSRpVe8uTsd71xGyG KCc6qMrwyFAZ/jUeiG5P0mVDnN1KNvRkRuyFaUefYrJjQ3jnP9arwVcmBH9K8Y6EcFOX+vaT KaPCFpWp5TpY0g1sAj07odcB/qhEp4ctkyL4txSywC6AvmU9WLmGY1mh2sRC1Bn+EG0s/Cv/ dPUpqYSpBykmTIIB4Ao5rUAUcVNN8yVpDZrrgeRrAWHr0jCTmpXuol6EqalEKZYaJw7JfZnQ vSnQkcM0J6sAE5KrC5OTjUKxkM342zYvxcpRa9Neq+WRLElqOrcTvPfOhSNVuVzoIsYmgu6e uQ3gECoYXzJhKdyTNd5Crdo1ysd7L5uvwpEOQWPF1MYk8FPLN9daCOlgQ55MdZ5F3gvRfi4J PT2rX7x4YJAZ7gQpPyyIZIshVfCMEbN/vTh3IlJefbiFDtb2VYauw4U4qYmVkXZtzj1xIJyf zukvOiBrc4XR3ronYFarrBXrZKQUC8GzoNyY64n9CQA+fD3ZvSAhCdlIYrQjl+bRFTZMAe65 NDuOe/UpE3+fCKC+X9K7Ne9v4dDJWzJE58vRypePgHe8Sy5fIggQObuHVBc7dsPrT89yhVln uWrR9biOZCQ9Ubxdx1L6momtz4AgnnEBSHOX4Km3tsYdV9OZAg96w0kSFPNTUHuUXUGzrFQx QIF6QQri2i4jaqm+w9LDLsKyWn8Yjlz1EhheJdGj+pabiA7XoLV9uaob9m3W/QFDHpzrO7OQ GZ7Hp7ckvGGJL2CxwAmr9EOMjsemxLNAP7jhMiMLn9+X80FA21a9K9GzBnkDAaTFu/mbZ+6a lN/pe2HTyB50kTVKdkEdb3uhDZISorcxfJ2RckWrKguyLd0+Z7k2viObBCXgePf4TalOics3 /ZPf6X8RujE+7C9f7mxMuZdBcpDIa/neBiDbWoPX2uIr+4fNDuMhvGaxdkUy1stiiO1iTi9H mS823docfzaSjKPNp8qAllla5qqGIMXysCB3+9n4vC9QihtvOWp6IJ5DZInyZNA3E2NwVFRE VQuHSjnWA3dvUaggHcBxmENPOQcxrbze5SHbqQ77I57DGes8kEq5P7Sy00+PxesnmtKbWSue +ocm7QKNxrLpsImwiVEU4diww1aoOT+8JciBMR0JYuC+TtzM/2vTLLuiYBgmDC5dS3enNCLd CEi3dEjn0p3CwtLggkgjS8NS0kh3SHcjIbV0I/ne7/fnN8w5c2bmGimsfo0im70lzLvsNC0H SoUrTfKl03nwLcXW0stkHGLPmz/gSrvXIeVa/tlBYsFRSAJP/G6vxJ+hAopaWNDD+Pn8mlMe nF98I1Fgbm85k73WrEaa09gnuU4quZC/To/77rY1mmP0qFyTbjcFixz2xrYMT4jfj/Pelm7i XmI15R+tx0RXyrfMptiGhLMWrVSIamHry8fh93kthv/+ZJBhH/V8ZjzbPg3nEurZboCw/IB5 NN6Xk5pWVzHbLC0Bbwfp5PE7fTNfaXX6zSJA5N/yP0qk1Xjm+DS2Sj7bbpfH+4Br5Xdh7XCl Ik8kKlnIPKtYb5Fvj2fO7rfk9wna9EHIJ0KN0rR0MMA5rTDnHYu6hntT3jRkfsUCbo1Ks9jp QafdQmr2qzBl6kdAjXYUX/+59YFvoZktEx7OeCf5cjmS5AUikJcxyv5dtpXV9cZqINNuB6Da kpXZQ+Ob4pFvbU0XzjGBOAqnmXK5xwULU+KWpiY0zG7exbpDechJ5V0+5ud8ItPmMde9jhc9 9Sz2L3I1OfmV2r9+F+KGacVuHToVXwwtGWS8eXYxeWMc5Ov2YFtdnOC3prGQwLYeoXpq7MxN 0VeTSSVE1BBA0UaiXGdeKCZSBSxoWg4az7L5p/y4uxsXH63QJ5num6B2NTJc16xcVmnMX6QJ 1y5cjriyu6y5eMMq7P+6rVW0stWtCVePlRSTg0BfxWmPGuY+KA/rzpoA0WVg/h0s7VhbIbG3 CziuhOnqO4pL9X+HtVGXAla/ySChHrUFiGF7GATNYfSYMuis6SwDX8wGxhjJHz029uNf0rIN jN2VmjBcxl0Aj7VvZArlRwheSY0s5JziN4xSVZGGyEDPtIA6SE3fUukwVcT5stbKzBUi0K08 jWtqrf/nswf9effWzAgzR1GAXf2fBMOjLy4DpkBF1CN5E/U/wfxYXk7YAv22Oz5/f3iohfbz X79NG4xgCwawM9uG3YRcvmt6m4LMwTeTRsWClo1+sie83K2tmOZnjFlutJ5Ut2KXiYXPZob8 nwxN39GJUDy0+FE8cEZhm0SJCpgW1To/+DakcPqzd1qF35DkG+m2yKKC0xp6nVO4ywIAkq7X 65U7+qCjrAfgeRLOSOhonFhg0g/5ZxqXiZf6iqUNVo81kciMTlRdNQlSORc6yASL0j0ZX63A OYqmzwbs9I8EUf+3u1EU4F5qhVIf5lsUeGRBtF1Ns0XpxbnpuGO1DkbWbpjm75hhQN3J5EUe +Dq1poYWpTltZqVZuz2k6+Xeaix1AqJxu7sVNN/z8irCW/rrZ4OF19ytnam9dQlUDzQHyTeb LIhyCf7t1X37UjKdY8IoCZoIKWG5kMzR+ujgIwYLOKzTxMb5vZ1P1RGVNbtNRKjrn4NkSwng x43JFw9wwvKFJNrWB47bK9ipwEDSUMUnN23iJi+qzRawOleuCajrohygKSMC1Py4p5Q25oIA hopd9/34uxdXSB5b6ENpgzwTxZ3MaY+VpPqqpowWOLP4z5J9Lg8LcwSJ2R/+7i8zkGjxHfhc Hj+fhupZy26rXZomiLBO4BYj8xLvtYypDDGH9j9ejvPW7QciQLsi/FemGL7MCHKPY05d3QpO /qAewFPHsqBv1vZXqlqEDPvQcNBUQJxywMGFYscqzSB6jDnh44OXXCYWSZ9Ayt6BuwgDPxkv 2gVqF3cjbd8fNmKiecnyNhF4RdNgzB1xiJctu1pgsGGTmI70/uGyE0pucHksiHrskdbRQ+K8 aXO/z9n7O++EM5gzttUi0TU3VT6jZMjt6CxKB0LJ6JLmZJ/RhR3mtjpWpJ04vSu7yCbBiVoi glFd+5Vbh2f627CVlACWXvGJhbFyPdaKiAAEgHX6raa1DRyS6aovFk/zP87d1FCZTVwO1iOY 64XB94TsM2neXfswf2JBXpefPovMoALWlrOY0/h03PjUFRncdPGI64MARtl/m5PjyX4xT00X bh0rciJ8nzWQ10Ju6sk0xsfEy4whAXyNaVY+8IOl0cPKRW+83yqK5ZDtLQs9vsm5bHFdj4SM +YRsABn1f25B5w8f7x/DfrjGXh4os+X6zuxkg5fG0l4/6iCzr3oq+pV0My08BrTAZokuPPoh zbWo4O5/8B6Vif9F4QfN79/SiCynXPjl7Pqu9kvC6ue5fZdRQ73bj6LUlegEzCc1FzTyXayB G+QAOd7V76mkrOB/qaGUmKFCQkG51sQRhMoYwe4dx9/LK9Rys9cNH7ynWa33NujHrDz57dyb iS5yVY1XyN/PuS1M/uKEHCAP+OpClho38G0E2wd46dhi8UsVpOhEhPe54Shnu8BqeEJQSvLB WFylq8qZIDxLb2kD5KNiOQA1meT4c36bdxNmiuQY/CFao6l1kkAtnTMVOlajVlZ6/e4+yDvN OboGxU9/GKPgpvkgrlDvMkgkW9GfoYY3tleUc9F47nUVYMQysEYMH0VeFF+pcVA6rZxpcrL1 Ror20ZbF/EFO8ahs1Sv6M0A7KdatNv2kgligE6jZ995TePWAie9Py0iPaT1TZqqU9IJmHanm 94ZZkWbY3xnb15Q/GOjqbu0DbhXEljmq21J/mVV8HdT/ypc1bjUILwt0o1eFydd6u90SJ/yF koCTuLhgXNUBv+lXb+dzHxqU8jGufEf5f3jyuRGciJq2cVPkOZijFOHlGupTzWA3dLq3PoxG aJb/og7GQka6SA//iqu15+EzjNCK/PsyZR0S8PQ1oI8EUuN17BqvVs7QA3/C69tWE+lysTns NU8/jdxYDgUR/khEaJPVD3MRFCgact/5auH5EA7UcXtlp/T+pJhGTXKfnnSSN+NDmDrWpdF3 diE/++NhRuBjNZM8qGoKdOuFvljaJBEWpok8fqg2ottFKbCZedVNYwxn+aXr83ISRY6l5NWH +d11YZP6baXnglB1Wor+WnKqrBaJRObjK59Lub3RJGpBSoE9SQO4lxvp4WrxpkRbW7sH6+qU L5QkB1y0D/ok1aoyKYWoj/Rkw6XkLwhNfhBwOuw3kDwsQMenWlClqfdoxS7qezKJx6/UtTrb K2Kj43SdrWFvmsrWB16LUfyuD9uuhHHSqe8ZUmjdQId+oSzI2r1iRWeARpoQPp07AZYd9RG+ FaUywb3flqAFHXgLo5a580bOWudqQKV7g3p2+irl6RO83quBbRi0SwBm3kCsbazLh6zRjqFn 6Yoz3elnJ8dXKeNs6GsSlfHa1jqaluvwHirGDrKhHhbPr3Ws9cwt/VynbGCdjioi042fw29u SD87cgYGcVUg5tJO1u50kyrnSoy55cwafJjbGrk/i2knMw389XS3N+uSTpYOy9jmanS99xCx xw03fhtUyH2gEFfxHTDI4VpdvPqQtYDGVsYrsq5rqnBO6XZXZOy60hZD5cT5+jXYK3PxilvZ ls5Avjj8vXxxASrjdVYbU7vlmXi9ZL+pTZGuWbGCsuBOAh1cjPFTMzY8AME2XnRKv93OfqxL wxwNsC2MKxs4XRdXVGLBNw3P1lOLViaO5bpFerNBqUq+4XEJHKfxMM6yD850+7pMNQcs3fxi cNBhxhQuF3yBo2x7lb5yqpBksQfbGddAy5PiNS2zWQnvGN6cM0Lkxk1CfcGkEkMV/j+fJV3b u+0w1xBcwI/a6A68I4Ogp8ETsKjsj9mH5lPc8YdljCBSWu+/tVdJGpxJzqEKBIcWy1TOVx7m Mct+YyzrgQTp/kyiriNfPzt2gzySGsPtfIubFju7jzvK+GCujF891AFhx8wlNuVIYAvQF6qG ekUnPYwKDmrQ0AyiEJncl0RS/sRB1gS7oEwcNCXQazO91ZN4rDjAk/btC6I93VvnmZ0KSfCc zgOYfIG/fZUTaFbBqSX9s6thdru+N12bRCCMjBVzWpzptrB8q49HCtzFBBXIiOuU90kyuuUe FRLFX35sYDSl4hU1iX+65HAhNVYbUeYv7L9P6L8jQrVjiMmoU1ig+Ib2yz4Xp9+rCg+pG0aM mLBs3zsOzM4Miagg8uX0R2U/GF/in73F6Pxaa7iP1UOK2RhVFZb1BNmcXVFjxs/UtUAw+E9F UNrULI4s3RsjZRD/hjqcY72eZonK7M+mbKaQ+D1qSE/dUv/e5CwQjb/S2riFvbf7QZOn8CM/ QJTtyuhdiuNU1lfp7uyd0cp9AG9Raq9MZYcbvPluKyocJOGiBVmKlPb24uTEXw/L7sSM9Kaw QxSQMZZz61V6K/fSMoB2tNrVIkeQAdt0TFyVl1Ghbh+5UFR7ccsgJ+NKKDF60u+glmyWIRxb LTEIP2LGow+fRa0/yCXJTTT2dxTDvl1/u6HS8Y9XYCnGHftBEkEoxzymTFmOWbU2MyXSR6ba kGTU+OrCME4RpBbkk5q46VPP0Cz2nSrcO55UqaCyZK6lYkXdno5CTYVmKI9DL4MNT9PWwgHz ACfE07lQOozpvy6TmmAMj4pWFJ2kOwVquDAWHeZczAq5Rayf0igJuHAhace1riNcxwPJiDYC 55vEcb9+ChuC4w7SUQTmNA5jIb1niLQOdpT8fMVBrPK6dAbUPOW+uBetK15GOo4xf38MFxTW 6A90H0XH0CU1tew59X5FHa7QhiBjYZCetp9rxq+dbd1aSqCNfSJiTNtN5xZRbIUbLUvx2590 VAvWi5ioKknSniyO/Cy57WaVaevgMoqTMbIYVs8DKw5SFPjDeu+5mbfZckVW3cykmP5NtCuN cMVXedX9ZGtOfgJkyKhnX50Q1cNSCFJ8+osO9q1NDr6uCLLdMelDLrSAh+VaAnP+5C1MRvTl vJocNMnGgVyGvkalmjuTumbTUIJPd8hXj4MdfgIzgQ8wpl/BQsFnbCBPE6/bbZ6hbUqfZ5Gq i2kzJ5xuzuVtO7PyPkDrFvflkuQdhd/XXBZ/RBVGXAga0hV1hoEUHo+Hdyl/uJhykVeafbLm NKG69o3qiHfy+6zICRTNocFxWpFwo1FyrI0XssJa+yQRBmuzePLghSDlXCTydNAoij0ISLzm ceUugp+BlyJDlOK1E8xwuprE3LIV+hQC9kbLSr6i5UJJta4Ov9PdvreG32xHeVEgoZEh1+/Y O1pfhTyNyE0yOaOrt/9G+/WlyQpDu5NbFEA1CQPTnahwJObFA0+8zOrysZq+yYpTNhea2C4Z YGQ6rKuAUjpbMNMs6sYbAzI9K5za59zm9xSHcbdJDvmp5wealKoOyZJbsr00ojn3onc9ksAQ Qj5PspmC933uKBgmhdU7AayZR5gjKQblsCzxpRccdXQ0/ZVYOmcQp7dK9c+7Ovx8N/KADNbP 8M5BFh1B5untIVZLsu/36C1ZwFXb0tQCVMe2gQ3vRhbMdNXMPpiQWPHvLZYzoLj3jp7F3B1b /nn731DsnC4VNNS5l5X3dpVGqWn7GqTi33cpT6Bkd3zyxkeeNBQnJzoyOvLwlzVF2gWluBLI 1Ae5ro9I2itGcz/Dd2CZJDJGDX2zDjz0+NHzLLL2BVTEy85wmrALfc78XPlylJFsetSHUCAg 0f3DxccH3WcySUaAJzXRVoYF5+GyDnODG2b0Ke7xpYXBkRqj7FckMfspne8TGlD9uYPfzfUm 89Hmb7AMyZGoH1acPqfkw0QYkp4pnqBQCl4ybtRWvo9kPNEy3Fekcd4LjknkOiYIa36sJ0nf E6/4eVGzcd1l3oVyvUw/dP6jxiLFFCQNws+n8tYlyGfbrY2jye9KXRA9dqX9ysXKCG2Cq8HE R4f5VpuDtJO6yqv1fABJ2Fsbn3qrm17kQKORe+y9WHldRR5oEaebLOIxFHOs2/8jL0+aXouc uaDzpugjzWUH60T3/pf2Yq+sdDdFT2znwq45RdvzK+kwL1DeW9lI0ybePxWzZWoycWphZLVM uNNoxtcBQYxkCoDMAT6FpaSH5bO/Co6X+RJ7A0FqZkwMTv77wzilDMGYGYX2Frbh1WpaqIVN dXnNTdn7Vb6R1ydRNhjW50h+fjr6azkxrKrlaZyh5q2ilts8w/LeKuoyq3NekI9m+cSycR0N H5nF/e7m39KaZ4tiA3/u9l3bL8boSTkTIRQbttQSLXdqbsn8PIWo2rI90BUQqPZJFadRpCQW 3+NjyS0Ft6ta26trVQVmipfnQA6O9oqYkErGxWhRlot+NcF04fCjvA2Y/iLqDORX3E74yQgq m3Nw9m4bBcqOYR9jXaxTfC0RkbXwfYLsz5fTrCBrNZN/Zp1KL+r5bWbiVOr5CgoOEx9axoOA pLctceArOTFcN1LMmW91vVCTHM9oabLXDKMdqlFbb4ZNNUzifrVdm7VsQFHj6Nif0yfkaGZf fBrbv9HF0a09JdLg6JUmJa1ixllxzJQcpIYErmtEQfe0U2AhT/+PQlLZaa9sA1ukqo6F7TqN 71v0/Blyb47IUZRorKoB85+iiSOqj7FG1dn2RgQKSMx699PeKef9NKn3ARaD/SV//Mp0D2T8 wQPa6nc3w/T8pW35vuOf/OXZs1UnIXO2wiTVe9VBmhwbDekBnade6n73Qq6nu8p3CRsZXtlC AOhhxbA6YhpbkX3XOwv/pNNGKUpeklCZK9K8CCrMn8BG/my5TljNT213JNdGQt3zIEsu7WYJ rso7bBfizkmVbBbPcpEY/f/hfDY25d0jbRmdoxCZ+aX4pjRodjFYTDEwJj6JGaVMaDhmIPBk zJdH/qffokZQOHplxqPaYYI/r8rwYJKihJbd6UFfFsYXj1iMB43fIkHDh0O3TBlukP25j+kP 1bIvMWHgd1Tev2x+BbRThEoIGM/BXR6z9A/6CZw30iir2Kclpj/hfYiD9A7gSOHkKWegSKWt RktLGdxDf+kJklJwXGpw8CevAWv1Qs1zPX/K8SZJXE6oHXE1jqiIMc9jwEu6f+OZN4v0670h aNdMNwo23KnBdt7IyZj/I+zq1Bpu2at//SfzpeCTFMu8Xo/GJhIE2ce3qoEaIW19e+ps9Pox fx3ywloKPoiFIVSDcoCGcfytV4gqBuu6aJrVmaevjQvxhVqWJyS+WF2jchDJfpYO6ZtxLcWO 4X1hsxQn/GdTmRsxWgdXB+ERFr/V6pxwjuCxdb0xc9JMuKArM7hIFFt00kIpyRVfZnW7vCr8 Dmkn47hn0Xv4+LSQp2Stm3kPvS3s89yPfSMAQxJ7pKr+DyiE+wtOrqijxNHNUBKwoDdMcRJJ 5XoRFCmg0GmgmRswdQ+2u3bUwFk4LwIY+SSN1x8YS8z8m+viZ0OrwhoY0vRbzoMH5BSE8j+Q 2u7qZxfwSsHXbZ+3SfKKEgeAGGBLDOle91tSN9rUDezmB9V0ELaC0b943dgGDh+56Hm8q8iX gAROcXREOi5fhkwO3U2MjA37qlbDJ/Ilnk8ZgLMpzCTR6Dtkf9YJBlLJ4sCvQY91svrENWzf yTWz1l91GO6Wnv/aAWhFBuNRhPJpH8TGGS7lSML0isYES6jBfAUmsmhHSlfKf37mEwq+JX50 qxArS/loIR7bmZoYsJ3UBlwo/XS45nm3unHYnkp+A/UDzNd+wQh1ldAozHE959cryDehlRLG 6N7HxF8+/XYqZDd3zfozOGuhu4Eps4a8wrlGrEyi+LKlHkm27D4q1jQvEpdA5CWgZV3+Oj1i WkW/inYIBYt7h/ELFSSPaNIqcJVvXeMNNvOfTxT1Djd7uf6Oou2LYe24WXt1m6ITt9xBBXIj rquZhdVEFul5TUbYwwgxV8x+3b0oZfs9JzaVJT6fVblJ+cnjbEV6UEiOA/nEcA/BLlqb11eD Z5Z/+8u+rVnQC50Fwpru7RYOavIVcxsaqOQcBvY3eOwKgXW0rJ11+AwjZ0IRVz8HB+O8nGgY r85eSOEwKecCbx9TSWRktJSjzR+AsuTgbc3BHfoeFBgCfp/PBs3re7IyXxOc8KYXraCRszdR USNM8Uy4pe43oSNvCNer0XYV6c0IVDk8Aavh60wd3atakVwjvn2aZgSgOqMlhtcfSV1VZqI4 MWhnpYAbvTWcDWb5k/y5jaouG42LbB0SlNK2/JUUHfmiWppaIuPT4wzCb7BgFfnHSXc16Qx6 z+dsifUwNZbBTDyf1qSE2y3K+0lEHeoXTzeU7BcavbH7nV018RaV8lQXRhglrxvR9keCTRkW oHxqfKodPOP8fuNkNi5IcpIasd5uyJrtiJu4PnRLI8tNXX490tQZxcx1G339Z7gi9A/hHjGb UGvgZ408iTM6bx+mZaUp5jA0hs4aXISBa/owZOHTUkJrOZT06p/9mZbKLR10D6vR8kekAX8t w8pbKyGhEOkF+vFCmuriX9q9olQieTfL94Nhuz2Xc6DY/s8qTsq9DxjnjLlvjQTadJuk0xxH YChru0s7kb8lNDXG+D9Je/CHaFe7hsw56hWyH/XD29+16XehTpQO0DcnbxiinXucyysZ0s1A FVXjZwXxTfQna7DawV6+VxvDjBS5CNF2HY63KW0J41odoIsYxO8FkVZ3iveJA1EFeYaxeEXs C9Q0pfG4XZU8PF+1WUJY2sg563po5ifeRLHZPNRyzdZepF+2SdRu4VvVDSGrciav9CgfPB91 paacvYm1j899V8zyJ38sV9L16gOScqYLOk/04xnllj7MCD52pN1hZxX2mLZOFhrJGM2YCCDq DJFU1e7lT/wvpbe9vl48I/Mphow3G0nLUd5HFMbMYNXaL4/74gOHUnDSTPvzH2aJBbPmija0 7Z2B3YHAj0csz8ntNZtoc4GU5aWb0xeHOksI56XfZTAryl6R3Mvfw0sHE7VvGAi8F+dWuCXt bSz0WjWE13k3BsKeMNuAToICn+qNQaQz4dleb7bPX6ZQD1Ae1A0oWIkPrHLZeqd4BBXrZGeG ZEMetgt6MTqyIvOQMD80KA25BOcMsekHAb+t4UrIWoMxZyLXxk5y9hqaQh71heNrDUET960Q CckXFuMWhbryv05FITJSG4mJur+e29+xX1cyyZoBsAsgTS1N7Kso5vrx6kNYzrhDL9GEXpJM 8d6BFO+djo/cK2jLRFyCDH8vhSN9aNzW//J2nr8QDCVB/9xmg1y+YTOJx5noWcYnp2I5eE4a 8rnZFI1KUiZx4WAPBi8ZeP9Xi6Dp8T2AABiwKFYpWUZwRkL3pkscjinevz8reufB38KSsEZK VKo03G3gN/Dv6RDj8k7/xDehkgBPVOzUFTeNv9XNvmeJewpuFnT9eCJOTy/0EunLb+nkAepY vTuQ4/9raZoLBd/4TMZWX7MV9LpT0VZ2EdaysIvB9wyoziAmSLR6NQOmpsrr6jrBcNcrKRvG aI/Cd8ci9JEAuZW8l5+kxuaE5raALpklGWN3ToGgUu0Ty4GZXNfSostudm7IVOiLuLc2rWgQ RYm+B8wOnWo/V2Hy7/z9nYXSIAvB02AiVU0Z38Hqp5a8IPuU4qLPZtLQ+t58YfddOOnLpTWI 8kKgQvftMSEyds8nYZxIkkst6q23DqZnzJPZL28HR4vABbym4+OFKgfgmPQyrHAfNo3+DNiI sLAg0+Yojw9ISy0CIcZKHxX2f5Ngl40KZW5kc3RyZWFtCmVuZG9iagoxNTIgMCBvYmoKPDwK L0F1dGhvcihTdFwzNTFwaGFuZSBCb3J0em1leWVyIC0gQUZOSUMpL1RpdGxlKERvSD8pL1N1 YmplY3QoKS9DcmVhdG9yKExhVGVYIHdpdGggQmVhbWVyIGNsYXNzKS9Qcm9kdWNlcihwZGZU ZVgtMS40MC4xOCkvS2V5d29yZHMoKQovQ3JlYXRpb25EYXRlIChEOjIwMTkwMzI3MTgyMjUz KzAxJzAwJykKL01vZERhdGUgKEQ6MjAxOTAzMjcxODIyNTMrMDEnMDAnKQovVHJhcHBlZCAv RmFsc2UKL1BURVguRnVsbGJhbm5lciAoVGhpcyBpcyBwZGZUZVgsIFZlcnNpb24gMy4xNDE1 OTI2NS0yLjYtMS40MC4xOCAoVGVYIExpdmUgMjAxNy9EZWJpYW4pIGtwYXRoc2VhIHZlcnNp b24gNi4yLjMpCj4+CmVuZG9iagoxMzMgMCBvYmoKPDwKL1R5cGUgL09ialN0bQovTiAzMAov Rmlyc3QgMjQ0Ci9MZW5ndGggMjI0NCAgICAgIAovRmlsdGVyIC9GbGF0ZURlY29kZQo+Pgpz dHJlYW0KeNrtWVtTG7kSfvev0GOoLazRXVNFpYpLINQC4QCbzVmKh8EeYE7MjM94nJD99ae7 JduyjSHJ5vFUMe0eTY/06euLRkJIzTImpGFCwSUtkwZ/HVNOwa9nOjfMCGYVmCnJLDXnzAnL BPPeMMl8nvUUyNBJrsBCwVOpUXFMKitB8UzZzDOhM6ZyfK4l08qhopm2cCe0heGsAGPNjLSu px0zxjl4zIyD0bVnxnvHfMZspgVYMyty7MIxK3EYsICuHCjwyEgAbcDWeOgUZ2Ez2dvZ6fGr b+OS8d26broev5zednR/UtWfe3yvaYdle50BMdkNf8/P+P513zD6u+nxi3LQsWslbd/BdPK+ VUwp+AEUeT/L0WSX7ewwfsn4UXPVMH7A3pwVX6r7oquaWm+xt2978LcG47lxBd3MB4VxMjcb VPt+ps1i1DgNmgXf3dnhl/yseCyH0NFRs1cMPv/8uNr2MyPjuEb3Mym/a9zDqh7+/KhG9jMV B7VZP8/td072sGm/Fu2mkX/G3cLJvsPxg58zAKaY6/tMv+Jukbr7ADpSONAF45/+/RdMLc9y Jp3qY+bV09Ho5sdNGd9vRk17OS4GJVPhjfOi68q2htyk23dP3dFlV3QlE9TQ44dN3RHqQ0gR yC4yOxSQ7i7qUmGWxfYcMw91GJJ/+nD7HySFXn/ETJ0/Om+bwWUJfAGEg0PGr8qnjkWgC8EY H9/fjdv7W3Y9h8oPyi/VoLw42rvBrq4N1KT/Xz903fSuMTklk7npC2aUAP2fyNBPkB4Knl6S JhN9x6AIgp5K63zfM2cd6spBPzZzfTuzgXoc8YX3wSKH6u6hJZcOJFo4r+FZ7Cno3kFKGkg9 SDxp8E2ZQ9+hV5FlCh4vwdA5mCrImjAZ0oyZA4kgRIZTgVoKaw8kuVzSlcShIyXULg2OI72C N3Mkh+69VmhHFql1kLD+wTQ0kAB4/MJS+xzR0GSCHqUVYJ+6IPZJ6IUjktYIf4Z2ksEmEByk tRbpQ5pnV0JxSnQqZ6Qn1CcOCGynMiCJ+AMbBu0j4yQDy+u8x5bAQGCcpNJ67q0lGTxMPKds pzIwn/KfeiFwnkojBCBXyqK+IdQ3yVxoCOrol8QXqUyTK5WBt4VXNkmBS1DIxCV3rLsGAhW+ u4TPcM4J+5tkQJB6giSUF/hls8tk2fyC9MO1QuVIk1QeJi8pyAzQDQEEJIoovVDwNEh8VQE6 GEwpwOgVWUNr0JzxICUEPLjVY69BooWj1viMrIOewnrtkkkfbk2GqYdkWZI0PycpRHN0pbE4 h5hW2QJz7CEPQYvceGeihSM2Yl9B1wbxQ5JjEmbzVAz95hT6SzgoQOWckaiF98kioqC+jMAW Db0s6ypDe2KEWlPvaeoxtLgwC7JZWAepaG6KfK2soLJK75NuqT3oUSode0l8RrjFBraf4Zxk sAncBmnlnOFUJgynPKdyxnnCfMJ/YDuVAU2cQWBDztiOkhhe5zy24PzVgmFcbPQSrwu2I8Mp z6kkVlPmU/4D20vSUz8h8zZF+Qbpg08JceqJVKZ5tZRjxFjqkU0yJ1QhD5d8seaXUGGEIJcs kb9BBhCpI0hidYOVQ+OuESeLO0pYx3IMKPpmwA+rWM4MBVOw8xbTHaBAn7C+ASxHlhIJ8ppa yAbHhbVRSlo/SVcZrXuY1jTRQDOMnMMXd0AAE8zpa8WrmOQqfgfgM4m12HoKEuxRK4M9JrrM cSEIa1xolwpXc2mQQu1o3aEWB7jV7N3EPkilELcCe9wBqvlTrfHzzVpDPIJ+k2y4cJdxUE4G bTXumjbsOnCXxvjpX6cHp8e/nZxeFvVEZNsX5f10VKDJqLifMB1s9/aaJ3a9rWGPso2fb0Ir 2McLQ5uuyaCEPQwU1x7fL8bvy+r+Id7ikPhsW+DdcVeMqsFufT8qWQa7v658/AhLKOxj4jvg fujioWhx5/KG7/I9vs8P+Dt+CLvBY37CT2FP+IGf83/xC9hmXvGC3/IBH8Cuqwb5+FjwIS95 WQymHfxgn/yO3zXTlt/zB/7wbfxQ1rzin/mIP/KaN7ypSz7m46It61F51wWtpRfHZVs1Q/7f aTnB7SMoTVcOb0dkN7sJpnQX1JZP+KT8AsNMqic+GRWTB97x7qEtS959bfiUf+Ff+Tf+N/+7 bJutwO5hBYwIlePubXmjvNlvux93P119nPlNvuI3IdBvdObjfo3fvN3oN/TYe/AS+gb9cUfs V3PSxwtSka4OSHlaYkKLH2Hi6vjk8o/TyIR/hQjYYW8rofEMKvtFRLjvDuAzICWEbRKm6+GZ hmbK1DPB9GwgafUj9P2+e/T++E+g77Spm1cLgMFAElCFMf8zYRf0mTxP6aPbOX1Syg302Tyh T4mUvjS7F3G0lsV1BUzNUzlkbZKGM9bS5FtjzKwz9q4eNMOqvodZVHd3JdSFQTlh18K+UAng uzstBs/VFYiRWKriRCLigBOR0UwQbnA0xgcsTaGe0JRCYaNpEzmwfM3jBBbDNOxgfcPIg43E evWEpT1SnCQpONUl9XEMOaLnWYrsPSF/sFCpGL8363GWHOxhI/h0r5iUdND1wnKzFKB0OI0u 4YdVO+kwJuCLtMdPingDAHr8z2rYPUzoaJtsZy6jY+tnU+AlaJsr6io0uQrNqgSakFkCzf8K aBtL3CoyvYpMm42k2V+BbHP1WIVmX4QmpEigme+Bdl7clxOoF80UgECZ+r0aYn6GM1AXTk9F ZsJvOMGdByuWPjB+c9AMti+7ou22WKgBKyfGoZSmjXILvrdWG9UW7P9XG/UW/ruGGscAtY/d 6YCCn1SPVbcCYGa1BpLaYVyXJ73BkJCqSQMMh/8WWul/9u7MZt55ZCueMotwqvwisuRlcCzY 4H921ryyX0CVb6BqkntYNIlzESZmNT48bYYl/2NSfph2I6hlE2o8KW7L0WRnh59NHyfXGSjn b8TW27eCNAmaJE2BpkjToN3gkfeHcVnvDqgIimwG7H+tx5jWCmVuZHN0cmVhbQplbmRvYmoK MTUzIDAgb2JqCjw8Ci9UeXBlIC9YUmVmCi9JbmRleCBbMCAxNTRdCi9TaXplIDE1NAovVyBb MSAzIDFdCi9Sb290IDE1MSAwIFIKL0luZm8gMTUyIDAgUgovSUQgWzwwRkE1QkZFN0U1MDJE NzA4NEJFRjk0MThDMzY2QjhCQj4gPDBGQTVCRkU3RTUwMkQ3MDg0QkVGOTQxOEMzNjZCOEJC Pl0KL0xlbmd0aCAzNDYgICAgICAgCi9GaWx0ZXIgL0ZsYXRlRGVjb2RlCj4+CnN0cmVhbQp4 2h3SRVJDURCF4e44eZAgQYK7u7s7BPdgCQxZAYzvEqBYBGtgBcyZUgX7CPl78tV50u/eW++I SCDnE3ERKICoiARzeUIQhggUQBEve6KSfBRSIH9PcioSt0vNp29LPhV9t+SHIIQgDKzmsZoX BQ8KoQhiEIdiKIFSKIMElEMFVEIVJKFOxZe2dauhBmo5FhOOWceYs4kJUlAl/GUT9TAKjdAE zdACrdAG7dABndAF3dADvdAH/TAAgzAEwzAC4zAFDSqRV9vBJBuyE43BAczALMzBPCzAIizB MqzAKqzBOmzAJmzBNuzALqRgD/bhCKZVYn+2l0M4gVM4g3O4gEu4gjRcww3cwh3cQway8MDZ +LJT8AHdcAGwWhyrlK3bKyHV7I8l/rmjII6COAriYipNH/Y0rvL8a6lY5TNlqUTV/2aJ0jhq 4SiDowzOylCnmnkR1aeE/AO9Ij2wCmVuZHN0cmVhbQplbmRvYmoKc3RhcnR4cmVmCjkzMjA0 CiUlRU9GCg== --9jxsPFA5p3P2qPhR Content-Type: application/pdf Content-Disposition: attachment; filename="Jim-Reid-IETF104v3.pdf" Content-Transfer-Encoding: base64 JVBERi0xLjMKJcTl8uXrp/Og0MTGCjQgMCBvYmoKPDwgL0xlbmd0aCA1IDAgUiAvRmlsdGVy IC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAFlkLtOxDAQRft8xS2zRR7jB8l2iIUCKhZZokAU kdcrjBK8cQLfj+M4aCXkYkYzZ+5cz4gjRtThUc0EmpsW3uAVX6iejdfmMn93PbwNUAQWcoGW qAdUjwPh3gWR6sX03Wx/zMH1ztvBzN7qbB2MNEESg5BimbtTeFDL1GEi6Al1yZmoBWtS1vKw INZoLzFpjBklFWoa8IYllZBES2tQwZFSBII64w35aRdUGHK/Q8FEuUfexUqWn0MltuaEFN7Y DS+2xH1sWOEuCTT/xTYNF1rvUE/r38LFkmXecjApk2W+Xi+Fa8tZsPxph9vN9Z9JTTWXZSpr N1yvOf4Cv4RmFAplbmRzdHJlYW0KZW5kb2JqCjUgMCBvYmoKMjU2CmVuZG9iagoyIDAgb2Jq Cjw8IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyA2IDAgUiAvQ29udGVu dHMgNCAwIFIgL01lZGlhQm94IFswIDAgMTAyNCA3NjhdCj4+CmVuZG9iago2IDAgb2JqCjw8 IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCAvSW1hZ2VCIC9JbWFnZUMgL0ltYWdlSSBdIC9Db2xv clNwYWNlIDw8IC9DczEgOSAwIFIKPj4gL0ZvbnQgPDwgL1RUMSAxMCAwIFIgPj4gL1hPYmpl Y3QgPDwgL0ltMSA3IDAgUiA+PiA+PgplbmRvYmoKNyAwIG9iago8PCAvTGVuZ3RoIDggMCBS IC9UeXBlIC9YT2JqZWN0IC9TdWJ0eXBlIC9JbWFnZSAvV2lkdGggMjA0OCAvSGVpZ2h0IDE1 MzYgL0ludGVycG9sYXRlCnRydWUgL0NvbG9yU3BhY2UgOSAwIFIgL0ludGVudCAvUGVyY2Vw dHVhbCAvQml0c1BlckNvbXBvbmVudCA4IC9GaWx0ZXIgL0RDVERlY29kZQo+PgpzdHJlYW0K /9j/4QBWRXhpZgAATU0AKgAAAAgABAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAAB AAIAAAITAAMAAAABAAEAAAAAAAAAAACQAAAAAQAAAJAAAAAB/+IMWElDQ19QUk9GSUxFAAEB AAAMSExpbm8CEAAAbW50clJHQiBYWVogB84AAgAJAAYAMQAAYWNzcE1TRlQAAAAASUVDIHNS R0IAAAAAAAAAAAAAAAAAAPbWAAEAAAAA0y1IUCAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARY3BydAAAAVAAAAAzZGVzYwAAAYQAAABsd3RwdAAA AfAAAAAUYmtwdAAAAgQAAAAUclhZWgAAAhgAAAAUZ1hZWgAAAiwAAAAUYlhZWgAAAkAAAAAU ZG1uZAAAAlQAAABwZG1kZAAAAsQAAACIdnVlZAAAA0wAAACGdmlldwAAA9QAAAAkbHVtaQAA A/gAAAAUbWVhcwAABAwAAAAkdGVjaAAABDAAAAAMclRSQwAABDwAAAgMZ1RSQwAABDwAAAgM YlRSQwAABDwAAAgMdGV4dAAAAABDb3B5cmlnaHQgKGMpIDE5OTggSGV3bGV0dC1QYWNrYXJk IENvbXBhbnkAAGRlc2MAAAAAAAAAEnNSR0IgSUVDNjE5NjYtMi4xAAAAAAAAAAAAAAASc1JH QiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAFhZWiAAAAAAAADzUQABAAAAARbMWFlaIAAAAAAAAAAAAAAAAAAAAABYWVog AAAAAAAAb6IAADj1AAADkFhZWiAAAAAAAABimQAAt4UAABjaWFlaIAAAAAAAACSgAAAPhAAA ts9kZXNjAAAAAAAAABZJRUMgaHR0cDovL3d3dy5pZWMuY2gAAAAAAAAAAAAAABZJRUMgaHR0 cDovL3d3dy5pZWMuY2gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAZGVzYwAAAAAAAAAuSUVDIDYxOTY2LTIuMSBEZWZhdWx0IFJHQiBjb2xvdXIgc3Bh Y2UgLSBzUkdCAAAAAAAAAAAAAAAuSUVDIDYxOTY2LTIuMSBEZWZhdWx0IFJHQiBjb2xvdXIg c3BhY2UgLSBzUkdCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGRlc2MAAAAAAAAALFJlZmVyZW5j ZSBWaWV3aW5nIENvbmRpdGlvbiBpbiBJRUM2MTk2Ni0yLjEAAAAAAAAAAAAAACxSZWZlcmVu Y2UgVmlld2luZyBDb25kaXRpb24gaW4gSUVDNjE5NjYtMi4xAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAB2aWV3AAAAAAATpP4AFF8uABDPFAAD7cwABBMLAANcngAAAAFYWVogAAAAAABM CVYAUAAAAFcf521lYXMAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAKPAAAAAnNpZyAAAAAA Q1JUIGN1cnYAAAAAAAAEAAAAAAUACgAPABQAGQAeACMAKAAtADIANwA7AEAARQBKAE8AVABZ AF4AYwBoAG0AcgB3AHwAgQCGAIsAkACVAJoAnwCkAKkArgCyALcAvADBAMYAywDQANUA2wDg AOUA6wDwAPYA+wEBAQcBDQETARkBHwElASsBMgE4AT4BRQFMAVIBWQFgAWcBbgF1AXwBgwGL AZIBmgGhAakBsQG5AcEByQHRAdkB4QHpAfIB+gIDAgwCFAIdAiYCLwI4AkECSwJUAl0CZwJx AnoChAKOApgCogKsArYCwQLLAtUC4ALrAvUDAAMLAxYDIQMtAzgDQwNPA1oDZgNyA34DigOW A6IDrgO6A8cD0wPgA+wD+QQGBBMEIAQtBDsESARVBGMEcQR+BIwEmgSoBLYExATTBOEE8AT+ BQ0FHAUrBToFSQVYBWcFdwWGBZYFpgW1BcUF1QXlBfYGBgYWBicGNwZIBlkGagZ7BowGnQav BsAG0QbjBvUHBwcZBysHPQdPB2EHdAeGB5kHrAe/B9IH5Qf4CAsIHwgyCEYIWghuCIIIlgiq CL4I0gjnCPsJEAklCToJTwlkCXkJjwmkCboJzwnlCfsKEQonCj0KVApqCoEKmAquCsUK3Arz CwsLIgs5C1ELaQuAC5gLsAvIC+EL+QwSDCoMQwxcDHUMjgynDMAM2QzzDQ0NJg1ADVoNdA2O DakNww3eDfgOEw4uDkkOZA5/DpsOtg7SDu4PCQ8lD0EPXg96D5YPsw/PD+wQCRAmEEMQYRB+ EJsQuRDXEPURExExEU8RbRGMEaoRyRHoEgcSJhJFEmQShBKjEsMS4xMDEyMTQxNjE4MTpBPF E+UUBhQnFEkUahSLFK0UzhTwFRIVNBVWFXgVmxW9FeAWAxYmFkkWbBaPFrIW1hb6Fx0XQRdl F4kXrhfSF/cYGxhAGGUYihivGNUY+hkgGUUZaxmRGbcZ3RoEGioaURp3Gp4axRrsGxQbOxtj G4obshvaHAIcKhxSHHscoxzMHPUdHh1HHXAdmR3DHeweFh5AHmoelB6+HukfEx8+H2kflB+/ H+ogFSBBIGwgmCDEIPAhHCFIIXUhoSHOIfsiJyJVIoIiryLdIwojOCNmI5QjwiPwJB8kTSR8 JKsk2iUJJTglaCWXJccl9yYnJlcmhya3JugnGCdJJ3onqyfcKA0oPyhxKKIo1CkGKTgpaymd KdAqAio1KmgqmyrPKwIrNitpK50r0SwFLDksbiyiLNctDC1BLXYtqy3hLhYuTC6CLrcu7i8k L1ovkS/HL/4wNTBsMKQw2zESMUoxgjG6MfIyKjJjMpsy1DMNM0YzfzO4M/E0KzRlNJ402DUT NU01hzXCNf02NzZyNq426TckN2A3nDfXOBQ4UDiMOMg5BTlCOX85vDn5OjY6dDqyOu87LTtr O6o76DwnPGU8pDzjPSI9YT2hPeA+ID5gPqA+4D8hP2E/oj/iQCNAZECmQOdBKUFqQaxB7kIw QnJCtUL3QzpDfUPARANER0SKRM5FEkVVRZpF3kYiRmdGq0bwRzVHe0fASAVIS0iRSNdJHUlj SalJ8Eo3Sn1KxEsMS1NLmkviTCpMcky6TQJNSk2TTdxOJU5uTrdPAE9JT5NP3VAnUHFQu1EG UVBRm1HmUjFSfFLHUxNTX1OqU/ZUQlSPVNtVKFV1VcJWD1ZcVqlW91dEV5JX4FgvWH1Yy1ka WWlZuFoHWlZaplr1W0VblVvlXDVchlzWXSddeF3JXhpebF69Xw9fYV+zYAVgV2CqYPxhT2Gi YfViSWKcYvBjQ2OXY+tkQGSUZOllPWWSZedmPWaSZuhnPWeTZ+loP2iWaOxpQ2maafFqSGqf avdrT2una/9sV2yvbQhtYG25bhJua27Ebx5veG/RcCtwhnDgcTpxlXHwcktypnMBc11zuHQU dHB0zHUodYV14XY+dpt2+HdWd7N4EXhueMx5KnmJeed6RnqlewR7Y3vCfCF8gXzhfUF9oX4B fmJ+wn8jf4R/5YBHgKiBCoFrgc2CMIKSgvSDV4O6hB2EgITjhUeFq4YOhnKG14c7h5+IBIhp iM6JM4mZif6KZIrKizCLlov8jGOMyo0xjZiN/45mjs6PNo+ekAaQbpDWkT+RqJIRknqS45NN k7aUIJSKlPSVX5XJljSWn5cKl3WX4JhMmLiZJJmQmfyaaJrVm0Kbr5wcnImc951kndKeQJ6u nx2fi5/6oGmg2KFHobaiJqKWowajdqPmpFakx6U4pammGqaLpv2nbqfgqFKoxKk3qamqHKqP qwKrdavprFys0K1ErbiuLa6hrxavi7AAsHWw6rFgsdayS7LCszizrrQltJy1E7WKtgG2ebbw t2i34LhZuNG5SrnCuju6tbsuu6e8IbybvRW9j74KvoS+/796v/XAcMDswWfB48JfwtvDWMPU xFHEzsVLxcjGRsbDx0HHv8g9yLzJOsm5yjjKt8s2y7bMNcy1zTXNtc42zrbPN8+40DnQutE8 0b7SP9LB00TTxtRJ1MvVTtXR1lXW2Ndc1+DYZNjo2WzZ8dp22vvbgNwF3IrdEN2W3hzeot8p 36/gNuC94UThzOJT4tvjY+Pr5HPk/OWE5g3mlucf56noMui86Ubp0Opb6uXrcOv77IbtEe2c 7ijutO9A78zwWPDl8XLx//KM8xnzp/Q09ML1UPXe9m32+/eK+Bn4qPk4+cf6V/rn+3f8B/yY /Sn9uv5L/tz/bf///+4ADkFkb2JlAGRAAAAAAf/bAIQAAgICAwIDBAICBAUEAwQFBgUFBQUG CAcHBwcHCAsJCQkJCQkLCwsLCwsLCwwMDAwMDAwMDAwMDAwMDAwMDAwMDAEDAwMHBAcNBwcN Dw0NDQ8PDg4ODg8PDAwMDAwPDwwMDAwMDA8MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwM /8AAEQgGAAgAAwERAAIRAQMRAf/dAAQBAP/EAaIAAAAHAQEBAQEAAAAAAAAAAAQFAwIGAQAH CAkKCwEAAgIDAQEBAQEAAAAAAAAAAQACAwQFBgcICQoLEAACAQMDAgQCBgcDBAIGAnMBAgMR BAAFIRIxQVEGE2EicYEUMpGhBxWxQiPBUtHhMxZi8CRygvElQzRTkqKyY3PCNUQnk6OzNhdU ZHTD0uIIJoMJChgZhJRFRqS0VtNVKBry4/PE1OT0ZXWFlaW1xdXl9WZ2hpamtsbW5vY3R1dn d4eXp7fH1+f3OEhYaHiImKi4yNjo+Ck5SVlpeYmZqbnJ2en5KjpKWmp6ipqqusra6voRAAIC AQIDBQUEBQYECAMDbQEAAhEDBCESMUEFURNhIgZxgZEyobHwFMHR4SNCFVJicvEzJDRDghaS UyWiY7LCB3PSNeJEgxdUkwgJChgZJjZFGidkdFU38qOzwygp0+PzhJSktMTU5PRldYWVpbXF 1eX1RlZmdoaWprbG1ub2R1dnd4eXp7fH1+f3OEhYaHiImKi4yNjo+DlJWWl5iZmpucnZ6fkq OkpaanqKmqq6ytrq+v/aAAwDAQACEQMRAD8A+oPHM5xFNfhxVdiqIXK2ba8sLBU44quXhira ZNVVl55WzbxVy8OOWMFVlytm19r4/wBjIq5v58VXpk2S9VXIMXcskq9V5ZFV/LFWsVb44q5c VdxxVfwxV2Ku54q5vtYq5VXFXfYxVdxxVdiq9skreRVbx44q0rYs2+WLBzNirS/YxZr8WDsV VP2cVWNiq/4sVc+KuxVUxVTZcVX/ALWKt4q18OKtNiqtiqniq7jiruPLFV64qtxZtr8P7GKt Yqu/40xYL+P2+GKu9P4sVWsq5FkvxVcvHJMWvixZr/tfY+xiqmuKr1VeORQ0vwZJivZcVd8e Ku44qvb48VWfb+PFV/xYqp8cWapgZtcf5MLBzL+x+3irmbFXfb+DFVTFgp8ExVtcilc+KqfN MkydiqpiqpireLBTXnirsVXKuLNvFW2bIobxVSVeeKFTjwxbWuOKu+1kmlrjirf2sVXcf58W a77GRZuXFV2KrfsYq77GFXMuKuwsG+WKr1wM1NcCrcVVMVdiq1mxVzLiq7FVvHFrcv8AJi2O 44qv44q5fgwq7jgVZxxVfyxVY2KubFXccVc2Ku44Vd9j7eKu5csVczcsVWMuBV7Yq7liqz7W Kub/ACMVX8sVXYq7FXYqt+L9jFVL9vnkmC7Fgt4/z4s2/s4sF2RbnYVW8sCrsKrWX4cDW1/r 4oWL/JkmTnxVytirvhxVfy54qs+yuKt4sHPirvg4Yq7FXcMVcrYqp4q77WKrGyKVRcVcuKub FWuL4q5eOKt8ckhZxxVzYq0uLNfiwW/5b4qpt/l4s3ccWC7jgbncWbpiqmy4WlT44s16rirm Xi2KrPixVrFWlbFg1/r4s23/AMvFguxV2KrWxVr7GLNZxxYKnHjirmxVbiqz/IxZtYsF7fBi rXHFVuKu/wBfFVje/wBvFXNiqm2LNzLirv8AUxVvkvDFguxVZ9jFm5sVayaFPIMXJiq7jiq3 /XxVtV/kySrsizWMuLBTxVU54qsVcVaxVbxxV3w8vgxVpvt4q3yxVTbFVv8AqZNk7hkGKzji ra5JVmWJW8uWKrFXli1uZfi4ZBVmTV2KqbLkFaxV2KrOOBmtZWwsFr5NVrYq77S/G+Kof/Ly CqnL4cmqm2QV/9D6etmc4i9VxVVVV/bytmvVlTFXL8WFgqcEyar+GKq/FMVbxbFy4q3y55Wh zNyXFWl45FWsVVmxVVbJK1xyKuVVxVe2KrGb9jFXfb+xiq7FVT7eKuxVz4q5MVXsuKquKqPL FV+SVauKuX/LyKq3HFVnL4sVdy+HFW8WbXH+TFguxVU4Yq5MVWKv8mKr8Vcy4q7FVTFWv2cV Wc8VVMVaVcVa44q38WKruL4q1iq3jiqvx+LFXLirv8vFVzfyYs1P7WKorIoU/wDXxVf+1w/n xVpfi+PJMWv2sWaxMVXsuKr8DNZ/kfsYWCov8mLBfxxVYv2MVX/tYq5V/YxV3JeOKtYq38XL FWl+BsWaxcVdxxVfyVvsfbxV37OKtYq3iwbT7GRS5sVXcMkydxXFXcMVd/xDFVTFVNVyLFU4 4pXYWxrjirmXFXMuKu/18VawsGvsfBiq/liq3FV3+Q+Ku5Jiq5lyKHNi2LsVdirsKtquBXf5 GFXfs4GtY38+KubC2O44q1yfArWKqvLhiruP28KrP2MVc2BVuKqmKuxVtl+LFXf5eLW7/IxV Zy5YtjuOKrsVXNhVqNebYFWJ/l4qv+1hVYvw/Hiq7FW2XFXLH8OKuWNsVawK7FVvHj9vCq7F VFsCqnHFXf5eKrPt/bxVfxxV3H4sWtSbi+SS1/qYquxVdgZrlXFVPCwbbAzd9nFWmwKtZf2M KrVbCwdzxV3xYq5MVdirm4YqqcfhxYLGXj9vFWsil3Lh9jFVmSQ22KtYq2y4q7/LxVy4qvTF VnHFV/DFVnHhirvhXFWsVWs38mKr+OKrH/y8VcuKreOBucuKtKq4Wlr/AIliqm2RZN/5eSS5 8Vd8WKqeKt8sVaX7eKuxVcy82xYLFxV3Hjirm+FsVdxxVT5Yq7j8PPFW/wDLxVvFVNmxVUxV T/axVzK32MVWN/OmKr3xV32MVWSYqprizVFXFg7lirWTZLfgyDF3HFXMuTZLcgxWrirmxVa+ Ku54qvblyxVZirsVWcnySt8sVa+FsiruXPFVr/5GSVZkVXf6+KqPHliruX8+Ku/axVZklUm5 YWDSfbyaruXL4MWxYy8vjxa1mKtZBVi/Birl44q7lxwM1jKuFg5V5YqpcMm2LWxa1Pjy+DFV RcVU5OK4qs44q//R+oH2/jzOcRfwxbFTjlaFX/IwsGlX4eGKr0xVUX+R8mrlbh/s8VVFXFsb ZcrQv/axVd+zkVd/l4q3x5tklVVb9jIq7/LxVy4qv+LFXNirWKt/5GKr8VU8VVckrX2fgyKq mKtfZxVvFV37eKrF/nxVfxTFWviTFmvxYN8fhxVZxxVeuKu4/t4q77f2MVX4q58Vdx44q7k2 KuTFVTFWv8vFW8VaZsVcq4qv48cVUuOLNXxYLOOLNtsWDeLNf/xHFgpp/l4qu5Ys1/Hlirat zyKF/wDxHFVi8uWSYr9v5MVW8cWa/wDyMDNvFXYqtwsFXFg7FVqt/Piq9cVaxVzL/Pizc3LF XcsVaxVcq4sHccVcuKr+GKqf7WRS77OKr0xV3PFXc8kydx/bxV3Hn8GKuTFVTFW2wM3faxV3 w4Fbwq7FXYqsXk2Fg1xxVtvjxV3Ht+xirf8AxHAzVFXAqxlxVpcVVsVW8cKrsVbVcCu/1MVa xVbxxVfx54q7/Xwq1gVzfE3wYq3xxVYq/t4qv5Yq1ira4q79nFVi/Diq7FW+WLW5vgxVy/5G Fsdx/YfAra4VU2wKuxVv4cKuZv58CuXFXfb+3iqxVxVfHhVtMLBTZeORZrsVdirfHFVmSYO+ PAzcy4q5cVc2Ku44q7jxwKtxVV/axa1keKtfEmKrf2sVWsuSS5lxVvFWuD4qvwM1PFV7R4FU nyTBzM2KufFXcfjxV2Kr/tYqs/y8VdIuKtfsfBiq7niwUsilc2SQ1iqpx5Yqp4q3/r4q0q8P t4s3LirWKqv28WCxW+LFVNVxZuXFW2/18WDuOKuZcVWYs2vi+3irbfH9jFg5Pt4q03HFm1gZ qSthYL+GKrPhxVv9rFgs5Yqu44s2sVXfDiwaxVa3LFWl+HFm2rYsF2KqeKrWxV3HFVqYq7ni ruGKqf2sVVMVc+KqT/YxZtfaX48WDmxVplxZrsVb4JiwW8vh54q5cVdxxVbx55JXZFWv2cVW ceWKu4Yq5mxVzLirl+LFVjYq7/YfBirWKrf9TFWskrXHl8CYqtbIqtfJsnJiqxsVU/8ALyaH fYxa12LYh8Wt2KuxV2KrFyCrcVWs3P4MDNSZcsS77eKqP7GLW5sVc/8Al4q1xZPt5BX/0vqB 9lcznEROVs2lwsF2KtszPiq/j8GKquTVcvwrirSf5eQVW/1MDNy/Biq7IqqL8eSVbyyKqnFu eKu5ccVX8cVb5ZJV32MirsVdirsVbX4skq5vgyKrmxZrFxYN8kxV3+XireKrlXFV2Krft/bx VevHFVNlxZqnHFg5sVX/ALOKrFxVy4qqriruWKt8fixVvFWvixVvFV3FPt4q5uS4qs+w3wYq 79rFV/J/t4quxVZyxZr+WKrOOKr/ANv/AC8WC/Fm7hirsVVG9/sYsGuOKtp9vFXYs21XAzc2 KrOWFgv44GbSrhaV7csVXYq2q4qs+xiq/lirTfH9vFm1irvs4q3xxVfkWLsVW8sVXcfi4Yqt XFV/DJIcmKtc8WbvsYq7/iGKuZf2MVczYqq8eGRZt8kwqs/awsF+BmtwsHYquyLNdyxV3HFX Niq7FVvHFV2FVLliq9cVXYquXFXLirTfBiqxcCr/AIsVd8WFW8LBrjkWbWKt/t/Hirv2sWty rirmXFsWM2Kr+L4VawK22LW5VxVrC2NtgVzcmbFXM3HCrlblgVy/yYq5VxVrFXYq3/r4q1ir vs4qu5YVaXArWKuVW/YxVvlirWKu+zirbNiqxWxVezYqs5YVXYqpfs4qvVVxVdiq3jiruWBV uKrvt4q7jhVbiqpiqkq4q3irTYqs44WDl+HAzcy4qtwsHKzYq58Vdiqpiqm32cVbb4PsYsHf 6+KtcVyKXJiq1ckhpv8AXyKVTJIc+Kqa4s16Yq7FVq4sHMy4q5sVU/jxZtsuLBdirsVW8f58 Vdx5YqsX+TFXcV+xiqmy8MWbsVc+Kt4sFP4cWbbYsGuOLN3w4q5VxV3LFW244sFNft4q7liz X4sFJWxVyrireKqbfyYqqYqppirsVdiruPx4qp4q2y4qsbFXcsVaVcWbcmLBeuKrGXliruXx Yq5sVdxybJy4qo5Bivf7eKrPsYq7j/JirsVWceGKr8VU8Vb44qtk+Jckqzj/ACYq19rCya45 BitfJsnfDiqz7WBiptliXN/w+Kqf/EsWtdiqnzxV3HliqlkFWsq4q5lxVZ/r4Ga3j+xljBTx VdxxVdzxVTxV/9P6hq2ZzQq/s5Wh37eFgvXjiq/FW8mq9cWxVxVavLFVdeeUoXr/ACYqs4Yq u5YqqNirlVv2MVXcXxVV4/z5JVir/Piq7Iq5m54q39jJK1kVVMVa5c8Vd8X7H2MVX8v5MVdx XhiruOKu/wBfFV/LFXfFirWKt/Cnx4q3/wARxVpeX7eKr/8AUxVrnizb4YsHceWKruOKrsVU +X8mKufFV/xYqprwxZq3P9vFVv8Ar4sHKuKqvHFm1iq34OWKr8WCz9vFmrJirviRsVc+Ku5N +3iq5MihczfDkmLsWa9sWClxxZqv7GLBzL8X+Riqz4/28VXsuKu+3iq9WxVa/wBjFmqcl/bx Vb8WLBzYqv4Yq7FWsil3+Rirvj+xkmTsVdkWLnyTJYy/Diq/4sVb/wBfFg7FV+LNZiwVOOBu UuGFgvZcVXLgZt4qpthYN8v58VVX/wAvAzaX4vjwK39jFVuKrv8AUxVdirsKrcLBdgZqeKu/ yP2MLBUyLNvj+xirWKtNkmDeRZuxVv8A18Wt3LFsWf6mLWuxVc+SS1+zkWbv9TFrcq/Fira4 Wxa/2MCrckwXZFmuyTBrj+3gZuZVwK3kmDXLIoX4qsblhbGsCtti1r1/nxVZ8XHFXcsVXquK rOTccVcrYWxZhYLvi+DIs21xV3w4q1irbYq1hV2BW244Va5PgVtmxVrFW+PxfBiqzj/JirlX /gMVczfz4q7jirlxVy4q5sVU+OKrsKrcLBvj2/YyLNvFXYVaXimKuX/LwNbvhxVS/aySXK2K u54q7FXN/kYqu+02Bmt4YGptMkhr/LyKXMuKrW45JDWKu5Ys3MuKttiwXpiqxuPH48VU+KYs 22XFg79jFXft4q5sVWfAmKtNirfB8VU2Xj9jFm36a/t4sGsWbkxVtlXFg1izWceeKrfsYsF3 H+fFmt4r+3iwd8eKuVsVaXFmtVsWDeKtcueKquKqXH4cVcv+Riqzhiq9lxVZirsVcmKqf2cV bXFV+KrGXFXce37eKu+LFVi/YxV3LjirpFbFVPjirlxVy4qt4Yq3/qZJWsirsVd/l4qs488V cy4q5mxVYy/DiqjxX9jFV2TYLsgzUeOSVfIq4qp8ssSt/wBT7eVoWyL8WWJW/Zxa1PFXPirX DIKs+LFXN8OBmsXCwUnybYqsuVoUnyxgtXFWuPxYq//U+o65lOOtXCwX/wCviq7FVXhk1crM uKq3+piruX8+LYuxVV48l4ZShen28VXquKr/APIxVy/yYq5V44q1irfwriq/FXfD+xirnxV3 H9jFXcf2MVV8Wan9tMWDTYqqMrYq0v28VW4s1/wt9vFguxVvl/JirlX4fjxV3xYqvX+fFXfD iqlizVf2cWDm5csVXccVXYq03L9jFXKrPirXHFXccVX8cWbvh+w+Ku5Piwb5YqvXlirXxcsW a1uTYsG8WbbR4q7jwxVfzxV3PFVTFXK3HFgt44s1TAzWM3DCwVOWLBzL8P8AkYq5WxVSXFmi G+DFg79nFXLirTLizcuKtry45FiuxVvJId/xDFXKuKu54q1x+LnizdirbLiwdirTLwxZufFV 3HFVzZFCnkkqi5Fm7JMFTj/PgZu4pgVYzYq3iq5sVc2KrsVdiq37eLWtxbF3+pirlXCruOKr 2X4cCtYqu44Va4t9jArWKt8sVdx54qt9PJMG8DN2BVuSYL2bIs2/5P58kwWfs4qv/wBfFVzK v7GRZu48f28Wty/axVb+1kkrsihSZf5Mklfiq5MDNamFg7FXL8OKrcihU48sVc+FsWvhYLuX 7eRQsXFV/DFVq88klb9nIoVOGKqOSSqNzxVzNirmX+fAzXYqpt+xgV2KtquKtYq1xyTBd8OR ZuVcVWfYxVfx/kxVr7WKrWX+TFVn2sVVvst8GKrOP8+KuVcVa4virfHFXNiqzjhVvFVuFg7F XYquyLN2Krckwab/ACMVd9rFVjfDirTNwxVtl4Yq3iwdiruGKuxV3+viqxlxVpWxZtYq7FW8 WC37eKr2xVT+xizb48sWDm5Yq7liruWKuVeP2MVWYs1Pj/JirkxVzL/PirfDFg1y44s1qriw d8OKtKuLNytwxV3w4q7Fgt+x8GKrcVb5Ys2sWDsVXM3/AAeKrF/yMVd9rFViYqqYq7FXYqp8 8Vd8WKuZcVWccVa/b/y8Vb49/wBjFWlxZtq2LBZxxVev8+KrGxVYzYqtXFm7lirWLBtlyStL 9rIq5lX+fFVq5JVuRVtcVcuKrPgxV37GKqLc8VbP7eSVSZl+xliW2xVr7OUoWs2XJW/ZytC3 jw+3ljBZxXFXYqsZv2MgrlxVy4qtxVrAzWccsYLOeKu/axV//9X6kMy5lOO3+z8GFgvXFV+T Veq4q6PFXfFi2Ij9nK0Objiq/jz+3iqrxyKr+WKrVjySrlXIq708VaxVU4Yq7FXYq7/XxVf/ AKmKuVcVcq4qu4/FizbVWbFg5V/YxV3LFV7Yqt44G5rimFpXx8cVd8OKu44q18OLNtf8vFgv xV3+piq7liruOKuXFV2KuxVa2KuXFVTj/wABirv+I4quxVvl/PirmxVpeWLNyt/PiruPPFV/ DFXYq7j/AMBiq/j/AD4q74cVdyTFW1ZeWLBVxVRVcWao2LBpcWaoq4sHcfhxVe3+piqhxxZr 19/sYqqf6mLB2KuxV32MVX4s1NuLfbxV2KuZsVbZsWDuGKu4Yq58VXrkWTmxVy4ti18VXrhV rCwdxyLNU/yMVW4q02FV6tga3f8AEcVdkkrfgxVcvw4Ga7FVv7eKrsVbXjgVy/BiqxvhxVf/ AJGKrF+xiq/jiqzj8OKrsVb+LCra/wA+Fg7hiq5vs88ihbkkufFWuL4GbpPsYWDa/wA+KufF XPiq7AzWcvi+PA1r/wDLwtjm54qtfCwaVm+xkWbf+vkmC74cizWsuSYLv8jAzbX+RMLBYq4q 79nFXPirueKu/wBf7eKqv7ORQpN/Pkku/ZxV32MVVeP2HyKFLjyySXN9rFVyYGan9nA1tt8G KtYq3xxbGsVdhVvlgVarfyZJg3kWbfLv+3irlxV3+phVtcVU1bFVrLxwsFzZFDmxVzN8WKrP tYq5sLY5VxV3HFVvB8LBpcVVmwM1jLireBWv8tPt4qpf8QyTBfyxYLcVcy4q5vtYqu4/sPiz bxVY+LB37OKuZWxVTxV3+pizcvLFXYsFTFVPFW2xVrFVqrirfHA3NccLSpccWbbLirlxYOXF XdnxZrOPw/5OKtsv8n2MWDl/nxVrFm5WxVb+1iwU+OLNUVcWCyPFWlX+TFm5sVbbFguxVSVs Vd/r4q3irsVa/wBTFWmb+fFVuKub+TFXcf58Vcy4qs44qvxVY2KrcWbeLBazccVaXFm22LBT bFVTjx+DFVuKtceeKrP9fFXc8VczYqs5fsYq74sVdxxVpft4qtZVxVzfDiqziv28VcuSVb/q YqpcXyxLbL+3iqm3xNiqzji1ub/XxVvFVNlxVZxyCtfb+3iqzj/PirmX4ueKr+WBmhuPP7GF g2v2smr/AP/W+pCtmU46pxwsF3DFW8mq9cVVcVWri2Kqr9jnlaF7KzYquVf58VXp/kZFV/HF XcWZsVcuKuXFV+Ku4Yq7FV3/ABLFW/2PjxVvFWmbliq5eWLNUXFg1iq3/IxVezc8Vcv8mKtY qu/4liq5MVcrfYxV2Ku4rirnxVyr/JirsVX8UxVpcVdyxVy4q3y7/sYqq4qt+Hjiq7FVnxfY xVfx4Ys3ccVbVcWDTN8OLNf/AJCJirl/nxV3JsVXJgZqv/EcLSprireLNr7WKqi4sHfbXFXM uKt4s2uOLBdirsVb44q0vv8AYxZtYqq8MWCpiqmv8mKtYs3LwxV2KuZsVdirariwXNirSZFk txQv45JDl+18eLNvFVNv58VVeOBmv/y8CrsVW8cVXYVW8cVdxxVdiq1lxVdira4FaxVv9nFX ccVaxVbxxVf+zhV3+RgVr7OKtszYq1iq5VyTB3+RirvhxVpv58DNvnhYNceH28Vb/wAvFV3J sDNb/r4WDsVXq2KrMVXfDgZrf2eGFg5lxVevx4q1yxVb/r4q77GKuxV3w4q5VxVcvH9vAzWt y44WDmXFXJirmXFVzYqtfFXYq5mxVdyb7GBmtTCwc+Kub4PsYquZsizWfDi1tYtjTLkmC74s izd/kYq5uWKuZcKu44FaVl/bxVv7H28Ku/ZwKv8AsYVWLgVZ/wARxVf+0+FVnp4FcvLFXL/P iq7FVvFeGKrOPDFVXFVvHFVuFVTFVHCwWriq/lgZrMVXKuFpdxyLJ3+Riq3jkkt8eeKrOeKu xVtfixYOfFVPgmKub+RMWbv8j9vFWsVXNiwX88VWf5eKubFWsVUWXl9jFmqcsWC7FVHjirX+ RizcuKr8WDS/Z54qs4/8Hiq/j8WKrP2sVdx5Yq1wxZu/yMVWccVczfDiq34uWLBtPsYs28WC 3/IxVZ+z/q4qq4qt5YqptirbNirv8hMVa5Yq3zfFXM2KrP8AUxVYy8MVcy4q5sVXr8OKqbLi zaxVd/qYsFPk+Kr8VW/Biqx/t4q79r4MVWcMVdwxV3PFXPiqzJKqc8VayKqKqq4q5v58VU2x Vbx4fBk2TeBipcnyxK5l5NwytC1VyxKjt/Jiq/li1rfs4qpt8OKtPkFU8Vb5fDiqzl8WKuZf iwM1nLCwWN8f28Vf/9f6kLmW4i+PFVTJq5VxVUxVdx+HFscv8mKojiy/YytDa5FVRcVW/byb Bd9v4MgzXtiq/FXYq7nirsVX8ufwYq7/ACMVc2SVdw/byLNy/DirariwX/s/Biq1sDctVcLB f9rFg2zYqtxZrlxYL8Vd8HDFVTFVN8VcmKr+P8+KrFbFV/H+TFV6f5GKrFbFVyrizX4sHYqt XFV6/a+DFWl+zwxZu5fDwxVy+328VcseKr1bFV2BmpN/JhYKiriwb+x/r4s2+P8APirmXFV2 LBcuKttgbnYWDXHliwXYq2uKuX+TFVuLNvl8P+Xirk+xiwVFXFXL9nFWuPLFm5eGKuZVxVpl 54qq4qsVeGLBfy/nxV2LN3HIob44WxYqrywK7jkmDat8WKrlbngZr+PLFV2BVrYquxV2FWuW Fg0q8sDN3p4FXqvHCrfHFWmkwKsVsVVOWFVuBrVOXP4MVWf6+LY1irbNirX2sVb5YtblXji2 L1k/bwq6P7eBV2SYKfDFXc8ixd9vJMnc8Vd8WKufFV3HFXM2Bmu4tywNazlwXFW+TYq79rFV rfDkkr2VuOKrPixVcuKrcVVOWRQp/wDEMkly/wA+Ku5fDzxVzLiq7hkULckldkULcUKmKqeS ZL/s4q0vxYGa3Cwd8T/bxV3JcVaZVfAzb44q7nhYO+z9jFXclxV2KuxVyYq7FXPiqniq/kv7 eRZu+HFWsVdirarirl+D7GFXNgV3L+fFWsVW8cVd/kYq5sVd8GKu44q5sVXYqoMuSYL8DNrl irmxVr/XwK3xwqsbCwXfs4sHceGKt4qh1xZr/sYq7FVTimLBZwxV2KuxVSxZuxVVxYKeKrGX jkUtcXyTJc2LB3LFXKuKrF4u2KrVxZr/ALOBmt5dv28LBv7OLBZ/kYq7/IfFXcV/bxVZy5f5 OKu4r/PirlxVbizb48GxVrFW1bFVvHFg0/8AkYs21xYKfLFV2KqmKqeKtf6mKrMVVMVWriq3 /UxV2KrGxVfx5Yqp4qtVsVcvxYqvZsVWcsVXN9vFVL9rFVrYs22xYLeGKuX/AC8Vczc8Vc+K rFXFXceGKrGj/nxVTZf58VbZeeKu/axVbklcmKodlyxLm+LFVnLhi1t/ZxV32sVUsgq3liru OKrcVdiqxsDN3HFX/9D6ltmU47fHCwV/tZNWuOKr/jxV3x4tiqq5Whfira5FVZPsYqt/yMVX r/Jiq/FXJirsVdiq9V4/BirmX4sVb5cmySrv2Miq9vjxVZ/l4qvZfhxVrFW1bFWvs4qqYq5W xVY2KtL7fbxZqnDFgqYqp8MVdirvtfBiq5cVXYq7FWuP8+KrvjxZrGxYKi/yYqv44qs44q23 28Wbatirca/sYsF3xYs3fs4q7FVPFVT4f28VXtiwcy4s3LHzxVU5YsHL/PirlX9vFWlXFmv5 cMVWq3w4sFb/AIniqniruWLNrFW2/nxVU4/z4sHYq74sVbZv28Wa7FXYqp8v5MVd8HPFVRfg xYN/ZyLJzcsWxvCrsVWK2Fg02Kt8eeKqvHjkWa7FXYq7FXYVWt8OKr1VcVawNa7lhbFuBW2b +TFXfZXCruOBVjNiq9eWKro+Sf6mLWpsvxZJLuOKruORZtqv7ZyTBrjkUOX/AC8LYtbCwVft fHgZrOOBW8kwcmKruOKuZvh+PIocvFG54qtZckl3xYq74cVXJgZubl+3ga2+PxfHkkuVcVWc f58Vcvx/YxVf9rFW8VaZsVdy5fYxVvFWuKYq1yxVbx/bxVezYqsxV2KufFXcvjxV2Kr2bFVn 2mxVcy8WyKHfa4YWxbG2Fgv5fz4qs4YquZe6ZFC7FCm3DJMmvhyLNvnkmC5VyLNbx4NkmDnx Vyriqn9rFV7KuBms/YwKuxVtcVWccVXq2Ku44tbTf5eKtsuFsb44qp8eOKrsCqLYqqK2KuVc VXYqpMuKrG+zhVUxVpmxVZxwsFZV+HAzUmbCwc2LBzNizWPirsVdwxVvniwdiruTYq79rFVN V5rzxZqa/bxVVZsWDWKt/Fiq3IpW/wCRkmSouLBzNirWKrV44qp8HxZr8DNT5YWDf2PjxVa3 8+LBpeeLNbxxYNKrfYxZt/5GLBb8f+zxZu+zirfLFVjMuKrsVa5YsGv2eeLNzfbxYNYq0zYq u5Piq37OKu/18VbxV2KqfxNirsVdwxV2KqeKttirl5JiruP7eKu+xzfFVn2MVbxZqS4sFTjx xVYn28VWc8Vc+Ku54q7j8GKrGxVZyxVzYqtxVTbl+xirfDJK7FXPiqlx+LLErGXFrbZsWxTX FrWPiruGKqf+RwyCt8cVabAzawsFrKuKv//R+parmW4ipk1cq4qqJ9vFV328VVV+18eVs3cv 28VXKv7ZyKq3HliqpxyStLkVcq4qvxV3DFXJiq9f5MVbxVpv8jFV6/C2KtcsWanyxVXxYLVX /g8VXrirmbFXNirv2/jxVf8AFiqz4/28Vc2KuXFVXjirf+viqzFVy4quxVa2Kqi4q5Vbliqz 7f28VXL9vFXfBizXYq22Kt8cWDv9TFWuPxYs17fZxVyrirueKu4/sYq2q/FwxYL+D4q7l+xk UubFK/8AyMkxaVsWa/FgtVeH28Vdxb7D4q1x/kxZr/hxVrFXYqu44sF+KuxV3HlirSrizVPt YsHYs1PIsVRV/bxSuxV2KtL/AKmKt/Y+xkkqfHFV7LkULmX4cVb/ANTFsXYq7FVqrirvjwq7 jiruL4WDmwM2+OFgu+NMizaxVtcVWcP2MVX8sVawq2uBV/HmuFVuFg5o8VdirnxVy88VVX+3 kULOPLC2LW+LCwVPi5ZFCyNeeKrlVckl3N8VbXIoa4pkktf5eKrsVdiq1vhyKF/FfsYqt+L7 eSS3iq1sVXt9jIoUvhySURy5LkUKX2cklrjirbfz4q5V+HFXclf7eKu+HFXN8GKu/b54q2rf FkUOySVPFV3HFVZviyKFJVySW8Vd8PLIoU+P/B5JK/j3/bxVYy/DirsVcmKuVcVa+HAzbwsH c8VXNiqzlzyLNfy44VWphYNMv2OGRZtsvxfHkmCxV+LFW8izb4/DirWKt8cVdxxVtsKrcCtN 8eSYNfYwM3fYxVdgVauLW7ji2LsVWt8OKu/1MVdxX/Y4VdhYKeKuxVbxxVv/AC3xVvjkUObF VrZJLX+XiwaTFmqYqppirlVsVbb7OLBZ/kYq7/UxVcy/tpizUmb4eGLBe3x4q7u+KrOOKtcc Wbv8vFV+LBbxxVZizbblgZtcf5MLS5uWKqbLizU8VVFbFVvLFg5v58Vd8P2MVW80xZu+zira +328Vcy/F/l4qtbFg0uLNfiwU8Vdiq3lirarireKtfaxVrjiq1uXHFXYqs/18VXt/kYq7FVP FW2xVYzft4qv5M+Ku5NyxVY/+Xiqz/IxVvFXYq7FVNlbFXYqs44qp8XxVfxfFXYqp4qptwxV vj/weSV0fx4qskXFWuOWJWM2KrMWtplxVT/a5vkFWqvHJqtyCuxVbx/kxVU5Yq//0vqVmW4i rk1cy4qrL8TYtjlxVVVv28rQ5sVVY2yKr1xVdirfHhiq/nirsVdiq/4cVabFVz/byStKuRVf xxVdk2S3jx+PIMV6t+xirm5Yq7lirm/yMVX88VcrYq7/ACExV2Ku48sVdx4Liq5sVWquKruO KuVeP+pira/z/sYqv4/YxVzNiq/jwxVzNw+DFVi4q5m44qu/yHxZtcExVtuOKub/ACMVa+1i qsmBm7FVuFg2q/DiwX8m5Yq2rfDwyLJe2KtKuSYu5Yq7liq9cVcuKu5Yq1xxZu+LFXccVdxx VUxYO54q7hirXPFm3/qYsG+WLNcvxt8GLBpcVXYqtbFXL9jFm5vgxVeuKuyKFTFVvLFVNV+H FsdyxVWwq7FVvHFV6rzX/IxVrFW2X4cCt8cKtcsCu44qsaTFV6rirl5YqsyTBf8A3WBmv5L9 hMVd+ziq1VwsFy4q5v8Ah8ih3L/g8WxbkmDmXFXcsDNdx5tiq+PA1tZJK7jiqxvgxVtv8vIs W1Xj9jFK1ckxd8WRS7jkkKvwvkWSky5JLXLFW244q3irvi5ZFDfZMVX5JK1VxVY3x5Fi7/Ix VV/bxSpr9rhirlbg3DFXZJK3/IxVEZFC3JJdiqiuKr1bIodx/kxV32f2MVdkmK1Wb7GRSub+ RMUquKrfTxVSZfiySVjLiruGKu+xirkxV3L4MVdirlZWxVbkWa5V/wCDyTBZy7/t4qub+fAz b48sLBpVwM1nH+fAq77OKuxVvjirWFW2wNaxlxbF2FVPlhYKmBmtXkuKrVwsFzYGblwK5m+L Cq3lhYKar+xiruOKt/H+3irmxYKnH/g8VWt8GRZNfF9jJMVvHFmt54qubFVrLirbN8KJiwVM VU8VWfDirXH4sWaomLBTxVtsVW/5eBuWquFg7/XxVY2LBvj8L4qt44s22Xl9vFW/ixYKmLNS ZcVWK2KuxVtl/nxYKfJf28Wa9v58VWcf2HxVrFW1xVYvHFW2xYNLizX4sFrYqtxVbyxVdirX 2cVa44qt4Yq5mXjirmXFXPiruGKrP8jFXf5GKub48VaxV2KrH/y8Wbbf8PiwWMuKrF/y8VX/ AA8uGKtNiq37eKu4Yq7FVjYqs5YquxVTxVS+3s/28uStytDcmKrPjxVbxyxLm5Yqs5Ytazjy xVrIKt44quxVR48vt4q5uTYq/wD/0/qWv8mZbiKmTVfyxVe3H7GLY7jiqplaFT4cVX5FVVlx VrFVRMVc3+XirsVXt9jFW8Va5LyxVpf8jFmqP/kYsHcW4YquxVvjiruWKu44q7/UxVevL9vF Vn+Xiq98Vd8LYq77GKuTFXc8VXccVcuKt8vhxVfyxVTXFVbFVrfYxVdirsVb5c8Va44s28ih cmSSsVsVXK3PFW8Vd/l4q3wxYOX7OKr1+xiro8VXx/DiruOKtccWbfL+TFgqf8SxVrjiq74+ GLNZ8WKuxYKiYq7hirsVdirsVXfZxZrcWC5VxZu44sGlxZqmBmpthYKy4Gamq4WldHizXcci hyt8WLY77C4qtxV3LjkmC7FW+WKrF+FsVVuOBm1+1irmwK79rFXL/Jwxa2sVcv8Al4quySWm yLNvJMHfYxV3w/sYqp4qrZFC3nkkuxV2Kr/UxVZirueKqv20yKFvw5JKrx/nyKFJVySWlxV3 LFVZW4f7LIoWcW+xi2OZcWt3H9vFWl+L/XxVr7WSSq4q5sihbxxQs44q5lxV3Lhiq/7GSZLE +3iq5lyKHN7/AGMVXtiq3FVNeP7eSS38S4q74cVXM2RQs45JLl+zgZr+P20wNbvi+PFVqtkk uVsVVVXIoQ75JK9l54qu4s/x5FC1WySWuOKq3x/s/YyKFnL+fFVrMz5JLm/y8Vc38/7eKrFX 9jFXPiq3Is132MkwW5Fm77WKtcueSYLmXAzaxVc2KrcVXc8LBrlkUNYtjsVbZWwq1iq37GKr U/yMLBd+3gZuXFXfBirXF8Ct8v58WtSkySXfs4q3irfHAzbxVbhYLVxVrhiwX8efwYqsVcVd y+DFXcvgxV2KuxV3DFXcMVU8VaxZt/tYq3xxYLG+HFWuWLN3+piq/Fg7FVL/AFMVW8sWarxx YLFbk2KtftYs2uGRQ7j8GKrV5f7DJJdiqniqoy4q3J9vFgs+x8GKtLizUuPPFgvZcVd8eKrP 2sVbxVUxVTxVTxVUxVplxVYvw4q7hiruGKu4r9jFVnHniq98VWfDirmxVY3LFXKvLFW8WbX2 2xYLcVaVvixVpsVWs3/AYq7FVP7OKt8sVdxxVT4viq3imKtccVW8MVU+P7GXJXNlaFJf+Eyx gsZcVbxVTxVrhkFWMuKtYqu44q//1PqemZziO4Yqv4/sYqvXFUQv+RlbNy/5GKu4ryxVXyKt q2Kr14Yq7FXYqqYqtbFVTly+3iqxV5YqrceGKrcWa5WxYObjirWKqj4qp4qqYq5eX7eKtN/P izWfaxYKit+3irsVXcsVb/axVrjiqtiq3liq7FVqriq+PFVNcWa/Fgt44qqKuRZOXFVvHJJd +ziq9v8AIxVyriruLM3DFXMuKquLBpv58VXquKuXFV/7WKqbYs1TAzWccLSv44q1irmbFm7j iqpiwc+KuZsVdirStizdiq5sVbbFg2zYq0uKtccWapgZrvgxVR44WCpyxVrg+RQqfFkkt4Ga niq748VXYqu44q0q4GtzYq1hbFuFgvb48izcrYVczYq5V/nwKv8AtfYwqt+LCwd8OKufFXcM Vcq/yYq7FXccDN3PCwdirmXFVyZFC3JJX8eeKuXIsVX48Uu5csVUvtZJKqvxfYyKFPJJcvLj kUNt/l/sYtiz/LyTBU+xirfFk+xkULMklrl8OKt4qtXFVTj/AD4qsXliraq2RQ7JJVvtZFCm uSSuVsihTZuWKtNx5ZJLm/nxVtsihr9nJJX5FDStiq34sklcrM2RQv8A8vFVPJJWrirf2cVX P9vIoX/Y+PFUPkkqy8VxVT5Yq7liq9VyKFq8sklvFWuSYq2uRQqMvw88VUmbhkkrMVa48Miz dy54q2uFXPhYOxVyYq0y5Fm2yrkmDuOBmtxVbywKuxV2FVr/AORiruPw4qqLiqmrNiq/j8OK rOWKqat/JgVU/Yxa1uFsWMuFgvwM1P4uOFgv+BMDNrCwdx/YxYN4qsXFm0rclxYL2XFVmKuf FXNwxV2Ku+3iqlizb/axVtcWDuPPFVPjizcuKt/5GLBzYq5lXFVnH+TFW8Va+x9jFW8VWLiz XL7fYxYO5ZFkh8klUZsVU8Vb/ZxVfiqlxxYOXFV3H+TFmtbjiwWM2Ku48MVa44qqcsVcy4qs 5cPjxVvFVPFXN8OKufFXYq5lxV3DFVPFW2xVYv2MVbxZtKvxYsHfbxVTbFWlxZr8WCmy8MVd irsVU8VdirbNiqlirXLn8eKrG+D48VWs3Bckrv8AIxVzfyft4qofayxg7FWlxVZirXFsgrsV U8Vf/9X6n5nOIqYqu+PFsbbKUK6/8SyStfbyKqyrxxV37XPFVb/IxVcuKtZJVy+32MirmXFW lxVtV+LFVTFm0rYsHcf5MVX/ALHPFWsVdirfLFXMv8mKr+LYq5MVa+D7GKt8VxVUxVT5fHir sVVuOKrcVb5Ys3fHira4sF2KuxVZyxZt/wCviwVPUyLJrFV7NkmLuP7GKu4/HirS8MWa/j+3 iq1eeLBdyxVvj/Jirv8AUxVVxVazYq0rYs3ccVX4sG1xVpcWbsWDar/Piq9lxVpueLN3PFXK 2KruOKtcMWC/j8Xx4q1xxVrjizaTFgv5Jiq1sWa77f28WC7/AF8WblxVd8XHnkWbv8vCq7FW /sfHiq3kvwYWDXHAzX/FgVrFXfaxVtWxVZy44tbuPD43wti9mwNbv8vFW+GSSu/ZyLNb8WSY OxVzNirsVdiq/wDb+PAzab7XDFVqrhYO/ZxVWyKFzL+3+3iqkvx/bySV3wt9jIocq4q5fb7G Krfj/wBhkkuVuHwYq74cVcrYquX+fIoWr/PkkqqrzXIodx/nxbFnp4tbX+viqo38mKu44qp5 JKtkULWXFWuL4q5mXFW1X4sVd9vFXLxxVb/xHJJXK2RQ5l/kxVauSStbIobb+fFVn+Xkkr/T yKF6/wCviqnkku4/D8eRQqZJK7IoQ65JK5sih2KHYq7JMlq4q5V/YxVf8WRQv5YqsX+R8VWc cklEZFCgq8ft5JLmbFVmKu+LFXKuKufFV2RQt4YocmSZOxV2KtN7/byLN3HFWsVdirf+piqx v5MVd+3iruOFVRcVWf5eFgt48cWDbLgbnLgV3HFrXYqpsy5JLuOKrG+H4ExV3HFgr4G5DthY LmXFg7/IxVzNirTYquxVT/18VXqv7CfYxVY+KufFXYq5MVafFmtbFgs4/wAmKuVeWKu44q5c VXYqpYs3faxYOxZt/ZwM2sLBzK2LBTVuGLNvhiwUsWatzwM1HCwXMq8sWCmrLyxZub4cVX8c VdiwW8cVc2KrcVa/y8VabFV2KreOKrePLFXJiruGKuxV3+XiqxcVWfsYqv8A2cVWcsVXYqoN izXMuLBbxxZrmXFg5mxVa+SVpl/YyKuTFVNft4q22KrGxVyquKrG5YqsZcVWMuKtsvNvjySq TL8WWJWccWt32/sYqsfFXfZ+xirWQVTxV//W+p+ZziL+PxcExVU+Hjiq9V+LKWa/FVvw/Y/k ybBEKzZBmv8ATxVy4qvxV2Kr15f7PFW8VbbFm22LBpWxZuVlxVvjiwX/AOXirl5Yqvb7OKqa fYxV2Kttiq/hirsVcmKuxVf9rFXfZxVpsVVcWbsVWtira4sF2KrWxVrimLNey8MVbyKHYq19 rJMXR8uWLNfx/bxVvj/JiwXfs4s2/wBrFg3x+LA3NKrYWl37OKquKtYs12Bmt+L7eKt4Wlts VX8eOKuxVyriruGKtf8AE8Wbv+IYq7hiqpiqxf5ExYL1X/LxVvFXYqt44qvb+TFmt/yMihU4 4qptiqtiq3jhbHcV/YxV3HFV2KrcLBdgZuwK22KtfZxV2Ktt/l4q5lbCrmwK2mSYOxV3PFXc MVXfYwM1vDCwcv8APiq7liraq37eKu+zireKt/ayKF7Yqotkkt8eeKq+RQos3xYqqcfixVSZ vi/yMkly/HirX+XiqpxyLFYrYqqqrccUu44qqf8AEcWxb9rFrWsuKu4/yYq79vFVvwZJK5ly KHKuKu/1MVXcvixVtcWxY32f5cWtyriq3FV3HFXccVcy4q5cVd8PHFVqrkkrlyKF/wC1irWK reP8+KrsVbVcVWcsVXs3xYtiz7GLWpsvw4q18WSSv4piqm2KrlVsihr7OSSvVv5MVWq3xZFC 1cklcytkUNKuSSsXhiq/08VWceOKruOKreeKrmb9gYGa37GFg7hiq5MDNay4WC1v8jIobVuG FsawK3yxVrFXYq7CruaYFb/a4JirWKrckwXYGangVd/r4tblxVzYq7/XxVy4qs5fyYWxrCwc 3HFg7jw+PFWvt/BizVcVU/2sWDXHFVn+RizVF4p/qYsFmKuxVZy/kxV3LFWsVb44q1irbYqs bFV2KttJyxVrFVvx4qskxVauLNdxR/t4sGvtYs2/8vFgtb+f9jA3OX/hMVW/D+xhYOb7XwYq sVv58VWcv5MVd9vFV/L9h8VWr8X28WC7FXYq7FVv2Pt4q5sVczYqp8cVW4q5VxV3DFXYqs48 MVc2KtYqtXl9vFVir8WKuX4MVVMWan9nFg74cVaXFVvFvt4q2+SVr7eRVY3LFXNiqz/iOKr+ PxfHiqiy4q1yxVzcf2MVUm/nTFXZJVNssSsb/Lxa3csWxZi1ufFWnyCv/9f6p/azOcRcqti2 ObFVXl8WVoVfhyKu7Piro/8AI+PFUSq4q7FXcMVX+n/PirS4qvySttkVUmxZqi4qv+HFW1xY O4/DirWKqjLxXFVi8sVc2KubFV/PFVTFWv8ALxVpsVbX4Wriqriqniqpiq39nhiq7FWuL4s2 8WDuWLNy4q3kUKj4qtVm+3kkuVvixVy8MVb/ANfFgqftYG5vFWsLSu/18Vcv/D4q3izWsuKr 8WDsVW/sYq0q/wCRizX8v58VVPt4sHcMVaxZu+HFV/Hhiqxmb7GKt8MWDvsYqvjb4sVW8cWa t9vAzU/sJhaVRfiyLJr4uPwYqvxbFq4Vcv2f8nFV2KrVxVbiqpiq1cVWrhYKv7KYGblXArfH CruOKtcf28CuX/Lwq3+zhYOxV3DFXMq4q7FXM2KufFXL/l4qvX/UxV32cVaXFXccVdxxVf8A b+xkUL1Xjiqkvt9jJJbZlyKGl+DJJVcVdy+LIodHiq7FXYq7FVv7eKuXFV2KuxVay4q5sVXc f5MVW8cVXYq7FVq/t+ni2LsWttfgxbFnx4tbuOKu5YqvXFVn2/jxVzLx+3iq3lkkrmXIoc32 uGKu5/sYquxV2KuxVbxxV2SS5fhyKF2KuxV2KuxbHYta3jiqi2SSv4/sZFC1vjySW+Pxc8ih 2SS0y88VVVyKFjccVUsklUZeORQuXJJW4q2rcFyKFLk2SSuXhkUOZlxVt/t5JKz/AC8VdzxV 3w4q7j+3irX+RgZtcEwK3xxV32vt/Dirvtf5WKtYq7FXYqptxT48kwXL8OBmuwKsb7eKt8eL Yquxa1Ll2/bxVr/LxVpckxX4G5UxVTxVd+3iqlx/YwsF2LBT4r0+1irX+RizcrYq77eKt4sH Mv7YxVSxZuZvh4Yq3yxVrFW8WCxvt4quxZu5fDgZtN/JhaXceWKqX+RizVMDNpmxVr4sLSsk Xniq1siybTJJdzxVzLiq3/LxYNYq3yb9jFVuLNpsWDuWKrGbliqriqnirStirXLFVv8AkYq5 lxV2Ku4YqqYqp/Fx+PFVPFXfaxVv4sVcrYq0uLNSbliwdyySt5FVPFXYq7FVnLFV+KqPHFV2 Kt5JVLIqtbFVH7WKtsvD9vFVP/Xy5LpOS4taxlxV37OKrOPHFXYq/wD/0Pqkq/sZnOIv+Lhi 2L/tYqqr/kZWhrIqqL/qZJVzf8FkVX/6mKr2X4cVb44s137WLBpcVVFXFXL8WKtccWbvgxVU 5YsHccVXq2KrOK8sVc2Kr3xV2Ku/18Vdiqpiq3/iOKt8f28VXtirv2uGKrGbFW8VXLiq/jir WKub4MWa3j/JiwbT/LyLJUTJJU8VV1bFVitiq9eX7eKq2LBTXA3N4q2v2MLSuxVby+LFWv2M Wap9pcWDlxVYuKrvs4qsZvixZrvj/YxVVxYOxVvlizW4q7FV3HFWsWCpiqzlizXYq3xwM1/+ vga3ceWKu9TFVvLJJXLgZuwsF2Bm2vwYq1iq39vAruOKrsKrVwK7lxxVe3wYVcy4q5l4YFXr wwq7A1rZFXJJc32sVcmKruOKrVX7eKuxV2KqvH+TIoWrxySXfFiqqv8AJkUKTfyZJLXHFW14 piruKYqu4/byKG+OKFnHFVfFKxlXFW/9TFXM3LFV7LirWLY7FrUE+3kkqvqfFkUL/ixbHM2L W1y/kxV2Ku4/Fiq1VbFV2Kt8sWxZ/l4ta9V/YxbFi/z4ta9W/wCAxV3+Xi2NYq7Frc328Wx2 LWt+3iq9VxV3+viqzlirXJ8VX4qt+PFsXYta1uWKu+PFXfYxVdx/nxVvliqnyyTFUZciyU1/ yPt4q22Kuk4/YxVS9Tnkkt4qtXFVblxyKFFsklf+zkULOOSSuZv2MihU/wBfFVnHt+xiql9v JJcmKuZcVc+Ku4Yq77GKu4Yq7jyxVcy4GangVvjirbL/AD4VWcsLBcuRZrF/nxVzN/JirmVe OSYLeXFsVW4qqKuBm7lw/wBfAq7FrU8Vb+PJMVmLN2KreWKubFV+LBay4s2+LfbxYLOGKtK2 LNUxVpcWC3/IxVT44s1jYqu+zirvtYquX4MWDv8AXxVTf/LxZuVv5MVd+xirariwWf5eKreO LNe38+Bm0v8AJhaWmxVrjizW8MVXf5eBm1haVP7fwYs22xYO9Pk3DFVvNMWa70/58WCzjirn /wAjFXceOKrPtYq7b+fFXfDirm+DFVmKuxVey4qsxVb/AMRxVpuWKu+38eKub48VWP8A5GKu 48mxVrimLNzYq19rJMFvHIq7lirfHhiqzniruLYqs44qsbFV/HFVBsVdxxVbirvixVZyxVbx blk2Cnk1a5Yq5v8ALxVZxX9jFX//0fql+1mc4iurft4tjf2Pt5WhuP7GRVfxxVUZeOKr1XFV 6Yq7FV6rirlXFV/HFXKv8+KubFXfD+xiq/jiq/j8GKu48FxV2KqeKqnH48VdiruP7eKu/ZxV 2KrmxVdirsVWriqtiqkv+Riq/jiq7FXf5GLN37WKrV+LFgu44s1/FcVdiq3l/l4sFVfgxZt4 q1yX7GKrl44GbsLSu/yMVab7GLN3LFW2xYOZf5MVdxxVfx54q7/iOLNbiqr/AMTxYOVcVaTF m5MVd9jFXc8VVOKYsG8VWNizdyxVdiq1sVX8cDNvAqpiq3jywq3xwsHL/Jiq7jkUNP8AYxVt sVWNiruOLY7jirlXCq7FVqtgVf8AtYq2qrkmC5m55Fmtb4/gyTBdy/nyKFqZJLTcUxVtMVc3 PFXLzxVfx/YxVzLxxV37Xx4qv48/t/Biq1eX2Mih3LFXf5eKtyYqs45JK5l+LIoXccklc2RQ 5WxV3P8AbxVdira+/wBjFVn7X+Tiq9cVdy4Ytjmxa3csVWN/Jirv8jFV7NirvixVrFW+WKrH /wAjFV2LYt/1MWt3+virmxV328VcuKrsVWriq7FW1xV3LFWsVbX4MVWM2Kr+OKu44q5l5Yqs /wAt8VX8cWxrFVq4ta/jzxbFjNi1rsVbbFWsVW8uWKu/18VXr8eLYsZcWtyx4q7liruWKubF VnB8VWf6+SSub9jhkUKeSSu5Yq2q4qsxVz4qu4t+xkWa3JMHN8WKu+HFWm4tgZuZvixVby+L CwXfDkUOZcVdx5/HhbGv2OGBW1xVyrirSfYxVb8eFW1XCwdxxVYy8cVXLz45Fm5mxa1jLiqr hbFL4sVW/ZwsFVcDNTwsHYqt5YqtyLFtfhySHL8H2MVa5fBizWL7/YxVU5csWDuK/t4qs44q 1/qYs2sVWtiqovwYsGsVWYG53LCwX4sFvHFVv2cDc3iqxsLSsxZu4Yqqs2RQpftZJLfH48WD XDFms44q3+3zyKFuSS7FWlxYLsVdiq1WxVdiqky4q3iqm+KuxVc2KrcVcmKuTFVi4q7/AF8V Wr/wWSVriv8AqZFXcm4Yq7/IxVZt/Pirv8jFW8VU8VdirkxV3p/Diqn9rFVvJf28Vb/bySqH 2vt5FXfs8MVWt/JklaZf5MsSpsuKuX4vjxa1i4q3ir//0vqky/t5nOIqxt8OVs1bFWsiqt/x HFXNiqtzxVUxVrj8OKuxZr1xYLvs4qt5Yq77a4quXFm77WLBv/IxVpfgxZqn+Riwcy4q58Vc rYqqYqpquKuTFVTFXYqqYqt4/wAmKtLyxZqnLhiwd8OKtcv2MWblXFXNirsWC9VxZrOOKr6/ 5eKruGRQuySW/tYGblxV3+XiqphaW+WKqa8cWa74MDNvC0t/6mKrFxVdirlbFm7jiqpzxYL/ ALP+piqn8WLNd/qYqt5N1+1irsVVcWDfLFmu+w2BmtXCwW4quwM1TArsVW8sVWrkmC/j+xir fH9vIobZsWxzNirWKuxVtcVcrYq1hVvj+3irlXngVf8At/Hiq3JMHfbxV3H+TFXN/Pirv9fF XfHzxV2Kr2ZsVcy8cVczcsixdyTJMmv9TFVb4v8AWyKFFsklvjzxVVX/AITIoUviySW8VVFy KF2KuxVb8eKu4quKu+3iq7Fsdi1tri2LOSYtbvt/YxVdiq1VbFVPJJV/8vIs3N8bYq5lxVrF rc3+Rirfw4tjWKuxa21XFsaxV2LW7FXNyxV2LY3yxVY2LWv/AMjFsXsuKrOOKr8VWcf2MVd/ kYq7i32MWtS4/wDB5JK5cihzYquxV2Kt/tYtixcWte2KrPgxVdiq3jiq9WxbFjYta7FVvHli rmZmxVz/AOXirvjxVzLyxVS+D9jJJWYqu5Yq2v8APiqziv7eKtfsfBiq/Is1qZJgvbliqx8V dzxV3FvsYq0y5Fms44quwq3/AJGBWsVVPsYVUeOBVbnhVZ8OBrcy4q5o1xVbx55JLXxPkWbX Hl8D4ta37fwYtirhVTxVbhYN8sDN3HFW8Vb44WlY2RZNN8GKFj5Jku/4jirWLB2KrOX8n2Mi yXpkmKnyXjizc2KrV+HFgu5PirmXFms4t/JiqozfDiwUeX20xVerNiqzsmKtNiq7FVvHFVnH lizVWbIoUuPD48klvhiwWcfhxVpWxZruORQt5ZJLuPPFW2XFgsVcVXYq7FVPFWvtNirTYqtx Vc2KrcVcmKrF44q5sVX88VWLiqzjk2TmXIMXN8P2MVcy4qtX+d8krX+XkVd/kJiqzFXYq7FV i4q5fgxVZ+3iqlx+Lnk2DbZBm03xZJVjLiql9j48sS3IvDFrU/8AXxV3L+fFX//T+qXHv+3m c4ioq5SzV2XJKsVWwsEVkGbfHFV+KuZsVVMVaVcVX/t4qv4v/JiqxP8AIxVd9rFXYq7FVTFX cWxVyYq7FVTFXYqsXFmvxYOxVdy+HFVP/iOKtr8C4qv+PFXccVXYq1izdirsVbVcVVOP8mLB vA3LcLBv/X+3iwX8f58VXYG5bhYL/sNiwXYq3gblPimFgqf6+LBYq4q3izb5ft4q7j8WKqnw cMWDsVdxV8VaZsWbsVdwxV3H48VbxYL/ALOKuxZuxVWwM1BVwsFVv5MizXYqtbFXKv8AweFV vH4UwsF/H4v9fFWv8jIs12KuxVtcVdyxVZyxVezYq19rFV3HCrsLB3LlirsVdzxV3L+fFVTI sVqtilbkku+3iqI5ZFDlXFVFsklEZFCnyySVuKu5fsZFiqfsYpcv8+KqXFMklpcVVuORQv44 q74uOLYsbFrXriqkyrkkrmyKF7Li2LOWLW5mxV3HFXf5eKr1/wAvFscvwfbxVy+328Vc2Kr8 VWNirWKtr/kYqs+L/Y4ta9mxbHKvHFWsWt3BMWx2KuZf2P2MVa45Jg5VxVvIs2/2sVdx7ft4 q1irfw4q1irsVdirfH+TFXftYq7ji1rG/kxV3HFV7YqpNw5YoVPs4pdirfHFXKuKtYqtVcWx arcckwVVyKGsVWriq9l/nxVDf5eSSuZfhyKFT/XxVTySVTFVHjirv8jFVrckxVyYq7FXcMVX sy4q0q/z4q7lirkyKFvHlkktf5eRZr+XNsKrFX+fFXM2BW3yTBbkWbfw4q5uWKtfC2LWt44q qccLYp8eWBXcsVcuKu44tbm/18VWyN8WSSt/axYNK2LNfgZrGXl8GFg3wfFgrZFkhskxa4Ys 3Yq3iwU/TyKVrZJC79nFm3x/kxYO44q1irXHIslrL+xkkrlwM2uP8mFpdxxVT/axZu44sFzN gbnf6+KqX28LBvhiwa+3izXYGa3Cwczft4qp/B/sMVXcu/7eLBpmbFmtVcWC7FVjfbxVrFVv LFW/8vFXfaxVYy/Diq9lxVYy/DirnxV3H9jFVjL+xirvt/HiruWKu4r9vFVjNirv9TFVmLN3 +XiwcrYqsxV2KuVcVc+KqKriruPxYqp8cVW8lxVvj8Px5JXPiqlkVWfsZclbi1tf5GKv/9T6 q/Hmc0Kn+QmUoVEySuXCwV8gzdiqtyxVdiq1sVbxZreOKohVxYObFXN/Jiq/FVPFVRVp8CfY xVdyxVy4q2rYqsxVUxVpVbFW8Va+1ireKrVxVpl/4PFmr4sG/ixVby+LgmLNby/nxVerYq0r fDzxVd8WLBdizd+zirar3fFgu+D7eLNfgZqfHCwVf8vFg7/IxVzcfsYq3izd6fxYGbeFpb/a xVr4ePDFm74cVbbFg5l/kxVf/qYq7/IxVrhizdirvixV3HliqorYsHfZxVdgbluFguwM13+X irv8vAruPLFXKuFW/wDIT7eFgubl/wABkWbWFW+P8mBV/wCzwxVYvx4q5VbFWsVdirfLnhV3 +vgVvlyyTByYqvf7eKtK2Bmt/wCIYWDnxV2KuVcVVMVa48MVbxVyr/PkUN8v28Vd9nFVi5JL ceKt/b/18ihe328Vbp8X+Xirm+1/lYq5sVcy4q5cVWq2SSuZsihzL/Jiq7FW+WKrFXFV6rir WKt8sWxr7WKqnDFVi/5eKublyxa1/DFscy4qsZeWKr0xV2KqeKqitiqxsVX4qp/Zxa24/wDL xbGsVVPtNirlbFVPFW1blirmX+TFXMuKtYq7i+KtsuKu44qv54taxsWxy4tbWKt8cWx37WLW 7jirWKt8fhxbHccVdxxa2sVb5Yqs44qv5Yqp8XxVfiq37eKu5fz4q6Rf2MVc2Ku/y0xVSZsk lVVsihyriqjxySVrLiq7/LxV32vgwM1rLhYOfFXfs4q7l+xiruGKu/yMVXsvw4q032sihZxx bHcfhxVrFW+X8mKtYq2uKtL/ACYtbsWxb9jCrv2MVd+xgV3+Rirlxa1uKu/y8klbiq1cVVFV ft4q1iwU8VXcsVU+PNcWbfH4eGKt4sGsil3DFW8khT44s3c0xYO4vira5FLm/nySGsVWcsWb bf77TFg0328Vb+3iq34sDc1hYLePw88VX4sFmBudwxVa+Fgs4/sYq7jira4sFvBMWa5mVMWC z7HwYquxVRbFVTjyxVTbFV2KreWKrV/nxVdxxVbiruGKqbN+xizbb4MWDm5fsYq5eLYq5l+H FXN/Jiqzjiqxv5MVbxV2Kqb4q58Vdiqz4sVWccVd+3iqk2TYLn+3kGa3JKp8eGRV2SVbliVr fyYtb//V+rK5nNCpwytDXDIqrKrYqvVcVXquKuTFV/2sVcvHFV6tyxV3+Xiq9Y2xV3HFXLiq /wCxiruGKuxVUxVTxVf/AKmKt4quVcVU+WKqnHlirXwYs3fYxVvliwc2Ku5YquxVtsVaxVzL izdxxVy8cVVcDNpV4YGtcuSYtf8AG+LNdy+xiwcv2ueRZLv2MUNr8PwZJDv2MVXYq38OKrX+ xizb5Yq7/LxV2LBv/LxVfx/YxVr03xZu48sVbxYO4Yq5MVX8ciyXYWxZ9rCwXquKtL/l4Gbl bAreKruWKrsKrPgwtLSrybFmqP8AYyLNtmxVrFVvHFV/+XirlbFXLiruPPFrcyri2NpkmDsV X/5H7eKrPtft4q7l/Pirvt4qu/1MVW/5GKohVyKFJlySWuWKrsixa45JCtiqniqzlizVuORQ uxV2Krfi/wBli2O44ta7FXYq7FVNfixQu/2GLa0zLi1r8VW8cVd9vFVZm/bxbHcuDYq7FVPF W2xVr7WLW38OLYvxVTxV2KqnHlirvt4q7FVPFW1+PFXM37eKr+eKu4YtbmbsmKrF+PFsX/Yx V2Ku5NiqxV/nxVr7WKqmKrGxa174tizlirmxVfiqxlxV3LFWsWt2Kt8cVd/kYtjuOLW7jiqx WxVd9nFW2xVrFVnJ8VVG44tjWLW22KrOPxYquxVzLxXFsWtx+3i1ubFXcfhxVSf7eSSqMuLB v/LyLJSZsklYy4quyKFvw5JLuGKufFV65Fi18PHJMluKu5f8HirTLy+N8izbfJMFuRZtrirl xV32lxV3w4VWYWDfp8MVaxVarYqqZFmt/wBfFV2KuxVTbJMFuKruP86YqsVcVc38+KtcsVaf Fg7FWuGLNz4q2rfsHFg77GKu+HFVnHFWuPP7H2cVdirbN/wGKu44qsVcVbZl/bwNy5cLS1iq jy54s3L8GKrPixVU+D9vFg02KqTYqu+xizXYGbSt8Xx4WlYy4qp/F+3izX8sVW/Y+xiwdyxV diqky/D8GKu+HFXcv58VbxV2KqeKufFVTFVNmxV3+piruGKrP8vFWuL4qu/Z+PJKpr8ORVpv i+xizb/18WC3FVrYqtZcVdiqnxfFV3HJKp/6n7eRVbirTNirm/nxVa32skrvh/YxVZ6fDFUO 2WMH/9b6tfZXMpx1/PFVVl/kyKrsVbb+fFWsVRGKtcUxVvFVy4qvX+fFXL/l4qv/AGcVUsWa qq/sYsFTFXYq7FVP/UxVUxV2KrVxVzYq3/kYqqYs1rLirfHFgv5cMVaxVc2RZOb7XwYq7i3L FW+GSS5W4YquwM3c8VdwwNar8GSYrft/Bgblyqv/AAWFpd9vFV64qsZsVXYq7FXYq74cWbv8 vFVrcsWC7FXfZxVUxVrhizd/xPFVXFg1izcy4sG8VW/axZtcsVXt8GRZt4qqYqt+3irlXCra /BhYLf8AUxYLmxZrmk/YyLNrFXYq3/l4q5f8jFWsVXfZ+DJMF3HFVvxYq2v2eaZFDWSS5MVc rYq5v58Vcq4qvX3+3irbfD8eRQ5sVWtkkqi4qp8cVX8fiyKFnHJJVlb4sihy4q7liqnkkr1+ z/lZFC/FW+Xf9vFsaxa1rNiq7FW+OKtYqtbFV2LY7Frb44ti/FVjYq79rFXM2Kr+eKuxVTxV tWxa16ri2O4Yq79nFXc8Vd9lsVWccVXvirsVdiqniqpirm5csVdirsVWNxxV3H+TFXftYqvZ cVWKuKr8Vdiqzliq/FVnLhiruWKubjiq/hiqnirbK3LFXccVdxxVrFXYq3x54qs44tblxVdi 2LZG/nxa12KuxVTXJJXcvh55FC3/AIjihcvHFLlXFXZJKly+HFXNkWKr/qYpUeGKt8fhySW2 X9jIoUuPD7eSS2+KqjN8ORQpNy+xkktviq/j8WKrOeKuTIsV/HFVP7OFtcuBVPi+KqjYq7/X xVzR4q1iq1cVd/qYVd6mKrsVW/YxV3LA1rsVW/5eKqf7OSYuxZtL/JirlxYLsVUsWbuGKqjf H9vFg0uKrcVWNirl/wAvFXKvH7H2MVaxVb/xHFW245Fk18SZJiub/LxZt8v2ExYLG+HFVnw4 qv5cVxVSbFmvxYNftYqpt8OLNdgZrV/yMLB2KrePxYsGl+3iqzlizXYq3iwW8f58VcuKrcVX ccVdxxVbiqny5Yq79rFV7NyxVQXFmqM2LBZ8WKuX/LxV3HFW/wDXySqf+RkVa44s1v7OLBY+ Ku/Z54q58VWLiq//ACMVWK37GKrOOKrcVdiqzhklUm+PLErv9TK0LW/y8sS//9f6sq3xZkOO vj/nTFV2TYKi5BmrLwxV2Kr/APIxVvFVyriq7FXc0xVUTFXLzxV3Hn9vFXYqu44qsVvixZqu LBbxxVy4q38OKt4qqYqtXFXMvHFXLiruWKr+TPirm5Yqv/Y+DIslrYqt45JK98VcmKqeKqit +wcVVFb9jFgt5Ys1ytiwbxVvA3O44WDf+viwXtirmZsVcuKtfYfFm7/UxVvjwxYL8VdirsVd irkxVVyLJb8WSYrWxZojAzUlxVvFXYFaZsVVcVWrhVr9n48LS1+2+KrlXA3LsVXfFhYNfFgZ u/18CrPsYquxVdwyTB3L4vsYq7lxxV2Krm48sihamSSqt8PwJkUKSZJLlX/gMVXr8fwYq5Vx VcvF8ihf/qYqorkkr0+3kUL1/kxVy/DirvtfG+Ku44quxVaq/Fiq/l/Ji2LFxa3L9jFV2Kre WKu44q5lxVevv9jFVnHFV/H4sWxy/Bi1uXFsaxVUxV32MVWLx+xiq/niqxsVXquKu4tirsVW fY+DFXceeKr/ALeKu5fsYq79rFXcMVcy4q58VU+X7GLWqYtjm+1irvhxV3PFXcvgxVTxVU4Y q5MVcmKrOX8/2MVaxa1TFsWKv/D4qv8A9f8AYxV3L+TFXc8VWLiq/wCHFVjfB8eKtYq7FVR8 VU8VbZsVcuLW1i2Nt7fYxa3csWxrFrWqv7D/AGMWxf8As4tbl+PFXLiqk2SS3yfIoVOOKrGX FVn2sVXs2KqPHJJb+LFXfFiqq/8AkZFClx/nySVzR5FDWSS02RYub48VWc8VXYpW/wCXkku5 4q0q5Fm7li1u48vsYtjl+z8eFXceGKuZsCrVyTBcuRZuZsKtYq3y54qs/wAvFXM2KuZcCr+P xcMWtRb+fFVXC2OxVbyxVTwsG8WDsVUsWbm/kxVaq/DiwX4qp/s4s3ceeKttiwdxxVrFVjZF K/JIWccWa/FgtVsVd/l4qs4/t4q1+1izXcv58DNr4sLSsVcVab4cWbsVWtiwXYs1n7fwYq1i q79nFg5lxVT4viqzj+3izVsWCniq3jiruOKt/s4q1xxVbiqzjiq/j/Jiqz9nFXLirl+BsVWf t4q7/LxVrjizWs3P7eLBvFVNvhxV3DFXYqsZv+DxVZx/nxV3+Xirm+LFVPjirSszZJVBVyKt ft5cl//Q+ri/ZzIcdy/ZxVW+3iq7FW1xVfwxVUxVYuLNVT/LxYO/18VX/wCpiqsq4qsxVzLw bhiq/wD18VaXFVqsvLFV3HFW1bFWlxVU/YxVpmxZtriwW4qu4/Dirl+38eKrlXFmsbFV64qq xrwyKFi8UySW8Vd/kYq7FXc8Vdiq9cWDvs4s1ReOLB3HlireLNytgZt4Wlvliq/j/Jiqm386 Ys2/2sWC/FXc8VdwxV3PFW+OLN3HFV/7ORQt4/t5JLTYqrNgZqPLCwVMDNrb+TFV64Fd8GKu 44Vc2Ku+w2KrsVb4/sYFdx/YxVrFW5MVcq8vsYq22FXccVd8L/BhYOxVTxVUxVUxVbyxV3+R irarirmXFVX/ACMihZ+x8eKrOWSS2vHFWlxVU44quVcihdirbYtjWLWt48cVdy+LFV6/5eLY 1i1rGVcVb4pi2L1xV3+pi1rF+xiq9lxbF+KuxVZ/l4q5sVX4qs44q5vs88Vcq4qvxVyYqv8A ixVZ+1irkxVyrirlXFXfEuKuxVyYq7FXPiruXwYq7FVP7WKqj4q5WxV2KuxVZ/l4qvxVzfDi ruX/AAeKrOP8+Ku/axVe+KufFVPFVR8VU8VVMVWMq4qvb+fFVnH+fFV6YqsXFV/DFVnHFXNi rWKrfi488WtevwYtjvjfFWvt/bxa22xVzYtjvixa1nx4q5l/bxV3+Rirm+LFV2KodsklW+39 jIoWcWXriqxsklzYq2rYq22RQ0y5JLX2vgyLNa+SYO+PnirnxV3+XiqxsVVGXnkUN/5GLYt4 4VW/awK22KrOKYqvaTFWsVdhV2Kqa8sLBcy4GbmxV37eKqfLAqpxf7GKu+F8VU1xV3HFW2wq t44Wlv8AY+DFVD/LxZr8VX8sWC3nirTNizU/s4qq/wCX+xiwWNirm+PFXNiqmy5FK/JIWN/P izX4sFrcU/1MVcvwtiqmv8+LN37OKreGLBpV+HFmuwM3L9nFVvDCwdiqxm+HFXf6mKrWxYLm bFm2y/tviwWP/kYq5mxVdiqnirXx/sYq3irX2cVWPirmX9jFVn+piq/7GKqeKt/s4q5l/bxV Y0f7GKuVlxVZx4Yq5fj+3irTYqt4Yq7niqxfh+B/t4q5l5Yqt45JW8iqiuKtc8krXFf2Miql lyX/0fq82ZDjqi/CuKr1XFWsVVOeKqmKuxVvlizdxxVdiqrzxYLmxV3HFW3+3irsWaxMWC9V xVevxYqp8sVb4/t4q3iqpiqniq7lirl5Yqu/axZreXHFg3izVsihS45JKrgZrcLBteGLBrhi zcy4qv8A2sVbxVb/AJeKruPFsihf9hckxdyX7CYquxVvjirlXFWv8vFmqYsHKv7GKuxVT/1M Waviqnx5ZFiuXnilzZJK7FW+OBm1hYLVxVevx4GbuP7GBV/+Riq7FVv+vhVvlhYLl44GblXA rmXFVmSYKnLAzW4FbVsVawqqMvDFXf6mFgpLiqs3wfBkWKzniq7jwX/XxSv49/28VaySVPFV zYq7/LxVdkWK5WyTJtWXIoWMv7GKqnLFV2KrW+LFV/HFWsVb44q1irsVdy+LFW1xVTX7eKt/ t4q7jiq9VxbHcuGKr8VU8VdirsWtvli2L+GKub/IxV2KrmxVbiqz9rFXfs4qv5cl54q7hiqz /IxV37WKu+FsVaxVUfFXYq7nirsVdirkxV2KuxV3PFXYq5MVcmKuX+TFXPirsVdzxV2KuxV3 PFVn7OKr2+1irlXFVPFVTFXPirv2uGKqeKuxVU+LFVnLFXcf58Vaxa3YtjsVb4/tpirlXFrd HiqxV/bxVdiq3jirv+JYqvVVxVZyxVdiqjxxVbyySVTIoW5JKp9vIoUvT4ZJKr+xkUKXLhkk rF54q7FXfDiq5sVdxblkULeGSS7FV37WBmp/sc8Ctti1uXFXN/Pi2O4/sYq5cVd9v4MVWccV X8cVWLhVdiq3liq7Aq3i3HhirmXFXLxxVzNyxVauSYLcVd9v7eRYrPhySGmkxZuZsVW/5eLB 3Hhiq3Fm7FW8WDf7WKrP8jFV2KrVbFVmLNVxYLePLFWsiyW5JKmq4qqsuBm18OFpWcef2MVd /qYq74cVa4/z4s1x/byKFL4skl3HFVqf5eLBdiq1sVXYqt/YxVTbFW/8jFWvs4s12LBbxxVb irsVWNirWKtsvDFVPlyxZt/tfzYsHf6+KtZJVvH9vIq7/UxVZiqxlxV3xYq1irTZJWlb+fIq p8cVU15ceGSVezYq/wD/0vq8uZDjt+nzxVWVcVaxVUxVUxVd/qYq1x+L48Wa3FV7fyYsF/L/ AC8VX8MVd8P7eKuZl/bxV2Kr1XFW8VWriqouKrPtYq1xxVUVcVXYqs+DFm5m5Yq5eHLFW1b9 j9jFgrKv/AYqprizczfsYqq4GajhYK2RQvZW/nxVr/UyTFrimLNvFVvHFVX4UxYNcsWa7IsX csUruWSYtLizb/ZxYL8Vdy5YqqYqpJizXr8eKt8f2MWDv2sVW8cWapgZreOBVTjiq3FVyr8O KrPs4qq4qtbCruP/AAeKr1+DFXL+3zwK1iratyxV3wp8fPFV/DCqjxwKvbFV7L8X2MKrft4W DlVn+xirl/kxV3+XwxVev8+Kt/8AEsihr9rJJXLyyKFvxZJLvhxVtWXIod/kZJi0rYs1Vv5+ eRQ5cVc38mKuVfixVbx5YoVVbhilrFXYq3yxbHM2KuXFrd/l4q7jzxbGvs4qqYqpt9vFXYq3 yxa2sVdi2Nsv8mKr3xVTxV37HDFVRmxV2KrP8j9vFV/L/g8Vd/qYq7/LfFXYq7FXfFirsVc+ KuxVUxVT4Yq7jxxVc2KrcVdwxVz4qs4qvTFV7R4q7FXJiruGKuxV3PFVjYqvX4sVdyX9vFVn +p8WKubFV/DFVn+Riq9MVdybFXN8OKu4Yq77GKub4cVdG2KrOX8+Kr+PHFVPFW+OKub+fFV+ KqeKtri1u4/Fi2LGxa3cfi54qt/y8klczZFDlxVv4sklr9vIs1vHlkmCnxxVWxVT5ZFDsklz L/l5FDskltlXlkULGySW25Yqs4riqp8PLIoWqq4Wxb8S4WC7IoU8VXN8OSSu4/BkWalGvDJM G8izW8sVXYq2rYq5sVdxxVrCq1cVX/FiqxVwK5vixVy4q77GKqeSYNN9lMVXfFkULVyTFZzx Zu4Yq3iwdirUn8+LNZ8T/wCpiqzkmKq74sFn7WKubFXNiqzlirXD9vFm3/qYsF2KrG+HIpdh bVPFVyfbwtLeKrHyLJ3DFXJhbFPl/Pga1TniqHZskl3L+TFV/L4cVb/ZxYLOH7GKrsVU8VaZ cVd/kcMVWfDirmX/AIDFXMv7GKrGxVfirnxVTxVrFm1+3iwd/wAJirmXFXfbxVT44qpccVX8 VfFVnHFWsVbVcVUOOTZK2QYodfs4q77P2MVf/9P6vxtmQ46rirfL+fFV6Yq5MVXsv7eKqmLN vFg3x+LFXccVX4q5W+Hniq9lxVrjiq7FWlbFVTFmt4pirfHFg5WxV3+piq5m/kxZtYq2uKtf ZxVpsWCvgblvPCwWR4qq88DNrnhaWv2sWbuPHFVTl/PiwXYG5YuFpVFVcVcy/Diq7FVq4qux Vviv7eKrcWbfxpiqpiwdirXDFm5WxVevwYq3irTMuKtLiqpgZqmBVvJMVWKuKt4qu4ft4q7j iq39jJMFTAzW/wCu+KrsVdgVvlz+xhVZ/kYFX/s4q22FXYWC5mb9vIoc3+Xirm4YWxazNhYL lXiuRZr+K/sYtazjkktxtirmblirTYqiMihS+LFVn+vkkuZv58VVOWKqmRQ7Fsdi1tquKrP2 MVVsWx2KrGxV3HhiruOKtKvP/UxV2LWqYtixlxVrFVTFXcMVdirl+HFXJirnxVY2Kr/2cVdi rv2sVU8VdiqpirlX4cVU8VVMVdwxVUxVbyxVby+DFXc8VdzxV3PFXPhVdxwK3x4Lirm5ccVc 3x4qsZcVXcsVdyxVy4q5sVabFku+HFisxV2KuZlxVTxV2Kt8sVdxxVemKuTFVnHFV/PFXc8V U3+xirfHFV/7WKu54qsVuWKr3xVTxVU4/HiqnirsVdirbYq5cVc2LW1iq37eKrvsfYxVa2Ku bFXMuKqX20ySVVVyKHSfZxVSf7eSSuVuf2PsZFDv2sVa48vt4q7JJW8sVW8uOKrv2f8AIyKH fbxVa+SS7FXfYxVplyLNvjhVpvgwK5fgxa2sVbZsWxrFXYq3x+LFVnHlhV3HFXcsVXYFdiqk rYq3/PkmCzimKubFg7jirf8AkYqsTFVTFVPFXJiqzlirv8vFWlb+TFm5f8vFXN/kYq2y4sFP jkUr8khaq/Fiq7FVHjiqtiqk3FGxVUbl9vA3KXHhhYOZeOKtKy/t5FDsVWr8OSS5m/nxVcy8 /gfIoUckl2KtckxYLsVW/YxV3HFVuKrWxVvl/JirlXFWuWKrWbhirsVc3w4qsbFXN/kYq7/L xVTZcWbmxVrFgtXFVrLirsVU/s4q22KrOOKubFVjZJXccVWZFX//1Pq9yzIcdUVcVX/t/Hiq /j8GKr1bFWuWKqiriruXxYqvVf5MVdx/nxVfy/bxVyYq58VX/DireKrlxVpvhxZqf+Riqviw b/yMVWcsVXfZxVrFmt44quxVuNsVVePwYGbuXHFXcMVW4WDsVa+D7eKr1xVevx4Ga37H28LB WxYLeOKts3LA3KSthYK2LBtf58VaX4/sYs3csVdy/kxVU4YsGm4Ys3LzxVyYqvX+TFXN8GKt 4q7FVRV/bwM12BVFcVVFxVyr+3iq7FVq8sKrsVdirf8AqYFWMuKr/wBrFWsVXft/HkmDX7OR ZtYVb+ziqrywNa18Vd+38GLYtyTBey4qqcnyKG8klS4/FirTN/Jiq9m/Y/byKGsklcv2MVWN 8eKqi8X+PIs22xa2lVcVVP8AUxVZ+3iq9cVcqqnx4ti/hiqzlirX2cWtvji2ObFV7Liqz4cW tyri2L+PLFVP7WKqmKub7WKu+L9jFV/Z8VWYq7FXYqs4/Diq/hirueKufFXcVxVyYq79nFV6 tireKreOKuXFV2KrVxVtuS4q79rFVnDFVTFVPniq5cVXYq1zfFXL8eKtNiq1vtYqqYqp4qqY q0yr9vFXcsKrGXhgV3FsVdirueKrOOKr+GKuxVTxVv40xVfiqxlxVf8A5GKu4Yq7FXcMVdwx VYuKr2ZVxVZ/qYq5WxVzYqvTFXKuKrF44q19rFW2+DFWvs4ta1l4LirmxVby5fBihVX48UtY ti1mxa1PjirafbxVe3xfHiqkzZJLk+3iqrx4/BkUKTfHihzfyZJk0y/DwyKF/L9jFUNkkqjN 8WKrm4ZFC39rJJa48MizWtkmCry/bwM1PArsVbVcVawq77OBVrN8PwYVXYqt44qtwKqYqtVs VUmXJMHL/Piq/AzWq2Fpd+zirXHFVvPFXN8WKuxV3PFXf6+KqeKtYs21xVvlzxYO44qtyKXY qt5ZJk2zcsWDpFxVdiqnywNzmxVpfj+3haVPj/JizXf6+RQtVsklvFgocvixZr+OKtcXxV2K ttirlxV2LBtmxVSxVpvgxVzf5f7eKtLiruWKrWVsVc+Ku/1MVdirnxVZ8P28VWcW54q0y4s1 jLiq3Fg7FXYqs5cMVaxV2Kt8cVUl45JV3HIq/wD/1fq+q/FmQ46riqoq8fjxV3PFV/8Al4q7 jwxVVxV2KqmKrGXFV+Kr/wDIfFViriq7jirb/bxVfyxVTZvixZqi8cWC7j8WLNZ9vFV/+vir uWKu+LFXfFirsWC/j8GLN2Kr1bFVNl54q3/kYq5MVcrcMVVeWBm1HhaXKvxYqq4qsXFmv/y8 Vb+N8WDuPxYquxZrOOKt8cWC/hirWLNUxVytiwWcMVbbFmvbAza+LC0uxZrsizXM3LFXMuKr sVU2+L48kwX8cVa44GbuOBV7NiruWKtYtbsWxv7OFW+OKtfB9jCwXqv7GKu4/wDB4Ga3kuFg 79rFVXl8WRQt+y2SSqrkUKfLFXccVcuKubj/ALDFXccVW8ckltfjxVEccihrFVNsklU4/DkU Ntirv9TFXKvHFscuKr0xVYuKr/ixa1PFsdiratiruP7GKr8VdirsVczYq7FXJiruXHFXc8Vc +KuTFVnLv+3iq/7X2MVdirv2vj+ziruS4q7hiq7jiq37eKuTFV/xYqs4Yq7/AF/sYqv/AJ3x V3p4q3iqniq5cVb+1ireKrvgxVbirXxYq5v8vFXcv28VbxVb/qYqtXhirsVXr/P+3irXLFXN irv8jFXcsVXYqo4slbFisXFk39rFVjcvsYsVvHFV/PFVnwtiq/FVPFVThiqniqo3+RirsVdi rsVWKv7eKu4/t4q1irfL4sVX4qs44q0vHFrWKvL7GSYqi5Fks44quxVYv28VX4qt44q5sVW8 sklbiq5sVXLkULsVUmXFVn7WFsaVuTc8DW1+1kktK3PFV/H9jIoWpkkuxVbgZt8V44Fb5YVa bArlxVy4tbuPw4tiz7C4quwqpthYKmRZrVxVTbFrXNkkrG+z8GKu+LFWmxVW/wBTAzU8LBZi waTFm58VbfFgsZcVa+HFm5cVb44sGsVb44q5sVaxVrFmu/ZxYNYqoNizW4qrYGbS4qpcMLBU bjiwUOOLNfirv2sVWftYq18f7GKt/wCviqzjirbNiwcy4quxVaq/yYqs488VWL/l4q58VX/6 mKt4qpsuKuxVy/z4qskVft4qsb+TFWmXFm2yriwUUxVt8krTLkVWf5eKubFXN8eKtYqt5fFi q3jz+PJK/wD/1vrFHmQ46tiqniqpirsVVl+L7GKr1xV3Hhiq/FXcfgxVc2Ktr/O+Kt4qt44q qLirmb4cVcuKuXFXckxVrh+xizcrcuGKu5Yqv5Yq1ira4q79nFV6/wAn7eKrlXIocmKuX/Lx VarZJKpiq18DNdH8HwYWleq4q3izdiratirfH4cWDl/yMVXcMWan9rFVXniwXccVWfbxZu/a xVtW+LFgubFW8Wa3liqp/kYqu5ZFC7FsUvs4qv8AsYq7jxxVyt+3hVf+1gVT+L7GLWqf5GKu /wAjC2OVf2MCt88kwaZcDNUXjx+DA1OXFWuLPil3H9jFVv8AqZJLv+IYqq/abIobxVb/AJGK tfDkkt8sihdyySVv+XkUObFXZJKpxyKHNxxVaq5JKpkUNtiqxsVX8cVcvwYtjuOKtYqqc8Vd iruGKqeKqnPFXPiqxf58VdxxVrFVThiqz4sVXsuKqeKqmKufFXKuKuZcVd/qYq7FV3HFW+K8 vj+xireKtfaxVvFVvHFVvPFV3HFVvPFV/wDqfbxVZiq9f5HxVZwxVdxxVa38+Kr2/wAjFV68 cVc3HFXLiqz4sVbxVTxVdxxVtW4fYxVZiq5cVWyf8Nirv8vFVTFWuTfbxVTyTJfyyLFpcWS/ FitxZNNirWLF3H9jFXPirm/y8VWf5aYqv5fBirkxV3xYq71PhxVTxVUxV3DFVi/yYq5vi+PF XLiq98VWLi1tYtjvs4qt4pi1r1bFXccWxY2LW77eKuX4cVXYqtbFWv2vjxVb+3wxVfkkrPiT 9jIoXriqxl5rwxVay5JKlkWa5WyTBzNirsVVOORQ1+x8GSS5f58VWL/PiruPwYq7FVuRZtti rWLWqc8VWNirWFsXLiq3ArsWt2KuwtiH/wBTCwcrfyYq38OKr/8ALxVZ+ziq37GLB2KuZvhx V2KqWLNtsVaxVdxxYNYq38WKubFVjYq3izbxYLePxYquxVT4/DgblXFVFuXHC0uxZu5NyxYK fx88WbuGKrFbhiqxcVX8sVcq4qt5YsF2KrWxVdiq3liq3FXYqp8v5MVXv9vFVnH4MVWNiq/9 nFVnLniqzjirm+xirmXlireLNS5YsFuKu+xiqzj8WKuWTFXcvhxVYq4q5mxV/9f6xL8OZDjq yriruGKuxVf8OKrlxZr/ALWLBU4Yq23xZJV+RVTxVf8AY/18VczYq3iqouLN2LBtlbFXfD9j FVNVxZr/APX+xirlXFXcsVWr8OLBdxxZqvDAzWr/ACYWC7IocmKr+PxYqs4YqiMLYsZeOFpU +OKqit8OKt4s1vHliq/Fg2rfyYq1/kYs3LiruCYsFTFWsWa/j8OKrf8AXxYOZcVVcDcsb4ML BzYsFX4X+39vIsmv2vjxVvlirlxbHf6mKu+L7GFV2KuX7eBW1bFXK3DCrWBW2xa2sWxpckwX pirmbFXPiq9lxVZiq9lxVrjirf7OKrvgTIocvv8AbxVb8WSS1/xLFW+D4q2rfFkUKif5GKuV eOKrl44qt44q5cVX/Diqzkn2MVXti2NYtba4tjv8vFrcuLYvVcVdirueKuZcVdwxV2KufFXY q5mxV2KrFxa1+LY7FVTFVq4qtVsVXcsVWJkmSrgYreWBW144q7g+KuX3+3iqxVxV2Kr1XFWl xVerf8HirbLy+3iqz4cVWfYxVf8AZxVr/LxVdiqpiq3kvPFV2KuxVSZcVXsuKu/yMVc2Ku44 qo8MVXccVXYqp88VVMVU3xVUxVbiyb+1ixd+xwxV32cVWYq5ZMVd9vFV6thVZzxV3DArsVdz xV2KuxVZ9pcVX4q7niruGKrFxVrFVRMVdwxVY2KtfB+3irf7OLW1iq3jirl5Yq7JJXtkUOZs VWMvLFV6rzxVY0eKuySVLl/Jirf/ABLIodyxVr4EySXfFiqzFXf6mKu4/t4q7hiq7nkULV55 JLueKuxVpl54q1kWbvtYq7k+Ktr8GLW7lirmXFsUuOSYKmBmtZsVXYFW8fhxa1mSYtYs2+Pw 4Gaz/IwsERgZqHLC0rOGRS3kkO4Yq7FXcMVU8VdyxZtYq3yxVasa/bxYL+OKqf28Wa7FV3+X iwU/i+xirfx4qs/ZxVvFVvHFXcsVW/F+xiqxsVa5M+LN3+pirm+Fa4q0328Vb5YqtVsWDmbF XP8A5eKu44qptirbL/JireKqfLh/qYq58VdirueKu4/z4qs44q19rFV3/EcVU+PBvgxVZx/b xVYyr9vFW0ySqbZFXMuKu/1MVWcsVX/s4q//0PrLx+HMhx3cf2MVX8MVXccVVF4csVcq4qv+ x9jFV6/5eKuVeGKqnxZJVPhkVXr/AJGKquKuxVb8eKr+OKuX/LxVrFVjNizXYq3xxVyrirv8 vFVReP28WDWLNyriqriwXfFyxVY3HliqnizVOORQrYqs+PJMXcsVbxZuxVcvLFg79nFWmbFm 19rFVXFg7nirXLjizXNiq7/I/bxYO+LFWvtYs28VX/8AEcWDa/H/AK+RZO44q5cWx3Jf2MKu XFV2KrlxVbgVtcVb/wCI4q0vH/YYq7/Xwq2v+RhYOfFV3DIodJyxVbkku+HFV6rz+DFWmxVE ZFC3JJU+WRQ7JJb4fsfsZFC3j+xkkqvH/g8ihT/y8VVFXivDFV2KreXPnzxbGl+3i1r8VW+p 8Xx4qv44q7jirWLY3yxVy/sYta/hi2OX4sVdiqniqpirlX9jFXcMVd+1wxV2KuxV32MVcmKr 2XFVmKuZv+DxVUxV2Kqariq9sKrOGKr1XAqxv9TFXJiq/l2/bxV32cVdx54q1/l4qqMv7GKu /wCJYq7jiq7FXYqpL8eFV/28CqfHFXccVVGVcVU1xVUb7GKuVv8AgMVd9vFXceWKubFV2Kux VauKrcVXfsYqsb7GKrPsYq2uLJfixW8cVW/6+Kr/AIsVWf8AE8VX8UxVvFXYVU/9fFV/HhgV rjiq3FXPirsVdirvt4q7FXcMVdiqnirfHhiruOKu5Yq5cWt3HFsaxVv4cVWccWt3+wxV3+Xi ruOKr1XjirmxVrFXYqtZcVU8klauKq3P9jIoUuOSYrGXFmuXFXLirbNirm+DFWmXl8GRQtX+ dMklpm55Fm3kmDueKrGbjireRZtM3HJMG/sPkUOxbFv+piq7FVvHCrv28Vdx44FXYqh+WSYO bFW+X7eKt4q5v58WC3lizaxYO4Yq7FXPirsVdx+H48VUl+3izbXk64q2q4sGvs4qs+Lhizd8 L4q7j/Jira/8JiwcuKuf/IxVSbFm38OKubFgsfFm79rniqxmxVvl8ORQ18OSS5v8jFVjM2Kq nHh8eLBZxxVZx/nxVpsVVF44qptirbfHireKuxVTxV37OKu4Yqsb4MVaxVuTFVn+piqz4P2M Va44q5sVayStL8H28iqxv8jFXMuKtYq//9H6y/tZkOOvxV2KruOKuXFVZft4q2uKr+eKuTFV zYq2rYq5V+HFW8VW8cVVP2MVcuKrlX9jFm5sVb44sFuLNU5fF9vFXJirm+HFXcMVbfFg5VxV UZf2MDc7jireKrF5YWC7FguVcVa+39jFm7liq/Fg2q/FirTfyYs3ceeKu4/Fiqorc8WDSYs3 JirXxcueKt/FiqriwWccWbfxYqvVcVXfs88ih3+XirvgxbF2FVrN8WKu+3irm+xgVf8Ab+PF XccVWccVXsuLW7lirfHC2Lv2sDW1kmLX28Wa5eGBm7jhYO44q3+zkWLXH4fjyTJf+1kULGyS V2KtfZxVV+3kULG/yMVX8f58VcvxYquxVbxTFV/LFsdxxa1ityxVeuLY1iq1Vxa1/wDkYq3/ AMSxVbi2KmKtM3DFW8VdiruXLFV/2sVa5Yqp8MWS7CxX8sVczYFWc8VVMVU0xVevLFXfH+3i rvtYq02KrcVVMVdirTLirv2sVa44qqNy/wBhirlxVzfCuKqf+piqozYqtxVdy/kxVzNiruX7 EeKuVfixa1Pli2K64qsX7P8Ak4VW/BhYLmbIs3fFx+PFXf6/2MVW4q18T/bxa1/28LYuwKtb j+3irlbjiq3FV3+RiqxuPLFW8VdirX2cVa5Yq3x54q7imKu5viqxm+HFXMuKrlxVvj/l4q5l xVZirsVdx/kxVy8fsYq58Vdirvt4q7FXc8Vcq4qs5Yq1iqoq4qsXFWsVdirfLFWsWtb9jFV3 7fDFW2XFVnLFV2Kt/FiqzJJU1Xgvx5FDTYocuKrl+zwxS74/2MVaySXYqtbFXLiq3/IxVrj8 XB8DNvnhYOTFXf6+Kub4l+PFVuRZuxVvlw+3irWLW2q88Wx37WKrH/yMKuXFVNcCu5Yq22FV nHCwb+02Kub/AC8Vd+1irbf5eLBtW4fBkWSzFVvDJJdiq/jiwW4qsZeGKuXFWuWLNzccVbZc WDmX+TFVi/yYq1/l4s1+LBb/AKmKrFZcVd+ziqriqF+Ll8GLNf8AFkUNfYyTFZkWTfw4q5cV Xr9nFVLjkkuXj+xiq3j/AJeLBy4q5ZMVW4qtbFV2Kqf2MVcyriqxV5fBiq/l/P8AYxVZ/qYq 19nFW/ixVTX4cWa7FVJcWDariruKYqs/y8Vcy4q5lxVTxV//0vrKuZDjr8Vdiq5cVbVcVXri qsq4q7FXYqv48MVa44q7liqo2Ku/y8Vc38+Ku+PFWv5MWa9v58VXtzxVZiwXvizXc8DNS7ph YKjcvt4sGvt4s1XFg7jgbnceeKubFWsLBysrLzxYKmLNv4sVaxVdG3PFg7liq3Fm2v8AJiqp wxYO/wAjFWsWbuXHFXcfgxVyYqvbFg3izWtiqtirlbjkUOZv2MWxdhVbx/kxVdgVUX7OFVvL 9jCwaX48izc2KrMkwX8nwM16r8WKrf2cLBd+zkULf2ckl3DFXL/kYqqr/PkWbl5Yta3/AF8U LvixSs45JLatiruXxYq02KrsVVPTVsih3w/YfFV7Yqsf/IxbF2LW3xxVZxxVdiq1V/bTFsX/ ABfYfFrdxxbF6/Fi1qeLYqLwxVYuKtYqqYq7FXcMVXccVXYqp8MVdhVe2KrMCruOKrcVXf5G Ku44q5V/nxVtmxV3JMVa44qtxVe3HFXMuKr+PHFXMv8APirjx/2GKuT/ACMKrGXAruP8+Kr+ Pw4tbuPw4ti3FVyriq3FVTFVqrhVdgVaq/8AAYq5v5MVdx4ti1ub4sWx3Lmv+RhV3HAruOFV PlgVU44q5mxV37GKuVsVdz/bxVTXFW1XFXKuKu+ziq9sVW4qtbFW1+xireKuxVpmxVY3xYq5 MVXLiq7FVONcVXLirbfBiqxmxVzfFirsVdwxVz4qp4q7mmKqn+pirnxVY3+Riq9MVU25Ytba 4qs9PFsX8cVWfsYta7FVvLliq7FVnHj9jFsX/G+LWt4/z4qskxVVxVSVcVX8uOKqS/z5JLTY q5lXAzXyYGtSfJJdirl+3/l4q5lxVy88VXN8f+pgZrG+3irl+DArmXFXL/l4q7l8XwYqs+3i q/jzwq1irsVWtgVZywqsbCwVE/y8VU1xVVb+fFgp/tZFKzhkmTkxVUxVT4Yq3iwdirv9fFVN mxZu44q77WLBtm/4PFVjL8WKtN8OLNvl/wAHiwXYqtXFVmLN2Ktfs4q0zZFC3hkkt8m+xiwa xZrkyKFnLFVmSS22KrWbFg7jirmbFWuT4q1irsVa5JiruP8AJiqzFXNy+xiqzjirWKuxVY2L NtlxYLcVdxTJK7Iqp/6+Kub4/jxV2KrOOKv/0/rQv+Q+ZDjuTFV6tiq5VxZt8f5MWDlXh9vF VZMVXLiq7FWm44q77WKuVcVXt8WKu+3iq708WblXFW+WLByfYyLJU4Yti1uPHJMFjcsVX/Yx VWyKFP8A1MkleuBm3irTN8WKub+TFVNW+xhaVf48iydkkrWX9jFW+H7eLB3D9vFV/HFXcsVW 8XxZt4sG4/t4qvb4cVafFm7/AFMVbxYO4/Hiq5lxZt4quVv28VXMv7eRQ7j/ACYWxey/FirW KuxVb9j4MCr2xVZxxV37GKr+74qs+1kmC77ORZrskwXM2RQtTJJdirl+ziqq3F8ihayrkktc sVVP9fFV2KqXL9jFW8VaZcVd8OKqq5FC7FXYqt+xirl+zzxVdiq3/UxVfxxVrFsd9nFXYtbf xYti9MVdirvhxV3H9vFXc8VcmKu4YqtVsWSouLFb/wAQxVUxVpuOKrMVX8uGKrP2ueLWv5d/ 2MWxrjiq7FVvLFVTj8XDFXfsYquxVa3w/Biq7FVHjiruWKrsVWtiqpx+HFV2FVrcv2MDW7jh bHcvhwKuxVb9vCrvjxVauFgqfZyLN2KqnH4MVWceGKuZsVd/xpirmXFVka/z/YxVdhVay4Fa +w2LW22LY7/IxVzYq7liqnyxVWxVSX4MVX8vhxVzYq5cVdyZsVcn+Xirl/n/AG8Vd9jFViti q9cVc2KqbYq2rYqs5N+3irsVcv8AkYqs5cMVX4q5MVdiqzliq98VdzxV2KqeKqmKufFrU8Wx b9jFrdyxVWxVT4Ji2LWXh8eLW7liq1ckldy/4bIoU/8AjTFVflzxVYv/AAmKu5Yqotkku5Yq vVsihfkkrfjxVbyyKFn21+PFV3Hhkkrv2sihSVckl2KuxVfxTFVnH48VdwxVTb7GRZr2+3hV 3LhirWBVrfb+PCq9v8jFVnHjirlXAq3Cqn8XL4MLBcq4sGlXFmu49v2MDNb8OFg20eRYrMkh rFmvZuGKrcWDv2cVU8VVMVUsWbbfyYq7Fg7FWuXw/wCXgbnKy4q3haVFsVc2KrmwNy1lwsGl XIoa4/tpkmKxvgxVd8OLNdgZrOOBrW5Jit5c14Yq7jirmxVbiq3jiruOKreeKqmKqfL4uGKu TFXYqsbjiqnxxZttxZeGLBzLirmXliq37LZJWv8ALyKuT7eKt4qp4q7FX//U+tH+XmQ46/iz /BireKrVX+TFVXFmq4sFPFVblirf+Xiq9sVWL8GKr1xVyf5eKu5Yq1y5Ys17fz4q5vf7eKqv 7WRQpcV/YySVXAzWquFguyKFvPJJb5ccWCpxwNzuWKuX+fFXfaxVpV4YWlUX7GRZOySVv7eK qnHFg7f+TFWsVbbFXL/JiqsrYqs+HFVTFVNMVcmKqjfbxZtquKqfLFXNirlxVV4vkUNt8TYW x3Hliq9lxVrArsVb+zhVvjirTcsCrFXFV/7WKuVcVVOOSaWlxZrcVc3w4q58VVWj4ZFCz9rF VRVySVP/AFMVdxxVtWxVczZFC/7GKrVySVzfz5FC7j/PirbNirmXFsaxa3YtjbcsVcuLW1i2 N/5eKr8VdirsVcy4qsXFXcuGKr3xV2KrmxVdirTcUwq74cCrG/4TFVTFWm5Liqz7XwYqv5cv 2+OKuZv+AxVZiq/4sVX+piqnxxV3+XirsWSp6eLF0jft4q77GFVuBV3HFXKvw4qtxVV5Yq1h V2BVuSYL/wBnIs1n2W4Yq748KrW+HCwXfbbIs1RsKrcCuxVU4/sYqsb4v9niqxv8v7eFV/HA qzj8OFXNgV3Hji1rsVdi2LWxVZx7fsYq5lxVpcVXYqpr8WKr+P7GKu4/yYq7izdMVX8cVcv8 +KuX4sVXYqp4q7FV3H/LxV37GKqa4q7/AFMVXYqp4q7niruGKuxV2Ku5ccVc+Ku4Yq5f58Vd irnxVYq4tbmX9jFscuKubFrWNxxVyf5GKrsWxb9vFrXYti1sWty4qv488WxYuLWotkkuZf28 Vb4/FiruPxYq7l8WKr8ihT/40ySW2XFWmxVamKrq/wCXkUO4/Bi2O+xi1rVb9g5JLvsYq0uR ZuZsVd+zhV3LArWKrfjwquxVa/8Al4Fc2KrcVXR4tbviX7GKqK5JLuOKr8WDviyLJZ/r5JK3 nirf2MWDuGKuVsVcmKrW4pizWt/PirbYsGsVWLizd8GKr8WC1/28VU/hxZrExVf8OKr8ihT5 ccVcrYq7C2LUwsF3+pkUKX7WSS7/ACMVW/sYsF2KrftN8eKuT/LxVY3+RiqnizVcWCm+Ku4Y qs5Yq5lxVy4qsT/IxVe3wYqs5Yq5f58Vd9jJslmQSs54sHYq58Vf/9X60ZkOO7FVb/LxVT5Y qrYq7FVRMVd/l4qu5Yq2zYq0uKqjYq79jFV7Yq1x+HFmu+HIodyxVvnkku/a54qu4ZFC3JJV cWDmbA3LOeKqjM2Fg2y4sFn2sVXquKu/bxV3wYqv4/F8eKrFb+fFXLiq/wDy8Va/axZtYquX FgvxVplVcWbv9TFVTFXK2LBauLNtm5YquXAzawsFT9jIs3f6mFXfbxVteWFgubIs1nLFV2FW 2wK74sWtvlhbF3+piq3hhYLviyKHf5HDFVqrkkqmKtfFiq77ORQtVvt5JLXLFW1bnireKqn/ AA+RQ5VxVfyxV3xpi2ObFrWMuKu44qvXFWsWxvji1tP9jFsbXFrc2LY1i1t8vhxbF+Kqf2cV VMVdzxV3w4qp4qqriyaZWxYuxVz4q5MVVMVW8sVW4q7hiqpirS/BirXHFW2XFV/HFXfBiruW KrsVdiq1mxVdiq37bYqsZeeKquFVuFguyKFvLji2KfLFVTlxbFXSNi1r+WLY7jirl+L4MVd+ zirlxV3LFXftYq5VxV3qfBwxVZ8eKq3FsVd8SfbxVT5pirbL8PwYqvX7OKrP2sVczYqs/wBT FV2Ku/Y4Yqt5fD8GLW5V/YxbF2Krf28VW4qu/wAjFW2+xhVTZcCr+XxYqptiq/i+KtYqu44q sX+fFV/LFXcsVW4qpr9rFXN8WKu/4hirkxV3DFXc8VdxX9vFXf6mKuxVTxVU5LirsVWf6+Kt faxVv/Ixa2sVdirsVdi2OxV2LW7FXYqt4/Dirm5Yq5sVWLxxVY2SSqccVWcf58Vc3wYqu+HI oW/tZJLvixVYqtiruXHFXL8a4qvVsVWYq1xyLNzYq1iq1Vxa3f8AEcWxdhVtv8v9jFWsVUWb +TAq7FVTFVvLFVuKqbZJg7liqpgZrV44WlvFVLnizdireLB2KuxVZ8OKtrklW5FVv+piq9si lS4vkmS5cWDl/kxVv/IyLJTySW/8h8DNb9v7GFg3xyKFrN/PkkreGKu4/t4qt/Y55FDX+vkk ubliq1cWDvttiq3FWv2sVcy4q02KrsVU8Vdirv8AXxVTxVtlxVYvxYq7/LxVd9rFVrYq5l+L FVuKqa/Firv8jFX/1vrQrZkOOq/5eLNTXFUR8OLBYrYqrYq7FVTFXYqu/wBfFV2KrV+JsVd8 GKrsVbVsVdkWTa4q3kkufFV0fLIobVsklfgZuxV2Kt/s/wCThaXK2KrsVWN9vFXMuLNy4qv+ 1iwd+1kUtrkkO+HFWv2sWaxlxVX/AGcWDm4r9vFWv8vFmuXFVT7GKqa4qqYGamy/yYWC/kr4 GazjhYIjIs1q/F9jCruOKqnHFXf8RwK0zYqs5fFiq9cVbTJMHcMVWf6mKquRQ7/U+3i2L2Xl 9jFrUv8AUySVzYqrL/PkULWySVzZFDsklS4/yYqqrkUL1X/Y4qsblirk/wAvFXcP8jFXM2Kr vtYq3yxVpPsYq2uLY1irbYq5lxVrFrbXFsdx4Yq1iqomKuX4sVdirsVWt9nFkq8eeLFpsVXY qp4qqYq7FVrYqqccVXYq7FVqrirXJ8Vbb4lxVdirsVW/8SxV3p/z4qpqrYq39tMVcq4qv+xi rmb4fjxV32MKu44FXYtbXFMLY3gVa3w4q5V/kxVd+xzxV2Kt8v28VX/s4VWcsCu5Yq7/AC0x VzfHirmbFXNiruXDFWsVbbl9jFVnHFV/HFV+KqeKt/s/HirlxVrFW1bFXLyxV3+pirWKuX/L xa1rfDi2Ob7L88VW8skwXR8cizXYqtZf+AxVZzfFV/2PsYq5ft/BirvsYVU2wKvb7eKtYqt/ 18VcuKreGKu4/bxVz4q7j/PirsVd/qYq58Vdirv9TFXYqp4q2zNi1tYq7FW2ZcWxYq/t4qux V2LWtZsVcrYq5cVdkkuXIodxTFVPjiqnwySV3+viq7FVT7eRQpP9vJJcy4qs4YqqryyKFLJJ cmKuZsVXNwyKFn2HxbGn+xirf+RiruTL/r4q5mxV3LFXfa/2WKub4VrhVrFVvLArmX7eFV2B VBv5MkwX4Gaz4k+xhYNNiq5/t4sFN8Wazliq/l/PirmbFW3xYLGxVrFXYq7FVrYquxVRf7eL NWxYLWxVS44s1Xl/JiwWq3w4G5Ziq7/XwNan/l5JLvsYqtyKGlX4cklfxX7D4qt+HFg1iq1v hxVzYqtxVpVXFWuWKuXFVuKuTFXYqskxVZ/kYq74MVaXFm7imKt8eWLBYvLFW8VaZcVf/9f6 088ynHXM37eKt5FVy8X+PFVb/UxVyq2KrlxVv/XxVyriqrirsVU8Vb4/z4s3LiqrxyKG1Vf2 8kl2KrFXFVXIoXfFkmLf7WBuUvtfHhYK2Bm02KrlwtK7FViquLNU+HFgsXFV7Yq5sVcuKtLi zdyxV2LBUxV2KuxVcuKu5Yq3izVsDNT+PCwabAzWccLBWXIs12Krf2MKrsCtsv8AJhVrArfH FXNi1u44tjeSYO+18GKu4/FwxVdx5/HkWa34skwdy/nxVyriqIxVZy/YyKFvxZJK7+9/2ORQ 1/lp9jFVRVxVeuKrOWKubFV32sWxv/Xxa3L8eKtYq7FsVOGKufFrU8Wxv/IxVev8mKrOOKr8 VdiruGKqeKr1Xhiq9cVW4q5lxVd/kYq23LFVmKruWKreGKq3H+fFXNiruWKrsVWq2Ku5/sYq s/y8KuVsCr+WKrcVXM37GKu5Ytbl/nxbF2KtcskwaxV3wZFm5sVXr8GKu/1MVdxxVzN/Jirp P5MVd+1iq/hiqzlwxVYuKu44qvblirm5fsYqvxVYq/z4qs4/Fiq/j8WKubFVitiq9vj+DFXf tYq79n4MVa5piq1f5MVdx44qv/yP2MVcuKu5Yq5v8jFVir8OKr/8jFVnwYqvbFVnwr9jFXce WKu/bxVdiqnyyTBtWb7eRZreX8+Ku44VXrgV3wYq5sVW4qtbFV2KqeKuTFVTFVvHFVuKu54q 7FXfs4q5v8jFXfYxV2Ku/wBfFVjLi1tYq7FW1bFsU1+3iqpy4YtbuOKtYq7FVq/FiruOKu5Y quxVb/qYqp5JKpy5ZFCl8H28klczZFDuP7eKrVXJJdx/bxVpmwM1uFgqceTfB9jIoU/2cklz fz4q3x5N8GRZtcMkwa+x8GRZtYq3/qYq3xwq5sVU/wBvFV2Krf8AIwK5fhwq5sVUm5YWDeKt M2Kt8u/7GLB2LNTxVvhiwb44s2nxYOxV3DFVjfz4q7liruWKuVcVaxVYvxYs3ccVa+38GRQu bk/x4oUmyTJvlwxVU/yMWCk3+XkWS3JJcrYq1/r5FC3lkku5Yq0/2MVa5cfsYsFy4s1JfsYs GuWKrsVaVcVWcfi54q7nirueKuTFVNmxZrOSYqqcv28WDX2sVUm/y8mycv8AwWQYqmLNSbFg /wD/0PrZ/r5lOOqYWSly/YyDFeq/sYqrL/JiruP7eKr/ALWKu/ZxVfxxV3HFXcv+AxV3LFW8 Wa7IoVHxVbkkruPLIodx/kxVyriq7ivHJMV2Bua+38eKt4q7FW1wtK7FXfFkUrP9fFV+SQ7F VThiqlizbZcVcuKqmLByYqs+HFV/+Xiq/wCx9jFXN/PirTLxxZtcsVXYq2rYGarirsCrVxVb 9v4MkwXf6mRZrsVb5fsYq1iq7jhV2Fg7FXc8VdwxV3DFXYquVf5MVbbjirf2cWCpizcrfsZF CnyxVUVv5MVc2Ku5csVXYq7FVrfDiruWKr/ixVrFW+WLY1zTFrb5YtjX2cVb5Yta/j+3i2OT FVPFVReGKuTFVPFVTFXYq77K4qv5fFireKuxV2KtJ9vFXL/l4q7j/Piq/wCxiruOKrcVVMVW s37eKu5/t4VcuBVrfDkmC5cDNb/l4WDuOKrl+LIs12KrlX9jCrXH9jArWKrWwqv44FaxVtfg xVr7OKtr/l4q1irbYq5cVdyxVy4q5eX2MVdy4Yq1irfxYq7j+xiq/iuKrOK8cVcuKrGxVfyx V3+Riq//AFMVWNirmxVr7WKt8V+xiq//AFMVU8VdirfL7GKu+HjirWKttirmxVZxxV328VXY VdgVbyT7GKqas2Kq2KrfgxVv4eOFW8CreK/sYqsZcVa/yMVbVcVabFW1bFVnH9jFXYqsbFV/ PFXYq7FXftYq7FVPFW2XFrdxxV3HFsc2KuVuWLW5V/YxV3+Xi2NfZxa21Xji2O44taxVxVdi q1sVWfaxVZxySV2Krf8AIxVcq/yZFCouKqTKuSSsZcVdJ/kYqubFVrfz4q58VXcf28ihzf5e LYsXFXNyxVzfHiqz7GLWv5YtjbYVU/i+xirmxV3LAq3FVy4VUeWFg38TYqqM37eLBRxVpMWa riwU0xVrFm2+LByYqs44q5m44q5WxVrFW/8AXxVT5Ys2lwM1y4Wldiq34XxVZizaX4PjT7GK tceWRQtP7eSS7niq3Iod8H7GSYrcWa3/AGeKr/sriq1m5YsGlZf2MWbf+viwdxxVY/28VbxV T/axVz4q7FVPFXYqs/YxZqit/JiwU/8AUxZtcf58kwWtkVXYq//R+tGZDjrlxVUZf58VXquK u44qvxVc2Ku44qqL8OKub+TFV2KuVfhxZrlyKHM37GKt/wCRkkr+OLB3Hhiza44qvbAzd/qY qt4/DhYNccVXfZxYL/8ALxVyriq9mxVTXIpX/axVv7H28kh3LFWm/nxZtcExVcq4sF68vsYq 1zxZqnxYsHZFLb/bxS5Wwtjv8jFWsLBvlgZt4qub+TFXNgV3LFV2FXP9jArfLFXNJhVvCwaV cizbVm/2GSYLm/yMDN3JcDWsXFsVF/nyTBy8cVaXFW+PxYqrYsFrKuRZNK2SS1yTIoXcXxVt cVX8cWxzYtbuOKrGbFXLJ/wGKtMv/B4qqce/7GKuXFsaxV2KqnDFVnHFV6Yqs5cMVX/Diqz4 cVaxVU48sVXr8eKtcsVb+HFWuOKrcVXccVW4qvVcVbxVpVxVen+RirmxVT5Yq2sbYq0uKqmS YO/18izdI2LWuwti3i37GBVT/iWKtcfi/wAvFV/28VWccVc2KtcXxVvj8Xx4q5sVdyxVytir v2cVWcsVXq2KtYq3x/kxVr7OKt8mTFVi4tbm/nxbHKvL7GKu/Z4YqtVskwXfFwyKF3wriqoz Yqp/tfYxbFuSYL2bIs3fDirv9TFXMuKuX4MVcrYqsZsVX8vh+DFXcsVdyxVZybniq9WxVr7O KuxVtlbFXfFirWKruOFVBVwKvyTBzZFm77DYqtwqu44FXYqtb4vsYq5fsYqos2Kr1/kxVpV+ HFW+PDFVnw4qu/4liq3FXcMVcmKuxV3Lh/qYqs/yMVX/APE8VWcf58VaxVUxa3Ytini1t8cW xrFrW8uTYqv4/t4tizh+3i1u/wBfFV6rxxVZ/kYquxbFq/a54qsX3+3i1t4q0y4qv44qpNkm LfHnire38+RZKWSS7niruX8mKrkwM1PAq37WSYKjYGa3ArfHv+xirmxVy/5GKtYqt/18Ku44 q7n+xgV37eKrsVU8KrPs4WC/AzdiqlhaVXIslLnkmLWLN32MVcy8vjxVvFgoKuLNf8K4q5cV b4/DiwWceOKu+xirvjxVzYq22RZNKv8AwGKGsLat44GtT55JK1lVvjTFg5m5fYyLJr9nJJWf 5b4qqcW+xiwU+OLNtm/nxYLPixVvFVTFVLj/AD4q7k328VWYqp4qqceWKqeKrWXliruXH7eK t4s2vt/Hk0KOQYr/AIcVf//S+tfFMyHHXccWbf8Ar4sF2Kt8eeKr8VVMVaVcVVcVW8cVXYq1 /kZFkuXliqpiq3hkkqka4sFvLFm3yxYLlwNzuOKr+WBrdihpskhvFmuZf28WDS/z5FLfLFWl XFW2bJIaZcWbf+RiwXquKuTFXcWxVyriq/jkWS7FXYqs/aySV3HAzcuKquBVrYq7n+3irv8A UwqvVcVa+zgVv/IxVrFW1xVbxyTBcq8MVb5YGbviwsFzLkULV/nySVy/DkWa1MkwVmxVa2RQ t/y8klW48vjyKHcuWKuXFV2KrVxVdiq1cVXYtjbcv2MVa4Ji1rf9fFV64ti/niqzjiq/FVjY qvxV2KuZv28VdwxV2KuxVey4qsTFV/LhirS4q7jiq7FVq8ft4q2q4q0rfDiq7FVTCql9rAq/ /UxVZx+LFV6/yYtblblhbFvHjhYLlwM2lj4YFX4q2uKu4s+KuVv+DxV3HFXccVW8skwaZcih 0n/D4tjlxa12LYtZsKu44Gtyriq9mxbGsVb/AG/gxVzLirv2sWtfy44q5f8ALxVTxVpckldx ZV+DIs1v7OSYNYqvXIoaxVrlkkt/B+3kUN/s4tjWKu+1irf/AA+KrVbJMG/tZFDTZJKxmxVV Vf58izdx4/b+1iruWLWsySV2RZttxxV3qYqv5fBiqi32MVXYqtXl9jFV2KreWKqfxcsVV/hx VYuKu5fDirl+HFVnH9jFXfaxVr/UxVdiqn/xDFV3+viq3FV/w4qsxV3PFXPirueKujb9vFXJ irsVdi1uxVTxV2LY3xxa2sWxtmxV32PjxV3HFrWf8RxVdiqxft4qvxVtcVWL/wAJirv28VWr /PkkrPi+xirXLFVRVxVRxVyYq58Vd9jFXYq5lyLFerYqsbC2tf5H7GKtYFbbFWsVdhV2KrVb FXccCrfh4/HkmDsDNbhYLsDNUxVRbA1u5YqsfJMXYq0mLN328Vc+RYrH+xirv2ckycvwYq7F g3x4YqtyKVv28VdyyTJv4MWDvtfB+3kWSn9rJJXN8eRQpc8kldgZufA1rGxVZ9nJJb5Yqp4s F+LNZiwdirsVab+RMVWcMVdirmXFXYqsXFV/qfD8eKqf2sVWt9jJsnN/PkGLlybJZ/l5Bi// 0/rdxzIcddirafYxV32/sYqvX4/sYq5lXFVzYq7jiqouKu/y/wBjFVzNizb+NMihtVxbG+OF Vyt+3ga3Lkkr2wM1nPFXLhYL+PP48iharZJKtiwWJ/l4s2+XxYsF2Kt8cVdxxVp/sYq0/wBj Fm2rYqv4Yq3wxYL2X9vFVmKufFV6/HirsWbsVXN8WKrE+3iqrxyKF2KuxbFy4Va5ft4FbbCr S4Fd8OKubFWv2+eKu+ziqp8K4tbsVd9r43xVa+SS5fixVe32fgxVvFWuWRYq+KVPFV2SStbF XcvixVcq5FDvt/YxbF/Hni1rOP8APiq9lxbFjNyxa16ti2L8VWceGLWvxbHJirsVU/tYqqft Yq7hiruXLFVnxYqq8cVW4qu44q2vF8VbxVa2KuXFW1+xiq/lirmxVbiq5l+xhVTXArmxVd8G SYLsVcq5FmrftYqp4q3xxVzf5eKu5Yq7/IxVythVrAra4q1i1tMuSSu/ZyKGm5Yqqcv5MVWL 8Px4q7li2Okxa3f6+LY5cWtplVcVb/18VW/5eSSu9PIodJirWKt/6+KtL9vFWuWSS1irbYqu /wAvIoX4qpKuSSubIoWryySVVmyKFnHFV+KqfJuXDFsb5f5eKu5YtbmxVytiqzJJbXFVVMih R5Ytjlxa17fZ+PFsd8P28VczYq5WxVZx+HFVuKrmxVT/ANfFXNiqtiqiuKtt8GKr158cVXYq tb+TFXceTYqsXlirTYqtxVczfsYq7/UxVv7OKrFXFrU8Wx2KqmKqeKqn+XirsVdwxVTxVvji ruWKu+39vFWsWty/bxbG1/nxVZw/bxVdy/nxa1Pjkkrv5MihyyYq5lxVzfF+xi2LP9T9nFrd x4Yq74/9nirXB8UOyTJtf58ihS+z9jJJXK2RQt+H9vJJc3DFXPirv9TFVuRZuxV2Kt/6mKtY qtZcKu5ccVU/8jAqovxYq5sVW4VVMVUuWKrFwsFvxYqvbIsVj5Jk7nirfDFg1kUt5JClizbZ sVdxxV2LBrIpbySFv/EsVXYqo8cVcrYs2mbi2RQt4ZJLatiwbVsiyU8Va45JKzliqov/ABPF gsVVXFVP9nFmv5cfsYqtZcWDXHFV2KqeKubniqnirvs4qqYqpYs3Yq1/kYsHM2Kv/9T63K2Z Djub4sVXqvHFXLiq/hiq9f8AIxVpcVV1/nxVzKuKuVv5MVXqvPFVqrkWS/C2O4Yq5V/YwNa3 JJVfhwM1nPFWvs/HhaVf7GRZNJ/kZJi0rNizb5YsF/LFWsVdirfHFVuLNdgZrcLBVxYO+LFX ftYqv4/sft4q2q5FkubJMVJm/nxZr1bl/qYGa1WwsFVVyKF2KuxbFv2MKu4/z4FXfbV8Vd8H 7eKtrirn+xhVpft4FdhVdwwsF3L+fAzdy+HhhYLW+1iq/wC39jFXcHxVy/yYq5lxVcv+pkUO VcVXtHirlVXxbFq5JgqrkUNYq23xfHirX2sVb44q7ji2OX/IxVfiqxsWtf8AYxbHftYqs44q v/y8VcrYq7j+3irueKu4Yq5MVb/yMWTf+Rixd/r4q5cVW4qqYq7FVq4qqft4q7l/JirlxVbi qqzYtazji2LsWtvjz+DFsWMv7eKqzNiqzj+3iqx/8vFV/LFXcu37GKu4/wA/28VWcv58VbXJ MG8izdirfLhi1u/ZxV3L+fFsWNyxVe2LW1ira4qpccklU4/FkUNccklV5ft5FCxeP23xbHft YtbWKt8cWxr7WLW2vwYtjmxVrFrdx+LFW1xVrFVyZJKxuOKqirwyKFvH+fFsaxa2uWSSu/yM izaf7GLW3xxVay/Fkkts3NsizabJMG1/kyKFTniqz4cVd+1iq/7eLYsjXFXMuKu5Yq7jiruO LWs44tjm+L48VWMuKt4quZcWtzLi2O4/yYq1xfFVqriqrirsVW8cVWfFirm+BcVabFW25fsY q3iqm3+XirsVWNiq9WxV3PFXLx/YxVzfFiqzjwxVemKqeKqmKqeLW22LY1irsVdi1rP2vgxV tV/bxVzYq7kzYq5lxV3xL8eLYuxa3Yqh+WSSublxyKFNvsf5GSS5l+HFWuPw5Fmvwqt54WDu XLFXf6mKruGBmsVsCt8cKtLxbFWsVb488CrZPgyTBS/y8izVOWKuXFV7ccVWccVUvsfbyTBy t8WKtrkUN/s4qpftZJKpiqm+Kr2xYLHyKVmSQ1izdiqqzLiwU8VW8cVXYq7FVrYq19vFmpvk UOxVf9nFVLhkkrfhxYNNx5Ys3N8DYq3xxYO4/DiqnxxZuXFW+WLBbiqniqpirsVU8Vcv2cVU 8VbbFVLJsly/yZBi7jxxV//V+tzZkOO5WxVf+1irl5csVX4qiMVdiq1sVXtirWKuVcWa9MVb xYN8MiyXZJK3liruOKt8cWC/Ism+P8mSYt4s1vH4cVbXFgvbFWsVdiq/Fms5Yq2q4sF+Ktfb xZruOKtfBzxYKuRZLcklpWxVvFXYqqf5D5FDlxVrk+LY2vLCq9cCu5KvXCrm/wAvArWKreOK qmSYOxV3+piq7Iod/lpiq3JJdxZfsYqv/wAv9jFXN8H28VXceeRQs5ZJK+NcihfxxVzccVcv HFV2Krft4quxVtlxVZ9hcVX/AA4tjWKtri1u5fyYti//AIhirsVdzxVT+ziqpzxVT+ziqp/q Yqu5YquxVTVf2ziq7jiq7FVPFVTFXYqu5ccVc3/CYq7h+3iq7FVsbfFhV32/t4FdxxV3x4qr fHzxVTX7eKt+nirX2cVdirvtYqu5YVaVmfAqxsVXry+3irmxa1/xYqp4q2q88Vab/LxVvmmK ubFV7Liqz4cVczcPgxbHcuP2MWtauSSicizU3xV2Kubl+xiq5cVUvtN8eKr1X/g8VdirvhxV TxVUxVzN8WKrlxVb+1irv8jFXfF/s8Vd9vFXLxb7eKrOOLWsySVrL8OKohlVsihS/ZySVzN8 ORZreWSYO/ZxVcq/FkUOVsVdy/kxbFmSYLVXFVVWyKGsWxteWKuXFWsVbZueKuaRsVcy4tax mxbF2KrVxV38+KuVeWKrPixVfyxV3+Xiro8VW4qtVVxVvl/Pirm5YqsxVz4q7FXc8Vdirvix V2Ku+3irvhxV37OKuTFXJiqnirsVdi1ts38mKrG/kxbF2LW7FW2xVrFXYqpyL+3kkrsVc2RQ 7/XxVzNyxVY3x4q1xxVT/wBTJJdx+DFXcuOKuxVb8H7eRZqnH+fCqxV5fbwKsbjirlxVeuKu 4/bwq2uKqfL+fFXNirlX9vAq7FVqrirvh44qtwqsXl9jCwXfs5FCmy5Ji77LYquVsWaj8WKq jNiwd/xPFVnHFWmXFmvZWxVa3x4sHcsilZxySHcsVdy/nxVzLiqkuLNfy/nyKFjLybFV7Mz4 qpMv8+SS58VWcvhxVtv5+GLBpsWbbYsFn28VU+WKtszYq3irsVU8VXccVW4q7FVnw4q7liqx WybJ37GQYv8A/9b628syGpUVcWC9mxVyYqqYqtXFVbFWsWbTL8OLBf8AyJirXH+TFm5V+HFW 8ihUVv5MVb+1kkr8DNauBrXK2KG/sZJDvsfbxVpvixZu4fsYqvxYN8cVaxV2KubFm5cVVMWD sVa/y8WbsVbTFgqcfiyLJrJJXYGazlhaVVciyc2KuVf28Wxrjy+3ira4VXt8eBXLiqxsVXri rar+xhV3L9vCwdy5Yq7FXcvh54qu4p/s8izdxblwfFVZcWtZwfFWsklUXi2RQorkkq3HIoXY q3xxVYy8cWxr7DYtbfHFsXYtbarirvhxVzLi2O44qv4Yq5vixVzfZxV2KuxV2Ku54q5lxa1/ HC2NNgVtVxVZwxVercmxVr/IxVyquKtr/Piq9eHLFVn7f+Xirl/nxVevHlzxVdiql8WLWvX4 cWx3LCq7ArmVVxVv/Uwq5sCu3/nxVrgmKt8cVUuPHJMFT7ORQqYqs+P7GLYsyTBcrN+3kUNt iruWKuVuGKuXFXccVd8WKuZcVX/t/Hi2Kf2cWtUb7WLY7hirsVdxZ8VdiruX7eKu5csVdiq9 v8jFVmKr1bFXLyxVzLiqxvhxVz4q5MVcv/CYqs5Yqv8Ai5f5OKqX+RkmCqq/FkWblXCqzjga 1jYq3xySXLirlxVd8WRQpceWSSuxVdkUNccklrFVZMizWccVcrc/t4q79v4MVcv28KrE/wAv Aq7FW2X9jFWsVU/8jJMFy5Fm7JMHNkWa3FVzfyYq5sVXYqp4q0/28Va44q3+1iqxlxVf9nFV mKqmKqb4qp4qqYq7FXYq7FXfYxVZxxVf+1irX7XwfZxa1vH4uGKr/wDX+3i2LP8ALxa3MuLY 1i1tccklplyKF2Ktriqk38+SS3y5fYyKFvp4qvbFVn7XwZJK/kmRQpcfhySVmKr/API/bxVz fyPiqzFV3H1cDNTwKqf6/wBjFVPFW2xV3+virTLxXFVrLhVv01TCwa45Fm5lxV3p/tYquwqt 5Yqo8cLBfy4ZFDeKqKrkku54q3iwXsuKrMVd/qYqp/FizVOGLBYuRS7lkkLcWa5eT4sFnp4q 5/8AIxVbx54G5b6mFgu+1kUKT5JLl/yMVU3+xirbLiq1sWC9sVWf6mKubFVnL9jFV/H+TFVP jiq7FVPhiq5sVW4q58VWN9n48Vcy/DirWTZP/9f635kNSqq4sHcl/YxV2KqmKruOKuVcVXYq 7FV/DFmtbjiwVEyLJ2Ku45JLuWKrlyKHNiq/h+xkmLuOKu5Yq5VXFV6/5GKub/IxVf8A6mKq bLyxZr/i/bxVvj/JiwdirS/5GLNauLBeq4q7hirfHFmuxVyr+3iwbxVf8S/BkWTv9TFXKuLY 7/IwquxVbx+HFV6tgVy4qs44quxVVXl+3kmDTc8DNTb7eBrVeX8+SSsxV3DFV6/z4q3irS+/ 28VabFURkULWXFXfYxVfxxVrFVv2MVXqvD7eLYsbFrXquLY74sVdyxVr7WKqnDFXcf28Vd9v FXYq5mb/AGeKu+L9jFXYq5fs4quXFVrNirsVXLiq7FVP9rFVbjirvi/YxVytirlxVyf5eKrs VUuPDFVZsWtZy/4DFsdH/wAJiq7i+Kuwq2uBrc38+LY79rgmKuVsVcy/z4tazimKr2+DFXKv HFV74qp4q02SSu45FDWKt8fixbF7c8Vc+KrGVnxV3Lni1r8Vdx+xi2O+FcVcmLW5lbFsdzwq 7l/JgVyYq7nirsVdi1uxV2KuxVz4tjsVXK3xYqo8v5MWtv8AusWxfyXFXYqu5YqtTFVjL/Ji q9mXlirm/wAvFWv2PjxVtmXFVnx/Yxa1mSS77WKr2bIoX4qo5JK3jiqqq5Fm19j48WttV/Yx VZkkuxVdgZt/s/HgVzYq77fx4q5W/bxV3HFViriq7FVq4q79v7GLW5sWxbiq5lxVbirsVdiq mmKr15Yq3iq1sVXYqp4q5mxV2KufFXJirsVdzxV2KuxVzLirsVWf6+KtfaxVv/Lxa2sVW8cV XYq5/sYqt5ccVdz/AGMVdw/YxV37GKu+FMVd8L4qtxVd9jFVFskly4q77GRQ5m+LFXK3w4q5 vjXFsdx/kwqtTCwW5Fm3y/YxVyriqxlxVe2KrGbCrv8AXxVdgVauKrcKuxVS4YWleuRZKfx8 MUN8MkhrFm5MVb/ZxYLOWKu44q1yxZu+ziwdiqnxwNzfLCwXYqtZcVbZsixWcueSQuwNymzc 8CrVbJMFjfyYq2zftpiwcq/z4qtxZrWbFVT9rFgsVsVc3w4quxVS+zireKrWxVa+KuxVZ/l4 q7jirmxV/9D63J/kZkOOvZeWKr+PHFVTFVy4qpriq/jizbZcWDS4s1bFW2+P4MWDf2vgyLJb x45JLsVXccVXquRQqZJit/yMVX+piqn8eLNtV44sF/HFWsVbbFWv8jFms/y3xVX5cm+PFg7F XYq3/r4s1qtkWLeSQqfYTA3LeD4WC/j/ACYquVfiyKFNsVVF+FsWxzYVW8fi4YWCqvwYGblw K3zyTBpcizaxVv8Aawq3zwsHYqu44qtZcVXsuKu4/Firm+L4MVbxVb/xLFVRVxVcv8+RQvX+ fFsaxa1nJ8VcqquKqi/BirmxbHcsVaxVvji1u+LFsXs3xcMVdiqmn2MVVMVdwxVyriqz/XxV eq4qvbjiqzFV3LFV2KuxVT54qv8AtYqv/wAvFXfYxV3LFXceK4q5cKuX4cCuZsWty4tjuOFX L9jAq/k+FXKvD7eBra4/t4qtb4vt4quxVtf5HxbHMuLWs5Ytit/kYtan9rFVvwYti7Frbbl+ 3iruWKu+LFV6ti2OVsVczYq7FXMvw4q7FV6rwxVZ9vFXc8Vd+1irsWt3+XirsVdwxbHYtbkx bHJi1uX7WKqmLYp4tblbFXf6+KuxVYzft4qv4/t4ti7jiq3FXcn/ANhirv8AUxVzNirlXu+K rP8AUxVf+1iqzj8PPFrXfB9jFVqriq//ACMVU8Vb5YtjvtLiq1WyTBcvx5FDlxV3xYq7jirv 8vFVnH4ub4qv/wAvFscuKu/yMVd8OKtP9jFW+OKu44tbWLYtVVxVdiq1sVW4qu5Yqs+ziq/j yxVT44q3x588Va5YquxVr7WKrOGKruOKrWXFXfFirueLW03+v8GLY3irsVdzxV2KuZcVU8Vd irsVbbFrab9jFsW/Bi1r1bFVnw/7LFV/Lv8At4tixl/Yxa1P/IxVpv8AIySVfIoQ/LJJVlyK EPxXJJdwxV32MVdirv8AIxV3x8MVdirsVW5Fm2zYq7l/PiruWKtYq7i+Kuwqt+xgVzYquwqh +WFg7jiq9W55FDS/yJ9vJMVP4sWbueKtfsfBiqo2LBbiqnira4q79n48VW4s1vHFXK2KuZcV d9j7eRYtrkkKfFf2MWa5lwM1JvjbCwcv8+KreX7eLBc3+XizWMuKu5Yq3+1iwWccVa4/DizW /axYN4qtbFXLiq1WxVytx+3irv8AXxVw/YxVTf7GKv8A/9H648vh/wAjMhx1/LguKrGXFV/w 4quXFVT4MVX8eHx4q74cVaXjizX8v2MVb48vt/byKF7Yq3xwtjeKrFXCwVsWCzi/2MWbf2MW DuXJsVXYq7FW2/nxVr4sWbn+xiwVPixV3DFWl+LFm5vjbFVX9jhkUKWSSqquRQ1kkrlxVdx4 tkUOb7GLYuxVTZf5MkwVMizW/BhVeuBXNirWKtti1tqv8mFscmFg5VxVdy45FC3ivHJJXLir bcsVd8H7GKqjL8ORQ2ytiqlx+LJJVV+HIocvxYq5cVd/kJirlxVdirfLh9vFsWfs88Wtfy5f 6mKu44ti9MVWKv7eKr1bFXYq7FXfYxV3PFVPFVRf8jFV6rwxVrjirmxVy4quxV2KrVxVdiqp iq1mxV3wYqsXjiq9m44VXYFWq2FXLgV32MVX/wCXiqzn+xiq9Wxa3L8f28Wx3FfsYqsXkuKr 2bFV6YtaxWxVbyySV3LIoWZJKtkWbv2cVc3PFXPiq5sVWpiruGKuX+RMVcmKuX7OKuX7XDFr diqpi2KeLW5MVcq4tjsWt3DFsdi1uxbFTFVPni1uX4PgxbHYq7k2KuZsVdzxa3c8Wx2Kub/I xa3MuKu+HFXYtilyyTBVVcizdwxVUxVTxV3PFXcMVd8WKuX/AIfFXMq4q7j/AD4q7FVjL+wm Ku/yMWtZ9puGKr2+zwxVrFW1ZfsYtjv2sWt3w4qsZsLYuwK3y+LFV74qs4/sYq7/AC3xV3Lt +xiqhyxVf8X2MVbbFVuKqmKqeFXYFW8cVbVcVbxVp/t4q0uKuZVxVb+1irsVcv8Al4qp4qqc MVcmKu/axVZxxVemKqeKqmKrGxVrFW2XFWsWt2Kt/s4qsb/hMVXYqt+3irvgxVzYqp5JLX2c VXYsFjYs22b4cVbZWyKFPjyXhkkuVeeKu4Yqu55FmtyTBpl4fGmRZuVsKuXArvjfFXJ9jCru WBWsVWrxwq5eWKrsCqP+piqouFVJlwsFmKquLBTxVrnizdzxVvhiwWccilbkmS74sWDmxVY3 HFW1wNy7FVn7GFpWNkWS9pOXwZJisZfi+PFXK3BcVU8WbuGKub4cVUlbFg7liq7lizdxxVa2 LB3LFXfYxV3Hj8GKqOKr/wDXxV3L+fFVmKuxV2Kv/9L648v5/sZkOO74sVXr/kfYxVUxV2Kr v9fFXccVb+zizVHxVyYqubl/ssihev8Al4qv44WxR54qr4WlrFm0qriwcq4qv44qvZuGKqfN MVaxZqqtzxYKf2sVVExV2KtYs17LirS8Mihb8WSSvVcVXriq79jIod8eKrsWxazYquxV2FW+ WBWm+NvjxVv7WFWvtYFdy/bxa21/nTC2NphYLl+zkULckl3x/YxVdxb9jFVTIoXNiq3/AFMk ld+3kUOVcVcuKuf/AC8Vdy5fHi2OZvi+DFrXsuKt/wDEcWxpW/kxVZxxa3N9jFV64ti/niqn 9rFVTFXYq5fs4q5MVdirv2cVcmKuxVfHirTYq3+zirXHFXNiqouKu44qprirf7WKr+OFXYWD lyLNdiq1cVX/ALWKu5Yqs4t+3i1r/wDXxVfiql/r5JK7jkUO5Yti/hi1qeKrckl2Kqy88izc 0eKqmKqfPFXSfz4q79rnirTLzxVv/IxV3PFVjL/Piq/Frcq/DirsWx2KtK3PFW/+J4qqYqtb FXccVXYq7FXYq18OKtccVc2KuXFW+D4q0q/yYq74eWKrsVWriq7FVvHFVrLhVUwKp1/y8Vcy /wA+Ku4/D8eKuVcVU8VVMVdiqpiqnwxV32fgxV2Krv8ALxVZ+x8GKreOLW1x+HFW2VcWxzNi 1tcfixVvjzxV3LFWm+3irbe/28VW8e37eSSuZcizczft4q5lwq7l8OBVjLirvt4q7/UxV3LF VuKrvsYq7kr/AB4q5eOKqa4quxV2KuxVa2KuVlxVb+1iq7/XxVdiqnzxVbzyTBY2KquRZuxV YrYqv54q58VdzxVT+1irsVbZcVd/kYq1i1tq2LY5cWtYy4qv44tizjxxa1Jm+LJJa44qqMuK rP2cVbxVbxxVa2Bm74sLB2KrsDN3wcMDWsZsWxrFW/8AIxVrFW+OKub/ACMVWfHhVf8A5GKr PjxVzL+3gV3P9vCq348LBT5YqqZFClkmLT4s3cf+AxV3H48VbfFg7ir4qsbFXNirmxVT44s3 fYxV3Hliq/Fgs+xkUrePPJIbxVpvjxVT4Ys1it8WKuZf5MVdx4Yqsb7GKu/YxVv7eLBZxXji rTf5eLNU5JiwU2xVU44qptirfHnirmbFVnPFX//T+uKr/JmQ46t8WKuVcVVcVdiruPw83xZu XFV/Hh9jFXN8WKrsihavxZJKriwdirX+piq5l/YxZuZlxVv08WC//LxVTbFmvbFW+K/YxYO4 /b4Yqv4smKu9PnirXJcWbeLBrj8GRSqZJkuyKFnHhkkruWBmq4FW/s8MVWKuKt4qub4sVXYV dirsCuxVtcVcuKuXj+3iraZJg58Vd8OKrlxVW/yEyKF2KqDNwySVVVyKHKrYqtVcklUyKFrf Z54q7j8WKu+DFXcv5MVd9vFV2LY3xxVfiqxmxa3csWxfirsVd9vFXcMVdirsVX8UxVvFXYq7 FVvHFW/s4q1xxVtfsYqvVsVWK2KtcsVbVfi+D7GKr2X+T7GKtcnxVUXFXenirm5Yq5mxVrFr U2ySV2Kr/wDXyKGlVUxVUZeXx4qsXFV74q7FVnHFV/8Al4ti/wCziqz4sVdwxV3L/gMVdirl 4Yq7FXYtbsVcvw4q5V+LFXJirsVdzxVz4tipirXL+fFWmxVUxZLcWLXL4cVcsi4VWYFVuPHF Vi8XxVVxVTxVauKrsVaZeeKtccVXYq0zfsfzYq5v5MVX8eOKrcVdiqmmLW7FsdzxVz4q7/Ux V2LWubFsW/5GKuxV328VWLxxVemKu+FcVdx/bfFVn+Xi1r/8vFXcMVdiqnI2KtcsklczZFCz JJc3/CZFmvb3+3iqxvi+PFV7fHhV3w4FaxVTXJMHft4qu5YGa7Aq3jiruP8APiqn/qYqqcv5 8VczYqtxVc2KrG/kxVzf5GKrHxVezYq77WKrMVcrfFiq/kmKrOGKuxVyYq0y88Vb/wAvFXYq 5VxVzNirnxVRbFrXri2LOOKr2XFXccVdyxa1nHFXccVUlXJJbb4MWC1l/bxZr+TN1yKFL7GS Su+xgZrXwsHPiq7l/JkWblX9jFVnHFWsVbb/AC8KubArWKt/DiqkuSYOVsVVMDNbxwKp/wCp i1qnwpiqm32vgyTFbyxZr/sfbwM1JVX9jCwXrxxVZ8P+zxVvhiwdiqniruCYqs4ft5FLbNir X7eSZNcXxVbx54q20fLFgu45FKzjkkN/FyxVR+JGxVc+LNvj/PiwU9/5MWbfHFgs5Yqv4r+3 iqxl5Yq7j/JirXLFm2uLBbirSfbxVrjiruOKv//U+uKr/PmQ469MVVlxVzM2Kr4/8jFXf6mK rcWaq3+RiwX/AOXiq7Ismskxdiq5VXFXLiq1vt4s22xVUXFg5cVaZsWbvtvirfHFgv5fsYq5 MVdirsVVMVbyLJarfDirXHJMXfZxZrvhwM17Niq7Aq1l+HFV2Kuwq2y4qs5JgVevx4q1irfL nirfHCq7ArlVcKrlwNal8XHnkkr+WKr/APLTIoWquSS1yxVUXFV3wZFDvjxVy4q5uK4qv4/F i2OVcVcq4q5cVaxa2+OLY5lxVy4q79nFV+Ku4Yq77GKu+3iruGKrv8vFW+P7eKt4q7FVPFVb /XxVSVcWSvixW8cVcvxYquxVaq/Firn/AMvFXL8f+phVeuBWvs4q23t9jFVLlkmCov28ih32 cVaXJJWcuWKqvLIod8OKqXLjkkruf7eRQvXFV6/ZxbF3HFVvH9jFXYq7Frd8OKu/4hi2LOOL Wv8AhxV2LY5m+LFXf5eLW7FXYtjsWt2KuTFsX/ZxVrjiq7FVq4quxVpmxVvFVvHFW244q5f5 8VWc8VVMVW8cVXYq7FVuLJdixW/5GKtr/wAQxVvFXYq7FWlbk2Kr1+LFVuKreOKuZWxVb8X7 eKuX4sWt3FfsYtjsWtzc8VdyXFXcMWx2Ku5ccVdy/kxV3L4MVd/l4q7FXKuKqXp5Jgu/ZyKG uT4q0uSSubIs3ccWt3+virl/yMWxevwfBiqnirsWtbxxbF/HFWsVW5Jg5VyLNb9vJMFzLgZu ZvhwK7lirmxV3+Xiq3FVv+piq1vhxVUxVbxxVvl8OKrG/nxV3DFXcMVdirsVdzxVzcMVdirm XFXYqpp9jFXYtbfw4q5sVaxVa3LFXLirmb9vFXMuKqfHFXZJLXH4sVXcviyKFnHJJW4q58VX f5GBms5c8CuZeWFW3wsGvsfBkWbvt/Biqz4MVd/qYqvZcKrPsYq7/iWKuVsVd/qYFXYtaiv8 +SYuxZreWKqmRZrckwU/2sVVcWCnirv2sVUsWbeLBvliqn8HLFm5W5Yqqf5eLBYy/t4q3yyL JT4/z5Ji77OKreOLNr4sWCmuLNtsWC/4cVWfDiqnxfFW/wBjFV2KqDN+xizVWX4cWCxuWKt4 q7FXYq//1frpmQ465cVXYqqYqtVfixVdiq/Fm7/LxVv4/t5Fi5V4/bySFzYqqR4q1gbnccLB vjiwc3HFV3HFm7jzxVrFV3HFgv4Yq5VxVr/UxZuTFVTiy9cWDarkWTXHFsXYVa44qv44q7jg Vdiq3liruf7eKrsKrfTxVfy4Yq1gV3x/sYq7FVy/5eSYOxVdy+DIodx/bxVtVySVX9vIoU25 ft4q7JJaVvt88VVWb+fIoXYq3xxVZ/PzxVf/AKmLY5cVa+zira/z4q5sWtrFsVPhxVz4q7ni rl4Yq7FXJirkxV2KuX+R8VXcsVb+HFWlxVy4qqcvixV3L+fFXcvixVyfsYqtxVd/kfbxV3LC rv8AXwK5ftcMVab7eKq+KqeKts2Ku/y8Va5fz4tbf+pirWKtq2KuVf58Vcy/sYq1irXLJJV1 yLNamKuVsVU8VVExa3L8WKrmxbFq8MWt3xYtjueKuxa3cMVXtxfFsd9nFWlxVdirX7T4qs/a xVUxV2KtfZxVpsVbZsVd+18GKu/ZxV3wt9vFWv8ALxa2uPBPgySW/wDXyLNzYqrYqpcv58Vb xVbxxVdiq1sVW/D/ALPFV3LFXf6+Kt8eGKtLiq3jxxVUxVbxxVtf5MVdIv7GKt4qp4ta7ji2 O/18VXYqp8uWLW58Wxe3+Riqx8Vd6n+XiruXw8MVcmKuTFXYq5MVXNiql+zi1uXlxxbGsWt2 Kt/6+Ku+L9v7eLYsbFV2Kts2KrPttiq7FW/tviruPD48VWf5eKrsVW/5HDFrc2LYuxVR44q7 /LxVXbFVjYqs5fz4q5vsYq79rFVmKrmxVbirsVU8VVExV2KuTFVnLFWsVd9nFXYtbsVW8cVd 8P8AscVXq2KtYqt44qvXFVjYq7JJUWxVWxVTbIocuKtMuSS1/r4Ga/g+BrUkxQ7JMl3+XzyL N3+Xi1qfF8VbZcWx32f2MVd+zirXNMVdhVT4fsYWC77GRZqa4qqNi1qTZJi0uLNEYGah9rCw W4sGkxZu4Yq2+LBYzYq1irariqz/AI0xV3+RirS8sWa7jgZtcviwtLv8jFVNlxZr2+xgZrGX CwW/FiwU+OLNfzxVZ6fDFViq2KtYsHYq1izXNirf+piwW4q1+1iq1sWb/9b67/Y+DMhx28VX cfhxV3HFWlbFmqLiwXPizd/kJiraty+DIsV+SZL/AE8WDl+HFVLlizVuWBm1xwtK7FXNizax VvFg22Kr0xVtsWa39rFVy4quxVr4cixXccLa1hYNR/Biqr9jAzcq4FXYqtZcKreX7EeFgq8e 37eBm5sCtYqtXFV/xYq6PlirfDJMF3xZFDuPH4HxbHLx+xkmCrybhkULV/18VW/tZJLv2cVV eP2OeRQ5eWKu/wCJYqvXFViriq7FsbXFrdx4/bxVfwxVTxbFdlxVZirsVdiruK4q7hirlXj8 eKr/AIsVWYq5vixVcy/FiruWKtsuKuXjiq/liqxmxV3Lj/sMVX/Ywq7/AFMCubFXZJg7i37G Bm7j8OBV7fBirv2sVdx5tiruWKtfaxVtvh+DFWsWtvi3+zxVpft4tjbf5eKu5YtbuWKtYqqK 37BxbHcmxV3PFrcq4q7lxxV3w4q5lxbHKvH7GKr/AIExV3w4q5vsYq0uKrsVablirS4q3+1i reKrf8vFV2KtftYq3i1rWxbFRcVU6Yo4FT48UrsVW8ea8MVdxxVTpijgVG+xivAs+ziwbxVp l5ri2N4ta5cVd8GLYtxVdxxVTbFW2+PFWlxVdirX2cVd+1ireKuxVUxVRbFXNiq7FXYqp8MV d/qYtbmbFXYtjlXFrdwxbHN/Ji1uxbHL8WKruWKrcVU8Wtvliq1ckltuORQqKuLYs/yMVc2L W5vj+39jFsd8XL4MWtSb4sklczLkWa7kzfBirf7OKrP8jFXcWXFrd9jFsW/HkmCpkWbsKrPi +xgVfirsKof/AF8CojFVFsVc2KuZv28VXYqps3PFXYq7FXYqsVsWtfi2OxV2KufFVn+vi1tY tjfLFXcsVc2KtYtbsVW8sVdxxVauSSs/ZxVV/Z/ycihdiqly+HFVnHJJcy5FC3JJa/y8DNfx ZeGKu4/sYGtZxxV3xvi2O+HFVi/E2Kr/AIcVWcfhwqt44WCpgZrW+LFWviTA1t8eWKrGbC2O 5Yq7j+xga2mVskxU24/7HFmvX4/gxVbiwc+KqeKtqvPFXfFiruWKrcWa37C4qvxYKPx/sYs2 +WRQt45JLSYsG+OLNtVXFVmKu5Liq1cWCzjiqzlz+PFV3FVxZu5YqvxYKeKuxV2Kv//X+u6r mQ47eKrl/wCHxV3Hg3PFV/8Alpirv9T7eKrcWbfL+TFV+KqnxYsF6rireLNpsWC7FXYq7FWs WbeLBtcVX4q1xV8WbvsYq5v8jFUVkWa1Wwqp4WC7Aza5cMVX8eOBV2KreWKu44Vdy44quwKt yTBf+1gZtN8bfHgVtV+H4MKt8MLBytiruGKu+L9jFV3HFV2KqjfFkUKPHJJbZcVXr/PiruOK qrLkUNYq7FXYtjbYq7jirlxVe3xYq7FXJirsVdiqxmxVy4qvxV2KqmKtfs4q74sVbxVr7WKt Kq4q5cVVH/yMVU/8jFW/t/YxV3L9h8VX8v5MVdkmC7Is2/sfYxVzYqs5fDhV2Fgv48/jyLNY 2LW7JJXfscMizbVeOLW5VXFXf5GKu5dv2MVdy54q5W/bxbF7fZxV3PFrdi2OfFrdirvt4tju X8mLWu44tjcmKt4q7FVzLiq3FVPFVTFVq4quxVbxxVU44qtxVpPt4qv/AGMWtTbFsVP8vFV2 KuxVbiyW8eOKrlxYubFVrYslqrwxYcCp/r4pXYta1cVXYti3jiq7FVqtiqmuKq2KqTLi1tf6 mLYrYqo8sVdyxV3LFXccVVMWS3Fi0zYq5WxVfiyUeP8AJixXcsVW4tbueKuVcWxyYq58Wt3+ pirvtt8eLY58VdzxV2KqXLJMG8DNU/18DWsX48Vc2KtYq0q5JLeRQ7Fsdiq1W5f6+KuXFV/J uWKu9PhiqxsVWfs4qv8A9TFXLiruOKu4/Fiq7FVFcVVFbFXcsVWfZxVY+Kr/ANj48Vcq4q5l 4fBiqzFXJirsVc+KufFVPFVRMVdwxVZxxVTVlbFrVGXFVNv5H+3iqp/kYq1iqm2SSu45FDm5 YqsVsVXq2KqeSSp88Vcq4q7hirXw5FDf+Xih328kyc+KuZsVa48Mizc3t9jFXNirWKu4Jiq3 h+3hV3LiuKtt9jFW8CqTfa4YVbxVT/18LBcv7rFg3iqnirT4s3Yqt44sFz5FKnkmTfLFXYsF v/EsVd/kYq7jiruOKqTYs13p/wA+LBtcDct5YWlpsWa1W4Yqt+HlzxYLOOKub7Hx4q5mxVzL /PirlxVbiq1cVdxxV//Q+u6/HmQ47XHFVRcVa+y3x4s1/wDl4qqLzxYN4G5bx/kwsFXFg0q4 qv8AjxVtcDcu44WlzYq02LN3HFXfaxYKmKuxVyYq19jFmqYq5sizbb4MKu5fFirWFg2uBmv4 /wAmBV2KrePLFXccKr1bFXLxxVTb7eBVT/IxV3+RiruPxYq3kmDvt4quVuK4Ga18LBeqtirX LFVTIoU2b+TJJb4/z4qqt/JkUO4fsYquxVb/AK+KuXjiq7FsdiqpzxV2KuTFXc8VdirvsYq7 FXYq5vs4q7FXcf8ALxVcuKu5YqtxVf8As4q3irX2PjxVpcVb5virmbhiq9cVc2KrsVW8cVXq vPFVjNiq9WxVY2Kr/wBnFrcy4q7/AC8VaT7GKt8cVdxxbF6rirkxVy/axVr7K/5GKtsuKqf7 HDFrVMVd/wATxV3Lji2OX7OKrmxa2+PxfBhbHMuBW8Vdiq7FksZsWLeKtfFirXHFV3HJMHZF mtbFV2KqmKqS8uWKu488Wtevx/6+LYuxVT44slzYsXfF+3irvsYq7lirsWTm+HFi7/IxV3H+ fFV2KrcWTvsYsV2Kqa4slzYsV2KrWxV3+Xiq7FVH/Lxa2+OFsaZfhwNa7FsWriq7FWm+DFW8 VW8cVb/ZxVvFVPj8eLW74f2MWx3PFrczfDi2OX4cWt2LY7Frdi2Oxa1PFVTlyxV3FcWxzcMK qeBrVMWxYrfz4q7jzxa1i/Y+PFsb4/z5Jg1y4/YyLNvjkmDTLkWa9lxa1rZJLX28izX/AA4q 1hVvjgV3HFWsVWrhVy4q74MCu+DFXNirv2uGKuZsVW4qtZuWKrsVdiqniq5cVW8MVcy4q5MV WccVdy+LFV74qsXFV+KuxVZyxV3Jv9hiruOLW19nFVv+pirlXmuLYvbFrWKuKubFVnL9jFWs kltuWRQs45JLuOKrWXFXYq7iqYq7FV3H/gMihb/xHC2LcCt/t/Biqz7eKrsVb+HFVn28Ku/y 8Cu44VUvt/bwsF/+Xiq3FWuWLBZ8WLN3PFW8WDkxVSxZqiYqtbFgskbFVJcWaviwWtyxVzLi rv2MVU+OKt8kxVz/AG8VU2b4sWbv2GxYLf8AUxVrFW/2/gxVZ/r4qvX+fFVjYq79vFVuKv8A /9H68ZkOOubFXcuWKrmxZr/sYq74sVcsa4q7hiqp8OLBfxxVr9vFm7i+LBV/4jirXLFWn+xi qomKuTFXYq0y4s3N/kYq7FVbIs1ki5Jg5VxVvFV2RZrn/wAjFV2KrWXFV2FXYq38X20wK3/x LCrTL+xgVrFW+Pw4q3kmDnxVzL3TFV6qz4qsb/LxVf8AaxVzNiqvkUIdcklW+DIoXYqtX4lx VdirsVb44tjuP7GKr+eKub+fFXYq7hirueKu54q7FXMuKuxVcuKrW/kxVf8AZbFW8VU8VX8v ixV3Hv8At4q1yxVvlzxVVxVS4/t4VbwKub7fx4q5VxVf+zi1u/18Wx37OKuVuGLWs+Hji2OV cVXfaxV3H9vFrVOP7eKrP2sVXr/l4tjnxV3FcVWf6mFV7NgVz4q74sVdirnxa3Yq7/IxbFy4 qqft4qo88VczYqvVsKuXjgVpcVb48vt4q79rFXNwf4MVbxV2Krf9fFXcsVXYq18OKt4ta1sW xU5Yq7jiq7FVrYqtxVUxVbz/AGMVd+xhVdiq1cCuXFXcsVXYqtbFV2KrWxV3LFVvLFk0vx4s W8Vc3LFkqYsVHjirbLiqriqjyxVy4q3+1irlbFWuOKtp9vFW8VU1/kxa3Yti5cVb4/DwxV23 8mKtNirmxV3+virfwPirlbFXMvD4MVWPi1uZcVVMWxT+HFXc8Vcv+Riqpiqni1qfJUbFsbb+ fFXfDi1rMkld9nIobVsVWepi2Ky8eWKrFbFWsVc328VWs3xYqv5fz4qs/Z54q5vixVT5Yq5W 44q7liruWKubFV2KtLy5Yq02KrXxVc2KrsVU8VWcsVXquKu54q5VX9vFVPFVTFVPFVTFVP7W LW7FW+X8+LY74sVaxa3Yq2y/8BiqxWV/t4qpNxySV2LBe2RZLeOSSo8MVcmKrnwM1v8AqYWD lXFXPiq3Is3YqtXFV/H4cVc2KtthVTZuWKuXAq7FVL9rCq3jzwsF3HAzU8LS58VXM2LNY+Kt 4sFPFWvs4s1vHFW1xYOf/IxVrA3LsLBplxYLOPxc8VW88Dc5v8vFWuP7b4Wlz4q03JMWa3ji wa/ZxZuX+fFXYsHYqtbFWlb9jFm//9L69LmQ463FVy/YxVvFm3/r4qr8v8vFg74/28Vd9nFV y/bxVfiq3ly+PFV7fyYq7liqzliq9cVX88VczYq58VaX/IxZr+PxYq3iq7Is1NckwXYqqcf5 8izc3J/9TCqiq/yYWCs2RZrcVXccKqi4qtwK2y8fgxV3xcsVawqufCwXLiq1lxV3w4q5V+HF VTFW8WCxm55Fk7jkkqy5FC7j8WKuxbFvJMWtdi2NrirWLW2y4tjv9TFXM3/B4qv/ANfFXcf2 8Vdy/bxV2KuVcVVMVdiqnwxVcrfz4q38OKu488VaZf2MVcq/8HiruOKt8f58VX8cKuVVwKtx VdyxVzYqtVskwVf2cizdxxV3HFWsWtb9nJJXrkUOXFWsVb44q5eWLYuZeeKt4q7FVvDJMFzL kWbvt4q5MVVMVU+GKruOKu44quxVpVxVZwxVerYqtXlyyTBVbAzXYGtS4/z4q3i2NcuGKu+1 ireKqaYqvb7GKt4q7FV3HFVPFkqf6+LFzYq7/IxVy/yYqtxVczfFirl/nwqtVcLBc2RZu5Yq uxVa38mKu+H7eKrsVW8sVcuKrVxZKvHFis44quxVbxxVTbFW+Pb9jFXL9r48Va/y8Vb+zire KrVxVzYqqMuKqbYtbl5L/k4tjfwfbxVpsVbVsVbxVr7OKu/axVrliqozYq7k3PFVNsVb4/t4 q5lxVZy+DFrdwxbHN9nFVnw4ta/FXMuLYv8AhxVZ9jFWuXNcWtbyxVy/Hiq3jkktr8DZFDf7 OKuZv5MWx3LFXcmfFXccVd9heeKuX4/sYqsVWwqv4/F8eBVn2MVdy5fbxa12LYo8cVXYqqYq osrYq2v8mKu+LFW8Va+1ireKqbLiqzl+3iq9WxV2KuxVT5PirsWt2LY7FXYqtXFrXYq2y4ti zli1rsVW8cVcuKrOPDFVrfYySXcHxVrjirmxVbxwM3KvPCwdiq7iv7eRZuZcKrP9fArlxVrF XYq7FVvHCq7Aq3jiqz4/2MKrOWFgvZcDNpsDW3kmK1vgxZrMVbbniwdiqn/kYs3NirsWDbYq p/YxZuZsVX4sFFsVXccDc7/XxVTwtK74cWaxePLFXYqpr9vFW+WKu488VaxVcy/8HiwWNir/ AP/T+vXH+TMhx12Ku4/sYs16/wCRirlbFVTFV2Bmps37GFgqLyxVzYqqL/Jiwa+zirsVb44q vTFXYq2q/t4s1vL9jFXKuKqq4GbeKtK2KquKreOKrsCrV+H7GKrcVXf6+KuXCrv28Cr2xVZk mCpirsVd8WKuxVzf5GKrl/y8DNeq4Gtey4qt5ZJKnxxVdiqp8eRQvXFsaxa1vw/7LFXfBiq7 FXJ9jFsbXFWsVb44qv8A8vFVPFVTFWvtf6mKt4VXr7/bwKsxVy8m+PFVTFV3+piqnyxVtuWK r+TNirvt4qsX+TFVXFVP/XyTBcuRZrsVWKvxc8Wtfi2N8sWt3+pi2LeOSYNYqrJkUKXHJJXc cihesa4Wx3DAruGKuxV3+phV2Brd8OLYs/Zxa1/H4MWx3+p9vFrVMWxbxxV3+pirfxYq1yxV biqpiq3jirarhVVwK7FVP/UxZLlxYubFXNiq7FVvLFV2Krf8vFXfbxV3LFV2KreOKu5Yq5sV U+WKqnLFXfsYq77GKubFVuKrWxVtW54qq4qt9RcVczYquxVbyxVzNiq7FVrYquxVazYq7jir v8jFV2KqPHFXf6mKq2Kqf2MWS5VxYrfgxZLmX9jFitxVpmxa3cUxbHL8eKtccVc2KrWbl8eK uxVW44qs4ryxVvFVv+virlX+TFXKv7eKrcVdwxVyYqu44qt+xirsWt2KufFXf6+LY5VxVZx4 Ni1tYq77OLY7Frc3H/Z4q2y/t4tjmVsVaxVvjiqxVbjiq9W4YqvVcVUVXFXcvi4YqtxVUxVb kmDuWRZrGbFV/wDl4VW4FW/8SxVtl+HhirXLFXfDx54qt/4nirkxVz4q7FVPFXYq7FW+WLW5 sWxy/wAnPFVn+Xi1uf8AyMVWtihd/r4pXL/l4qt5Yqpce/7eSSu+LIoa/wAvFVv+Xkkq3JMi hT44qp88kl3H9vFVRcihbhbFr4WDTfBkWbv8jCrf7WFgtyLNay4Vc2KrF9vsYFVcVW8uOFV2 KqeKrF+xhYN4qpsuKqnwfYxYLOTft4q7FVPFXYqqN9rFVPFXYq1izW/s/wCViqxsWC5WwNyk 3+XhYNsrfsYsG2bIsnYWxS/y8LBvjiwd3fFXcsVW4s2mxYP/1Pruq5kOOu44s1Tj2/bxYL1+ z8eKuX7WKtrizb+B8VVF/nxYNt8Xx4G5a32MLBfiwbVfixVy/wA+Kr+LfYxVd9v7GLNtv8vF gp/C2LN328VVsDN2BVv/ABHCq3jhYKy5FmuxVauKu/YxVdhVan+XirlxVdgVb+xiq9lwq23L 9jCwW8nyLNdzyTB2KqmRYtq3w/62KVvw5JKvkUOxVQT7eSS3iqpyT7eRQ74MVdyxVzYq5Y8V XYqqcf2MWxYuKr3xV2KrOOKr+eKuxV37OFXf6+BXJiq5cVXYqu5YVd8eBXccVcrYVdz/AGMD Ws/Y+DFsX/YbFXMuKrcVXcf5MVX8cWtfyXFsU+CYq3/kJiq1myTBVbhkULP8vFVmSS2q4qqq uRZuZv58VcvDFV6tzxVDZJgrc8ihyquLY7FrXccWxa3DFV6/YxVerYqsVsVVcVU8VWriruWK uXFVTlxbFV2KrcWTm/kxYrsVdirsVW8cVW4qq8sVWLiq7FXYqt44q5V/nxV3LFrWfZxbF/28 Vd9vFXLirmxV3LFXN/JirlxVdiq1fixV3xfsYta/jwxVQ44tiuuKrFxVdiq1cVcq/sYq5sVW N/PiruPDFXN8GKquKuxVa2KuxZO44sXfsYq5f58VcuKrsVW/5eKqfLFXcsVXYq0q4q5lwqv+ DA1rG/y8WxZzxVcuKqi/FiqxuX2ExVpcVXYqp4q7j8GKu4ryxa3L9nFXYtjlXFrX8f2MWxZi ruGKu54tanzTFW1X9vFWsVb5cMVcuKtLxxVtsVd+zi2OX48VWK2Kr+PxYq1hVa2Ku48cCu4p i1uVsWxytiq1V+HJMFzZFC7Fsdiq1mXFVirirTYqtxVcuKrcVc3w4q7nirvsYq7FVjYtbWLY 38OKtYqt4/yYtbsUL2XFKzliq7FVsmKu5N9h8Vc/+XirTN8OKrV/nxVr/UyTFT/ZxZu+L7CY qq8u37eRQswti1vhwsF0nLIoWcueFsdx+LFXccCtYVdirsCreOKrGXFW2+HJMFNsVXr8GBm1 xwKpvkmDvtfHirf+viwdirsVU1XFm77OLB2Ku+1iqzlizXNgZqS4WlzYq7lz+DFm5mZ8Va4Z FC39nJJb5N9jFg0+LNt8WCxsVa5Ys3YsH//V+vmZDjtYs3Yqqc8VcvxYqv8At/Biq5fjyKFy r8OSYubFXLxxVf8A5GKu5Yq7jzxVfx44q0mLN3+XirsVXYGa7CwU/j54qqYqqcfhwM3LgVzY q5fhwquxVdxxVbgVvl/Jirv2cKu48vsYFb+xkmDlXFXcv58VXL9rnirl+LAzc0eBW2/y8kwa Zv2MVXYqtX7XPFVbjkUO/wBfFsXYq3xxa1i8sVdyxVev8+LY7jiq/FXN/kYqsbFV+Ku5csVc 3874q7FXYqvZsVc3x4q7kmKr2/nfFXcvhxVT5YqublkmC5f8j7GRZu/1MWt3LFsdI2KrsVbX FXKv7b/bxVzcvsPiql+3kmDvsYqqsv7GRQ7lzxbHLi1tYtjXLJMFVfg+3kWbm+zwxVUxVTk+ DFVnHFrX8MVX/axbG8VWtiq7FVvw8cVb48MVc3x4q5sKuVsCuVsVabFVTjiruOKtL9vFW1xV diq3jirv9T7GKrcVXcsVXYqt44quxVTxVcvw4q5VxVZ+ziq/jirlxVzfYxVyr8OKr+OKtYq3 y/YxVzM2KtYq3/kYq5l4Yq5cVaxa22xVzcWxbHKuKtYq3x/nxVZxxVzYqvX/AC8Vdy+xiruT fYxa3ccVWccWxdhVT+xgZObFVy4sV2KrVxV2LJ2Krv8AIxVRXFi5V/kxVdirsWtr7OKt4ti3 jiqtiqnirsVdiqmrYqqYqp8MVX8fixVY386YtazlwxVe+KuZWwtjuXHArsWt3PFXcv2MLYsV eOBXf5GLW1irk+xirXHJJbXjkUN8sVaX4GxVa3LFsXYq2ythVfzwKsVsVcuKubFWsVUeOKq2 KreX/B4quxVTwquT/IwKsb+fFWuWKrcVX/abFWsWS3/UxYqeKqmKuTFVjYq7/IxVr7WKu+zi rsVWti1u/bxbHLi1u5YqtXJJXfD+xkULW+HJJa4/DkUN/wCXkkrsVUVxVtv8jFVjLirlVVxV 32fsYqp4qif8h0yLNYv+RhVTwNba8sLYs44q5cCrsVWcXxVvlywqtxVT5YWC/wC1gZt4q7FV Hl8GFg3iwdirsVU/2sWbuP8AJirWKrmXFg1irsVWs3HFVJcWbbL+xiwbXkuKqbfFizXJgZux VpMLSp+nizWNiq7FX//W+vX7GZDjr+TccVaxVU54quVlTFm1yxVWXIobyTFtmxVyrirlxVpf 5MWap9jFg5VxVrFmvX4MVXfE2BmsXCwXYqrYGak3wYq3gV2KqmFW/TwK1irf7fwYtbTf5eKr WxbF6/A2Kr1XFVq/5GSYO48sVd/r4q5vtYqu+D48izX8V/Yxa1/Ll8eKtKq4qp8uGSSqcXyK G2XFXfYxVdiq3lirlXFVT/iWKreX7eKqnPFsdzxV2Ku4Yqp4qqcfjxVdxxVb/l4q5lxVUxVa uKt/s4qv/wBTFWuPL7eKtsuKu44VczfDgVT/AOI4qqMuKuXCruKp9j7eBV8n+XirmXFWv2+e KrWbFrdkkr+ORQ0v8+KtsuLY0v8AJi1qmLY7FVn+Riq+v+Xiqniqovxtiq5V+HFrc2LY39j7 GKt4q0rYq3xxZKa/5f28WKpirsWtbxxbFbFVq4q7Fk7lixd/xHFXLiq1lxZKmLFS+1iqqvwN wxa1qr+3iruWLYv/AMjFXccWtYuFsXsuBrWMv7eLY7lirm+zzxV3HFV2Ktr8GKu5Yq1irfLF Xf5GKu/yMVdy54q1iraqz/YxV3HFXM3xYq5cVdyxVZxxVerYqsxZL2xYt/8AEsVW4qtxZL/2 cWLuOKtYq7FVPFVrYqqcvhxV3+Riqn/kYqvVcWTbLixXYqtb4sVdiyXYsVqriruWKu44qtxV 2KreOKrsKqa4WC5sihtmxbHcfiwq77OBWuOKq2KqLYquxVay/Fiq3/LxVzfFirm/nxV32MVd 9vFrU25Yq2uKu/ZxVe+KqP8AkYqvbFsdx5NzTFXfY+PFXfCuKu488VdyxV37OKu44q1iq1W/ kxVzLirmbCrmwNbv28Wxbiq1cVW/6+Kr+P7eKrMVXr/kYqs48cVdirv8jFXMuKrOWKr+eKrG xVy/Z+PFWm/yMWt2KrWXFXfsYquxV2Krfh44qorkktq37aYq1/l4q7jiq7jkUKfxZJLuLYq5 V+HFV3FWXhkULeGSSqKuLBTZv58WbSs2RZtYq2vx4VWfHirlXArv8jFVuKtcuGFW8Vdiq3Cw U8VbxYOZe6Yq7hiqzjirXL+TFm1iq7l/PiwdxxVT48WxZrGxYKjKv2MVXYqpfsc8Vc3H7eKr eX7b4G5azLhYN/s4sGuGLNYy/FirlbFX/9f6+NmQ1KiYsGnxZtqv8/2MWDl54qiMVdirsVc2 LN3L4cVb5YsF6Yq1/wAQxZu/18VbxYKnF8WaxsVdyxVf/l4GbWFg2uBmvVWwK77GFVTjirTY Fd6eLW1i2LVb+TFXK3LFV2FW1+DFW8LB2KruXD7GBmt+HCwcq4quXFV2Kr2+3kUKf2/sZJKr 8GRQuxVavw4qv+HFVP8Aa+PFV+KtqvHFsX8v+AxV2Ku54q74v2MVd/kYq7FXMuKruWKrsVU/ 2sVXquKu5cMVbxV2KruOFVP/ACMCqir8PDFV7Yq74uOKuVcWtZx+LFXZJK7l8ORQ3/qYq79r FXfa+D9jFWsWxUVcVXt9n4Pt4qs4/YxV3+RirueKuTFXcmxV3H4MVc32sWtcuLYuxV2KtL/k Yq74cVbxVbxxVUb4Wxa1uKqmLYt44q0q4sm+OLFyr+3irmxV2LJzYsXLiq7FVv7eKu/18VX/ AGPsYq1irbYq7liqzliq7FVFcVVGxVfyxVe3PFVP7WKrVbFV6twxVzYq7jirmxVrFXYq22Ku XFXM37eKrFXFV2KuxV2Kqn+XiqzlirlxVzM2Ku5Yq5cVc38+Ku4smKqXHFku/wCJYsV2KrWx V3LFXfYxV3HFXccVcn+Xiq7FVv7P+VirlbliruOKuXFV2KrOXH7eKt8cVdyxVdirsVWr8OLW pti2LsVdiq3FkuxYtfFiruX8mKtccVdyxVdiqnirsWtUxbFNMVdiqnxfFra45JK7jkUNYq2r Yti1ckwWccVVWyKFjYq77eLYuxVysv28Vb+39jFXceeKrP8ALxV3HCq39jCwWtkWa7FVrYq2 y88VczYq74sVWPiq9VxVZiqxl5/Biq9MVdybFXcMVc+KrF/nxV37OLW74sVc2Ku44qs5fD8e LYvXFVnLFrcy8vjTFVP/AFMVb/b/AMvFXcHxVytiqzl8XPJJbX4/sYqs+H9j7eKuVsVX8kxV Z9vFXcMVab/IwM1nHAq/j8XB8Vd8b4q1hVbywK7jiq7FVrYVUVwsHcsVbZsVWftYq7j/AD4q qcm/bxYLMVU2xZtYq3iwbXFVi4qvZsVWNiqxl+LFW+OBud/r4qpc8LBtV/kxYNcfgxZu48sV bVefwPiwU1xZv//Q+vq/A2ZDjr1/kxV37XN8VX/axV3FMVXqvH7GKrsVb+HFWuX7eLNrFVXn iwc32cVcmKuxVd9nFm2yr+3iwVMWajxxVUwM2lXFXceGBV68cKrsCt8cVdzTCruOBXLirmX+ TCrWBV37WSYLuPx5Fmt+xkmDsVcuBm5MLBf8WKtNirv9fFXLiqtHxyKHZJK7IoW/5GKu4ft4 quxbFTni1rOOLY1iqpirnxV2Ku4Yq5WxVcq8sVXYqt5Yq2q4qvVeHx4qsb/IxVvFV3Hjiq3j kmC5eWRQuxV32cWxyfYxVU54tajkkrvs5FC1PsZJK7IoWN9vFsVFjxVfirkxV3DFXNx44q74 sVW/8SxVdwxa3YtjkxV2KojFVPFVv+Riqpyxa1uKtN/kYtjX+piqo38+LWs+LFsX4slvLFVT Fit44quxVb/l4quxVa3HFXfbxVyrirv9TFXccVXr/OmKu5Yq5lxV3HFVn7GKrsVdirariruO Kub+TFXN/PiruWKu+38eKu5Yq5uLYq1irsVdirbNirl+P7eKu5Yq7/IxVr7OKuxVr7TfHkmC 5o8DNfwwKp8ExVtsVa+1irbLirWKuxVtfgxVr7WKreOKu44q7jiq/j3/AGMVcy4q1iq3l/Pi rl4/t4q5eWKuVsVdxxVzLiq7FVq/5H2MVdxxVy4q7jiq3jiyXcsWKzg+Kt4q7FVvLFXNiq7F Vq4quxV2KtcuGKrG/wCHxVz4q5mxV2LW5eeKu54tixV44ta/FsdxXFVjNiq3jwyTBcq5FDv2 sVdy4fbxbFjYtbmxVfxxbHNirl/kxVYuKu44qt5ZJguxV3HIocuLY7/XxVY3LFWmX4sVb5fs Yq74cVWcMVdirnxV3Fft4q7FXcMVWNirX2sVb44q1zTFrW/BiruOKubFWuL4qqf5GKrG44qu xVQb+TJJXriq3FXfC3x5FCn9vJJdzxVzNirvsYquZsDNb/qYWDuGKrcizb48/t4qtZf2MkwW ZFmqYqtXFXcf5MVWf5GFWsLBb/r4q5sVbX/LfFVv+piwdiqnyxZrGXFVfFgsZcVcuKtcXxVa uKubFVv2cDc79rFWsLB3+piwW8f5MDctfCwdx+Hniqz/AFMVf//R+v8A+1zzIalnL4sVROBm pq3/AAGKqrNhaXftf5WKr1XFV7fZxVZyxVfirWLNz4q2qrx/y8ixX8f58VaVckybxVWwM1Bv gwsGlxVdxyLNWxVa2FV37HPArsKtrgVc3JvjxVTVWyTBV4/z5FC1Mkl3PFW+eLBfkUuxVTxV 3+pkmSoy/wDB5FCp+xiqkq5JKquRQuxVby+HFXNiq9cWx3LFrcuLY7jiq9f8jFXYq7nirv2c Vc+Ku/18Vcq4VXLgVzYq7jiqtiqjyxVv9rFW8VX8kwq0y4FX/s/Birmb4XxVyrzxa1mSS7FV 7NkULMkleuRQ1iqpwxbHfF9v+fFXL/JirmXFXcMVcq4q5V+HFXYq5Vxa3YqqYtjsVab7GKtL irv8jFV2LWu44tjuOKuxZO/1MWLuXw4q7Fk7FV2LFazNiq7FVvLFV/w4tbuOKrOSYti9cVX/ AORiqz9nFW/+I4q1yxVy4q77H28Vc2Ku/wBfFWsVb44q74/sYq5cVcrYq5f8vFXNiqzliq9s VaxV2KrfjxV3LFV/Jv28VWLiq/jirWKt8cVdyxVy/wCRirWKtt8eKr+eKqeKt8uGKtcExVtc VcrYq1ira4q1irf7WKu44q5lxVrFXYq7FXYq38WLWs/yMVcq4tiz7HwYqq/ZxVb8eKrsVdiq 1V+LFV2KrcWS3jiq3jixcy/Diq7FWmVv2MVc3HFXfB+3irlXFW8VWriq7FVPl/Pi1uVcVdiq pi2KeKqbccWtUTFsXcsVW/6mKqf2sWt2KrcklWTIoU8Vc3+Riqm2SSu5ZFmvZv8Ag8KrMLBy 5Fm5V/bxVy4VU+OBVSTFXf5eKqa4qtTFXYqu44qtxVpm4Yq23w4q58VdiqniqpJ/l4qp4tap iqxvgxVrFXYq3+ziqzn+3irmXFXN8WKqX2skl3xYquZsihZxySVzL/PkULf8vJJbZcVWry+x kUNviq3JJc+KrX+xkWa1vixVd9rFXYVdgVav/D4q1yfFW+P8mKqeSYNMuKruX7aYGaxsLBp8 WDsVUsWbbNiruOKrOWKqnLFg7liqn+3izXYq1/sPgxYLcVaVvhxVdkWSm+KtJkmLeBudir// 0vr+vw5kNSp+1iwb5fsJgblv7Hx4WCovL9vFguxVUxV3PFVNft4qqftYqu5fyYs3fs4qu/1/ t5FDk/y/t4q1kkq2Bmp4FXfsYquxVbkmDv8AUwM1/wCzgVri3H48VbZsKrf8vCwabIs1ZY8V XYtSm+SZOxVeq4q5V4Yq5l44qub4Pt5FC34lySV+RQprkkr+P20yKFbjiqxmxVdi2O+1irsV W/sYta/9nFV+LY5eTfYxV2KuVcVdirmXumKruOKt8f28Vdx4YqsVsVVMVWsvxYqrYqtf/LxV f/kJiqxv5HxVWX/IxV2KqeKtri1rf9fJJbyKG2bFsXvi1rP2cVVVxbHNiq1MVczfsDFXcMVc q4q7jx+2+KrVXJMF2RZr1jwq3gVbyxVbzxV3PFVTFVq4qqM3LFVPjiqtirbNiqj/AJCYqv5Y q77eKrsVdx+LFrWri2LsKreOBrXP9jFsbbFWsVdira4q5f2MVa+1irarirvt/Hirv8vFXcue KuZcWt3p/wAmKu44q1hbG/h+3gVrj/Ji1t8cVb/1MklbkUKiq2KrVbJJa/y8izWKuKr1Vkxa 1vLg2SS3kWbfxYq19rFXYq2zfyYq7/LxV3H4eeKtYq3+ziruPFeeKu+HjirmXhirv9TFXcsV Xt8WKrP2cVaxVtf8vFWsVbXFXLirXLFk3+zixcuKu44q0v8AJi1reOLY5cKrcCtN8eKr+PLF WuL4q3xxVdiq3liq7FVHFkqKvHFi7/IxV328VW4q7FXYta3ji2Nt8Hx/tYq0rf8AB4quxVa2 KrWXFrdi2O/axVrj8XwYq3i1rOWLYvp/kYq5vj/1MVUckwXtkUOXFVvHJJXceGRQ5lxVrFsb /wBfFrd+1i2Ob/IxVY2LW5cVaX7eLY38GFV2BVrfC2KqfHFVq/Fiq5f50xVtv8vFVnDFV3+v iqlxxVfirkxVTxVUfFVP4Wxa1v2MVXtirWKuxVvjiruWKu5Yq1iqg3JPt5JLvhxVpcVVmX+T IoUmXJJVWX4sihY3t9vFWuOKqf8Ar/YySXYqt4vkWba4q5V+HFXNirWFVPFVTAq3jirbfYwq ptiq37OFg5mxVzYsHNiqi2LNr7WKt8ubYq0v28VXLiwczYqp/HizXYq03/CYsFjcf28Vb5YG 5YzYGt2KtMuSYt4G5bhYP//T+v6ZkNSon28WDuXP4MVdy+J3xVfxxVeuKuX48VaZcWapzxYO +FsVa+3izc+Kr1XFXc3xVd8X2/2MDNaq82wsF/w/t4qu44Ga7FVPj6uFgqquRZubFXf6+LW1 i2LWXFVRcKrvs/6+Bra5cvjTFV3LJMViqr/HizVfg/byKF+SSpK3HFVX9jIoWfb+DFVLJJRH HIoX/tYqs5YquxVauKr+OLY1i1uxbFThiqz7K4qv4/BirsVc+Kr1bFWvtYslvJv2MWK7/IxV vl8OKr+PLFV2KqPHFW+P8mKr+OKr1xa2sWxvlw+PFWuX8mLW3xxbGsWtvliq1VySWsVXN/kZ FDa4ti/FVy4qtTFrd9vFsdwxa3c8VdirsVXf6mLY23HFWlxVvj8WKu/ZxVvFV3LFV2Kqa4sl XjixaxVarYquxV2KuwqtXArpP8nFV+/8+KtYq7FXYq3+zirv8vFVj/5eKr1VcVWccVXYq39n CrWBXfaxVtf8jCra4q7CwcmKrfs5Fmu/4jirStirX2sVXccKrcCt8vi+DFVitiq/i37eKtYq 7Frb+x9vFsXt/l4q7l8GKu/ZxVZ6eKtYta6P7PwZJK3IoXMv8n2MklzYGbX7OBXcsVdy+HFV 3Hn9jFVmKuxVvliruOKtfaxVay/sYquxVvjiqzjiq7FW+OKubFXLirXBMVdiq1cWtzNirmb+ fFsc3xYquxVb8eKrsVdiq1cVXYq7FVuLJdixdiqnirSriqz7GKqmKreOKrsVU+GKruOKt/Zx VZi1u54tjsWtyti2OTFXLx/YxVdxxVSZlxa2uP7eKu4/yYq3/qYq7lwxVfiqyRcWxyr9jFWs Vbb4MVWfsYq5uOLW5sWxdiq1W/kxV328VW4q7FWl+PFVmKrG+PFV/PFVnH4sVX88VdirnxVT xV2LW7FXYq5f58VW8eOKrWySV3HIod9vFXN8LYqo8skltVVFxVcvwLkULOWSSrf6mRQ1xX/Y 4qoMv7YySXYq7l/weKtcXwM3NgVrl8OLW3yxbFJm+LJMF3HAzdx44FU2X9jFW2wq1hYKnwYG akzYWCzFXM3H7eKrPhbFVTj+3+3iwWNiq3Fm38OKrWb+fFg5mxVyrirmXFXMv7eKrf8ALwNy z4cDWs44q3zySVytgZv/1PsArc8yHHXqvDFVv+RizVf8jFguxVtcVaxV3w8sWbsWCpx+DFWs Wa7jiq18VVW/yMDNa3t9vCwVU/y8izdy/nwq7l/Piq9f58VawKubCrS/8QwK7jx+3irax4tT nyTJcq4Gbm4/bwK7FXKvxYq7hi1q2SSp/wCvkULmySVzfFkUKat+3irariq5V+HFV+Krft4q uxVavxYq5/8AIxVdirbYtjuWKu5cMVdxxVfirsVXrxxVvFVNVxVerYq1wfFVRcVXr8S1xVSx Vcq/FirlXFV64q1iq1fsYqvVcWtrFW/ixVpuOKuxVbkkqn/EsizXf5GKuxV2LW5MWx37OLW5 f8jFXfYxbHcMVc3w4ta7FuXYsXYq7Frab+fFsVcVdirsVWtirsWS7Fit/wAvFV64tbWLY3xx Vri+KrOT4qqcfhxVrFXYq7/LxZOxYt8cVb4/BkmC7Iod/l4qs5YtjWKuxV2Kqn2MVWLirX2c Vb5Yq3/xLFVuKtquKqv+piq18Vd8TYqp4Vb4/DgVf9r4MKrPsfbwKvb7OKuTFXcfjxVzMv7e Ku5ft4q5m/bxV3PFVnHFV7fDirl/y8VdwxVSZckwXNkUNYqtbFsXYqt44q5VxVfxxa2uP+Xi q7/XySVuRQ3xxV3HFV/DFVPFsdirf7WFWsCt8cVaxV32sVW8cVd/r4q7jiq7FXYqtbFXfbxV byxZOVsVXNxxYuxZOVcWKm2KrsVa44Va44FVsVWriq3FVv8Al4qtbJMHJkWa/wC1iqzFrc+K uTFsd8P7eKu/axV2Ku4YVWMuBrdyxV3HivwYtjuOLW7/ACMVaXlirfHFsdxxV37OLWpYti5f 5MVd/kYq7/XxV3L+fFVuKuxV2KtK3D7eKrHxV2KuTFXYq7FVjL8WLW77f28WxfirsVUmXJMF zZFDmX9vFsWLi1rsVUvsJiq/jiqzjwXFW/jySVP/AFMVWyN/Piqrx7/t5FC/jiqxuWKqWSSu bhgZrG+1wxVtcVWv9jArbYqs44q5lwquxV2BXYqh/wDXyTBUwM3Yqo4WDkxV3FcVbxYLPsfH iq3Fm7FVzYsHMzYqtxZt4sFv2Pt4q0zYs1P7eRQ7hiq34n+PJJdwxV//1fsHmQ1OZVxYLlxZ tquLBfx+LFW/+I4q1xxVemKu4Yq74sVVFwNzmxVb9j7eFgu/a+DAzbX7GKtr9vAra4VbX9hM LBdx+LIs3f5eFWsCuxVU/wBf7GFVvDCwdx/nxVzc8VXK3/B5FC3JJVfsJkULVbnkktcsVXYq 2rZFDuPw4qvX/hMVVP8AiOKtfDiruOKrFb9vFXfbxVdirfLFscq4qvxVyYq7FXfYxVyrirue Ktcuf28VVPs4q3iq1cVVOWKuVsVWrkmC7jkWbuPxYqvZcVWcuOKrsVb+FWxVpPsYtbarirWK reL5JK9vs88ihf8A5eLY7FV6/BiqzFrdy5/BirmXFXYq5VxbHPiq/wC1irS4q2uFWmXjgVdi 1reOLYrYqtxZObFi7lirXxfbxVtVxVdi1t/6+KtYtjsVb44q7jirWKuxV2Kt/DirvixV3xvi rvhxVfhVz4Gt3DFXPirvt4tjuTPirv8AUxa1PC2NrgVzfBirX2sVdhVU48cCu/b+PFXfYxVy /wCRirmbFXYq7j/Jirl+zwxV3H9jFXLzxV3DFXf5D4q5l7piq9WxVZx/kxV3H4fgxVzfZxV3 H9vFVTFVNVxV3DFVvDJMF2RQtb7PDJJWNireRZtt/l4qv4/Hiqzlw+DFXccVb+xkmC77GRQs /ZxVev8AJiruPHFVPFsb4txxV37WKtYq7FXLiyW4qvVsWLv8vFrd+z8eKqXFX+PJJXNkWa7F Vq4quxVbxxVy4q5cVW8sWSpixUeWLWqcsVWcP2P2MWxzfyYq3hV2BVrYq2rYqsTFrdwxVUxb GvixVY+LW5WxbHK2KuxV2FXPgV3/ABPFrUl9vt5JK79nIs3Ni1u44qsZsVXsuLY5VbFVmSYL OX8+RZr2VsVXYqtb4cVd9vFVuKuxVbxxVdiqm3xYq7FVn+Riq/FV3xcsVUuWLW5vgxbHNirW KuxVazYtbk/y8VXq2KtYqsZfhxVSbJJXYq19nFVy/H9jIod8CYq7j8OKqTL3TJJU8VVMVa45 Fm7jwxVvjhVbgVbx5YVcrYq5VxVdgV2FVLliq3jhaXccVWvirSYs28WCnirbYquX7OLNYzYq 3xxYNYqs/bxZu4viwX4qpKvBcVczfyZFub48MWtY+Kv/1vsH8WZDjuxZtccWCorYquxVtsVc 2Kr/ANnFXPirsVVGXA3OXFVnHCwVmwM12BXYVdirsVb5fDgV37WKuXFW8kwdy/n+xiq7kqL/ AJeRQtySV3Hn9vIs1/L4ub4tbX7PD9vFVrZJLarirmXFW8Vc2RQu45JKquRQs+xirTL8OKqi tirWKuxV2LY7FW+OKr0xVT+ziqpirsVdwxV2Kr+XxYq3iq1eP28Vd/qYq7jiqpxxVa2SYKmR Zt/6mKtYq2y4q5cVdyX9vFrWr8GSSu5ZFCk3wLzySVTIoVF+zi2OxV3+Rirvt4q7Frd8OKru OLY7jirv9TFVTjiqmuKrsVWr/ImKqitxxa12LYsZVbFV+KrcWSmuLFy4qqNiruf7eLWv/wAv FscvLliruOKuX+TFV6YqsVsVaxVv4ft4q5WxVr7WKt8sWtfiqxVxbF/+X9jFXft/Hiqzliq/ hiq7liq1uPHFXKv7GKrI8VXphVZx4YFcy4qv4Yq7FXLzxV3HjiruP7b4q7FXK2Ku4Yq79nFX L8OKu+LFV3LFW2/nxVZxbFXcMVXMv8mKrY2/kxVTxVUxV37WKuTFXYq77eKu+xirsVWKuKtY VXYWDXH4cizczYq0v28Vbb+fCq9MDW74OGLY7FVnHFVysmLHgcmK8C3j+3iyd8PHFWsVdirs Vb44q1irfLFVn7GKruL4q3yxa2sVbXFVnHFXKv7eLY5cVcuKrsVWt/Pirv8AXxVT44quxV2K rl+H7eKrsVU8Va4/yYq3irsVW8cVW8MVWLi1r8VU8VVOGLY5lxa1n+piq1ckl3LFV3qZFDmb /g8Vdx7ft4q7ji2L8VUfjxa1rZJK5lyLN2SYLcizXLirm/4TFrU2xbF2KqfDFVy4qt48sVd+ ziruXHFXPiqzjirm/wAvFV+Kqf2cWt2LY23wYtaxeWKr1xVZkkr1yKFnH4sVUvs5JLX+vira tiq/Ioa4/Diq/j8OKodvhySXc8VXfDkUKPF8klUXAzdwwsFPjkWbmXCrmxVdiq3jgVzLhVpl wtKzFm5lxYLG5csVa4Ys28WDnxVTxVrFmu5c8WCxmxVdiqxcWaoy4sFJv58iyW8uf28klrk2 RQqYq//X+wmZDjrf2sWaovLFg7l/PiqrizWcsVbVcWC/FXYqvxZrsDN3LCwdyZsVVMihbxwt jmXFV7YFd+z8eKt8cKtd3wK5V+HCrbf5GFg5WxVUxVTVf5MVXrHirl+xirXHFW+X8mKu48MV d+ziq5lyKF/HFXfFwxVdi2Nt/PirX2cVdi1uxV2Kts2Kr1XFXL/Pi2LFX4cVXqv7GKuxV3H4 MVVMVWrirbLiq9eT/YxVpl/4PFW/i5Yq5f8Ah8Ku+DAruH7GKr+PDFXccVaxVbyxVerYtazJ JXN/kZFDk+xiqp9lcWx2Kr/2sVWfFirv2sWt328WxUxVpWxVrFk3+1ixd6eKtf5GKrsVW8sV XYta7h+xi2LsVW8cVWcv28VXsuKrcVVMVb/y8VaxVtlxVrFVR8VWccWt3LFscuKubjirWKu/ b4Yq3/kYqv4/8HhV3Fv2Pt4Fc3x/6+Ku/wAvFXK3/AYq7j/wGKu/18VcmKuxVzcnxV2KuxV3 +virsVczYq5uGKu5c/jxV2KuVsVczYq77eKr1/kxVZ/kYqv+ziqxMVdyXFWlbnirf28Vdy+D FV7LiqzhirueKrv8vFVq/wA+Ku48sVcv8+KuxVe38+Ku/ZxVZy/YxVz4q5V4tiqpiqm38mKu +HFrdirsWx3PFXN8WKu5Lirm/kxV32MVcy4qsblirWKt8fhxVrFW2xVY2Ku/y8VXYq7FW/tv iruOKuXFHA7livAs48ueLB328Wxy4q5VxVyf5GKrcVXccVW4q2y82xVZxxVtVxVpsVXYq1+z iq9sVWcufx4q6RsVWYtbsWx3DFrXNiq7FsUmXni1t4tixlxa3Mypi2NYtbvtYq38PHFVrZJL eRZu5piq3jirskwXZFmt+3irl+LFXcsVUeeKr1+P7GKrGXFXK2Kr+PJsVWYqsVcVXpirsVWN i1u/yMWxrFXYq77WKref7eLWuxV2KuxVD8cklUbFVnHnirTL/Jira/YxVvFWvixVrIodx+PC 2LXwsHccDNbirat/PgVrFVvD9jCq3/IwsF38mBmuwKh+OSYKvxfsYsFnp/t/t4qsfFWueLN3 H9jFW2/kxYL+X7GKqD/YxV2Kt8sVaxVTbA3Nq3LCwbbFgs488VbZsDc5cVf/0PsH/qZkOOv5 fz4qvXFWsVcv8mLN3+RirfHFgv8A8vFXcfjxV2KtrizRGBmpx4WC5ft4q5VwM1/xYFdy5fbx VrFXL9vFW1XCrfPCwXKuBmtXnhYO54qv4Piq5fs/BkUN4qtySWvtYq1xxVevHjwyKF/+Xiru XLFV2KreX7b4qvZfi+DFsWR/Fi1r2xVzLi2OVfixVzYta/hi2OfFXcMVd/l4q7hirlXFV3LF V2LW7FsXfsYqv44tahxxbFRf+HxV3Hliq5vt4q3xxV3H4uGKtYq38OKu5c8WtbyySW/sfbyK G/2sVXr/ACYtjueKubhirsVd9jFXcMWtUxbHYqu/1MVW4q0vHFWmxV3HFW+P7eKr+OKubFXM 2KuVf2ExV3HFXKuLW5sWxy/8Jiq/4sVdxxVzYq7liruP7GKr/wBrFrU/tYti3JMFb/XyKHJi ruGKufFVNPsYtjsVV1bh/r4qsb+T9vFXfs4q5f8AhMVd/qYq7niq9mZ8VWcMVc3xYq5fs4q7 i2Ku5fzvirsVc3xYq7/IxV3xYq5m+HFVyt8OKrfixV3L9jFXYq5mxV2KrOOKr1bj9jFV/wDl viqzj8eKrP8ALxVeq/yYq77eKr/2sVWfFirv2eGKufFXYq7niruGKu5fDzxV3PFV6qvLFW8V Wtiq1WxV3PFXKuKu54q5vj+xirsVdzxV2Ku4/wA+KrXyTBbkWbsVbXFWmVVxVd/xHFVyr8OK rOOKuVeeKtYqp8sWSpixb5Yq1iq1v58VdxxV3HFV2KreOKuXFXcsVU+WKrsVdiqn/kYqiMVU WxV3+pirmxVzNyxVtPt4q5mxV3B8Vcv8+KrHxVzN2TFXc8Vc32cWtY2Ku44q5v8ALxbHcsWt r7Hx4q2zf5eLY7/XxVpo8WtbJiqm2LYqccVXYqtXFXK3HFVPliq37eKqmKtcfixVZ9vFXMuK uxV3DFVnH4cVdyxa16YtjkxVYzfFirTfyYta1mxVfxxVa2SStX7eRQqNiqHZckldzfIoXt/P iqn/AJeKtt/kYqpN/O+SS7hirsVdx+DFVjYq1xwM13BMCuxVtfi+DCqz48Vd8eBV2LWp/wCw ySV2KqfLhiwa/axZrG4t8eKuX/h8Vb/4niwdiqzlirlxVrFVjMr4s3LirbfyYsHMq/YxVrA3 NccVf//R+wUa5kNStiwWriq7FW1xVfirX7WLNU+1iwdyyLJWwtijhYK2BmtVcCr+OKu/ZxVb 9j7eSYNr9vIs12SYLuPHAzably+DA1rvixQ5uXLnkmSw/t4qq/E/PIoWr/JkktccVXfDxyKF v+pkkqi4quX7GRQvXFVi4quxV2Kt8f20xVYn+Riq9Y/i/wAjFsa+zirfHFrXpi2OxVytirue Ku/18Vcq4q7FVy4qqLirmxVT44qv5LyTFW1X+fFVuKubJMFVl5ZFm5l5Yq79nFXfFirm+DFr dyxVr7b4qtySVZv8jIoWLi2KrYqtfFXfbxa3JirueKuX4cWxczft4qtVcVVMVaVcVbxVdyxV auLJdiruWLFTbFVTlirvt4q7jiq3/IyTBV5ZFm1ira4qvVsVWcvh+DFXNiraZJg1y4YGbuOB rcv8+LY5v8jFV7fB/r4VU8Vb44FX4qvX+TFVjfFiq9f5MVWL/Jirv8vFV7ccVd8D4qs54qvb kjYqs/yMVd9jFXL/AD4q7/LxV3H4fgxVd8XLFVvL4MVVMVU/g54q58Vd/kYq5WxVeqrxxVYm KuTFV3LFW+X7eKrOGKruPw/Biq37GKrmxVb/AKmKr/tYqsfFXYq7FXJiqz4uOKr8VXr/AD4q sX41xV1f8vFXN8OKuj44q7j8GKrmxVazYq7j+3irvi/2eKu/4nirnxV3FfsYq5lxVT5pi1ux bG+OKuXFXLirv8vFWsVb44q1irbf5GKtcsWTsWLsVbX42xV3HFWsWt2LYtX4F54qv44qs44q 5fhxV2LJ2KqfLFi7ji1u/wBfFsc2KuT7eKreXP7GKu/1MVX/AGPsYq7jzxVvFWvtYqsfFXM3 PFrdwxV3L9jFsa/Y+PFW8VWfs4tbm+PFXMv2MVd/l4tjv8vFrcq4q7lzxbFnL7GKrsVWN9vF VvL4cVa5YqrYqh+P7GKrm+1wxVvl+xiqzFXYq7niruGKu+LFVnLFXftYq1irfHFWsWtTb4ck lzZFiqYpbXFsWfD/ALLFrdxxbHKqr9jFrUvs5JKrw/byKFL7OSSs4Yq7/IxV2KuxV2Ktfb+B Mizdx/YxVzLirmbFXN8eKtYqp4quXFrXYWxSbFWm+xhaVmKtcMWbsVbxYKf2cVaxZt8cVbbF gsZmX7GKtrgblv8Ar4WDf+XiwU+P8+LN/9L7DcUzIcdy4qvVcVaxVUxV32vgxVzfz4q1wxZq qrkUNZJK7AzXNgVdirf7WKuXFXLirX2sVXMv7GSYO54q7FXZFiu5fD9vC2rVXCwRCq2RQs/a xVrjirSrwySWmxVVVVyKFTjirlxbFnLFrdyxVdiq3j/weLYuxVU4/wA+KrOWKtcnxVUxV2Ku VsVcmKub/LxVe32MVVcVQ6YquXFVT48Vc3w/bxV3HFVNcVXNkmCpkUN/6mLY7j/JiqxcVX8c Wtby55JLeRQ7/U+3iq3JJXrkUL+PBsWxyt+3irvt4q5vhxa3c8VVMWxrimKt4q7FrWti2Ki4 quxV2Kqa4sl2Ku+3ixcuKu44qv8A9TFrc2LY1irbNiruOKuZsVcrYqsbFXJ/kYq5VxVdirsV bZf2MVdxxVtV/YwquVcCuxV2KuVsVc3w4q5WxVzf8QxVerYqs+3iruLYq7/LxVezLyxVyfbx VZirmbFXc8VcrYq7FXc8Vd9vFV6fbxVYrYq7FXc8VdirlVcVWN9vCrfDCwdGrYqu/wAjAzcy 82+PAq1VyTBUVmyLN3qJiq3FXN8WKuVsVdiqxmxVey4q5VXFVyt+xiq3l+xirsVc3PFVzYqp M2Kr154q58Vdiq/7Hx4qpqzceGKqnN8VWf5GKu/ZxV3H48Vdwxa1n7OKtcnxbFvHFV/+RirW Ktt9rhirmXhiruWKtYq7FXL9vFW+WKu5d/28Vdx+LFWvg/bxVa38+Ku44Vd8eBV2KreSYqtb FkuxVzYsV2FVL08VX/Hga1Pliq7FsaZcVabFXcsVd/qYq5sVc2KrcWt2Ku+y2LY5MVWMuKu4 4tazJJXZFDbYqtbJJb5fyZFDn+xiqnxySWuD5Fmv+3iruPL48Vd9j7eKubFVNsVW/wCpiq/9 nFXfs4qsxV2KuxV2KuZcVd8P7GKu4/8AAYq7jxxa1nHFXMuKuXFWsVbX3+xi2OVv+Dxa1jfD iq7FVvwviqnkkt8UyKGsklb/AJGKrfsYq5MVXNwyKFnw4Wx3HAruOKuXjiqzlxxVTXFVbFrU mVsLYs44WC7FVnH4eeLBrhizdy44q3y5YsHYqpq3xYs2sVbbFVvx4sG8Wa1fsYq7lyxVtsWD /9P7D8cvYtLhaV2KuxVU54q7nirS/wDD5FLuGSZKmKrVxVEZFmtX+fFV/wDl4q79rFWsVa5Z Jg79nFV/L+fFVTlkUKfDJJcv+Riqpiq7n+xirXqcMihtckla2RQ2vLFV3xJiqouKrOOKuZsV X8cVWcfiTFsdxxa1/FeOLYv4YqsXFrX88WxTxVUxV2KuVcVdwxVcuKrsVaZl5Yqv+xiruX8+ Kqa4qrYqtb4vjxVzLiq/l/Pirl/nxVzNzxVrj+3i1qiYqs/axVpv8jFVTFsWcsWtfwxbHYq7 7eFXYFdirm4YtbvhxbF3LFVvJsVXLiq3hiqouLJdiruPw4sVvHFk2zYqvxYrf8jFV2KreOLW vbFsWYsl2LFtW/YxVrFXYqt+xirlxVfx5f6mFXNxwK1hVd9tfjwsGv8AUyLNerLi1rFVsLYv Zfi/nwK7FXYqv4/Diqz/AFMVd/kYq5l/YxVy/wA+Kur/AJeKr9v58VWfYxVdyxV3HFVuKuxV zfaxV2KuZcVcv2cVd+1irmZv28VXf6+KrePwYq5lxV3PFrdxySXccVXYqpquKu4/HiqtkWbX 2mxVzLiqzjxxVy8MVdzxVyYqpp9jFVTFXJiq7jiq18VczNirueKrlX9jFVv7WKruOKt/AmKr GXhirsVXr8eKuXki4qsZcVaVeGKr+OKrcVcmLW7FVnLFsbyTB3HAzaXAruWKuVcVc2KtYq7F W1xV3LFVJlxZKmLFvlirWKt/5eKtYqt+DFXft4ta7FsU+WLJUxYreOKuXFV2KrcWSnxxYubF XNiruWKq2KreOKrGXCqxv8jA1uxV2Ku5fEnPC2OwK5v+ExVzf5H2MVWLi1tYq232vjxV0mLY 5v5MVWcP28VXs37eLW1i2LWVcVWckxVey/sYqs+zirX/ABHFVqtz/wBfFV/2Pt4qsxV3Llir sVWccVcuKr8VWftYq1hVvjgVrFrdirbNiqzliq//AFMWxZy5Yta/4uWLYpcckwWM3DFV37fP IoWquSS0uKreL/7PFV2RQpccklfwxVa328izdirfHFVj/wCXirm+HCq7AqjxxVrjz+PJMGuO KubFV3Fl64sFnDFXcuWKu4Yqs4/Fiq3Fm1yxYLsVdy+LFm1iqzlgZqmFpf/U+xGZDjt/5GKr 8VU8VVF+HFXc8VVeL4qsZvhxZt4quwM2m+D7GBVaP4MVWfbxVev8+Kt8sKtLgVyt+xireSYL vg55FC5cVW8ckldx4/YyKGuXxZJKqy8sihTySVTFV7LkUOZeWKtYq7FsbbFrczYtjWLW2q8c Wx3+XirWKqj4q7/UxV3DFXKv7GKuTFWl+D48VVcVU8VX/YTFWlX+fFVRm+HhirSqvH/LxVaq 4qvbFXZJgvX4GyLN37XBMVcuKrP9TFrXJ9jFVT/UxVYy/wDB4q7liqzJJVuGRZuTFXfbwq5M DW74+eLY5WxV328WtyquKqmLYt/y8Vd/qYqqNiq7FVuLJdixU+WLJc2LFzYquxV2KuxVtcVa xV2Kuxa1RMVWKv7eKrV/kySV/wDxHIs2uPw4q1wTFVR8VU8VVlX4cVWt/l4q7jzbFXJirl/k xV2KufFXL8OKuX+R8Vdy+PFXPirsVc+KuxVy/Firvj+xiq/j3/bxVZwxVpm4Yq2+Ku+LFV3H FW+D4q5lxVpsVb4PirmVvt4q0q/DirarireKtcvi4Yqvb+TFVi8cVbxVdx+LFVnL+fFXcV/2 GKrf2skwa4YGa1vs4WDuPwYquyKHfDiq7ji2LeK4q58VX8eGKu/axVZ+1iruS8cVc3wNiq/7 WKrMVVMVdiqniq/9rFVjcMVd/qYq5l5fYxV2LW5mxVR44tjskwX8sizdyxVrFVThi1rGxVzN 8WLY5uOKubFV74qp4q7FVPliyVMWLbYqsZsVXri1rGxbHcf5MVc3LFXccVd/qYq7jirv8hMV diyXYsVHji1u5Yti7FVvLFV2KuxVbxxVRxa3NxxVUVl+3i2O5ft4q79rFXKuKrOPD48VWZJg 3xxVdxyLNy8sVUuOSYLv2Mizcy4q5vh/bxa3Lxwtiz7WBXcv5PsYq1/xLFV2KtM3xfHiqzhi rlXFXYq5fixV37OKufFVnxYta/hiqz9rFsX4qo/s/Bi1r2XFsU/ifFrbT/LxVfxxbFnHFrUv tZJKquRQtxVrl8OKqS8f2Mklv7TZFDeKrXySVqqvLIs25FXFXK38mKtfZxVa2FV2KrW+HAqz jhVY2FguxVZiwXccVW88VcmKrGXFWuWLNvjiwc2KrfsYG5avw4WC9cVW8cWD/9X7EZkOO77W KuxVU4Yq74cVcq8MVb44s12Ktcm+3iqryyKF2LY7FV3LCrXHArvhxVrFVRpP58VU8KqnL48D W39rJJXLyT7GRQ1kku/1Mih2SSqLx+3kULft/BihUxS7FXMvNcVU/wDXySVTIoWriq9VxbGs VdirsVcn2MVbZcVaxVUxVzN2TFV/H4sVWc8VVMVXcuOKu5ccVU1b9vFVTj/Pirmb+fFXckxa 17Yti/niqny/kxa1uSSvXIod/qYq7/LxVZkkr2+PIoX4tizliq/l+2+Ku48sWt37OKuxVcuL YuxVauKubFV2Kts2LJvFXcsWLlbFVPjiqpxxVdirsVd9rFXfZxVvj+xirlxVy+/2MWtplXji 2OxVcuFVnLCwbyLNUZsVdwxVerYq1yxVa+Ku4tirvhxVyYq7niq5cVWvirm/yMVdiruXwYq7 7eKu5cW54q5mxVdyxVa3w4q5uGKr1XFVnDFXcWxVzfaxVevLFWmxVU/y8VWceeKr1jxVT44q qN8OKqfHFW/tfbTFW8VW8cVVsVdiqkv8mKu4/sYqv4piqmuKrsVdiq7j8OKqa4q39nFW8VWs vHFVRcVWMuKrGX9sYq5MVX/tYq1/kYqt+P7eKuxVr4Pt4q2vw4q74ePwYq7nirlX4sVdwxVU xVa2KreX7eKu54q7nirkxVZy+Hhi1uVv58VcrYq1yZ8Vb44tjuWKuZcWtrFsb+w+KtfZxVtm xVrFW5P8vFXL/JirlxVrFVir+3ijgVOWK8CxWxS7lyxV37GKqfLFVRcVc/8AkYquxVaq8sVd 8eKub+TFrWN9jFXM2LY0uKt/axV3H+fFVmKtNxTFrbxbHYq5l7pirnxV32MVc0eKqTZJg1ir uORQv4/z4tjuWKrGxVZ+1ireKqmFVPArsVdiq3liq7FVNvtYq7hiqn9rFVRftYq6NcVWNHir mxVfzxVY2KubFrcuKrPhdsVXfaxVb+z8eLYv/wAjFrWeorYtik3LJMHf5CYqq8sihZkmKk38 +LNzfaxVzfDirm/yMVczf8HirmwM2l/y8CrOOFXcsVb5JirX2MCrGwq5sVW8eGFg3iqm3+Ri rv2sVbxYOTFVNsWbvsPiqxv58VcrfDirlxVdir//1vsT/qZkOOsT/LxVfxxVfirsVbXFm3+1 iqqrYGa7Aq1W/bxVT5YqrfaxVtv8vFVjN/Jiq7FV2SYLuXHIoW/bySVTi37GRQ0q5JLf+RkU OySVTl/PkUKeSS5f5MixXLiq5cUu4pirmbFXKvL7GKu5ccVX8cWxrFXYq7FXYqqYqsVcVX8M VdwxVfx/nxVpcVXYqt44qqfY+3iq7FVLimKquFVNWwsFX/IyLN3LFXcsVdxxa2k+xirTZJKr kUOVcWx2KuxV3DFV/wAWKu5fDiqz4sVdwxVUxV2KuxV2KqfDFrVlxbHccVW/sYslTFitj/nf FrXYti3jiq7FXYq7FW+WKu+w+KuWPFXf6mKu5cP9fFrWccWxdirsVdiqozft4q7/AC8Vdirs VdirkxV2Ku54q7FXYq5vixVfy/kxVY+KrUyTBevHFVjfFiq70/28izc0fw4ta7ji2KnP9jFV nL4sVWKvw88VdxX9vFXPiq9WxVe3w4qptiqpy/Y/bxV3wYqsb4MVX/D+xiqz9rFWuWKqjNir v28VcuKu5/t4qsjxVf8AYXFV2KqStirub4qq4qtVsVd8eKuX/UxVdiq37eKu5YquxVRXFXKv 7GKuZfhxV3HFW+D4qs4/BiruPxcMVdybFXcuWKu4Yq5vtYqvVsVWcMVd8WKqmKqaYq58VXq2 KrG+1irnxV32vsYq7j/weKrUyTBrl/JkWa//ACMWtZxxVY2LYv48MVaxVauKr1bFXcf2MVax V2Kub7eKt/5eKrGbFXMuKu/YxVf9nCqxsCrP2cVVcVW/YxVpmxZNr8OLF3x4tanxxbFvH4eG Krv8vFXNirv9fFW2XFVj4q7FXYq77XPFXKuKuZcKqXLCwVeGRQpN/l5JLWKubAzd8eBrcy4t jmbFVPjiqthVSZcCuZV/bxVvFWub4qs4Yq5vhxV3L/g8VU/tYqqYq5WxV2KqeLW22LY7/Lxa 1nHFXccVXL/JirsVdiqzjy+3irbR4tjlbji1reX8+SSs45Fi02SZLWXFV/2sVbxVTfFXYqty LNrjkmDeBm7FXYqt+3gVbhVdhYLP8vAzWt/kYWCxv+HxVU+ziwdy54qh8Wap8OKrFxV3H4cV WNirlxV//9f7Et/PmQ47lXFWsVVExV3w4quVsWa7/LwM2lwKqDj/ALDCrlX/AC8Cu+3hVdir sCrl/nyTBrly+3kUK37WKqXDFDuGSZL2Xniq9sVWcf8AhsVVW5ZFDv28Vdx/kxVTXFVbFVP7 eSSu/wAjIoXYtjvtYqp8P28kwVf8vIoX/Di2LG+PFV+KuTFXc8Vd+1irkxVr4P5sVX8cVXYq p4q5fhxVWVsVWfs4qvZcWt3Fv2MWxey/yYqs+DFV7ccKrPt4Fb45Jg1x+HIs3MuKq2LW58Wx 3DFXf6+KuxV2LW7hirl/y8WxdxxVdiqmq4qqYq7FXcP2MWTm4/YxVdyxYrcVXfYxVZ9j48VX tiq7FW+PDFVnJMVcuKr/ALXwfsYq79rCrv2sCtYq23JMWtvjhbFNsCq2LW58Wx32MVX/ALWK tKv8+KrXxVyYqvf7eKrGXFVjYqq8cVb5fz4qs4Yqu44qpsuSYL/2sVaXnkUKmKruOLY7jiqm 2Kt/E2Ku/axVfx/kxVR/axVUxVr9nFV/+viq3FW1k54qs5YqqKuKqfHFVRlxVY3wYqvb+TFV uKreOKqnLi2KuXFVuKtLybFV6rirlX4cVWcHxV32sVX/AOpiq7FVJuWKu5cPjxVf8SYquxVR Vf28VbblireKreWKt8P2/wBvFV7N8WKqbK2KrePBsVdx5YqqYqp4q7FXem+KuxV2Ku/yMVdy XFXPiruLccVcv8+KqmKtL7/bxVZwxVyYq7jyxa3cvjxVTwtjbLgVf8WFVjLgVyr8OKu9Thir vhxVrFW+OKtYq2y4q1irsVWtiq7FVvx4q7/UxVzYq7liq3jiyXYqtxYuxVTb+TFV/H+fFXfY +PFWlb9jFW1ZfsYqs+yvD9vFXcv+AxV2KuxV2Kr2/nTFUN+3i1t8fiySW8ihUxVR+xi2L/8A LxV37WKrGXFrW8UySXZFm0q4qv4piq3FVN8VXs2Kt4qp8eWKufFXYq7niqniratirWKt8sWt zNiqxVxVzN8WKrsVWs2KrsVUuP8AJirf+pkkrmyKFLkmSS3iq3j8GRQ3xVPt5JKzFXMzYqp8 sizX/s4qs/YxVzLhVU5YqprgVzYqo8ckwd/kYq7liq3nirsVdzxVviuLBY2KtccWa/hiqzFg 2y/Fir//0PsRmQ47fw4qvxV2Ku5fBiq/lkWS7C2Ln/yMCu/y8Vd+1zwquwKt44qvVcVXquFV vxYWDsVdkWLskyXNirmxVvj8P+pirl+DFV2LBrIpXLkmSr8WRQp/F9jFW+WKrsVbbFXLi2L/ ALeKrOWKu+HFV6Yq58VWK2Kr8VcmKr+PxYq1yxVzYquxVbxxVU/y8KubFXfb+DAq9fjxa3M2 LY77Hx4qs/1MVbZckwXLkUOXFVL7bZJKr+zkUL2+BcWxdxxVamLWs44quVeGLYqK2Kt4q0y4 q3iq1cVdxxVUbhxxV3H+TFV2KrVbFV/H+fCqzjgVdira4qsVsKrl+3gVUVf9jiqxV54tbvt/ 6mKreXw5JK7i/wDJkWbv8vFXfs/Hira4VXcfjxVTwKqM2KuxV2Ku5NiruTYq7FXJirl+1iru eKu/18VXquKr+WKrP2sVd+1iq/8Ay8VXYq7FVHliqtiqniqpiq1mxVY32MVa+Hl8GKtquKtc sVVOPLFXNyxVYy4q77aYqv8A8jFV2KrW/kxVy4qs4/z4qvZuOKrGbFXSNiruPDFXftYqv44q 7liqmuKq2KqXL4sVa+Lj8eKt8uLYq79nFW8VXKuKu5YqsZcVX/Hirv2ueKrPibFXM2Kr+KYq txVpvjxVSfJMF1P8jAzW/wCvhYKeKojjkWbf7OKrOGKuxVf9nFVnPFXL8OKu48sVcrfDirv+ J4qvZsVbxVpfjxVZx/bxVzLi1qeLY3y54qtX48kwVeGRQpfs5JK79rIs2sVdirXBMWTeLFtW +LFVnx4quxVby5fbxVdirbYq5sWtrFsdiq3jirmXFVnH+TFW8VXccWtT44tip9jFVNcVW4tb uGKu4Yq7hiruPHFsaZuGKrVxa3KuKuXFVmSSv5ZFDvi5YtjWFXYFWq2FV2BVrLirv2MVWM2K tLiruWKreGKr+WFXMuBVDFVTFXcMVU8VVMVU8VbVsVc2LW1iq1lXlirmb+fFV/7WLYs+PFrU viySW1Zcihrjw+PJJWPiqxsVXs3PFXYq7kuKuZsVab4Pt5Fm1irXFMKtf5GKuZcCubFVuFVu FgqM2Bmh3wsHN/PirueKr+OLBbwxVSxZuxVV4/sPiwWL/kYq/wD/0fsT8LZkOO7jiq7Fm5ee Kr1XFXJ9vFV3Ll9jAza5YFVOWFXKuKr1wK1irsKqjfB9vA1rckl2Ku4YqvVVxVfkUKbZJKqy rkUN5JKzFgv45Fkvb3+3i2LGxa12LYtXFrczYqvVcVa/b54tiomKu+P7GKrGxVfybFVPFVTF XN/kYq7niq7/AC8VW8v2MVVMVXLiruOKu/1MVXr8GKrP9TFV6tyb48VWL8OFV32sDWtySVT/ AIjkULeX8+Kqn+piqxmxVev2fgxbFJVyTBVyKHYq7l8eKuVsVcrYtityxVTbFXccVXYquxZL sWK3Fk5lbFi7jiruXHCq9mbArWKuxV2KtrirlxV3LFXccVdyxVrFVRm54tbueLY7niqxmxVf /qYq7FVPFVT7eKruWKtq3w8MVU/g+3ireKuVcVdiqpiq1cVc2Ktp/kfYxVvFVy4q5lxVY3wY q0uKr+PH7GKt/s/y4qp8sVVGX4sVWfb+PFV6/Diqm2KqjfDirn/yMVXYqpftYqvb7fwYqp/6 +KtyYqv9Ph8eKu/yMVdx+H4MVc3FsVcuKrsVUVxVUbFXccVd+3iqzl+w+Kt4quXFVPlirb/b xVr/AC8VbVcVXquKrGbhiq9vi+3iqzj+3iq/l/JiqxvgxVvFWlXFV64q77eKu44qs+x9vFV6 4qprireLHgW8RivA1y+PFkvXly+DFVnw4qs/ZxVfiq5sVb5c8VWcfgxVcrfDiq1MVVMVa/yP 28VWYq7l+3+3irvsYtaxVxbHfs4q79rFXMvLCrmXhgVrFXYqu/4jiq7jyxVZx/nxVrFXfaxV 2KrcWTm+LFi7/XxVdirsVdiqniq7/LxVZ9nFrX8sWxT/AMjFrb+HFsczYqsxV2KuVsWt3DFX cv58Vcv/AAmLY5uP7eKqP2PgxVb8KZJgqcXyLN2KrWb+TFV6s2KubFVJckwXKv8APgZrGXAq zhiq7jiruOKu44q3+zirXLFVuKuxV37WKuxVzfZ+PFVnL9tMVaxV2KrV+D/Uxa2viTFV+Kt8 fixbHMv8+LWsbFXZJKk3wfbxVr4uOKtq2KrMVXJkULOOLY1irsVWN9vFW/8AUwq2q88LBpsD Ny4FWfawq77OKrVVv28LBdx+HAzUsLBr9j4MVbxVvFg5W4tiqnirWLNtcVf/0vsT/r5kOO7/ AFMVXYs1+38mKtccVXYq3yX7f8+Bm2y8fgTCwVMDNU4/Hiq3liq3FV2FguTIoWs3Fcklx/bx VEYqpfFirXLFVb/IyKFPFCoq4pWqv7GSSu+PIocuKqn/ABLFWuWKtYq7FW1xbGsVc328VVHx VyYq7nirueKuxVd/qYqtxVdyxVv7OKr+OKrsVdiq1l+3iq9VXFXen/PiruP8mKrOXHFW2bJM FXIoWccVW8cklVTIodzxbHf6mLW7iuLYs/y8Wtfi2L1XFW8VWtiq7FVq4qqLiq3jxxZKmLFb xxVdiq3jiq/4m+PFXcsVa+zirfLhirWKuxVrlkmDa8cihtlbC2NYFbbFWsKqmBXPiqzjiruO Kr+GKuXhiq7/ACMVW8MVd+1iruP7eKu48cVab4PgxVtfixVf9rFVi/zviq/9j48Vdx/y8Vd+ 3/kYq5v9TFV7Yqpriqp9jFWm+L4MVaxVc2KrF+BcVcq4qq4qp4qu+J8VdxxVytirlxV37GKu ZcVWcW5Yqq4qtZmxV3HFV2KqeKrv8jFXccVWNxxVpsVVFVsVWKq8sVVcVUWVcVXYq7FVrYqr Yqt44qp8cVVF5Yq7l/JirvsfBiq3FV0eKrsVWq2KrsVUWVcVbVuH2MVX/wCWmKu/y8Vc2KuZ sVU/8jFVR/8AIxVR4Yq7hiruPx4q7FXcmxVdxxVa32cVcy4q7FXN8WKub/LxV3L/AIPFVyt+ xiq37GKrOOKuVeeKr0xV3w4VU8VdgV2KtcckwX/8RyLNrjzxVyt+xirlxV3HFXcsVcuKuZfh xVZ+xiq7FVvLFXYsncsWLmXFXcsVc2KrGXFWlxVb+zzxV3xYtapi2KH7OLWv4Yq7hi2O/wCI Yq58WtS45JLeRQ3yxVfzxVRXFsXqv7D4VWNgVdhVbyxVY/28CrMVXcsVXYq0zYqs4/yYqv8A 2cVUWxa1+LY79nFVP7WKqnPFVn7WLW5mxbGsVW8sWt3HFXM2Ku4/z4tjv28WtSk+H7GSS3ir X7OKrOGKqvw5FCz4VxbFv2MkwXcebYGaxV4fYwK74cVc3+Xirf8AxHCq3FVHjgVU4/sPiqzj hVzYqq4qhWbCwc3+Riq/4cVW4sHYq7hiqmvHFms5Yq//0/sTyzIcdfwxVz4q1wyKVy5Jkv5c MizX/wCpirlwq2q/yYWDS/YyLNdirfL7GKt8VyTBevHlirlbFVmKr1Xn8eKq+RQ7FVDl+3kk t8fh+PIoVOWKr2bl9jFscuKu44tbuOKrMULeOSZKq5FmvxVTxVtf58VX88VdwxV2Ku4tirsV cmKrlxV3HFXNirlX4sVVGbFVNcVXr9vFW/8AIxVf/r4q0328Vb5Yq038+LW79vhirar+xiq/ l/P9vFsdyX9vFXM3xYta7li2N/b+DFVnDFV/2cVa5Yq7/XxVdirsVdirsVXcsVcuKreOLJUx YruOFVuBW+WKuZv28Vd8aYq5W/YxV3+Rirv8jFXNxxVrFrVMVaVsWXA3iycrYq7lwbFVjNiq /wCHFXcuOKruOKrftfBirpF/YxV32WxV3DFXf5eKu+z8GKtLHzxVU9PhirvhZsVdx+LFWlxV U44q5VxVT+JWxVv4cVdyXlirl44qv+F8Vd/kYquxVb9vFXccVU/9fFXLirmX+fFVT/UxV3x4 q5lxVT5YqqccVdxxVeuKtYq3x/YxVYq4quxVbxxVzN8XDFXccVdyTFXfb+DFV2KreOKu9PFX ccVdyxVy/YxVzMuKrsVdirsVWrirlX4sVU1xVU/bxVbiq1sVVGxVbiq7/IxVzfyYqpqv7eKq 2KqeKrWX9vFVvH+TFVuSYOVsVVFyLNaq/Diqpiqm+Ku4riq/7fwYqsxV2KqmKqfL4MVc+KrO OKtYqrNiq3/IxVZ/kYtbm/kxbGsVb5YqsblirmXFV/HFXepzxVrFXYq5ft4q3xxVrFVPFVTF XYqt4fsYq7Fk79jFi5lxVbirsVaZsVa44qtZcVdirsWt32MVdiqky5JLWKr+ORQ5sVW8cklY y/z4qiMizWccVWM3w4q5cVU2xVdiq1cVbVsVaj/kxVv7aYqsxVUxVQXFV/DFXfYxV2KqeKu+ zi1qjfDi2KeLWp8cklc2RQ5cVcrYq5sVc3HFVJWySVFsVRHH+TIoUuGSS5lxVytirmwM1P8A bwKuxV3BMVbZea4qpNkmC5VyLN3+Xi1reOSSt+39jFg7Fm5VxYKatizc+Kr2xYO44qtX4sVU sil//9T7GKuZDjrlxVbzxVrhkUqvHC2t4FXf6mFXMuKubFVb9nFXfbxVbhYLmXhkULWXJJd/ kYq7j8eKojjkUKStxySVXjyyKFJWySVVVyKF2Ku5Pi2LeWLWuxVarYqv+LFXLiruOLYv5ccV d9jFXJirvixV2Ku4/sYqqYqpquKuX7WKruWKtrxxVVxVtWxVZyxV3/EcVdw/YxV3J8Kr+WBX cvi+PFVv+RkmC7/LyKHLxxbHccWtzfB/r4ti/wCxirsVdi1u/axbF7LirXHFW1jxVpcVXYtb sWxcq4qt44snLiq7FWlXFW/h/wBlixXcXxV2KuxVa2Kr+PPCq/7GBrU+P7eKqir+2cWx2Kux Vz4q5mxVZyXliq74PsYqsxV2KqmKu+3iruP7eKuxV3DFXYqv4/FiqxftYquVVxVzYq5cVXYq t44q7jiqtiq37GKrsVWq2Ku5YqtxVcrYqs48MVX8P2MVXYqpfZxVVxVb/l4q5lxVyriq34MW S5mxYrsVdiruWLJ2LFtcVaxVbxxVzfDiq/j+3iruX7eKtYqpK2Kq3L+TFWsVWquKuZcVc3HF XLiq7FW1XFVmLJzYsXK3w/HirlXliq7FVvHFXKvw4qtxVdxxVdiqkzcMVVcVUuXw4qvb4P8A UxVy4q5fhxVZxZumKr+Xw/BiqizYqrcvixVT/wAjFW1+zwxVZiq5cVbVVb48VWcMVc3w4q5Z OeKub4cVXsuKrMVd+1irsVd9lsVdxbFXcmxVUxVT+3iqxv8ALxVtcKrnwNbmXFVn7WLY7j+x irWKtrirWKttiqz/AC8Vczf8Birv8jFV2KuxVT5YslzLixU1xVdirsVdiq1sVcy/t4q5V5Yq tfFrdx44q70+GLYpM2SYNsy/byLN3BMWtTbJJXriqrkWanwTFW/2cVaxVb9v4MVW4q1x/kxV vFVrM2Kqit8WKqfHFV2KrVxVSVuGKr3xVYy4qv8At4q5mxVZyxVy4q1i1rf28Vd+xirvi4Yq vX48VUW9/sYq7JMWsWbfxJ9jIoWt8eSSs/yMVdzxVZ+zirStkWa7FXYq3yxVrCq34v8AgcCr /wDLxa1Dj/PkmKpizUlxYLsVUv2cWbmVcVVMVU1bFVRm5YsGuWKv/9X7Fq2ZDU7FV3LFV3xc fgxYLsDcqYFW8sVX/wCphVZ+3gVeq8cVb+wvDJMHYq3+x8GRQ1kkqqt/s8ihZ/wmSS2zYqvX FV2RYuyTJ3LlkUOX4cVXq2KtcvhxVbxxVzYqv4/Di2O44q5v8jFV/wBvFXPirsVdzxVUxV2K tL9r48VWf5GKrmxVUX4cVdHirl+xirmxVyti1u4q2LY79jFXccKu4ft4q5W5YFX8uHwYtbWK tLkkruKr0yLNfwxV3JcVc+LW7FVTFsW8cVXYqp4qqYqqYqpriyXceS4sV2KrVxVdirsVb44q v5fsYqo8sVXYq77WKtt8eLWvXni2Kf2cVb44qv4Yq5MVdwxVzfZxVy/DiruPLFXPiqpiqmmK uVeeKuxV3+virm+D7eKu5csVaXl9jFV/+Xixg3x54snKuKrP2sVVmXFXfHiqxuWKt4qt44qq cf5MVdyxV3+pirm5Yq5v58VXYqs5PiratiruWKu/YxVYq4qvXFXLirv8jFV/LFVnHlirmxVf yxVZ8GKrsVW4snf6+LFzNiq7FXYq3/lpirWKts3HFWsVWsrfbxV3+virvsfHiq7FVrLirvgx Vy4q5f58VdxxVbiqpiq1P8vFVPliqoy/Fiqzir4q3irSrirlbFV64qs5c8Vc32MVVcVU8VXN iqnyxV3HFV2KtftYqpcMkwa+HlkUL/ixbHMvdMVdwxVzcMVdirX2v9TFW2X9jFXcMVdiruPx 4q58VXrxxVYvDFXfDirmbFrUckleytkWbmXFW+OFVuBVv7GKr1xV3+RirWKuxV2KrV5Yq7jy xVdhVT44GS7FVNcWLbNirlXFVmKr1+xirXHFVy4slvHFitZsVd/kYtbkxbFPFrb/ANTFXcfi wti9MDWsZcVa5Nx+DFsVMVWftYqs4suKubFXccVdxxVTk/kxV3HFVqYq58VVMVU+eKub4cVd irlX+TFVnxYq7jiq9mxVZ8WLW1irsVdirsVW/wCRiqnkktKvLFXLJirlbFXM2RYrOeSZO/18 Va/1MDNzf5eBXcsVaxVa2KrsVdiqnhVdhYKeKt8sDNTwtLuGKrmbn/r4s3L7/bxVazYsHYq/ /9b7Fs2ZDU7/AFMVXr9jFV2LBe2BucrfsYFdy/kwq79jAq/4cVX4qtb7PPJMFy4qt/ayLFU4 rxxSqNiqirft5JK7FVTFV3H+fIoU+OKFy4pdw/bxVy4q7jiq/lirlXFWl+3i2N8sVa5Piqoq 4q7FVPFrVPixbFTFWvt/bxVpcVb+1irXLFXcsVVP2uGKqa4qrYVW/wCwwKv5fDiq3jkmDWKu xVcv28ihpsklc2RQ1iqpwxbHYqsXFrV8Wxpvjwq5lwKq4qotiq7FVyrirlxVdirsVdirfp4q sVfhxVdirbYqv/y8VWccVa4virsVdi1r274soNviyU/tYqqYquXFVrfEvPFXYqv4/Fiqznir v2cVc+Kr2+PFVn28Vd+1irsVcv2fgxV37OKrskwcrNkUwb+LFk5VxVvFWlXFVXFVqriqnxxV UX4cVcuKrsVW8f8AgMVU1xVfyfFW/wDXxV37eKu44q7jirlXFV2KrVxV2LJ37eLFyr8PPFXf t4q7liq7FXccWTbYsViriq/4cVcy4q5sVaxVa2KrvtYqtVcVcv8APirv9f7GKu+F8VXYqtT/ AC8Vd9vFV2Kref7eKuxZLsWLsVW/bxVdirsVW8eWKuXFV2KqS/Biq/48VW4qu/yExVZy+HFX cWXriq9VxVbirX2sVcrYq7j/ACYqq4qpM2KuZsVWcMVd/qYq5fhxVzN+3iq9Vbjiqz7eKuxV 32MVdirl/n54q7hirlXFXL8OKu48sVdx4Nirvt4q7FrU8Wxzfz4tbsLYqcMDWs/18VWMv7eL Yv44q1iratirWKuxVa2KuVuWKuxZOxVdixUf8vFW/h/bfFra5YtjuWKrsVW8cVW8v+DxVT/Y 54qqYqsVcWt3+pirv2sVcuKuZmxV3+vi2NYq7FXfH/sMVdiq3jxxV3+RirvhZcVXYqh8VXqu Kt4qp4q7FXYq7nirueKrP2cWtfi2Kf2sVU+OSYLmXIoXrirWKrePxYq7jiql8H7GSS5mxV3w 4q7liwdx4Ys2vsYGbmbFVjKv7eKuXAruXDFXKuKtYVWtgVbirXHCrl+PFWsLBZwxYO+HFV+L NT/Z/wAvFW8WDnxV/9f7GZkOO7i2Kr8WbmyLNUXCra4WDeBm2zYFdyxVtMkwXc8ihby/YySV zYqvVv8AgMihZ/kZJLfxYq22RQqcvh4YquxVb9jFV/LFVif5eKrsWx2LWtXFV6s2KtYtjsVV OGKu4/BirsVU8VV/2+eKt4qpsuKuTFV7LzxV37WKtccVc2Kqnw/t4quxVb/qYq74nxVcsf8A PiruX8mLW3xxV3H4f5sVa5fFira4qvTFsdybFXJirl48eGKr+P8APirl4pireKuxVarNiqti qm2LJUxYuxVb6eKu44quxV2Kt8sVXquKqeKt/DirlxVfi1u/18Wxz4q7/UxV2KuX4sVdirvs Yq7FV/xYqsXl+xiq5VbFVrL/AJGKu5csVXquKrOPHFXYq5V+HFrXccVWpi2KmKuxVd9vFVnp 4q79rFXf5aYq5VxVVxVb+xiq3FV3xL9jFXMrYquxVtVxVY2Kr1/kxVzYq1iq34MVdxxV3JWx V3FeeKrsVdira4q7jirWKrWxVdxxZLVxYrsVW4sl2LFa2KrsVdirsVdiq348VXYqt/bxV3wY qv44qsbFV2KuxVa2Kr+WKtYqt4/Firvg/a+3irmxVdiq3jirmxV3HFXKuKqfHFXKvw4q3+3w xVr/AF8Vb4pi1r+WLYsVvh4YqvXFXP8A5GKrPs4q5ff7eKuk+z8eKu/Y+DFVnPFXYq5V4twx Vev8+KrOGKu4Yq7/ACMVdwxVzfD/AJWKub+fFXMzYqv+1iqi2Kr8VcmKu54qo+nxxVe2Kr+X wYVU8Vb+HArlXFVPk+Kr/s4q2uKuZcVa5ft4tbfLFVjNi2OXFV2KrfsYquxVR/4li1rsWxTx VdyxVU5Yqovi1qXHJJVf2/jyLN3Lliq3/iOLW0uKuVsVcuKrMkl3qZFC/wCH7H8mLYs44q7l iqmuKu+Hliqoq4qs4Pirm5Yq5f8ALxVYmKuxVyYq79rFXYq58VWcsWt3HFsdx+LFWsVdi1rW xVdiq3/LxVZ/lvirUa/z4q1x55JLk+3irTYqt4/sYqufIoW/s5JKniq/jwyLN3H9vFVn2MVW rkmC74MizU2xVdhVbhYOxVzNiwU8WaxcVXt9nFVP7WKv/9D7GcVTMhx1y8uWLNpsVVuORZqi 4VW4qt+PAq/7WFW+GFg5MVX8VVcVcq8sVXL/AJeRQt5YoXfaxS7j+xiqriq1cVXYq22KrG/n xVzccVdyxVzfYxVdirsWxvlwxVy8sVXviqnirfL+fFV+Kr2+DFXfawqs5NgVUxVTxVW+xiru XHFVrNkmCr/r5Fm7liqxP2MVX/Fi1uVcVd8WKu/18VaXjiqo3+Ri2OX7OKu+H9vCrv8AXwK7 4sWty/Di2LmxV3LFW1/kxVVxV2KreOKrsVU+OLJ2LFVVeeFWsCt8cVd8WKtYq3yxV32VxVrF VRMWt3+pi2OxV3DFXcf58Vcv2sVdwxVzL+xirv8ALxVdxxVb+zirv9TFXPirlXFXKvxYq7ni q7/XxVay90xVyr3fFrXsuLY1/r4q5cVVFxVYzYqv+DFV2KqStiq/n+xiq7FVrM3HFXM2Ku/1 /ixV3/CYq5lVMVdx+HFV2KuxVtcVWNiqmuKq2KuxV3+XiyW4quxYuxV2Kts2KrGbFV2KrcWT sVXYsWuX8+LJcuLFZyVsVXcsWTa4sVnLFW2bFk3yxVauLF32MVXYqt/1MVXYq7FVrLiq7FW+ XPFVjYq7jirm+HFXK3xYqs+39vFVXFVrNxxV3+XiruKfYxV3w/YxV3+XiqnxxVvg+Kt4quXF Xf6+KrH+3iq/4fsYquxV2KuxVby+HhiruOKqfLFV2KtMuKrOPLFXYqvb4MVWJirl/wAjFVnL FV7LirvtfHirq/5eKuX7WKub4sVdwxV3p/FiqxsVd/l4q2q5Jgu+JPjyLNTxVtVxVzNirWKt 8cVa+1iq1sWtT44titirsVW4sl2LFTxa1vLFsXYq7FVPhi1uxbHJiruTYqpr/l4tbfLFXf5G LY5f5MVX4tajkkrsizdirsVUk+3iq/48Vd+3irmXFVuKrVxVzYquxVT+3irv2sVcmKuVcVU/ 2+GKqmKrGxVzLirv2uf7GLWpcuWSSq/DkUObFVjLirvjxVTySV3LFVrK2RQtb4cVW8v2Mkl2 KrOXPFVzNkWbWKuxVrl/JkmDeRZrVxVYzYVbxVrC0uxVYzft4s3Lx+3iq1MVVMVf/9H7GZkO OqYqtVcWarx+L4MizdkmDl+38eBmvXArWKqnPFVvprxyTBfx/nxVe2KrGZlxV32cVaXFVbFV 2RQtXFXLirvhfFscuLWuxVbxxVf+1i2NYtbbLi2Ob+fFWsVVP9fFXJiqxWxVVXFV2KrWxVdi qniqsq4q5WxVyriq/lirWKuxVy/bxVa3w4qv44tazJJX/wCRkUL+X8mLY5ftYq5WxVyYqu44 q2y4q3irsVa+HFW8WtpVxbG8VVMVdiq3l8WKu4ft4tbuWLY7liqtiqniq3Fkv44tKxv58WxW xa3Ji2OxV3+piruGKu4smKu/1MVX8fi/lxVZiruTYqv/AMtMVWM3ZMVdwxV2Kub4sVX/AGmx VSyTBdxbAzW4WCr8ORZu488VXqvHFV2KrVZeWKrF+NcVdx+LFWuOKt/B9vFV/wDr4qptiqpy xVYvx4qv44quxVbyxVdirfLFWsVbXFWsVW8cVdiyd9jFi7l8OKr2xV3LFWsVWquKubFV/LFV nLFVzYsnYsXYq3xxVrFVuLJdixW4sl/HFi5fgxVy4qsxZLsWLsVbbFVnLliq9sVcy4qs/bxV 32MVX/6+KrOPHFV2Krf+I4qv+x/qYqs5Yq7jyxVy4q7jiq7FVrYqs+x8eKr2xVYv2fjxVzfB iq5fh+DFVvxYq79rFXL9jFWv8jFVRcVW4qt4/sJiqorYqtxVrlwxa2uOKqeSS5MVXc8izXv/ AJH28VWYq7k/+wxV3w/sYq5vtYq5WxVy8v2MVc+KrlxVbirv8vFXcMWtS/1MklV/ZyKFi8cW xzNiruOKrG+LFV2KuX+TFrb5YqoNx/YxbFTjirsWTsVXYsVJVxa28Wx2KrWxVa3JvsYq5lbF XYq5lwqs44GtrFW+OKrMklczcV4JkWbfHhirv2cVWNiruPw4q3xTCrXLArvjxVdiqniq1V/k xVvm+KtcsVW4qs/ZxVfzxV2KrFxVfiqxm4fHiqxlxa16tiqxuX7eKu/yMVXYqtb+TFVL9jhk kttx5ZFDTfHkktty45FDf+W+KqXPJJXc8ihZxxbHcsVawq38PHFWsVWqvw4FXYVU8VW4WDsV aZV+xiqxMVd/kYqv+zir/9L7HryzIcdpsVV8DctVfiwKtb4vsZJgu44Ga77WBVyrkmDmXFVz L3TAzbblhYNNirbfYxVc3wtTIoWcckl3LFVRmbFXMuRYqmKXYti1WbFrXYtjsVW8cWteqrir mxbHK2Kr/wDIfFXf6mKuxVy/z4qvX+fFVmKr1+PFXcWXrireKrvt4q5fh+PFXf5GLWv+z8CY tjWKttiruOLWuVeGKrWxVZkkr/h5ZFmv4Yq79nniq/7WKrPttwxV3PFVzYq3+zirXLFW/hb7 GKtLiq7jiyXcsWK7FVvLFXR4qu+1irf7WKu5N9jFWmj/AMvFW+OKtYq3/kJhV32cVX4Fd/l4 qvVsVU/2PgxVv7Pxvirm/nxVf+1/Nirl+DFVmKuxV3FnxVz4q7j+3irsVXKv8+LW7jiqnwyS V7Niq/Is2vixVeqtirlxVZ8OKr+WKtcnxVv4XxV3x4qs4/sYqv5csVd+3irv28Vd9jFXM2Kr +WKreL4sm8WK37GKuVv2MVX8vVXFXccVa5YsnYsW1xVrFVuLJfxxYuZvhxVrFXYq2zYq5sVa xVv/AF/t4qtVsWS5v5MWLTYslvHFiuxVbxxVy4q5cVXriqxsVdxxVf8A5eKrGb9jFV2Kts2K rMWTvsYsXNxxVdxxZOxYuxVb/kYq77PwfsYq5VXFXf6mKuXFV2Krft4quxVS5N9jFVZcVUV4 8fjxVf8ABirvjxVT5YquxVUxVR5YqqL/ACYqs/yExVfyxVy4qtxVd/l4qtxa1FmySXMuKqv2 cihY32sWxzfz4q7lyxV3+viq5m+LFVvJXbFVTFVONfhxV37WKu5fz4q5MVdzxVyriqxlb48V d8WKu44qpLiyVPs4sXYq7FXYta1vtcMVd/l4tjv2MVWq3LFku/18WK3FWuP8+Kt4qt44qtTF Xc8WtzK2LY5uP7eKuZeP2MVUmyTBf/xHIoaZsVd/r4q79rFsd/r4qsZef+piq9eX8mKrPh+3 zxVav8+SYLmXIs1uKtcf2MVaVuOKrsVWtiq18VdirnxVY3x4q79rFXcsVd/r4q7/AC8VWM3L Frc3LFXMv7eKu/YxV3HFVH/XySXccVXYqqNkUKfw8ueKuySVPhirXH4sDN3FuOBXcsVc/wBj CqzjiqzlzxVfywKsbCq34cLB3Lniq5W/bwM1LCwXccVW4q//0/sg3wfYy9i1hYLsizVMKreW KruaYFbX9h8VbVWyTB37WKuxVerYq0uKt/F9j9jFVVsihR45JK7FVbIobVf2MWxYzf8AAYta 7Fsdi1tq2Ku/y8VcqtirlxbHf6/28VaxVUVsVd9vFXYq77eKrvh5YquxVay/sYquxVpf8jFX cv2MVX/6mKuXjiq/7f2MVaxVbx+HCq/lga2vtYq7FW/9TFV+LY5uGFXJga3Yqu44tjf2PgxV pcVW/YxVW44tblbFsdiydiq3jiq5cWLuOKuXFV2KuxVd/wARxVbiq1V5YquxVuPFXcsVX8uO KuxVyr+x+xiq7/UxVzN+xiql8WKr+XHFV7ccVczYqs5Niq5sVW8eOKqf2sVV15Yq1/r4tbv9 TFsbb48VabFVRVxVdiq1V+LniruOKrOP8+Kt4qqYqtXFXf5GKrGbn8eKr1xVe2KrG5Yq5sVX q2KrOWKr1XFVjNirlXFV2KuxVvjirWKrcWS9lxYtccWTsWLuOLJby+HFiv8At/YxVY3LFV/H FVnFMVa5cvsYq3xxV2LJ2KrsWK3/AF8VXLiybbFisVcVXtiruPxYq1ira4q5f8vFWsVbZsVc 2KtYqtbFV2KuxVtsVaxVa2KuZeWKrsVdirsVWt8WKubFXNirvt4q7/IxVdiql+zirS4q2vx/ bxVe2KrcVXNiq7FVHj+wmKqn22xVZ8H28Vdy+L4MVa/yMVXYqqYqo/5eKrXxa1uSSufIs3Mu Ku+JGxVy8ft4q5v58VX8v28VWcMVdirv8vFV/wBv4MVWcf28Vdx/bxVzcMVdi1rGb4sWxrFW /wDUxVpW/YfFW/2cVd+zirTNzbFXYta3li2O5ccVcy4quxVbyxVdiqnirsVU2XFrdi2OfCqp gVD4tbfHFXLirvsfbxbHMuKu5phVzYFcq/DirWFVvw8vjwK5sVcq4qs/axV3xYq1yxVtv2MV WJirsVWLx+xiq/k2KuxV2KuVsVWN8eKtYq3xxa1nLFVv28ULmbFLskl3+vkUKLN+3kkruD5F ipt/JkmTlbFVyr8OBmtwsHfDirStkWbWFW+OBVjLiruf7eKrcVaXCrWFg3+18eBmsXCwW/Di rmZmbFX/1Psdy4ZkNTeKqn28izX8v5MKu44FWfbxVfxxVvi2SYLv+J4GblX4cDW2qrkkqqt8 WRQ7lirv9n8GKrG+BcVW8W5ZJK/48VVMizW8sWtevJMWxzLi1rFbFXfBi2L+P7eKt/8AEcVX K2KuxV2KuTFXL8WKuxVUxVS/Y+PFV7Yq2vx4qvXCq7Aq3JMFvLFVVmwM3N/kYFX8V/bxVS5Z Jgu+LIoX4qpK2SSqsv8AwuRZu54VWRrgVfwxa13LFsW4qubFV2Krk/y8VdiydirmXFitxVf/ AJGSYLuP8mRZtfH+3irsVdiqxeP8mKqnHj9v7WKubFrcuKu44tit9nFVnPFXL8WKu/y3xVzL w/1MVc+Ku4/8Hiqz9nCrWKrnwsHJiq77eRZu/axVavPJMFRsihy4tjf2cVd6mKquKrf8vFXc vixVZx54q5WxVerfD8GKrsVdirsVWs2KrcVXLxbFXfCmKrsVW/Y+PFXcsVXYq7FVq/YxVdir sVdirsVd/r4sm2xYrMWTsVXc0xYuxVvjirWKtquKtYq7gmKtcf2MWS7j8OLF3Lniqny5fYxV firsVb5Yq1yfFXYqtVuWKu5YqvblirWKuxVvliqzFk77eLFdiratiqz4MVXYqt44quxV2KrV ZcVcv2MVd9vFXf5eKu5fYxVzYq79vFXKrYquxVTxVbxxVU4pirm5fsYqp8sVVGbjiqxfgxVp m+HFV2Krlbl8eKrOPxYqv/yMVXYqotirf7H+Rirl5Yq3irXw4tbpMVWPi2NKvDFW/wDXxV2K uxV3wc8Vcq/yYq7j+xirueKuxV2Kr2XniqzFrUeOLYv5Yq79nFWsVW8sVX8fixVzYqsbFXNi rvi4Yq5cVXYqptiyXYqp8cWK5lxZOxYtM2KrG+zi1u54ti9f8jFVH9nFXK2LW5V44tjTf5GL W7FW1+18GLY5mxVTX7eLWv5pi2KX2sVX8cVXYVW/6+BVnHhireKuxVTxV3+pirsVdwxV2KrO X8mKu4/z4q0/2MVW/wCpi1rvj/bxbFvL/g8WtdiqnJ/PkkrcVVP8tMihS+HlihVbFKHTJJdx +DFV2RQt5ccklpmwM2/t4WDS/wAmRZtfaxVb+3iq7FW/hxVSwq0uKrOOFgt4Yq7FX//V+x+Z DU2q4Ga/l/PirfH9vCwX/wDEsizab7X+XhVzLwwK5sVawqrx4Gtav8mSS5lxVrj+3+xkUK3x f7HFVrfyYoXfsYpd/kYquxVby/YkxV3xfsYtjm+HFrc3xYq7jiq/ji2NYtapzxbHcMVd/wAQ xV2KrF4tiqq2Ku5Yq3y/nxVr/UxVdhVpeTYFX/6mKu/yMKr15YFdyxVyrw+xirvhxa1i/byS W2/y8VXcsihr7WLYqc8Vd8WLW7hirsWxevL/AGeKtLiqp/kYtbuOLY5WxV3LFXLiq7FW2xa1 /PFsWcfhxVpft4qqKzLiqxv58Vc2Kr+Sr9jCrueBrdirm/yMWx2Ku4Yq5ftYq7FXMuKrG/nx VfyV8VW88kwXccVVMihrj+xiq1lySVnDFVXj/l5Fmv44qsWPFV7Liq7FVL4/2MVVcVWsuKqa 4q7jiqpyVPt4q7/IxV3x4quxVbxxVdirsVWftfHiq/FW1xVZx/4DFXK3/AYqv+LFXNyxVyti qm328VbxZL2xYtYq7FXYq7FXYq0y4sly4sVjLx+DFV3HFktxVdixd9rFXNiybX48WLWKuxVt fjxVpcWTsWK37HwYqvZfhxVrFVq4q7Fkv5YsVn+W+KrsVdirfHFVj/5GKrsVWsv7GKrsVdxx ZN/5eLFy4qs+38GKuX4vjTFV2KrfifFV2KrF+3irl+3irf7eKrsVW8eWKrsVW/bxVzNirX7X x4q1iqi+SYKjZFmqNirvjxVzNiq7FVLl/Pirvs4qv+DFVNsVW/5GKr1/bxVrjirmX4cVW8eW Ku+FcVcmKuTFXYqvX7GKrMVcrYq77eKqmKqXwfYxa1q4tjuOKtcnxVvj/PirWKtsuKuZcVcu KrGxVzL/ACYqpriqo2KuxZLsWKnxxZLeOLFdirsVWN0ySzU2+DIta9MWx32lxVZxxa1rLkku 5fsYq5lxVdx/nyLN3+piruWKu5YqsbFVn7OKr1xV328Vc2KuXFVPliq7FVNvjbFVPFVTFVPF VRMVd/r4qsX/ACMVd/l4q5mxVpf28Wtb8eKuZeOKtcXxVvjiqlyTJJabFVv+pirvj+xirsVc rYq7FWm/kwM2sVdgVc2FVPlga12LYt44qs44VbVVwsHYGa3Cwf/W+x32syGpV48cizd+xhVU 44q1x5f6mBVrZJgqqv7GKu4/t5Fm5ckwbZVVsVbXIoXK2SSs/ZxVUZvh55FDX7eSS3xxYKjN +3kWSzjiq9sVdyxVr7WKtq2KtYtjsVb44qvX/IxV3/E8Vd/xDFXcWxVyr8OKu5NxxVUxV2Kr uXLFViri1u5cMWxf9luGKr+OKtL9vFW/ixVrFrW5JLsVbbFVReX28izXtiq1lxVZ8OLWtbJJ Vft5FC5cWx3LFVTjiq3jiyXfsYsV2Kt/Y+DFVi4ta/jwxbHNiruOKrOOKr/2sVczYVbbFWuP DAq9WxV2Ku48cVcy4q5VXFXMq4q5MVdiq1lyTB2Kq/HIp4FuK8C/liyWcfhxV3p4tbmVf28V X/Bi2KfLFW/hxVfx+LFVNV5YqqfYxVZt/Piq9cVdxxVZ9tMVX/bxVdiq3lxxV3x4q77GKrsV diq348Vd8GKr+WKrP8vFV/HFXKuKuXliqzFkvbFiv48sVUcWTf2sVXNixbxZKeKrmxVtsWLu OKtYq3xxVZiyXYsXYqtxZOxV2KuxVeq4sVv7OLJc3wYsXL8XwYq19rFXYqtxZL+WLFZiyX/5 GLFzYqtZsWTeLF2KrcWS9cWLXBMVdirsVb/1MVaxV2Kt/wCRiqzliq9sVUm/nxZKj/YxYrWX 4sVdxxVyriq/jiqz4MVdxxVzfyYq5sVXYqs5cft4q1irXH4cVXsuKu/4liruWKqfHFV2KrWx VU5/t4qtxVpvgxVpsVcqtiq7FVPk32MVXNirf2sVWJiruGKub/IxVczfFiq18VaZuGLWs4vi 2Kj4VWceGBXcsVcy4qs44q7FktbFVXjixc3+RiqxcVcrYq7jiq1vhxZLl/nTFitxV2KreOKr sVU3xVZ/l4qv+xiqzji1tJ9jFW1bFVrZJK7/ACMizd+zirvhxVyquKrOOKuX7GKuZf8AgMVU 2xVU5Yq71GxVZ9nFXK2KrOGKu4Yqs5Yqvb4sVcq8P9fFXL/l4qs5Yqvb4GxV2LWp4q2rYtjW Krf2MWtyr8PPFXccVdkkrOD5FCl9r7GSSu4/yYGa18LByYqukX4vgyLNZx4Yq1iqnyyTBdy+ HIoXYti1sVWLhVrCwWtiq/lgZv8A/9f7Jrl7FysuBV/w4Vc328Vcvx4q38OFgqLkUKf2Mkly /wCpiq/9rIsVyqy4pWLkkttiwVcilzYpXYq74/8AYYq2uKtYq3xxVYuKr+OKtfZxbG2xVyr8 OKr+P8+Ku/axVzN8WKuxV2KqmKrWX+TFrVsWxS5dv28VVcVWryxVf8WKtYq22Ku/Zxa16/Di qH/bySVT/iWKt8u/7eRZr+eKuTFVjLhVfgV2LWuZmxbFuLWrLi2O+xirvsYquxV2KreXLFrX Ytja/CtMVczYqs+3iq/j+xiqz7OSYL2+D7eRZr+X7eLWsXFsXsvxYq5V+LFV/H4sVWKvxYq7 4/sYq5MVXfDyxVavwfYxVW4/D8eKqbL/AD4q7liqouKrsVUvixVy/Z4YqvbFXKvLFXf5GKqb N8OKrsVXceWKrcWtcv8APi2OblirmxVdirbYq7/XxVrFVvHFXLiruWKu+xiq7liydixbZcVc uKrMWS9cWK1vjxZKvH9jFi79rFVnw4q0uLJvjixdyxVtv9TFk1xxYrMWS/lixaxV2KuxVcv8 +LJb9nFi77WKu44snNirsWLXxYsl+KqeKr2xYtf6+LJbiq9f8vFisZfh4Yqv5c8VdxxVZiyX tH8WLFyrirlbliqzFk7FV2LF2Ku5YsnYsXYq7FVuLJerYsXcsVa5Ysm+WLFZx/bjxVzNirv9 fFXccVcy4quxVbyxVy4q5v58VWfbTFV/H9uPFVP/AC8VVOXL7eKrcVW8cVb5viq9W/kxV3+v iqmuKtq2Kr2Xliqz4sVd+1irl44q77HwYq74cVWfHzxV2KuTFXYq7j8GKu5fBirpFxVfx5Ni qzniqnirfLFXM2KuX+fFWsVbXFWuL4qp8cWSr/r4sVBsVVP2MVXYq7FXYqt5Jiqji1qmLYtX FVTjiqivwfBiruP/AAGKuxVZyxa1+KqStkkt8f58ihtVxbF/w4qskbFVnHFXKvxYq79jFVnB 8VVcVWtiqmuKrsVa4/z4q1yxVbirkxVY3wrXFXccVX4qs5Yq7jirm/nxV3HFVNvt4tbb/wCR irlbFXM2Kqa4q1yyTFtl/byLJTySVzYqt4ZFi77eSZNf6+RZubFXcfhxVZxxVzcvt4qp8cVV OH7eFVq/FhYLcVbXAzf/0PsmuXMXLhVeuBWsKtq3xYq3hYO/4hirv+IYqiGXIoWsuKGmXFLb fbyTFdyyLJvJMVzZFks44q7/AFMVX8uGKtYq2uKu+x8GLY1ira/5GKr8Vdirv8jFXYq7izfB iqpirsVaX/IxVfyxVT5Yq7/LxVUbjirlxVfyxV3LFXMzYq5Vxa3NxxbGm48fgxa21xVW/axb Fi8MVd9jCrsCu+3i1u54qqYtjTLzxa16/YxZwd+xil3+Riq7FVqri1r2xbGsVdirsVdirf8A l4Vdx/kwK7liq/8Aa4Yq74WxVzL8WKuxVUxVTxVcrft4q39psVczYqvf/LxVZ+ziq/7eKrG4 4q5v8jFXL/PirmkxVeuKrFbFV7/5eKrcVVMVdiqlx7fsYqq4qpc3xVfxxV3x4q5cVXYqtXFV 2KrePFcVd9vFV68v28VaxVbiyd/qYsV/HFWsVdirsVdirbfD8GKu/axVrjiyb5YsXcfixVZi yX8ueLFZiydiqtixWNiq1WxZKvJsWLTcUxVbyxVezYqo4sl2LFUxVT+wvx4sm1xYrfs4slXn ixW4sluLFUxVTxV3LFktxVdixdiqov8AkYqo4sl7N+xixcq4q3iyU8VXccVW4qv44sVnHFV2 KuxV2KuxV2Ku/wBTFktXFi5V/YxV3wr9jFXNiruX8mKubFV2Krf2MVc2Ku5Yq7kmKub+fFVn 2cVX/HiqxV4/bxVey4q7l8OKrFbniruPxYqq4qsb7eKrWb7eKr/jxVT5Yq3+1irTN/Jiq1ft YqqYqp4q58Vdy/YxV3PFXcvh54q7hiqzj8WKr8WtY2LY5m+2+Ku44q7l8OKuVcVd/kYq5m/Y xVy/Hi1tYti1WxVy4q5WxVyf5GKqfHFrVsWxS/Y+PFW8Va44VWJga3N8WLY58WtYuKrMklfJ kULOWLYvb4/t4qv4/t/t4qsZcWtQ44tip+xiruOFV2BW1bFVDjiq3/IxVc2Ku/18VWviruK4 qp4q7FVTFXNx5Yq7niqnirsWtaq8sVdyxV3wYq7jiqi2SS23JsixVWxSotkkt/s4qt+Jsihp eeSSuZcizU8Va5ZJg3gZrWwK5cVU1xVdhVbhYOxV/9H7Jryy9ivX4MVcvxfBgV3+Xira/AuS YOxVfy4fHiruPD4MVa44qvVsihUyTFrFm7jkUO4ft4qvVcVaxVbxxVzYq5WxVeq4tjWKuX7e Ku+1iqpiqniqpirkxVf8OKub/IxVrjiqtiq3jiqzl+xiq/izYqvXFWsVbXFXLyxV3Hni1uVc VX4qsVcVX88WxcuKrcWt3DFXKuLYqYq03wYq1xxVUZsWtdi2LWxVy8f2MVW4qu44quxVtV54 q19rFVvP9vFVT9rJMHLgZrsDW77GLY7FXN/Jirm/yMVX9kxVZxX9vFXcMVdiq5cVc2Ku44qq M2KrsVUvs4q1xxVWxV2KqW38mKrPhbFrVuXw88Wx3+RirmxVT5YqrYqt5Yqpq3HFVRfhxVdi q1WxVU/4jiqmvJsVcrfDzxVy/FiruOKuXFXYsl2LFbyxVdiq1f5/28VX8f58VcuKu44q02LJ dirTNzxYtYqu4YsnYqtbFWmbFW2xVd9jFVuLF2KqjfDiqnyxZLkxVdixc+Ku5fyYqo4slRV/ kxVdixWLx/nxVytirWKu/wAvFk7Fi3y54qvxVTxVUZcVc+KqX2sWSrixU8VdxxZOxYubFktx VdixVFXivx4qp8cWTsWK1sVXYq7FXYqtXFV/7WKtYqtXFVy4snYsVvHFV2KrVxVdiq39vFV2 KuxV2KreP8mKqat/JiraqvHFV/7eKub+fFVuKruOKrcVXM2KrGZUxV37OKtLiqtiqky/bxVY +Ku+3irmXFVzN8WKreGKu5Nirlb+TFXf6+KrOOKrWbjkmC7jkWbvhxVzNiq/FVjfBiqzFkvV cWLWKreWFXNgV2LJauKruWLFTbFXcsVXYq7FVPFXM2LW74cWxSbJMG8ih2Kt8Vbri2NYq7Cr fL4cCu44qs+J8Vdy5YqsZuGKquFXYFU8VaX+TFXKv+RiqzFV3HFVvFsVd9vFXYq7FVPFrVGX FsU8Wt2Ku5pi2Oxa1rKvHFsd/qYtaxf5MVW8fhySXL8DfHiqz7GKr/2sVaVcihZ8XL48klrI s22xV3HFXf5GKrGbFVuKruXxYtak/wBvJJd+zir/AP/S+yOXsVyriq7Aq7nkmC79nAzWphYL 1/y8VXriq7FVFl/YxVWxVyrkULsVb44qs+3iruWKrvtYqtX4cVXtirWLY7FVThirsVc+Ku+H FXYq5VxV3PFXfZ+3iqpiq1cVbkZcKuVsCr2XFV64q1irbL9jFXNirl+PFrWtkku/yMVXNkUL 2b9gYtjv2sVdi1uxbF6rireKtP8AbxVpcWtWxbFNsWTsWKpiq1fixVfxxVr7OKt8v58Vdy5/ HirmXFXftYq5cVXpirvj+xirnxVzNiq7/UxVaP2MVdwxVev2fjxVZ9r9vFV3+RiqozYqsZsV dxTFV7YqtxVdxxV37Px4qs48G4Yqv5JirlxVy4q7jirlVv28Vc3w4qp/5GKqnx4quxVan+Xi q77OKu5YslvHFi1xf7f7GKtq2Kr+WKtYq7FVq/Z54quxVtsVaxV3HFk7jiq3FV6/Z/yMWKzF k7FVZl4YsVPjiyW4qrKuLFT44sl3FsVXZBXJirnybFRxZLsWLa4q02LJUxYqOLJWxYqOLJd9 nFi18WLJvFi3+zireLJTxVdixVOGKqXxYslVv+HxYrFX9vFWuWLJtVxYr8VUl+PFk1iqsmLF TbFk7FitxZL1xYrMWS/lixcuKrOStiq9lbFWsVa/axZN8cVW8sWK7FVqriq7FW2xVYzYq5vs Yqv/AGcVaxVbxxVdiq37GKu5YquxVb8GKu5Yq5v5MVc2Ku/yMVcv2eGKuZV44q5WxVZ8OKr2 bFXfbxVzYqo8MVXsuKrFbs+Ku4/z4q5VxV3FcVdiruLYq5lxVamSYLv8jIoU8Vb44tjWKuZW /bxVtsVd/r4q7/XxVzNi1rVXJJWcsi2qmLFa2Kqa4quxVa2KrsVU8VU8WtU4Ytini1t8cVdx xV37OKrVXJJaVvhyLNe3FcVX/DiqjJiqz7OKtNirv8vFV2KruOKrOD4q0y/t4q5cVWt8OKuf FXfD+3irsVdirv2cVW/8SxVbi1t/5GLY7lzxa1mSS5uORQpq3HFWmbJJaZf2MVXs2RQt+LJJ a/yMDNa38mBqVMkyUcDN2KtrgVZyxV32MVcuKrsWtRb+dMkxa+38GLN//9P7J/by9i74MCr+ Xw4q5cVVOWLUtX7Xx4pX5JLbNkUNcv58UKuSQu+LIslP4eOKG1xSuxVbxxVytirlX9vFV/HF Vitiq9cWxzYta/ni2OTFXMvdMVX8v2MVWYquVuOKubFVbFVq/DirlxVZ+ziq/wCDFXZJgv8A 9TIs3K2Ku7pirXBMVbXFrdxxV3HFV6/Di2O+3irv2/gxa1TFsWqv7eKu5YqrYqt/18Wt3x4t juOKu5Yqp8cVVsVdirfHFXcsVcuKtrhV3/EsCruGLW7lw+3i2O4Yq7lxxV3LlirsVcrYq7FX L9rFWvg+xirariq5l44qqM2KrOXw4q5l5riruPDFW8VablyxVey4q5P8jFVjft4qq4qpL8LV xVWbFVnLFXLirlxVe2Ku5Yq7jiqzjiq7FW2xVrFVrNx+PFV7YqsZVxV3+piq9VxVrFXYqtxZ OxVc2Kt8lT7eLFrFXYq5cWS7/iWLFczf8Hiqz4cgyX4q58Vdirv8jFVnHFXKy4qvfFXZNi5V /kxVRxZOxVWyCuTFVuTVTxV2KqmKqeKrvs4sVuLJdixVHxVTxVcvx/bxZLuGLFZx5/BirWKr m+HFk1/l4sW8WSniq7FitxZK2LFT+ziq3FkuxYuxVvjirmxVZiyX8cWLWKqf+viyXf8AEsWL lXl8GKrsVWr8WKr+WKrPt4q5sVd9vFXccVXYqt+3irmX9vFXLiqm2KqjYquxVYyr/s8VbT/L xVy/77fFVNsVbVcVd+ziq9fsYqs4pirlXhirm+DFWmb9jFjNzLxxZNr/AJGKrGbFXcuOKqmK qeKu48cVcmKrGbFWuCYq22KuXliqzJMF2RZt8sVaxVv9rFWsVWtirl+HFV2Krf8AIxVZ+1ir eKuxVdyxVRbhirkxa3Pi2KeLW7FW/wDIxVy4q70/2MVcvL/YYtja4Va44FdxxVZxxVy4VW4F XfY+PFVjR4q77OKtMrYq2y4qs4Yqu5YqtfFXcMVWNiq/FVPFXYq7FrW8sVc/+XiruWKrf9TJ Ja4/DkULFySV/H9jIoW8eeSS1kUKOSSqM2Krcizdi1tM3HJJXL/PkWazjiqnyxVWxa1uSS// 1Psrl7Fv4sCu9TnireSYO+DhkWLnyTJf+1irm+Jq4q39psixXKuSZKmRQ38WKqXw/YySV3wp kUO+PFV2KuxVtlxVrFsbZcWt3HFsX4q7hirsVdiq9V4Yq3irsVXcfh54q74MVXYqpN/kYqv4 8WxVyr8WKq3+viqz/L/YxVy4tblVlbFsUv28kwVPtZFCo3+Xi2OX/IxVz4VcmBrVMWx2KtMu Kr1+3hVYq4FX/t4q5sVd8GKu5Yq5cVXquKubFWsVbVsVd+zirmXFV74q7FVzKuKrePHFVTFW mbhiqz4sVcv+Xirv8jFV/H4cVc3x/Hirl/Y4Yq3irsVa4piq/wDy0xV32MVdx+J8VXYqpNxx VzfHiqriq3jirmxVzYq7Fk5fhxYu4p9vFXfbxVfyxVrFW/2cVWYsl64sXLx+3iqzliq7FW1x Vy/BiqxmXFXYslT4sVW/6+KrsVXYsVjLyxVbx/YxZL8Vdx5Yq79rFW0yDFvFks44qv8A8jFV nHFV74qsbFV+Ktc8WK3jiydxxVerYq1zxYt4smueLFarfsYsl+KrPs4quX/IxYreWLJfiqxc VXtwxVyriqz/AF8Vcq4q3x/kyatcf28WLS4sluKq3+RkFWNirvhybFrFW1xVrFXN8PwYsm2X 4cWLlxVrFW2xV3LFWsVbXFVnHFXMuKrsVW8cVcuKrsVWt/PirlbFXYsl2LFbiyd8P2MWLuWK uxZLsWLsVW/8RxVdiq1VxV3P9vFVNW+LFVTk3PFXf5eKu5Yq5m+HFXcsVd+xiqk3TFjN3H+T JIaTIs3Yq58Vc32cVXNiq1eGKub7OKukXm2KqeKt8eGKtYqqYtaxuOLY1ira4q1irTfyZJg3 kUOxbFn7Xx4q22KqbYtblX4sWx3LFV2KuxVbyxVay/sYtblX9jFsdzxa1PFWuOSSubIoaxVv /UwtjmZsCtcnxV2KrePxYq5viwqprgVtm+LnhVzNgVrjirlxV3/EcVW/6mKuxV2KuxVytiru eKqeLW3yxVr43xVay/z4qvb48WxZxxa3fHirlxVR/wAvJJWpirmXFXPirl+ziq5vhyKHYqsV f5MWxrFW2+PFWsVW8cWtzLir/9X7Jr8S5cxXYq5ft4qu+xkmC/7OKtfDyxVv7WKtLiq9fgyK F/qLirSrihpsVVeWLa7/AF8Wtarft5JK5cihyriq9fixbFPFVTFXYq5vg+PFXMuKuxVyYqu4 4qtxVevx4qv/AMjFVuKrWxVWwq7AqpiqnxfFVv8AqYVXtga3NirmXli2O44tbl/nxbF7Nirm /wAvFXLzxVeq4qtVcWTfLFirYqptiyXYquxYrf8ALxVy/Fi1r1xbGvs4q2v8mKt8sKqeFgq/ YyKeBt8WTuGKu5Niq7liq37X28VdiruGKuVcVd+1iro1xVyYqub7XDFXcsVb+P8A2GKr+PHF V2Krf28VXYqo8cVVGbjirvgxVyt/J9vFXNirfH+fFk1y/nxYr1+DFVjYq5sVXYq2uKuXFXNi rWKuxVr9rFk3ixW8cVXYq7FXP9jFVuLJ2KqiYqs+1irfHFVTnkFdirm+HFXPirl54q7FXc8V WcsVX4qsXFV6Yq7nirueKu54q5uGKuxVz4q7FVPFVTFVjYqv/wAvFXU/yMVdwxVpVXFi23x/ BiyWLiq/FXYq7FXN/kYq7/XxV3H4MVdy/kxVrFisxZKj4q0mLFarYsm+GTVpsWLWKuxVtsVa 44sm+X+XixWNirv9fFV2KrVxV3FWxVd9rFW/8vFWsVdiq1sVXYq2uKrOWKrsVWsuKu5fz4qv +LFVnHFXKuKu5YquxVarfDiq7FXYqtX7XPFV2KrWXFVi8sVXriqzj9jnirvixV3Jf28Vd8CY q5fsYtbX/EsWxbiruXwYqqYqp/5eKuVsVd/qYq77GKqeKr1Xhi1rMLY7ArbNirm44q19rFW+ WKtYq7FVrLiq7FXYqtb4cWtTbFsb+38GKtcsVXYqpsvH7GFXf6+KqafYwK0y5JguVsihrl+x irbNiqlx5ZJK7j8WRZqjYVaX/LwK5lxVYv8AkfYxV3x4tbv9TFsd9vFVuKuxV2KrWxVbyZ8V dzxV3PFXKuKuVsVU8Vdi1rWxVdiq1cVcrYqpP9vJJa5YqrYqo/5GKrWb9vFV/H+TFWuK8cih a+SStyLN2FW/ib7eKtYFdhV2BVvHFX//1vss2XMXNirvixVvnkmDvt4q7FVzYq5cVX4sHYqq 5FktxQ77eKXccVcv8+LYvXFXLiq/niruPLFXcMVdiruXD48VdirkxVUxV2KtfB+xiqriq1sV cv8AJiruKYq5cVXquKuVsVd/qYqt/ZyTB3+virTLkUL+6YtjlXFVVW+HFVHFVRlbjhVamFgq csizcuKrXxVEKq/HirfHFVjfFhVdgVtcVdx/YxV3HFXfDirvtfGmKu/axVfhVr4Pt4FbTFVT FVNMVXccVb/Y+PFVj4q5lxVz4q3x7fsZJgqcsimDfwviyUeX8mKruOKqn2FxVdiqly54q5Vx VVxVbxxV3LFXL9jFXf6mKuX7X+Tiq9sVaxVa2KuxZNL9vFivxV2KuxVvl8WKtccWS3FV3LFX YsVv28VXtirWKu/Y54q232eeKrfs4slX4/t4sVuLJcmQVpMWLeLJ3+viqxsVXpirsVU8VVMV cmKu4Yq7FXcMVdwybFdxxVbiruPP/XxVzfz5Bks44q77OKrnxYrf2sWS9MVdx/YxV3+pirsV dirsVdwxVyYq5VxV3PFXc8Vcy4q7hirv2cVdirsVdwxVYvHFV+Krcmq3FiuxZOxVZ9nFVXni xUcWS9sWLWKt8f28VWcfhxVdirsVdxfFXYq22KtYqtXFV6/BirXHFk7FisX7GLJfixWt8WKr sVW8fhxVdiq1cVd8GKubFXLiq3FWv2cVXL9vFV+KuxVR5YqqN8H+piq3FWm/y8Vdx+LFVn+p 9vFV3HFVvFeOKu/ZxVzcWXFXNwxVy8kxVzcMVX8UxVD8skwXNy+xkWbWKuxVUxVTX7eKtrir WKrePw4quxVT4/Diybb7eLFtfsYtanxxbF2KtftYq3iqnirnxVz4VWccDW7/AC8VXr/l4q77 GKrGXFsWLiq//XxV3+Xiqxv58VdyX9j7eKu+3iq7FVKTFXfFirTYq38OKrMVXsuKrOeKuxVZ x4fBirv9fFWm+3i1uxV2KrFVcVX4qtbFVJmySXM2Ku/axVrlira/BiqzFXM2KrcDNvj/AD4F dxxVytirWFWuKYq3gV//1/stxy5pdxxbF/28KuZv5MLBZ+1gZtphYLuOKruWRQu+DJJXNy+3 kULVXJJVMih2KuxbFqti1r/hxbHK2Krlbnirb4q5MVdirsVX/FiqxMVVMVaXjiq9sVc2Ku44 VcuBV/8Ar4q7lirWKrOXL7GKt5JguyKHfsc8WxyryXFrVP8AITFsd9vFV3LFVL9rFV+LWvX4 8Wx37WKr8WTuWLF3LFV6rwXFWsVdirfxYq1xfFXfB+xira/BirlxVzYta9eGLY7nirm54q5e GKrvh5YqtxVUxVauKrfh/wBhiq3hkmCpyyLNUZcVWceeKt4quZsVWcuC4qv5cvgxVdiq3jir X7XwYq3z/YxVyrirv8jFV2KreOKuxZOX4cWLvgxVy4qv44q7jiruWKtYq7FXYq3yxV3HFWsV diruOLJy4q2y/wAmLFfzxVb/AKmLJdwyCqeKqi/yJirsVWcsVX8Mmxd8WKu+z9jFVvDFkqKv 8mLFb9vFVuLJ2KqeKqj4qu+3ixXNirf7OKrMVdiq3FkuyCuxV2TYrcWS7IK5MVdk2Lvtt8eK u/4hiq18WTarkGLf28WSz4cVX8MVU8VVOeKu4q3x4qs/1MVX8MVWNiq/FWlX9jFisxZOxVd/ r5NWmxYuXFXLirS4snLirsWKomKrOWKtYq7FXYqtxZLlxVrjzxVcy4sVjLirsWS7FitxZLsW LsVWs2KruWLJbxxYubFV2KrWxV3LFXfBirlVcVU+OKqitirvsLirv2ueKqfHFXcsVb488Va/ yMVbb48VWNy48MVd/kYqubFVq/HwxVf+1iruX8mKrOXLFXYq77eKrGXFXMvH4MVd+1irX7fP FXYq22Ku44q1iq3jxxVdiq1sVc32MVU/9TFV2KrWxVay4q7hirvhbFV3HFVsjYVWfDgV3LFr dxxVyt/wGKu+3/qYtjuX8+KtYqtZcVdxxV3D9jFVitiqriq1sVUWXFVTFVrYqtxVZyxVy4qv /ZxVZxxV3HFXccVWKuLWv44qs+xiro+TYqo8cklU+xirXxZFClkkqmKqfHAzXf5eBrW88klb kWa3/Uxa1/H4sLYpt8OFpb5YG53+pir/AP/Q+y3w5c0uVsWxtv8ALyTBr7WBm2mFgv4/Diqv kUKOSS0uRYqv+pilauSSqZFC3FC7FtVMVWccWtzNzxbF/Hlirv2cVcrYq7hiq/lwxVvFVN8V X/Fiq9cVd+zzxV3xPiq3/IyTBd/kYGa7AruT4q7FXJ9jFrbVsVWZJLmwM1/Hhga1ytzxbG8V c+FXJgV3DFVTFXftf5WLJdxb7aYsXLiq7FXP9jFW1xVY/wDkYqvbl9jFViriq/j+3irWKt8v i54qvTFVjYqvfFVi4qvxV37WKqeKqiYq7j8GKu4/z4qv+HFXLy/bxVzf5eKuZsVaXFV2KtNy xVdyZ/sYqs/y8VVP28Vcy4q7jiq7FVv+Xiq7FVq4q5VxVfyxV3w4qs4/tyYquxVr7WLJrFV2 LF2KuxVtcVdx/bxVpsWTmxV3LFWvtYq1iq7FiqK2Ku55Bk7/AC8VdiqxsVX/AGMmxd/kYq79 nFXK37BxVyYq5MVcmKu/1MVcmKuxV2Ku54qv/ZxVZwxV2KuxVz4qv5fDirTYq2vLFVnPFV/2 sVWYq58VVMVW/wCXiq1v58Vd/kYq7FXKuKreGLJdkFdwxVRyaqnDFVy8MgrueKuxV3DFVPFV R8VWfZxVv7P2MmrTYsVmLJUxVTxV2Kt/ZxVcuLFZiyXcsVa+HFVzYsVv2sWS5lxYrGxVeuKt Yqp8cWSryxYrPgxVdiq1cVXYqtxZLsWK1/8ALxVdiqkq4q5mxVev8+KqbYqqcuWKuZcVU/8A IxVvl+xiqriqniq7/IxVTbFVRVxVRb7OKuZe6Yq5mxV3w4qvZv2HxVYqt+xiruXHFXM2Kub4 /gxVZ8f2MVc2KreWSYN5Fm22KtYq7FrWti2LsVdiq1cVc2KqfHFVvL48Ku4/sYFcyrirmX9s Yq7j8GKuX7OKu54qp4tbv2/8jFVTFVndMWxay/z5Jgu45Fm1hVbx/b/bwKv/AGub4qs48sVd yxVy4quxVTxVr7OKrG+1irkxVz4q7niqnirbYq7jzxV3HFraxVb/AKmKrsVdiqE/Y+PJJVuX w5FCriqjkkqfPFV7ZFisyTJrl8WRZub/ACMVbbCrTLywNaxV/kwti7FX/9H7K5cxXLhVVVsD WpLzySV6q3+zxVr4uOKuZf2MVXLyXIoc2Kq3H4sVbb48Vdy/YxbFjfyYta/9rFsaxVtlxVzY qvxVzMrrirsVdirsVX/axVrjiqoq4q77C4qsVsVX8sVXYq2zYq7/AC8VX/tYqo8eOLW7JJXZ FDXLJJcuKtr/AD5FCp9jFsdiruX7eLW7FVTFsVMVdiqkzc1xVf8A5GFVvP8AYwsFTIs21xVr FXYq7mmKuXli1uxbHYVV/wBj48CrOeKuVvixV3+RirkxV3L+fFXMrYqv/wAt8VWLK37eKrmx Vtf58Va5YquxVdy44q748VczYq79jFXf5eKu5fDiq7FVq4q5uWKrsVW8cVXMy8cVbVcVaxV2 KuxVzYsm+OLFZyxVdxxZLePLFiuxVbiyVuPHFip4q7FXLiya488VXcsWK39nFkuXFisxZKy/ FkFd8S4q5mxVbk1VePw4sVn+XirsVdiq3niyXfYxYu4/sYq7FXc8VcrfDiruGKreeLJdzxYu xVaq4slRcWLfxYqsxV2KufFXYqv4/Diqzhirv9TFXPirsVd8WKu4Yq7FVy4qt+3irsVd9psV d9vFVr4sl3DFi79rFVvPFku/a4ZBVPi+KqmKrFxVrFW+OTYu+LFWsVW4snYqv5YsXM3xYq1i rbNiruOKrftYsmsVX8v2MWKzj/Jiq7FXYq2y4qs/1MVd9jFXf6mKrvtYq77WKrcWS9cWLpGX FVjNiruWKrsVWs2KuXFXNiruWKubFVuKrl+HFXcsVU2b4sVVsVUl4/sYqs5ccWtz4tjm4Yq5 lxVcuKrWXFWlXhira/5GKr+P7GKrOGKub7WLWp4tjfxcsVWZJgu4vkWbsVdi1rWxbHK2KuXF XccVXYqotiq7FXYqpvi1uxV2LY58VU8Vb5Yta39rJJXf6mRZrF+xi1uZcVX8sWxpmXjirsVU /t5Jg7Iodi2LeOKqn21xVbirTLireKofFVTnirvixVZ9j7eKu/1MWt3HFVjLirv9fFV2KqbL kkrG+DFW1yKFRl5Yqpfb+PJJabFVHivLniqozfDirv8AiWRZtN9t8Vcv8mFXM37GBVnx4VXY q//S+y3L9jL2LbN+wMLBytz/ANfFVX4P28ih37OKu/ZxV37OKujbFVXFW/8AUxVpft4q3/l4 q19rFVTFsWN/kYq79v4MVcq4qvxV2KuxV2Kr/tYq5lxVY+Kqy4q77f28VWfZxVVwq2y4FczY Vd6n7GBXKuKtcv2MWt2Ktt/kYtjuXFcWt3L4eeKuVcVX8eOLY77eKqa/yYtasuLY2q4q0uKq nHkuKu+xiq7FVvLFrXYtjf7WKuXFWsVbXFrWc0ySV2Bm2uBV6/Diq5W/nxVby44qvZuf2MVW Kq4q7/LxVytirv2cVdiqsrfFirmxV3x4qsX48VabFXLiqo2KrcVXNirmXjiruXLFVNcVVOWK u5YquxVTb4sWSpixdirbYq1iqxW/4PFV+KuxVtsVaxVbiyVMVdiq3FitxZLsWK7hiyaVcWLe LJ2KuZcVXZBVPFVTFVTJsVPFXYq7FXYq5MVd+ziq/j2/YxV2QVZ+ziyX8f28mxc/28VcvHFV nxfsYq7FXcMVc+KuxVzLirsVc+KrlxVT4Ysl2LFz4q7hirsVX8fhxVZ9jFXYq7FXYq7/AIhi rsVcmKu4Yq7FXYq7FVrLiyXZBWuXwYsW8WSz/XxVf8WKub+TFVr5NVuLF2Kqit/Jiqniqpiq muLJvlixaxV3+piydixdiq1uWKu5Yq7Fk7/UxYu/1MVcrYqu+ziruaYq3yxVrFXYq38OKrGX FV2KreK88VaX7eKtrirmXFXcfsYq5cVWMuKquKqK4qqMvw4qp/6mKrWyTBevwZFm7b+fFVnw 4q7niq/i3LFVnH+TFV6/YxVZy/bxVyYq7lwbFVnw4VawK7FVv2ckwU+ORZq7Yqs5Ky4ta7Fs U+WLJUxYrft4qtxV2KtM2KrMVX/tfHiqzni1uxbHYqt/4li1qeSS7j8Px5FmvZf5MWtzNirW LYqYqp4ta3JJdxyLNT5YqqfYxVy/yYqs48/jxVZiq9vgxVQxVUTFXNzxV2KrP8jFraxbG2XF rd+z8eLYs48154tbvgxVzYqs+LFW8VW5JK3/AF8Vb+HFVnDFVzfayLNby/4PJMGlbIs2sVdh Vv8AZxV//9P7LfDlzFV+zi1KeSZLlxVUyKFjfHkkrsWC9siyd6i4qvbFVFmxVVxVvji2OZv+ DxVytirWKt8cVaxVtWxVfy/bxVf8H28Va5ftpiruOKts2Kr+WKrPs4VX8cCu48cVX/s4q1ir sWtvjirTf5eKuxVbkkrsihUxbHKuKu54tblXFVTFsabjiqzFVZW/YxVdiq3Fks5fDixVcVbb FWsVdira8cVcy4q5mxV3+XhV3LAq9ueKuxV3H9vFV/2/jxVrliruOKrf9fFrdzxbFZVxV37G KrG+DFXf5aYq3irTKzYqv44q7lirlXjirX7Xx4qvxVSb7PPFV7Liq7FW+OKubFVn+viq/wD1 MVaxVtVxVrFW/hxVrFVr/wCRiratiyaX7GLFdxxZNtixW/s4slyrixWYsl7YsW8WS1/sYsXL iyVMWKnkGSpwxV2TYu/1MVdy/bxVUxVauKreeKtcMgq/jzxVysyYqtxZLv2cWLXLFXNiratx xVamLJdwfFi5smq3nirsVXt7/YxVZ8OKu+HFV3+viq1lxV3DFXPirsVVMVU/ixVzNirsVd8O Kr+Xw4q1xxVbiq5sVW4q7FXcMVcv2cVdirsVdirueKruOKrUxV2KqeQZN8sVX/Diqjk1XquL FZiyVl4YsVPFW/ixVzYq0uLJ2LF2KtquKrMWTvgxYrsVa4/t4sm8WLsVdirbYq7lirWKrcWT sVdx/wCDxYuVsVXYq7FVvHFXf7PFXMuKrcVW8sVcuKq2KqPHFW+PDFVn28Vdy5/Biqpiqnwx Vpfj+DFW2+NsVd+38eKr2XFVj4qsZfhxVf8AYxV2Ku4Ytbl+LFVjYq5cWx3HFVnLFV2KuxVa y4quxVauLWs/axVY+LY7i2LW7j+3i2LGxa1/+pi2OTFVjLwxa3f5eKrOS/sYti9sWtr7WLY2 vHFXNirmxVY2KrsKqeBV328VWcv2MVWcv2MVXr/PirX+Xiq18Vc+KrP8tMVX4q7FVjYqpKvH /XyTBd+xkULsVdiqn/qYoWccVbyTJT4Yq5lxVdy+xkWa1vgbJMGm+DIs2vs4q38XLniq/FUO 3+vkmD//1PsymXsXPga1n+vhbFb9j4MDWsbJJbVsVVcixdxxSvb48VcuLYsZfsYta9eXLFsa xVUTFVjYq5sVX88VcrfyYqvZcVWJiq/4P2MVdx+LFVjfDiq5sVVG/k/bxVZ+zira5Jgq8siz Wcl/YxVfxxV3HFXceeLW5WXFXf6+Kr8Vc+KuZv2Bi2OxV2LWv+zi2NcsVb5cMVd6eLWv44tj uPHFV2KrVXFV2Kt8cVaxVvl+3irv8vCrl+18H28Va+1gVv4eWFWlXm2BVTkr4q5WxV2Kub+f FV68uOKtNirSrz+DJMGm/nTIoX/Fi2N4q0v2MVXr8PwJiq3FXYq1yXliqriqjy+H48VbZcVd 9nFV/wBj4MVXYq7FXP8AYxVbz/YxVpft4q2zccVXsvw4q1ira4q0uLJ2LFtcVdxxVZyxVdxx ZO5YqtxVUxVTxVW4YsVnHIMnN8GKr8VdzxVrnixb4ZNV/L4sVWc8Vd8OKtNwyCqmKuxVT54q v5Jiq/n+3iqlx4LiyX/6+Ktcv58WLmXFWuWKrsVWYsm2b9vFi2zYqp5Nku4YsV3B8grlb4cm qz/UyCr+PPFWuOKrmXFk0zLk2K3FV/HhirSsv7GQV3HJq2y4qt4/FwyCrsVaVsVa44q7/iOK tf8AEMWTv2cmxcmKu54qtxZLsWLvhxV2Ku4YqtfFkuyCuxVzf5GKrGX4cVWZNVZMWLmXFVPl iya+1ireLFbiycuLFdirfHFWsVbbFVi4qv8A9fFVnH4sVX8cVaxV2KuxVtsVaxVaq4qv5Yqs XkuKu5fDiruOKu/4jiruWKrsVUVxVv0/i+DFXMuKquKrPi+xiq3jy+3iruP8mKtccVcq8sVW t/Jirlb4ueKrGxVemKrvh5YquxVT48sVdzxV3L+fFVTFVDliq9Vxa1PFsdiq9uKYqsxVbxxV an+RiyVMWKni1uxVT/1MVd/l4q7FVTFsU2XFXMzYq58WtR/nxbHfZyTB2Kq3H+fIs1P7OKt8 v58VaxVbkmCmuRZqnH+fFXcv5MVWM2KtcsVcqtiq18VczYq79nFVn2/t4qvxVZxxVfwxV2Kq eLWt4pirlxVd9nFVvFv2MVWfZbFVjZJK1mxVy/ZxVVZcihS4ZJKnxyKF2LYu44VU+L4WD//V +y6rmQ1O4YqvX7P82Ku/ayLFpm/YyTJEZFCHXJJVG4/t4qqZFDl44q22Ku/axV3HFsX4qp4q qcMVWMuKr/8ALxV2Kr/2cVbxVauKuXFW2+xirX+viqoyti1r+P7D4tjm+L4ExVzNirWKu+x9 jFrb44qpcsklUyKG1xbF/wDqYq5V7viqzj8WKr8VXsuKtf5eKrUxa0Ri2OxV2KuxVauKuxZL 1xYu44q74sVcv8+Ku44q5vgxVy4ta+NcWx3H9vFXPirmX4eGKu5fz4q5vtc8VUvh+xkmC9W+ LFUQy5Fms+ziq9WxV3HFXNiruWKub+TFXccVXYq3/r4qo/ZxVey4q5eWKrsVdiq3Fk5cWK5s WS1m/wCAxYr2xVv/AIjiqn/r4qv5KvXFWsVdiq3FkuxYtfaxZL8VXJixWviyXJixUl+PFkq8 v2MgrsVcrYq2y/z4sWuGTVUxVauKrVb9g4qvVvh/myDJpV/b+zixcq/F/r4qsVeeKrv9fFXf 6+KrsVa+39vFWmxV3HFW/hxVrjirv9TFWuGLJfixU/sYq38OLJ3PFV37fPFis4YqvbFk1yxY rcVX8V44q74sVbxVb/qYquxVpl54qq4qo8sVdy/2KYq5cVVsVUvhxV3N8VbxVpeXHFW+SZNW 8VU8VdirsVczYq7nirueKufIMnYq7FVPFW/g/YxVemKrcmqnirsVXrixWYsl2LFvj8XPFXMu KtYq2uKtYq38WKtYq7FW2XFWsVbb48VcuKrFXjirlxV3+piq9l4Yq1iq1ufHFV2KqXJf28VX tiqxV5/bxVvFV322xVbiqpiq1WxVbirXH9vFVP4X+PFVRfjxVpsVW8lxV32MVdirv2cVczdk xVzK2KuX4sVdi1qeLYtbFXf6mKr+WKrP8vFV2FVrYq5cCu5YqtxVbyxVdiqni1rmxbFrfyYt bkxbHJirmb+fFVPFrbbFXf5eKu/ZwtjS8nXAra/HirlVsVaxVT5ZJg7Is1TFXYqpfFiqzFXP irvtNirm+H4+GLW7FsdiqnirbfD/AKmKtYq2uKu48PgxVTbJNLbZFko8skldiqyTj+3kUNZJ Lv2sVdkWKzjzyTJdy/YyLNy/BhVy/EtcVf/W+y7fFmQ1OxVerYquZm45FC/l8XBMVWcf58Vd kmLarizVV/yMizaxa1vp4qvVcVaT7GLY2rfFirm5Yq7jiq/FViriqquKrfsYqqYq7FW+L4qt 4/DhVr/XwKqZJgv45Fm5sVa+ziqpwxVS45Jg3kUN8cVa5ft4qqYtjmX4cVdirXHh/qYtbmbh i2KuKrVVsVVF/kxa1vLFuXfFwxYrsVbXFraVm+3i2N/5eKuXFXcvhxVy4q5f5MKr8CrP9fFV +KuVmxVfyX9jFVi/zpirlb9vFXcf+DxV3DFXcvjwqt+3hYKv2PjyLNvFVqryxVUXFVNl/bxV U5Yq7liruPLFXcuOKrsVdirsVdira4qsxZLsWLbYqsVcVX/b/wBTFVmLJdxxVvlixaxVbiyV FbFW1bhirT4qtxYrsWTS5BV/2MVdy44q5mxVy/FiruLYq1ixbfFk7l/weTYuxVyty+PFV3LF Xcv28gruPw4q7/L/AJcVW/tYsm+OLFteOKu+02KuX/LxVzYsljLixVFVcWTvhxVrj/JixabF XNirbfyYq5mxVa+LJvjixXfs4snYsWm+PFW8VWriq7FVvHFW/T/bxVdiyWq2LFpeP7eKubFV y/Z4fbxZOxYrWxVdirsVW8sVW4qqYqs+z9vFk1ixbyaqOLJWfFi5pMVc+KqmQZKWLFvFkp4q 7FVTFXc8VUvs5NXM2KtYq7FVy4q19rFVzLixdx54q1xfFW+OKtYq7liydixW4sl/Lhixa5Ys m2xYrU+xiyXccWKzFkuxYuxV2Kt8cVUFbjiqp/kYqsbjireKrVxVWxV2KuxVR5Yq5WXFW+X8 mKt4q1x/2eKrOeKu4rirlX9s4q77eKu+PhirmXFXcf28VUuPP48kwXcv5Mizd+1iqxV/kxVe 2KublirWKrft4quxVb+xiq3FVrLxxVdirsVdiq3jiq3niruP7GKuxVTxa1uSSvZeP7GRZu44 qsZsVX8v2MVXpiqxWxVrFVv21wq7jgVy4qpsv8mKu5YqtxVzL8WKrOK/YxV3HFXNirWLW3/r 4q1i2Oxa22XFsaxa1LJMV65Fk7JJUm4/t4q5Pt4qsZcVX8cixWPkmTS/A2RZu5Yq5sVf/9f7 Ls3w5c0O/wAjJMl3DAzbVlwNTeSZLeWKqyt/PkULY2xQu+DFLvsf7HFscrYta9cWx3Ht+3ir WKqjfyYq7hirkxVY2Ku/18WtXxbGuPL7eKuVcVbxVdx+3hVbgVV44qvZfh/yMVWem3HFXftY tbm9vsYq74cVWZJK/jkWblxVfwxV37WKtKvDFW+GKruOKrsVaVf23+PFXK2Kr+X7EeKreOLJ dx/nxYrsVdira4q1irfLFWuXxYtap8f2MWxe32fjxVZ9r48Vcy/Diqpiqnirvt4q7j/Jiq9f 8v7GKu/Y54qs4Yq5eP28VX8f5MVc/wBvFV/LFXLiruWKu/bxVzLiq7FVvL+fFXcn+xirvt/B iq5sWS3FXfYxYuZsVXYqt/18Vdx4/Hiq77OKrf2MVXYqtxZOxVf8WLFvFkp4q7FVTFV3H+TF i5ftZBksXFXM2Kr1/kTFXfbxV3+viruGKu55NitxZLsWLvt4q2rft5BXcsVaZv2Biycq4quV eWLFZwxVUxV2Krf9TFVT/UxVbyVMWTXLhixd9tMVa5Yq7jirfxYq5l54q3irmZcWTsWLsVa5 virXHFVT4v28VU+WKt8eeKquKqf+piyVMWKi2Ku/1MVbVcVcq4q79rFWmxV3HFXccVcuKtqu Kt4q7FVPFXceWKt8v58mrsVXM38mKrXxVzNiruTZBku5YqpsvPFiu54sncMVdwxVTxVdx45N VvLFWvsfbxVc2LFbx/YxZO+HFWsVXtixaxV2KtfZxZNYqvX+fFitVeHwYsm8WLsVbXFWlxZK fHliq7jixXYqtVsVXfaxVay4q5sVWMuKr1b7eKrGbFrXsuLY79vFVjfHiqrirsVUeWKtqvDF Vj4qv5vireKqa/z4q18H28VbxV37WKqmKqHHFXf5eKtfaxVUb4sWtYq4tjmbFXK2KqfF8Vbb FXccVdiyW4sXYq0y4q1xxV3HFVrLi1uxbHYq79v4MVc3+Ri1rP2sVdx4Yq5Y/hxbHKvL4MVc v8mKuVv2MVWfYwqs+LArXLFVRVxVTbFVrLiq5sVWpirvt4qsbFV/28VaX4/gxVauLWv+HFsU 8VbbFWsWtay8vgxbFPJMFbIoQ/HJJbb4G4Yqu+JcihSfJJd9pcVc38mKtM3w5Fm5m+LCr//Q +y7NmQ1Ll+JueBm39rCwbZWyKGmXJJVWyKHZJK7IobZeWKrPh48/5sWx3LFrXq2LY1irsVVM VcmKu54qsXFV6tiqphVpeWBVXFVvJv2MVcn+Riq9cVaxVteP2P2MVcq4qt5ZJg7liq7jzyKF +KrFXFsXvirsVc+FVPA1q/2cWx3HnireKtcuXx/YxVW5c/sYq5VxVY/+XirvgxVeuKtYq3xx V32HxVzYq1i1qjSfsYtjsVcy4qu5YquxVTb/AITFV6/a5/sYqs48sVd8DN/l4qu44q3+zirX LFW15Yq6TliruX8mKu/ZxVr/AFMVVGX+fFVuKrv8jFXf5D4q7jiruP8AJirlXFV3LFktxVdi xb9T9vFWsVW/bxV3wYquxVteOKtcnxVUxVRxZL+WLFfiq1MWS3liqozZBVjYqv54q58Vc32s VdwxVrjyxYr1yarcVdzxVUxVb/l4q1xyCuXFW/g+3irXHFVTjiqxmxVpcVbVf5MWTTYsXcsV XYq7FWmbFXfsc8Va44q2y4q3iqxl/wAvFkvxYruXFsVWfaxVy/5eKuX4MVa44qqf6mKqa4q3 +18eKt4q1yZemKr1XFVuKtM2KrMVXt/l4qvbFVi/Hirl/wAjFXfFireKrmxVTbFXf6mKt83x VzN/Pk1W4qvX+d8VWMuKuZsVdy/nyDJzLirWLFvlyxZOX+TFWueLFvhiydwxVzLiqniq3Jqr cMWKz/UxVey4qs44qvxVRxZLsWLfLniqzFkv+FsWLWKrfsYqubFk23wYsXf6+KtYqt/YxV3q Yq5lxVdirsVUuSYqv44qo8MWtWb4sWxZIvLFW8Va4pireKtN/JireKqariq5cVcuKreXw/bx Vz4q5MVdxXFXPirueKrP9TFXLirm+PFXK3DFXcv5MVWMvw/Biq7FVPFVX/LxVS/YxZLmbFip ti1u5Yti7FWmXFW8VU/8jFXMv7GKuxVzf8JiqxsWtrFW2xbGsVb488Vc38mKrG5Li1u+PFsc y/FiqmuKt8UxVrlirv8AiOKtquKrHxVyYqp4q3/qYq1irbLi1tYqt+PFsd9jFrc/+Riqiy/5 GKrsklU5fFkULFXhiqkrfFkku54qu4ZFmt4ZJgu4YGaz7fx4Ff/R+y+ZDU7FV7fHirTYq5cV bVcVXtkWKpiltcVWK2KrsVdi2KmKqeKuxVUZWxVY2Kr1+zirmb9vCq9Wb7GBWuOKqiriq3FV TFW+X7eKu5fFiqzli1r+OKuZcVd8OKrMkltsVVfsZFm7nirsWtYq/t4qvxV3DFXJiq5cWxWx Vb/r4q5sVcv8+LW77GFsc2BV/LFXKzYq1iqov8mLW77eLYp/ZxVU4Yq7hirmZcVa/Y+DFW2+ zzxV3+RirueKrckwdx/nxVV+HIs3N8eKtLiqov8AqYq7lirv2MVc2KrsVdiq348Vd+3irm+L FXfYxVpcUQbVsUr1xVZiyXYsVuLJcuKreOLFeq4qsxZLmxVvjixa5YsluKq3H4MgrueKuTFW uGLFvFk7FXftYq7FXYq5eeKu/wAjJsVqYsl2LFyYqu5Yq7jkGS3FW1xYq2KqStxxVrlirmxV tvsYq3irXLFk1xxYts2Ku+D9vFWmxVWxVTxVpfgxVpcVVP8ALxVZy54q1xxVbiqpiq7jiqny xV3xcsVXYq0zYq3iq3jiq5fsYslvHFiuXliyVMWKnyVGxZLf8vFi1zxZL8WK1sVV8WShxxYu 5Yq7/IxVtvjxVZy44q38P7GTVyYqqYqptzyDJzfH/qYq7iuKu/Z54q5uGKtM3+XixbfFks5Y qvxV3xYq7hk2K3Fk0q/z4sXNiraYsmmxYtYq7FXYq5cWTXJ8VXL/AJGLFrFW1XFXfs4q1/l4 sluKrsWK3lxxVdiq3l8WKrF+19vFV7fC2KuVsVdxxV3HFXfFx4YqsVsVX8sVdyxVTbFW2+PF VXFXYqh2XFXfFirnxV3PFXYq7/LxVyYqsbFV7cf28VU/s4tbbLi2OX7XPFXLiruOKtYtbbYq 1i2LfsYq7l8XwYqp/wCXiq1WxVdxxVay4tbm+HFsWNiq/FV3HFVJlxa2vs4tjfxN8eKtYtbs WxtWbliqk3wrkmDS/wAmRZr+WKrcVa5YVa5YFcuKrf8AXxVz4q7FVnHFXf5GKu/y8VcuKrFb FrXti2O+HFXccWtRb4W54q232Mklc2RQsb4Wpiql/r5JLl/18Vdiq7lz/wBfIoWt/kZJLTNg Zv8A/9L7NK2ZDU0uKqn7GKqKYqqqv7CZFCz/ACMklW/YyKF3J8VdirarirvhxbHccVczfFir WKttiq/FXcMVd/r4q7FXfYxVW44q7liqxeWKq3FU+PFXMv7HDFXccVcuLWsXFsVnxa1iri2N L/Pi1t8ueKr+P8+LY7j8eKuxa3Yq74sVXLi2LsVXLi1ubFsdx/kxVT5YqqKvxf5GLWv/AGcW x3HFXfDiruOLW5sWxpv58WtUxbF3HFVvPFXc8VdzxV3PFV3LFVv2MVdy5tiqzji1q+LYu5Yq 7liqz7OKr/t4qs+1irlXFV8eKqbYqrYqpcu37eKquKreWKr2xVY3HFV2KrcWS/1MWLvhxVYu Kr1bFWmxZOXFVuKr2Xlixc2KrMWS7liq/hkGKzFkqN8OKrGxVrk+Kttiq/jxxVfx+LFVmKtR t+xixbyau+P7GKuTFV6rirvs4q7IK0v/AAWKt/Hy4fYxZNcuGLFvFXfDiyXL/wAJixd/sMVc 3w4qs4piqpxV/jxZKa/yYsV7fD9vFVnH+fFWuWKt/ZxVzNiq/jiqz1MVXrirv8jFV2KqP+Ri q5v58WTsWLsVXcUxVzYq1iyW/tYsXcvixVfxxVay/wCRiyWK2KruPxYsW1X4eeLJr4mxYtcc VbX+fFWuOKt/ZxV3JfsJiq//AC8VWKvH7eKtcsVa55NXYq7FXJkGTvt4q7l+3irsVc38mKu4 Yq7FXf6+KrOOKr+eKuX7X2MVU8mxa/k4Ysm1X9jFXfaxYqmKuZvixV2KqeKubFk2v+RixaXF k7/UxVbirTMq4sV+Kt/5eKrGxV3HFXNiq3FW1ZnxVY2Ku+Ljiq7FV3xft4q5cVXYqt/2GKrJ MVXtiqz4ExVr/IxVy4qtb4sVdx+Lhirm/kxV2KuxVy/5GKrF/wAvFV7faxVpm5/G+Kubi+LW s+1i2KnJnxVYq/yYq1irsVW8cKqfLAq/imLJfixW/wCRi1rcWxbxxVbi1uZcVdi2LuWKreXw Yqs44tbuWKu/1MVd6eLY18H7GKuxVtsWtZyxVzYtjmXjiqxsKt4FWsq4q36eKrOX7eKu/wAj FXYq58VWK2Ku5Yq5uPHFrczfyYq1irfHFVjfYxVSXjkkt4q2v8mRQpMvxfHkkqjclyKFP7X+ vkkuZcVXLy/2GRQs5Ytj/9P7NN8eZDUuZf8AZ5FC37fwZJK/lirlxVcv8+RQ7/UxVf8A6mKu XFVnLFV3BMWx2Kt8sWt3HFsaxVUxVcq/z4quxV2KtftYqq4q7FVrL+xirv8AIxVe3+RiruOK tc0xa2uWSS1irbYq7jiq7jwyLNeqtxxVT+1iqo3wfbxa3Yq5fhxVyYtipiq708VdyxV3wYq5 sVXL9vFXfZxV2KuxVU4rirnxa3c8Wxe32MVWYq5MVWceeKqrK2KrUxV3Lm2KufFV3HFVqqy4 tapi2KmKrWxVT44q2vxrhVzcUwKv/wCJYq7/AIlirv8ALxVy8cVU2VcVVOOKuXFXMuKu/wAv FV7Yq7lwbFWsVbbFWuOLJv8Ay8WLXLFk03x4qqr9rFisXjirlX/gMVczYq0n2MVdkGSp+zir sVdiqxcVVFxYrcVbVcWTl+zirmb9vJsVzYq7/XxVzYq5cVWcMgraYsm+OLFU/bxVYrYq7lz+ DFXLyxVpcVVFxVYv+Rirl44q2v8AqYsl3+RixW8fhxZNc3xYr/8AZ4qp/wCpiruWKruXPJqv 5Yqp/wCviq//AC8gqn8XHFW2X+fFk5fj+DFivXk2KrFyaqnL9t8VU2XIK0uKt8vhxVe2KqfL FW/2/wDLxVvFXYq0zfFirXHFXNirf2cVX/bxVZx+3irv2cVd9nFWlxV3LFWuX7eLJevt9jJs W8VU+GKu/wBfIMljYqv+3irsVd8OKuxVrFi38WLJ3DFXN9nFVPFVRlxVbk1dirS4sVmLJdxx Vv4sWK/niq3/AFMWSniq9lxYubFWmXiuKt/tYqs+PFXYsl2LFa2Ku48cVU+OKqnHFXfHiq7F VPFVy/H/AKmKrOPw4qq4qpcf5MVd8WKr+WKqar+3irf2cVc3H9vFXfaxVZy4f6+Ku/a4Yq7l +xiq/kvx4qs/ZxVdyxVa+Ku4Yq7hi1qeLY7FW2/nxVrFXYq7FVqtiruOKqbLiibmxSrYq7FU OmLW7hiqzli2L2bFXc8VWLi1u/1MWxyt8WKu+LFV+KrGxVy/zviqxsVd8X+xxVdiq3kmKrFX FWmxVdiqnx+PFXYqs+LFV/PFVn+Riqxm44ta/jiruWKubFWsWxS/yP2MWty8uXwYqvb4cVU/ tYodkmS0/t4Ga1lwsHcfgxVzYGb/AP/U+zfpplzSqP8A5GKqXLhkkquKqPLFVZVyKF/xYqsX FV/HFsdy+LFXK37GKtYq3x54q5cVX4q5WxVf+3/kYq7g+Kr/ANvFVNsVVsVW8cVWrkmCqvwZ Fm1ira4q79nFrWquSS2v8+RQ2rfDiqxV/bxbF/8Al4tbuWKr0xV3w4q7FXc8WxcuKqi8cVdx xVbyxZLuXw88WLlXFXLiq7FW+OKu44q1iqpirm+LFXJirv2cVa5cPsYq3yZ8Vc38+Kr/AImx Vy8uWKrOXwYq7FrXcsWxU+DFV2Krf28VWfZxVpcVbXjiq/lirlbFXfsYq7lirmXFXf5GKtL9 vFW1blirbNiyXLixcvt9vFXceGKu4/z4q1iq3FkvVsWLeLJTxVc2KrsVXMuLFbzxZLsgrv2c VWNiq/FXJiq77WLFbwxZOxVpVb/YYsW/9TJq5MVXccVWviq/IK7FWvhxVVxVauKrP2cVa44q 5sVb+HFWv9fFWueLJvjixXYq1xyattIuKtccVVFxVTXFV2KtL8GKr1/4TFXfF9hMVd8eKubF VuKqmKqStzxVeuKrsVUk+3iqpkFUv2XxVtlxZNM2LFrlirX7OLJtm/YxYt/tYqub7eKrP8vF W+X7eKt4qv8AsNiyWYsXYq18OKr2X9vFVi+32MVWt8OTVzfD8H7eKr19/t4qsb4sVaZsgrfP Fk58VaxYt4sncuOKuZsVdirsVdzxVzLzxVZyxVf8WKuxV3Lliq3hk1a4/FixdyxVZiyXrixd yxVpsWTsWLTLiyXccWKzl/PiruWKu48cVa5PiqpyxVZxxVdiq1cVWN/Jirvs4qvbjirvgxVd iq3i3PFXcsVd9vFVPjiq9vt4qsXFV2KreOKreX8mKuxVfx/YxVZirm/nxV3Lliqz9rFV7Li1 uxbFjYq5sVaxV2KrOT4q1xxZL8WE1mKWlbFWlb+fFVvL+TFXc8WtzL/Pi2LF+PFV/Hjiqjxx Vd9rFWl/y8kwXM3HIs3Myv8AbxVzfyJirlxVzR/8Biqzji1u5Ytjv8vFVNcVXYqp4q7FXJir nxVTxVU5csVWceeKrFbFrdyxV3HFsdw/Yxa3csVUVySVv2MVVvjyLFZ8WSZLMVd9vFXYquZv t4Gb/9X7Ocv58uaVnH4MVX/ZxVZyySVZeX7GRQ7liq7FW+WKrGxVy4qv/wBTFV/w4tjuGKrO XxYqv54q7lxxVd/kYqqccVcuKuVsVdx44qtxVtvt4qqcsVdy/bxVZkmC9fs/5eRQ5sVX4qs5 fz4tjv2sWt3LFXf5eKr1XFsdzxa3Ji2KzYqo8MVV8UQWccWa5mXFiuxVvli1tYtjvs4q5V5t irfLFWsVXsvPFW/ixV3wcMVd+zzxVd/l4qtp/kYq5fixV37OKu+3irsVXNiqpyxVZ9nFV/LF Vi/HhVrlgVy4qqfsYq5sVWLxxVVxV2KrX/y8VXYqtxZL+OLFYuKu/YxVyrz+PFXNiq7liyWt /JixXr8eKr0xV2KreeLJpW5ZBXfFiq98VcmKu54q7niruP7D4q58VdirXPFi3y/kxZO4tiq5 smxWviruGKr4+WKtceGQVZirlXniqt/r4qs5cMVbxVpsWS/7a4sVP/LxVU4ft4qs+1irvs4q 1yxVv/LyarsVbZfi+PFVrLiq9lxVzYqtxVpVxV32cVaXFV2KuxVcrYqpry/YxVU5N+xiruWK uZsVWN8GKubliq/lxxV3LFVnLhiq/liqxmxVy/Z54q0rZBXfaxVvFWljxVpsVbZsVbxVr7WK tNiq7FXKuLJZ+1irsmxVMVU+X/AYqv5Jiqn/AJGQVvhiyaxYt8MWTsVd9jFVPFW+X+Xiq/FX PiruP8mKub+TFXKuKuTFXf8AE8Vd8fPFVqtk1W4sVuLJey4sVmLJ2KrsWLfHFXcsVWYsl/Ln ixU2+3iq/FW2b4sVd/qYq5uWKrPt4quxVa/+Riq3FWvj/wBhiq9sVcq/DiruOKqbYqqf5GKq bYq3+1iqz4+eKuX4/t4qvZcVWc8Vd/l4q5VxV3wrirv8vFXYqp4VWrgVdirbLirWKrWZcVd8 GKubFXNiqj9n7eKr2bFXf6/2MVWf6mKub4OeKu+3i1uTFsWf6+LW1iq3JJXr/kZFm2uFWm44 Fd9v48VczYqs5YqpriqouKqbYquxVb/r4qtfFXYqs5cMVc2Kublyxa2vtYti1/8ALxa3MvLF V6/F8GLYs/18Wt3wYqptiqpkku4/F8GRQo8sklfzfIoUvj4ZJLlbFVytkUP/1vs22XNLfH+f FVn/AA+SSv4/FkUKvH+TFXYq2zYqs4/DirlXFV/LFscv+Riq/FXYqsXFV+KuVcVVMVWriqpy xVytiqmzfDiqpx+LFrdxxbF/+virX2sVdyfFW+OLW7/UxV37WKtfY+3irvtYq36fPFsX4tbu P7eKqeKq6/H8GLY3irS/5eKruXLFEGlxZrvgxYrsVbXlirWKuxVvjiruOKrMkwVsizdwxVZ9 j48VX/Z+xirsVdirmXhirsVdwxVd/r4q7jiqoy4qs5fyYq5f8jFXKuKr+P8AweKu5/sYq77a 4q7lxxVe2KtYqtbjirv28VcrYq5m44q7Fkv44sWsVbVv2MVWYsm+P7GKtYq7FVTjyxVbkFVO eKuxVZyxVrFVRlxV3w4q7jyxV3wc8VdwxV3DJsXcMVcyrirv9TFXYq7FW+WQVdx/bxZLG/kx Vyt+wcVX4sWmb4sVa/18VcuKrlbFku/nxYrOPPFXc3xVv9nJq7j8WKquKrft4qtxVczYq5cV XYqoriqpxxV32FxVrk+KtriqnyxVtePLFV7Yqp8sVdxxVtlxVeuKqfHFV/F8Vb9PliqxmxV3 H+fFWmxVv9r48Va/1MVdyxVvIK0n28Vb9TFk0rYsXM2Ku5c8VbxVauKtq2KuVcVW88WS5smx Ws2Kr244q3iq3/XxVbirsVX/AA4qs4Yqp4qqM2QZO4Yq0mLFvFks/ZxVc+LFvhiyU8VX4sW0 xZOxVTxVcy5NVuLFdwxZKeKtp9jFVy4sWsVWtiq/liqzFkv48MWLlxVrFXYq3yxVYy4q77GK uZmxV3LFXM3/AAGKrsVUvixV32sVdyX7eKt4qt/4liruOKrePwYq7iuKuxV2KuX/AC3xV2Kr +XDFVn7WKreOFVuBW1xVY2Kr/wDIxVYzYtbmxbGuL4q5pGxRNZyxS39rFW8VU3xa3Ytjm/y8 Vc3+XiruGLWt/wCI4q02Ku/18Vcrf8Bi2Ob+fFWv2+GKtt8Xx4qs44q5mxVTXFW2/wAjFWmx Vvj8WKrG+NsVdiq9lxVR/wBfFXf6mKr8VWLi1qa8uPDFW+OKr2XFVLlkkub4cVWN/kYqu+39 vIocrYqq4qhckl2Kr2+P48ixf//X+zf+XlzSqcfixVZ+xwxVeq/yYq79jFV2KuxV2Ktti2O5 c8Vaxa22+PFsXviqniqpwxVUxVb/AJGKubFVRlxVTbFVT/h8Vd+3iq/9rFWsVbVcWtrFsVPg 4Yqo/ayTBcv+XkUN8sVX4tin9rFVTni1u54quXFsdiyW4tKsvLFsWft8MVcvx4qvb+fFV6/a 4Yq5f8jFWsVdxfFWlyTBVVmyKFPFsVG+LFXc8VczYq5W/bxV3x8MVd9jFXfYxVazc8kwVeP8 mRQv/wBfFsWN8XwYq5WxVfy/4DFVjfE1cVXr/Pirv9fFXf5b4q5vj54quxVbx/4DFXM2KrsV diqmuLJVbFisZcVWr8OLJf8AZxVvFi7FW+OKrMWSs+LFZyyDJerYq5f5MVWM38+Kr+GKuxV2 KuybFbiyXc8WKpirX2sVWYq7jyyDJvjixcuKuXFW3+3irS4quxVT54qqK3xYsnYsWl+xireK t5NVrYqqfbxVT44qrYqt44qp/wCviqpyxVy4qs5viq//AIjiq3FXYqu/YxVZx+LFV64qs5vi rv2sVbxVrivHFV7YquxVR5Yq7jirv8jFXf5eKtt8eKr+K/sYqptiqo2KrPs4q74PsYq03H7e Kt8fhxV3p5Bku/yExYqSYsl7NiqpixU8VW8sVdyxVU4piqxW+LFXfs4qsxVdyxVrFk5MmxXr 9jFW8VUfixZLvixYr0+3iqz7GKr144q02KqeLJv/AIhkGLfPFk7hirkxVytzxVz4q5uP7GKu xVYrYqvxVbwyatccWLWKt/aXFXcsVa44snYsVvLjiq9sVdyxVSb4cWS7jixWfs4qvZsVX8sV axVay4q77GKrP2cVXriqm2KubFW+P7eKuX+fFW8VWnFE1vDFLm+HFXN8WKr/ALOKrGbFXK2K uZcVWN8H28Vcq/yYq7lirmZsVaxVan+Rirvh/bxV3Ljiq7FVFsVXYq18WKtcsVW8MVWM3xfB iq98Vd8TYqo5JgvVcihy4qsySXfHkWa9o8Ku5LxwKs5Yq5mxVYrYqv8A28VWNxTFWmxVtWxV Zirv8jFVnLFV7c8VWccVaxa1rcft4quxVa2Kr+OLYs+3/ssWtY38mKtZJLsVWriq3niq7/Lx Vvj+2+RYv//Q+znxfby5pW/ZbJJWM3ZMVVuPw4quZf8Ah8ihzf8AEMVXtiqxftvi2L+WKr/2 sVdirsVdirsVd/l4tapi2OxVcq4qptiqu2KrF/4HFV/LFV7R4qoquKr/AIsWtzYq5W5Yq5V/ kxVrFW/9fFW3ySV2RQ58Wx3PFV3LFW+TN1xVvFVvHFrVF5YtjuWKu44q5m5Niq77WKu+1ira /Z+PFXLi1r+K4tjsVdwxVz4q7/XxVytiq/7fwYqsb7WKub+TFVuSYKjZFDlxbG1Xi2Kub+fF XfZ/1MVbxVr7CYqq4q7FVv28VXYqtbFXccVd8P2MVb5piybxYuXFktb4cWLsWSt9n7eLFTxV vlzxVrFVuLJW/wAjFi7l+3kGTvtf6mKrFX9vFV7Niqz/AFMVbVcmq7hixdiqpiqnirsVXLir l5ZBW8VW8sVc2Kt/DirXHFVuKruOKu44q2rYq5uWKtq2TVr/ACMVb/a+PFW8VW8sVVsVUm44 q5eOKu5fFirS4q3y+LhirUn8mKu44q2v2f8AIxVVxVb6eKu+x9vFVjfBiq/h+3iqz9nFXNxx VVxVbxxVTbFVTliqz9rFV6riqzg+KquKqS8cVbxVpvjxV32PjxVzLirXHFV/22yCtcfh5vir smrTNirTKuKr1yCrcVcq/Diyab7GLFZiq9mxVrjirafbxVvFWv2sVa5Yq3+1iruD4qs/Z54q 3k1c+KuTFVqriyXcfgxYr2X4uGKrOGQZO4/8BiqzjwxVf9jFVjYqvxV3PFWsWLsVbXl9vFk5 lxVzLwybFT5Ysm2xYtYqtxZL/wDXxYrP8jFXMuKrsVW8sVXYqtVl/wBhirm4/YxVdiq1sVc2 Ku5Yq7jiqz4cVbxVdyxVbirS/E1MVX/b+xiqmzfFixm39v7GLJZiqpirTNiqxf8AIxV3x8MV XcsVUuTv9vFXNi1u48f8jFsaxV2KrW44quxV2KrW5P8A6+KrP2cVcv8APira4slvHFit4Ytb kxbHN/Jirm/kxVTaTFrdirS5JLuOKqvPIoUV+LFXLi2LsKrWZv28DW7ji2OXFVP/AF8Vb/Zx V32sVcy4qsfFVjYqv54qsb2+xirWKts2KrOH7GLW5WVMWxzfyYtbl+x8eKrWxQtyTJpV5tir eKqf2lxVyYq74cixf//R+z/HLmlTySW1+DIoVlXFXMzYq1irbYqs+3/lYqrPi2OxVz4q7hir ueKuxV2KruWKubFV2Krv+I4q7l/wGFV6rgVfirvs/Biqgv28VVFbFWsVaZskwXceeRQvxV3P Fsc3+RhVUwKpvirsVXccVdxxVtVxa1XFsU8VXcsVX/5eLW1i2NtirlxVrFVTFrcrcWxbHfbx Vy/ZxVyrzxVf8WKrMVd+38eKqmKqHH9jFVRVXJMF+RZuxVa3L9vFW2k/yMVd/kfsYqq4qpfF iq/9jFVi8sVVcVdiq1sVcq4qvZcVWcuH+viq/jiqzFk7FV3LFXYsVz4slrYqtxVUfFVytkFd iqzliq/l8eKu/wAjFXYq7JsXcWxVfxbjwxVZirvhxVbiyX8sgxXYq5uOLJTVf2MWKriyaVWx V2LF2Krf9TFV3+XiyXqv+Xk2Kz9nFV/wviqz9rFV6riqz9rFXfZxVf8AbxVZ8WKu5fz/AGMV X/5GKujbFXKuKrGXFV/+p9vFXSMv+wxVYv8APiq9v5MVU+WKrsVXK2KrPhxVf/l4qp/5GKqi syriqmy8cVVF44q5WxVR+3iqsq4q5cVU2xVzYqqL/wAJiruX23xV3+Xiq3FXYqqYqt+1/rYq 5VbFVnHh9vFVXFVq4qsyCuxV2KuxVbxxVr/LxZL8WK3jirbLirTYq7lirbMqNirv9fJq7jiq 3iuKuxV2Ku54q7FWsgrbN2TFkp4qqPiqniqpirnxVYqtiq/l+3irX7OLFv7TYslPJsV2LJrj ixWt8GLJrFV2LF32cVbXFWmxZOxYrcWS7Fi3x+HhirWKrW+L48VXt/Piqxf28VcuKu/yExVZ 2fFVXFVHjirbfYxVzNiq/kvDFVFMVXcsVW+o+KuTFXM38+KuZcVdwxVZ3TFXccVaxa21xbFj Yq7/AC8Wty/77fFsd+xiq7FVuLJRfFpVMWx2KqeLW7FsdiqkvHJMF0eRQvxVSbJJc2Kt/B+3 kUN8cWxZx5/sYq77f2MWty8WxbHenz+PFV2Kod8VVMVU8VXcsVWsuKuTFVPFVT4cVWMuKtYt ajx+L48VVFb9jFV2KrWxVSVckly8sVVePpZFCH5fyZJLvhxV2RYv/9L7N8cuaW/hxVarZJKv kUOxVT45JK7lkUK2LYsXFXLirlxVev8AJirkxV2KuxVyYqrLirm+LFXcea8MVdyxVe2Kr8Vd y5Yqh+OSYKq5FDvsPi2O44tbv8jFXNiq/iuLY58VcmLW7/LxbF6rireKuxV2KtKuKr2XFXLi q9fg+DFWsVdirfLFXccVX4tbsWx3DFXcMVcmKuZsVaWThireKuX4GxVy8v28Wtyt+3kkr1XI s2uOKu44qqft4qs4r/s8VX/5eKqf+viqtirsVW8VX/UxVdirsVdiruWLJtcWLvixVy4q1irs Vb44q2rYsl3PFipriybbIKvaPhirT4sW1bFk5V+LFV6fbybFS+xiyXM3PFi5lxV3FcVd9r48 VXNirfxIvwYqtbIKuXjxxZOxYrf8vFXNiruWKt8uX2MVa44qqrk1d9n40xVT44qqSL+xirX7 XwYq3y44q7/IxV3Ljiq3FVyf5GKuf/LxVzYq5WZPjfFV7Yq1iqniq71MVdxb9jFXKq4qs+LF V7Yq79vFXLirmXFXcf58VWcf5MVcvv8AbxVev2v8nFXfBiqzimKr2xVY3F8VX/t4qptiqtiq 1eOKqf8AxLFVbFVJuWKuVsVaXFV2KreOKqjccVU1xVU+3iruH7GKqX+RkFbZeK/5eKtNirfF MVd9v4MVc3LFVmKr+D4qsTFVzYqubkuLJT+HFiqf6+LJb/r4sVv+Riqp8WTVYmKr1+DFVn28 gyd/xDFXcVxVY2Kr8VWccVd8aYqvxVrlxxYrf2sWS/FWnxYrGybJbirf7OKt8sVW4qv44sWs Vb5YqsxZL2xYrFxVzL8XDFV2KuxVbw/YxVyquKrsVUmXFWuOKqnL4cVaX7eKtr8P28VWLyxV VxVRyTBav2sizd/kYq77PxpirnxV3LlirnxVzNzxVTxVtsWt3LFscy8fjxV3HFVjfz4q6NcV XYqtbFVNsVdyxVU44qo+n8OKqmKqHwv8GLW7/UxVbyySW8ihbkkr1yKHftYq7/XxbHf6mKqP L4sKr14/sYFdxxVzNyxVbirX7OKrMVVMVU2X9sYqp4q7FW2+JaYq5sWtrFVvHFXLirlxVzL+ xiqxlxVYuSS232fgxVrliq7j8PPIoWr/AJeKv//T+zf+plzS19j4MklVxV32Mihf/qYtjmXF rcq4tjuOKr1Vv2MVWcf5MVX4qs44qvZcVXq3PFVmKrv9fFV2Krv8vFV2KrVxVercfsYq5V54 q5sVWNhVvlhYLmyKHNiruWKuXFV+LYp4tapiqpi2LlxVT5YqqLirsWSniqtixdirbYq1irsV bXFXKuKr8Vc+KqmKqa/5GKuTFVPFVRW5NiruX8mKrmxVarcMVXf8SxVdiq5cVWcueKub7GKr +PHFXLxxVyt8Px4q5mxVdiq1uOKrsVWs2KuxZOxV2Kr+X7GLFrFVyYsmmXFi5vjxVv8A4liq 7hiqzlkGTuX7GKr/AIsVdirXDFi39jJqqYqp4q7l/JiruGKrlb9jFXf6mKrfiyDJdxxVvFi1 y+LFW+XxfHiydixa5cMVbxVvJquVfSxVYy88VbxVa2Kt83xVf/PirTLzbFVvxYqv5fDirlxV y4q5sVd/r4q74MVd8S/bxVyriruOKr2/nxVr7WKrPUX/AGGKtnj/ALDFV/LFWsVW/wCXiq/7 H28VaxV32cVb4/t4q1iq34MVX8eK4q1iqkzYq7lzxVe2KuZf5MVdxxVyf5eKuVsVd+zzxV3+ XiqyNv28VaaT9jFVRl/bxV3D9jFXM3w4q77P+riq7mmKqX2/gxVfJiqm3H9jFV68sgqnxxV3 +pirf2cVbaP9vFk18X2/2MWLv2sVWYqv+BMVabFWm54slzNixbxVYy5NXYq7FXKzZBk5MVU8 VXpixbVcWTm4/sYq7nirnxVZyxV3HFV6/wAmKu+3sn2MVWcu37GTYuXFWmxZLcVX8l44sXLi rmxVzYq5V44q5f58VWNirlxVe2KrOOKrsVUvixVf/l4quxVTxVpWX7eKr2VsVWcHxVvFXYqp piruGKqmKqbNiruS4q7kuKub/L+3iqxVxa1rLkktMzZFmuxVv7fwYqsZcVU+WKqjLiq3liya xYTbxS0q4q0zft4qtfFXLzxVz4qs488WtrFW9/58Wx3Ht+3i1u+z/r4tiyT4cWtd9rFsdiq1 lxV3Hl8eKu5YqsVvhwq5WwK74cVWYq58Vdiqnirf7WKu5clxVrFrdiq3jirmb9vFXMq/bxbF PJMG+LIuRQ2uSSsZlxVZ8P7eKu5Lir//1Ps1x/kzIal32siheq/FiruS/t4q1xfFV+KtquKt YtjfHFV6Yq58VcvDFXcMVVMVU/2sVX8eeKr1xV3Hj8GKuX4cVdx44qvbFXKuKtYq0y5Jg5Wx VdyyKGsVc/2MVbVsVX/5GLYs9PFrVmbFsWLzxVd/r4q5cVc2KrsVXYsnLixX8cVWNiq7FXYq 3x+LFVq5Jg3kWav9v7eKrMVd/l4qu5N+3irbcsVWK2KuVVxVfx54q7j+xi1r1/4fFsczL+xi rn/y8Vd+xirmxVdiql+1iqtyxVZxxVe2KtYqtxZO+3ixXYq3y/kxVrliyW4qqN8OKtM2LFpc WS5MVdiq5f8AhMgruGKqeKqmKufFXcMVd9vJsXPirvt4q7hiq5V/kxVr/LyCtcvgxZL/ALOK uxYtfB+xirbLiya4tx+DFi0uKtr8eKuX4MVVP8jJqpqvLFW2XFXMuKu4/wA+KtKv8+Kq2KqS riq/l8XPFXK37eKu4rwxVbirSrirvixVr/XxVU48lxVyquKu+38GKrsVdiq1V/4DFV2Kttir vtLirv2eCYq1irbYqs5ccVXriqz48VcuKu+2uKu+DFXK3/AYquxVa2Ku+3irv9fFV2Kt/wCR iqliq5vixVYq4qvZcVc2KrPsfHiq/wCH7eKqf/EsVVOWKrsVUuXb9vFWuOKqjL+3irv9fFVP lkGTeLFbyxVtff7eKtccVXYq0y4q02KrsVc38+LJTVcWK7lira5NVvPFXcMgyaxYu+xirsVb xZLFXjiq77eLFtWxZO54q7FXN/w+KrGxVvnk1Xcf+DxYqfLFktZv5Pt4sV/LnirWKuxVbx+L FV3LFk39v48WKz9nnirsWTvt4sV2KrfsfYxVpW4/A+Kr8VWsuKuX+TFXccVcytiq3FVrYq38 OKub48VWYq7hirkxV2Ku4Yq7niq34f2MkwXPkULPhwtjWBXfZxV2LW7FsU2xZLuWLFvFE1Pj hSvbAqz7aYq02KrcVWccWteqri2LOOLW0vLFW2xVy4q1iq3lyxbF/Lni1qWLYt+LlirlxVWx VS+LFXN8eKtLiq7FVN8Vc+KrOOKr8VWfC2KtYqt5Yta7FsbXFUOzZJg1yxVtuWKuZsVa/wBT FVv28Vf/1fs/w/Yy5pU8UK2KVrYquZvi+PFW1xVr7fx4q3yxbHLxxVfzxVTxa1TFsdwxVUxV pm+3ireKqmKqPHFVbFW/tvirm4/YfFXMuKu+FsVcuKuXjx/yMVdxxa3ccVdxxVezYtjnxa3c MWxyquKrmXjiq1MWtdxxZwXfYxZrcVVGxYrsVWriq7FXYq7FXYqqYtbkxbHYq7FVy4q3y/Yx VZ/r4q5MVdH9vFV6rireKuxVdxxV3+XirmxV3HFVPliqpx44quxVb+3irlxVdirbLirS4snf ZxYuxVdy44sl3L+TFitxZLsWK9m/YTIMli/yYq5lxV3PFVn+Riq/4cVdirsVdk2LuGKrcWS7 Fi3yyCt8ueKtNirbN8WKtq38/wBvFktVf5MWLf2cVbxV2Kt4sm+PLFi2q/sZNVkar+3iq9lb FVuKrm5KuKu/1MVXYqp4qqYqo8cVb/a+DFW8VXf5H7GKu5/sYq7j8X82KrsVWr/Jirvt4q5s VcvxYqvVcVWSN8PwYq5lXFXN/Pirvt/YxV3L+fFXf6mKu+PFXfYxVdiq3liq7FW+WKuXjirl ZcVWfYxV37GKu+LhiruKYquxVan+Riq7FVPFV3LFVjNirmbFXfFiq9v58VdxxVYv8mKrl+38 H28Vb/18VXYqtZv28Vcy/wAmKu+3irTLkFU2xVcy8PsYsmlbFisxVcuKt8eHwYq3iq3lirfx Yq1yxVcv+Xiydx54qs55Ni5VxV3w5Bk5MVc+Ku4t9h8Vd9jFXJirsVcmKub7WKqeKqn7OKqa 5NW+WLFZiydiq/jixaxVtVxVZ/qfbxV3LFW+PPFk18GLFeuKtYq7FVJv+IYqq4qt5cVxVYvJ 1+DFV7fyYquxVS4r9t8Vd8H7GKtLx/bxVtuWKrG/nxV37XB8Vd/kYq7hirkxVyYq7/IxVT+z ira4tbTfbxbG+PD7GKu44qs+y3PFV2KuxV2KrX/yMWtTbFsXYq7FVPFXf6+KuTCqz/IwKt/y MkwcuKruWRQ5sVWZJLvsZFm5V/bTFXP+3iq7FVq4q5mxVTbFW2/kxVY+Ku4tirsVdiqzjirW Kt8cWtrFXYqt5fDirsklZx55FC1mySVzfYyKFL/XySXYq//W+zTLmQ1Kq/z5FDvsYquxVvji rlXFXR4ti9MVWcsVX8MVWcsVX4quXFVqYqqYq1x4Yq3irsVXZJg5P8jIs1ytyX/LxVteT/G+ KtYq5eWLW23+Xi2NYta3JJVkyKHcf58WxT+zi1qiYqqYtjsVdirX2cUQVcUuxVa0eFXf6mBV 2KrWbFV/HFWvs4q23x/Yxa1VlbFsUmbFV6Yq77GKuxV37WKu+3irmX/g8VXx4VXs3HAq3FVz N+xiqzirfB+3iqriq1P8vFVnH4sVX8sVd+xiq/liqxuOKu/YxVdirXJfsYslyrxxYtYq0y4s m2xVcv2vgxVc+QV2KuTFXYq58VdiqxmxVrFVRueKr+D4qs+HJsV7LiqxVxVcq5BWv9fFW/tY qs4Yqv8A2sVb+LFkt44sW+PNcVd8OKuZsVXquKttk1WcuLYq3iq5mxVdiqky4qvbFXMv8mKu /bxVTbFVTjiruXxYq77Lc8Vcy4q5VxVzLiq//IxV3LFXN/Piqj8WKquKrV4/t4q7/XxVy/Di rv2MVdy/nxVfyxV3w4qsZsVXYq3xxVZ9hcVXriruOKuVsVdyxV3Lhiqz4f2MVcq/Diq7FW/s fbxVzYqs44q5vixVdiq3liq7FVq4qp/5GKqn2GxVT+x/r4qqN8H+virvjxV3H+TFVnLhirXH FXMvHFXLircbYqqZBVvx4qs/a+PFW2/nxZLWxYrsVW8cVbZsVd+3wxVvFXYq3k1Wsv8APiq1 MVdwxV3PIMnJirm/y8VdiruGKuZeGKqeKr/ixYt4snPiq3JqtxYubFkqPixW4slPFVzYq7Fi tVsVcrYq79vFV2Krf8h8VXYq39j4MVWfbxV3x4q5fi+DFV2KrZFxV328VU/8vFVTliruPw4q sbl+xiqzhirueKuxV2KufFXcVxVZxxVrFrb/ANfFsdxxVZ/kYqsb/IxVrliqpyxV37GKuZuW LWsb4MWxZyTl/l4qv+y2KrExVdxxVbwxVY2KtYtam2SSqZFDn+xi2Nq2KrFb+fFrXYti3liq 7FVHlirbLiqxWxV3DFXcMVdirnxVz4qsbFVnHFrXq3w4qsXFV6/Biqz4MVUuPw5JLeRYtMuS ZLOeKu5fD8GKv//X+zfHLmlWxV2KrVbFV7fz4tiz7GLWv44q5fjxbF/2MVdxXFXL9r48VWM2 KqvLFVvHn8GKqmKrlxVT44qrYqt5fDiq/wDyMVcuKuXFVmSYLeWKqvHIocq/D/l4ti9MVcvD FXMrYq5mxVy8uOKq37GKrsVW8sVW4qqYq7FVq/z4ta9W+HFnBrFLsVbbFXcv28KrlXAxg38X 7eLJ3DFXMv7GKuX+TFXc8Vc+KuTFVvxf7PJMEQrZFmprirmxVWxVbxxV3wYq7/LxVdiq1cVX Yqt5YquxVtvjxVZiyXYsVuLJ2KqiYqt5YqqcMgrsVU8VVOXxc8VcrfFirv2sVX4sVmLJy/Fi q7jzxYrUyaqmKqbNiq9VxVb8XHIKuxV2KrlxVSX7PwYsl37WLFvFXYqt44qr5NVFsVVGxVZ+ 1irXLFV2KtL/AJGKr+H7eKrF/kxVf8GKu+PFXLirvsLirlb4ub4qv/yMVcy4qsbhyxV3H4sV X/5GKrFZcVXry/bxVrFXYqtZsVc3w4qvX+d8VaxV2KreWKu/Z54q5eOKuZW44quxVa38+Krs Vdiq37f2MVXcXxVby+LFV2Krf28Vc32v8rFV7cvsYqs44quxVbyxVT/1MVb5fDireKrvttir uH7GKrOX8mKr/i5Yq5P8vFV2KqXHivx4qv5YqtxV2KruXLFXKuKqfxccVczfz4q1yyCt8eGK tcsVc32ueKrvtYslnL+fFW/8vFi3x/bxVvFXL9jFkpqv8mLFfxyarWXFXc8VcmKu+3irvids VdirsVUl+D7GLJVb4cgrWLFtW/4PFk7hiqxcmxcq4qsxZLmxVvjixXcuLf5GLJZixbZfixVr FVvFeeKuZcVXNiydixW8cVWLyxVfy+HFXcUxV3LFVPjircjftpirS4q5sVbZeH2MVX/bxVD5 Jgub+TIs1n7WKr+GKu4Yq74sVdwxV37OKuxa1FsWxfy/kxVYrYq79jFXK2KreOLJcrYsXLi1 qPH9jFsVMVU+eLW5MVdzxVzN/Pi2OfCqjhYLsih2KuxbG1XFVjLyxa1Pli2Kjf8AD4q5V5Yq 7l/wuKrOP/DYqsxVUxVTxVTxVU/y8VU8Vb+LFVn+Xi1rsVb/AMvFVi8cVUvsfbySWv8ALxVU XFVFlxVevHFX/9D7NsrZcxV/2cVdyxa1i4q7liruf7eKr+XP7GLY1iqpzxVT+1iqp8X+zxVy /a+PFV7L/s8Vdy4fYxVf8eFXM2BV2KuxV2Kt8cVWNiq79jhirfLhi1u44qsySW2xVcrft5Fm vxVZ6eKr8Wt2LYv+LFV/+viruPFsVd9v7eKu44q1y/b/AG8VVFxVY38mKr+OKu+FcVaxVtPs YVXf5GBjBv4v28WTuGKu48cVdiq9fiamKrOS4q79nFVv+XkmC7i2RZr2XFWlxV3LFVbFVv2m +DFVi+32MVX8/wBvFXft4qtXFkuxVdixW/6+KrsVW4sm2+PFW8WKpirlXFXM2QZNYsW0xZOV sVcmKuZfixV32MVaVv5MWLbfa4YsmvtfYxYtcMmyVVbFisVuGKruWKuVcgrfHniydixa+1ir uP7CYq5mxVVxVS45NW1bnireKuxVrj+xiq9f5MVdz/YxVy8VxV3LliruP7CYq0328VVGxV32 3xV3+viqxeOKuXl+3iq/4cVU1Xg2KtquKuf/ACMVd9jFXcUxV3HFV2Kt8ueKrOOKuX+TFV/+ piqzliq//U+3iqnxfFW+LMuKuXFV32cVbX4MVWfHiq7FVrYq7l/Piq/7H2MVdyxVYuKqn/Es Va4t/s8VWc/2MVX8sVWcv58Vcq4qvXFVnHFXcP2MVd9jFV/HFVnHjiruP7D/AG8VWcW+xiq+ Rfi4Yqs4pirXLFW2VkxVvFVzLirvi/YxVYn28Vdy/nxVzcsVW8sgq74/2MWS1sWLfHt+xirm /wAvFWlxVdiq3liruWKtYsl3JXxYuZV/YybJbxbFi77GKuVcVX/ZxVvFWvs4qpJiyc+KrueQ VrFi3iyUvs5NW/8AIxV3LFXYsVz4sluLFvj8WKrGxV2LJfxxYtYqt48fgxV3HFV/HFWsVdir sVdiqnirX2cVd8X2MVdy/bxVrj8Px4qqNyxVTyTBbzyLNev2MVWc8VdyXFXPirvhxVdyxVSX FVq5Jgu5fyZFms5fFirmxVdiq3lirl+LFXfbxVY32MVa44qt/wCIYq7l8eLW7hi2O+LFXc8V di1rFxVpuP8As8VW/wDEcWxzccVd/kYtbm44qpti2L/2vjxVzfbxVZxxVv4sVWftYq5ueKrG 44qv4Yqs5Yq19nFrdirsVW8sVd+xiqkv+XkkuX+fFViYqv8Ai+xiqzj8XPFX/9H7OcWbplzS v44q5cVXYq3/AJb/AG8Va4vi2Ntiq9MVdirsVdirl/nxVfxbjirvU/bxVf8AbxVyriqxm4/H iq9cVd8SYVXxt/PgVy4qvTFVnLFrcvLFsa+38eLW5PsYqqfD/s8Wx37OKu+y2Ku/4hirsWtc uLYuxVUxVR/18VXr9vFW+WKr/t/Birm/yMVcuKtYq38aYq1i1qnFuOLY7hirsVdy/wCAxV3+ pirsVd+ziqn9rFrV/wDIfFWmxbG2bFXK2Kr1VcVdyxV32MVdyxV3wYq7jxxV2LJcuKuxYuxV 2Kts37GKt4smuXDFi0uLJ2QVUxVz4q79nFXcuOKu/wAvFXftYqvX4/gxVZwxV3PFXfs5Nit5 4sl3PFi7niq77OQVto8WS1cWLf2cVbZsWSnixVuXxYq1k1XccVU2b4uH7GKtxriq/j8OKrF+ xirlVf28VX8sVcuKubFXft4q71MVczYqu+1irfL+fFVnLFXcP2MVXM3w8MVb44q1x4ft4qt4 /wDAYq5fiXFXcW/YxVdiq34mbFXNiruOKubFXcsVc3w4q7j8P+XirmbFXceOKr+OKu/yMVWc sVd+xiq9fjxVYrYquxV2KrVXFXcv+DxVdiq348VcuKtN9vFW+XxYq71PhxVerYqs+Lhiq74P 2MVdiruL4qtZf2MVd8GKu4/8HiqyRV44q79rFV7YqtxVcq/z4qs4pirXLFVTh+xirpPixV3H +TFVLlkFb/b54q7imKt4qtXFW3+3irlXFW/2OeLJrlirXHFiuxV2KuZsWSny44sV7Nirm+D7 GKqPHJslTFi7niq9v8jFVn7WQZOxVzNiqzjiq98mxUcWS/7fwYsW8WTsVWcf5MVcq4quZcWL vhxVrFW2XFVi4quxVb6eKrGbFV/7eKrsVWKvFcVWLirlxVWxVS/axVeuKqatxxVtuWKqbNwx Vv8Ay8Vc+Ku4Yq7i2KuTFVjNi1tcv28VbXFsaxVv4cWtY2LY5VxV3H/gMVdiyU2xYuXFVvL9 vFXJirsWt0a814Ytjl4Yq7kuKqfNMWtvjiqlyySVTIs3YqtZuOKuZcVd9jFV2Kod8Vdiq5sV UftYqqYq5f8ALxVYzLiq/FVFsWtdirsWxtcWtZyxVay5JKn8XLFVbFUPwxV//9L7NrlzSrsv 8+KtYq3y5Li2NYta1Vb9vFsXfZxV2Kt8mfFV/DFXf5CYq7FV6/Birm+xiq9l+HFXccVWftfB hVvArS/byTBWbIs2vs4q7FW2bFra+1irfHFWsVVP+J4q7FXfs4tjsWtcuLY3y4YqvVlxV3L9 tMVdiyXYsW14tirf/EcVa/ZxV3+XirvhxV37OFV+BXYq77eKuxV32fgxVzfyJirvixV3+Riq 5cWtvFlBvFk7FXYq0vHFV/28Vdx44q77GKrsVbVcVaxVtVxVrFXYq7FXYqqcf2MVWccVdx/n xVrIMl/7PDhixbxZOxV2KuxV2Kub7WKu/wBTFVyrixdxyarfs/Hiq9f58VWZBk3/AJGLFd+z iyW8sWLmxV3/ABLFV2KrWxVVXlk1dyxVT44q2rft/sYq1/l4quxVdy/kxVy8cVXfZxVb8T4q v4/t4qsVsVd8GKr+XDFVn7eKr1bFVi/z4q5m/wCAxV328Vd+xiruXw4quxV2KttJwxVZyxVf 8WKrG+Lhiq9eOKtMvFcVW8sVX/5aYq7/AI0xVZyxVzL/AMBirvi/2OKubFXMy4quxVarfyYq 7lxbFXfbxVpfs/5OKqnxJ/qYq1irsVWsq4quxVZxfFW1+xirm5fbxVe2KrFxVdiq3h+xirlb liq/9rg+KrOOKu/18Vd9vFV/2lxVYrYq74MVWfEuKr14csVd8eKqf+piqozcmxVdiqiy8Pgy CquKqXB8VVGxZKXHFiuX7PDFkuZcWKxlxVazYsl+LFbyxVy4qt54q58VdzxVfxyarcVdiq9m +LhiqzFXKuQZOxV2Krcmqz4sVVeGLFY3wYq7liq1mxZN/wCpira/yPixWMuKrsVdiq1sVcuK rsVdiql9hMVXtiq3FVzLiq3FV3+viruOKrF+PFWuWKtsuKrOP7CYqqYqpKv7f7eKttx/bxV3 JkxV3DFXMuLWt+HJJW5Fm3xxV3HFWsVdhVb9v7GBXfBirmxVYrYqs/yMVdirueLW7hi2OxVz Niqzji1r8VU8VXLhbFHlhYLuWBmuwK7FXYqt44qo/H/Liq9mxVRbFV/PFVPFW+OKr3xVTxV2 LW7FW2xbFjN+xi1qfH4fjxVyr/JirXHFCxlyTJ//0/syuZDUiWyKHfb+3i2ObFrWccVcuKrv tYtjsVbbFV+KuTFV/Lhiqz/UxVc2KubFXf5GKubFW+D4qvjxVfx+L4MVXr/O+KqK4quVua4t bm+3irfL4uGKr+GKu4Yq7FXYq7hi2KmKreWKr+WKIN4s3LixcuKr/ixVZyxVf8WKu5Yq7lir v9R8Vb/4li1ruX8+LY5W4/Hirv8AXxVzNzxV3H9vFXK3DFVv28kwVf2sihrji2K2KqLMuKtr /kYqv5Yq5VxV3H+TFV2KreOKrsVWM2LJfyxVazL9jFi7Fk3xfFV3HhixabFk5uX23xVUb+fI K58VdirsVcrYq5lxV2KtcMWLeLJbxT/YZNVyYsXYqv8AT54qp8Mgqpiq7j/weKqf/EsVXMvP Fk1x+LFi1yxVc3F8WS/k37GTYqf+Riq7FXYqt44q7/IxVU5Yq5V+HFV2KreWKr2bFXLirlxV Yq4qv48/t4qp8XxVU+LFWsVbXFXLiqxVxVf+0+Ku5fz4qs4/yYquxVbxxVev8n7GKrGxVe3L FWvs4qt5Yq5lxVezYqs/yMVcuKubFXccVd9v48VX8cVaxVa/+Riq9f58VWcsVXtiqxsVX8sV axV2Ktq38+KtYq7FXYq3x/YxVrgmKreX8+Ku+xiq7FVi/bxVtlxVfxxVZ9jFXf5GKr/8vFVn LFXLxxVy4qp/FxxVU/YxVY3wfbxVy8f9niqpkFdiq1v2MVUeGKr1XFXKuKuZsVczcMVa44q3 +1irfB8WTS8sWKx8VXqvLFViYq38WTVezYqsTFV+38+KuZsVU2XIKtbkmLJfy/nxVTxVv/Lx VfwxV328mxU/s4q1+1iyXLixa5YslrYsXccVd/kYqvXFWsVW8sVd9jFXccVd8HLFV2KrfsNi qnyxVvj+3iq/liruSriqi+Kr5FXFVnxYqvZcVWMvDFXfs4q7/IxV2KqeLW22LYsZsVXriqn/ AMRxRNvj/wABil3FuPPFXfbxVb8GLJdyxYqfHFVjLzxVtMWtZxxVfi2OX+fFVPFrdx+HFXcf 2MVc328Vb44tjWKrW+BfgxV3HFVzN8Xx4qt5N+xiqnxxVtuWKrHxVZ/kYqvVv5MVU8Wt2LY2 y4qs/wAvFrd+1zxVdyfFVjMuKreD4q5WxVZyySW/ixV//9T7OrmQ1LpMihyf5eKrsVb44tju OLWvxbFNV+Hhiqo3DFXYq7FVzL8WKrsVabjxxVf9vFV2KuxVbxxVfxxV3HFVn2PsYqvXFXKu LW1iqp/l4q7l8eKuxV3w4tjsWtyri2L+X7eKquKreWKrsVU/8vFku44sV2Ktr8eKu48vsYq1 irfxpirfLCrStywNa/k2LY77XwYq1+wuKt/s4q5l4Yq5l4/t4qtTJMFXiq/HkWbv2sVbxVpe XLFV6t+xiqxWxVVxVS488Vdx5riqt8OKtYq2q4q1iq39nniq7FXcsWTfLFi1iqp8WKu5fz5B ksVeOKr8Vdirm+LFXN9rFXYqp4qq8cWKzJsly/yYsVTFVNV55Bkv4/Diq1cWK7FV3/EsVWcf 2MVa44q39nFWuWKrvsfYyar+WKqbN8WKuZuWKt/Fiq/9vFXKvLFXcUxVcv28VbVcVWcP28Vd y+LFXM2Krn+xirvtYq39j7eKtfZxVbxxVy8f28Vd8KYqv4/DiqxV/YxV3LFXfE+KrsVW8UxV diqzk+KqjccVaxVtsVaxVay/z4q7+TFV/LFVjccVXrzf4MVaxVauKuVlxVe38mKrP2fjxVzY qv8A2cVaxVbxxVzYqub7SYqt+3irlVsVcuKr2xVZ/kPiruPH4HxVfxxVZ9j7GKu/1MVcuKru L4qtX4lxVey4qs5P9vFV/HFVjLirlxVYvwYqv+x8GKu4/FiqxuOKquKrWxV37eKrcVbXIKtx VpVxVU/yMWSzFi0vHFW2bmuLJr4sWKriqH+LFVTFWvtYq1xxVrJq5l/bGKr1XFVitiruTZBk 5mxV2Ku4Yq7FXMvxYqs44q2mTVbxxVUfFip4q7FXYqt44qu44snYsW+OKrGxVdiqkq4qv/2e Ku+F8VdxxVZ8WKr1XFVn7OKu4/z4qsb/AITFXPirkxV3H+fFXN9nFV7NiqhirbYtbmxbHNir mbFXNiqxcVXYq7FVuLJTZuWLF3w8cVW4tbsVcf28VXq3/D4tixlX9vFVPFrdirfLFWm+NsVb bFsaxa1P9jJJWs37GRZqn7Px4q5/8jFWuL4qtb4vgxVzf5GKqPHFV+KrOXxYq1irbYtbuOKr P8vFV2KrcklZx/nyKFjN/Pi2L2+PFrWfs4tj/9X7OquZDUqZFDsVW8eOKrsWxvjzxVev+Xir l/kxV2KqfBMVV/s4q3irsVW8sVb49v2MVVcVUeOLWqcsWxf+1irWKrVbFV6s2LWs+1kku+1i q/8AZyKHfH+xhbF/DA1u4YtjkxV0f+XhVEYFU8Wtdi3LsWLsVWriq7FXYq38OKu+Hjirl+18 GKrVXnkmCrxX9jIodx/kxbHfZ+DFXN9nFXJiqpiqniq9VxVytiruD4q5m4Liqzniq/7OKr+W KrsVWquKub4vjxVe38+KtYqtX7PPFXcsVdiyb/ZxVy/yYqu5c8WLv2cgyX8mxVyYq7FXYqs4 4quxYtviyd/qYq7FXZNi5m54qu44q5W45BVmKr/tpireKreOKt/ZxVzL8OKu+x9vFW/2cWTl bh9jJsV7Liqz9rFV/Hn/AKmKrsVUVxVdiqrxxVr7WKreT/YxV3Fv2MVX/wCpiqz7f+yxV3Fm xV3HFXfsYq5uWKuVsVXryxVpV4/B+xirsVW8sVX8sVc2KtYqt5Ny+PFV2KrWxVeq88VWKuKr vs4q3x/kxVY32eGKr1bFWsVW/Biq7gmKrv8AiOKrcVb/ANfFVjYq74MVXtirlXFXL/Jiqz/X xVdirvs4qt+PFXLyXFXLirvgxVerYq79rFVi4q5eWKr+P7eKtYqt4/DirlX9jFV7L+xirmxV Yvw4qv5Yqs/4jiruPHFXN+xiqm2Kq2KrWxVdiqiy/Fiqo3w4q7jirvi5YqtxV2KreXxfy5BV XFVJfgxVzLzxVf8AYxVT5Yq3zfFW8VdwfFk0n28WKzFW/tLk1diruGKtZBW8WTv9fFXPiruG KuxV3PFXYq79nJsVNcWTmxVbirlxYuf/AC8VXtiqz7eKrsVW/D+xiq9sVU2+3irf2MVXYqt5 Yq77bYquxVR44q7j+wmKrsVa/ZxVZx/nxV3w4q7/AF/sYqu/4liq1l/4PFXJiqxuWKtYq7FW 2bFXM3w4tali2KmKuxVbxxVTbFXLiq1MVdi1u/y8Wxy/ZxVYrfyYta/l8Px4qo/ZySV/HIod x5/BirlxVZkkrsizWs2Ku5YquxVS+1irlXFrUeOKr+GLYs/axVzNirWKrWVsWtdiq39jFXf6 +KqeSS0zYq1/r4qtXnir/9b7M8syGpW5ccih3H9h8Vcq4qvXFsdxxVr7WKqjf5eKuVsVdiqp iqxlxZL8WLsVXcf58Vc3wf6mKrcVXf6mLWuxbG1XFXLiq/8AyMWtRySV7cuWRQvZfsYtjl+P 48Wt3+pirsWxzf5eKr1+DFXK2KuZcWtdxfFsbxZOZcWK9cVc2Ku+LFXLirWKuxVvji1r0xbH c8Vdirl54q7hiqniqsvH7GKt8fhxV32cVVcVU8VaZsVcvx4q74sVX8P2MVXYqt+3iq7FXYq7 FVvLFV64qsxZLsWLa4qvZcgyU8VVP9TFVPFVTFXYq7k2KuxV3H+TFWkxYt/Z+PJq5MVd+zir bZBXf5GKuXFV32V54smlxV3xYsV/FMVU+WKqrNyT/IyarsVW/wDD4q77eKubFVje/wBjFV6/ z/t4q7/L/bxV3D9jFXfYxVfy/wAvFVn+viruOKu/Z4P+xiq//UxV3J/58Vd8OKqfF8VX4q7F XYq23x4q7lzxVrFW/wBnFVnL4eeKrsVWriq77WKtquKtL9vFVv8Ar4qv/wAjFWsVWqvw4qv4 /sYq5sVc2KtKq/sYq238mKtfaxVtvg/YxVZyTFV/HFWsVW8sVd9jFXfBirvjxVf+1iqz4OWK rsVWquKr1XFXcefwYqs/yMVdw/YxVy8VX48VX8sVaT7GKrV44q7liq/j8WKrF/YfFXccVd/x HFXfBiqxmxVVxVS/axVpsVVsVWv/AJeKqa4q7jirmxVtmxVVxVY3/BZBVuKrWxVUbFVnw4q0 2Kr8WSzlixbZcVa44qt4tirfL9t8mq7/AC8VW4q1zyCt4sncMVdirnxVZxxVrFV6tixaybJT xVWb4cWKjiyX/s4sWsVWtiq7FVvHFV7KuKtYq22KqLLiq/jiqmrLiqo38+KrPi+3ireKrl5Y qp/Dy4YqvZVbFVJMVXs2KrPibFV3/EsVWt/w+KrmX+fFVL/LwqvZcCrPTxVS+3iyVW+PFis4 4qvXFVmLJdixU8VaVcVWYtbuGKuxbFi4tbuOKrVySVy5FDmXFWsVb5fsYtilxyTBcuRZrsVW 8sVWMuKtccVXYqp4qp4q2uKr8VWM2KtYtaxVxQvxSt/18VUeOSS3wfFVfIoUvi+wmKv/1/sy 2ZDUrYqvbIoab7eKtri2L2XFXL/JirsVczYq74cVVMVU8VXccVbZuLYqvXj+3iq7FVv+Riq/ 4sVaxVb/AJCYqv488WtzYq7/AFMVdxxVyrzxbF/H+fFXYtbv8vFXf5eLYu/yMVd/l4q5cVVO WKrsVdirWKILmbFLlxV3HFWsVbVcWtdx+LFlBvniycmKuX+T7WKr/wDI+ziqzFXcf2MVVMVb 4viqxl/YxVtmxVpl/nxVv7WKtNiqoq4q74MVdxT7eKuXFV7Yq7lirWKtcvhxZLlxYt4sl2LF ZxVemKr+eQZLPixVf9n7GKuZf2xirvhxVzLirWLFvFk7jyxVbk1XYsXcMVXN/PkFa44q2y4q 7j8WKtLiqtiq3l8Px4qsb48VVOXxZNXcfixV3HFVuKrmb7GKu48sVW4qu/2GKr+PPFVi8cVc q/Dirv8AXxVdirsVbVf28VWcuOKuVlxV3LFV/HFWsVW8f58VVl+HFVnHFXccVaxV2Kt/tYq7 jirX2cVbVsVdy+HFWsVbXFXccVWLirv2MVdx5t8eKr2+PFXL8DYq74WxVr7WKtr/ACYq1irf +pirvhbFXcsVdx/kxVYvLFV7LirlXFWsVWrirmxVytiq9sVWfBiq/jirWKreH7GKrsVW/sYq v/axVYuKr+XL7eKrFX4ft4q7liruWKr1bliqxsVWftYqvVvhxVYrN9jFWv8AIxVU/wCJYq5V xVytirmxVT44q7lirviyCuf7eKu5fDiq/wDZ+PFVvHj8b4smvhxYt4qu5Yqs+x8GKuZsVd8H 7GKreGTVd/qYqt/y3xVrIK7FW+GLJzc8VU8VVG+zirv2eGKu5fsYq7FXcvgybFRxZKj4qp/5 eLFerYq7/IxV3x/YxV3w8cVdxxVYy4q7lirm+D/UxV3HFV2KrVVfsYqsZsVa/wAjFVT7GKrP sfbxVpcVW/YXhiq9fjxVZzxV2KuTFXcuOKrG+1/kYtbWLY3+zirvhxVrFVrLyxa3M2LY7jir sWSxlxaWmxbFvLli1uTFXYqp8vixVU4/yYtin9nFrVHxVRySV/H+TIs3fY+3iqyTFVrNkmDT LkWariq34P58VWMuKrMVcmKuZvi+DFVi/wAmKu44q1iq1sWtdiqxvt4q2zfz4qsbli2NcsWt cuKHYpf/0Ps+q/FlzS7lirm/kxVy/wAmKrsWxvjiq9VxVZy/YxVemKufFXclxV2Ku4Yqv7Ji q9cVc3PjirlbFXf5GKujxVev2f8ALxVrFrb+HFWuX8mKtp/l/YxVZyxVWTFsdi1u4/t4tjlb FV6tirTYqrYqtxZOxVY/28WlW/axbFPi+Kr8Vb44qvb+fFVPFV7d8WMG8WTlXFXN/Pirvs/H iruX7GKr1bFVj4qv5c8VXr/w+KrF+z/l4q3iq5fsYq7lirv8vFXM37eKuxZL1xYrVbFk1yxY t/ZxZNYqqYq7FVuLFdxXFkuyCqeKuxVUfFXcMVcvxL/kYq5v8jFXM3PFV32mxYrf9TJq7nir aryxZN8cgq34f28Vb/1MWKpxxVbirv2cWTX2sWLf2cmq/l8WKrOPxYq74cVd8H7GKu5virvs tiq/4uWKubFXN/Piq7FVrYq7/UxVezYqsZlfFXLiruWKr2xVYuKrsVb/AGv5sVaxVv8AaxVY vw4quxVvliqxl+HFV/L+TFXf5GKu/wAjFXcv5MVaxVvj+xiruf7H7GKrGxVeq88Va+1irsVb Xjiqxf8AXxVeuKuX4VpiruOKu5L9vFXL8eKuZcVa+zirvs4q7FXYq7FVvLk2KrsVdirsVW8s VdyxVdiq1sVab7eKqnHh9jFXcm/bxV3+virWKuxV32cVb44q1iq348VWMy8eGKquKrW+HFXc f58Vdy/kxVrlx+P9vFVjYq5lbFVT9rhirl44qpqq4q2/28Va5vkFbxVrjzxVv9rFkubFitxV c3/D4q7jxxVay/5eLJr7OLFy5NVv7WKuxVrIK23w4sl7fYxVQxVvliq/FVjYq74cVa4viq7J qtxYuxVzYslrN+3ixXYqtxZLsWLsVdiq1cVU+WKqjYq7h/kYqs5ft4qvVv28Vdx4L8eKrPtY q5fj+3ireKqfHj8D4q7l8GKuVVxVyr8OKuxV3/EMVdx/nxa1rYWxr9nAqxcVX/s4qsZcVW4q qYqt+PFVNl44omuxSp/bxa3cMWxfx+LFVj4taz/UxbHfs4tbWKt8uf8Ar4q5fb7eKqS/8Pkk qrZFms5fFiqm2LWqKuLYsb7GKu+FFxVy/BiqznirkxVZxxVzYtbWLY2uLWsZuOKruP8AJirf 7WLYh1Zft5Jg7j+xiqrx5rwyKFJvf7GSS//R+zPHMhqRGRQt+xiq/lirXL9vFVT/AC8WxTxV vj/Jiq9lxVz4q7l/weKuX/h8VVMVU/iXFVTFV37eKrsVb44q7l8WKubk+KrPUxVf8WLW7lir mXFsWtkmCqq5Fm7/ACMVd/l4q7niqpirXLhiq5WxRBvFmp4q3ywsVb4cCu/y8VdxxVZiyXti xcuLWvb/AC8Wx3H4MVX/AM74qsfFXYq58Vdx5YqubFXK3w4q3+18eKuVsVaZv58VbX4/sYqq 4qpcf8jFV/8AxLFXKvHFXL8OKu+3iq9cVaxVbiyVnxYqfLFktxVfxyCr8VaX+TFi3zxZNK2L FtvtYsnYq5mxVp8WLa/8Jk1dirmXFWsgq/7WKuVfhxVtmbjiyXLy/YxYrOX8+KtK38+KqvFV yauVf2MVU2b9jFW1XFWuOKrsVdiq3jiqoq8l+PFV2Krf2MVXquKrFxVy4qu5pirsVU8VVeWK rFbFXccVX/5CYq1irbfHirv2cVdxxV3LFXcfixVy4qsb+fFV2Krft4qv4/yYq79rFXL8bYq1 irbLyxVrFW+WKrFX9vFV6/Z+PFXL/JirvixV37WKu5Yq19nFW/hxVrFV3/EcVaXlirlZsVdx +HFXM3w4q5cVdyxVZx5YquxVtcVc3wYq0v28VdirsVb4/Diqz4lX4MVdy+LFXLw5Yqv/AGcV dy4fbxVYrLxxVy4qvbliqz9nhiqn/l4qqKy8cVcvw4qtxVr7WKr/ALHx4q79rnirl/nxVZy+ Lhiq9cVcuKqf/EcVa45BW/sfbxVf8eKrOPD7eKuXk2Kr1+HFVnL+TFXN9n4MVa44qu4s3TFk 5Pt5NipYsl2LFzLirkyDJ3DFVPFVT/XxV2Ku54qp4q238+Kr1/y8mxUcWS7jirvs4sW2xVb+ 1iybxYuxV2KrWXFXNirTfF8GKt8cVdxxVTbFW+Pw4q5m4Yqv/a/ysVdz/bxVZ8f+wxVTVeGK t/YxV2KuxV3L+fFXYq5lxa1PFsb5Yq5cVUOWKruWLJV44sVLFVzNiqm2KrcWtyrirv8AiGLY 7hirvg54q5vhwqsXA1reOSS3+3wyKG1+D7GFscy8sCrGb4vgxV3HFXf5GKqfHFXNirf7OKrG 4YtbTLzxbG414YqsbFXM3HFWmXg2KrOL4tao3x4qsZeOKqTN8OSS74uWRYu5vkmTuXDFX//S +z6/6+XNK7FXYqt5YqvXFXcsWxfirsVdzxVyYq58Vcv8mKr1+DFW8VXfYxVYvx4qv4rzxVf8 OKtcExVtsVd9teGKu5Ytbm+DFsa/yP28WtU+xiqxfgxbF74tbm+HFXYqvVueLY7lhVey4FXY qt44q5vhxVzYquxVyfYxVvjirlXFXLi1r+P8/wBjFsU8VVFbFXYqp4qqM3w4quZf2MVWr9rF V6rirmX4ueKtf8SxVy4q5cVVPh44q7jiq7FVvL4cVcq8cVd+xiq7FW/hxVrFVuLJWxYuxV3L jkGTsVWNiq/FV/wfbxVTxYtr/JiyaxYr+Pw4quyaqeKu54qv4pkGTSrixa5Yq3xxZL2b4sWK nyxVvl/Pirf2/sZNV/JMVU1xVtf58VcvLFV8fLFXM2KujxVdiq3jiq/j8WKrFxVzL8OKuXFV 6tirm4/bxVZ8GKu+DFV+/wDPiqxl44quxVbyxVdirsVb+LFWsVd9nFW1XFVnLFV2KuxVtf5M Vc2Ku44q19nFW+OKtYq7FXfaxV2KttxxVrFW2XFXfb+DFXceeKub/IxV3xcfjxVTVePwPiqo 3v8AbxVrFW2xVYq/z4qvZsVdyxV3+piruPP4MVdx/bxVYy8/28VXYqt5Yq74MVWepiqsy4q5 sVd8WKrP9fFXcn+3iruf7GKr/wBnFVn2MVdxxVZy/YxVe2KuXFXMvHFXcvixVdiq1f8Afj4q uxVbxxV3P9jFXfbxVZ9n/UxV2QVbxxVUX4sVU+OKrUxVeuLJe38mLFYq4q1yxVpueLJ2TYrc WS7FiubFVv28gydiqniq9VxYt4slPFV7MuLFvFksX/IybF3+XiqzFkuxYtKuLJdyxYu5Yq1i rsVW8f58VdyxVy4q7jiq7FVq4quxVRZfhxVU44quxVS/y/2MVczNyxVrliq1V5Lirv2cVdx/ YfFVi4q3x+xkmDXHIs3f6mKtYqt4fsYqt44snccVXcuPwYsV2KqLYqtb7WKuxa3Yq79r/IxV 3xfsYtjvstiqm3HFrdiqpiql8WSSu5cV+PIs1nwr8eKuZf58Vdy+HFV2KqLYq3x/nxa1mKqe LY3xxV3LFXM2LW1iq1cWxdi1reXw4qorkkt/s5Fi02SZLf8AUxV//9P7NJ9vMhqVeORQ7lir vgxVdirsVb+LFsXvirsVdiq7lz+39vFVqYquVVxVdiq7jirvsYq77eKr+OKuZsVdyxVy4q1z TFW2VsVcuLW79ngmLYvVcWtyYqtXhkkrsiheq/FzxbHcfhxVVxVaq4q7h+3iq9ePLFrd+1i2 O+FsVaxVvj+3irWKqnJsWt2LYp4qqc8Vd8LYqu/1MVW88Vdy+Lniq9cKr+WBVHFV/wAH28VX svLFXfHirmXFVn2sVXriruf7eKr1xVS+PFkqYsXYq5cWTa4sW+P8+LJdwyCuxVyYq7hiqniq o+KufFXftYq7FV32sWKmq5NkuxYt8cgq3FVT4mxZLWxYt/FirlZsVaXFVbFWlb4cmrlb4ueK rcVa4/Fiq9VbFWuL4q3x/nxVy8mxVzYq74UxVzf5H7GKuZcVd/xviq7FVvJMVXYqt+xirm44 q5lxVytiruH7GKr/AIsVczcvgxVy4qsZcVXYq38OKrPgxVWZv58VU8VVMVU8Vb44q7jirv2c VWMrfbxVfxxVrFW/2fgxVyrirXNMVb/y8Vcv8mKu44q1irfLFXL8K0xV3HFXftYq0v28Vbb7 PPFWvs4qt5YquxVvl8OKuVsVdxxV3HFWsVWt9j48VcuKu44q74MVXYqt/wAjFXcf58VXYq3x xVZ9j48VXt/PirlxVY3xfbxV3FMVd9vFXLiq7FVvx4q5cVd8Sp/kYq5v2ExVTVfhxVU9NlxV TbFXcl+3kFXriq34HxZNKuLFzNirbcvt4snYsVqr/Piq7/XxZOVuH2MVWZNi7FXceOKu54qu bFVqtkGTnxVrnixbZf2MWTnxVZxxVe+KqTfbxYqv/EMmqniq1sVXYqt5fyYq7/LxVey4qsxZ O4/DixXYqt44quxVR5YqqccVc2KuX4cVcuKqfLFV2KrWxVb8HDFV7cvsYqsZv2BirlXFXf5G KrG44q1irlXm2KrWxVdiq1sVXYqp/HiyXccWK3FVNvhxVy/Fi1ruOLYtxV2KukbCqxeX7GBr d/qYqoquLYv/AMjFV2KrePH48KrsCrW4csVcy4qp8sVW4q7FXPirmbFXclxVT+1irsWt2LYp tkmC7lyyKHepxxVRk+xkkrsVU2bFX//U+zeZDUrrkUNYq7Fsdi1u4virbYti9lxV3+pirueK uZsVcv8Aw+Kq3HFXf6+FXcsCuZsVW4quXFV6riruP8mKuVsWtrgmLYqc8WtTxbG1b+fFrcrY qv54q5eeLY7Frdy44quZeOLYqM2KuxZLsWLfLhiqzjirlxVf8WKu5fDiqzliqt/r4tbl/wCJ 4tjmX4ueKr+XD48VWKvPFV/Z8VWYq7FXcv8AgMKrlwK23HFXcv28VX8vixVYvLFV/wCxirvs YquxV2KtMuLJczYsXLirWKuXFkqYsVvFcWTXL9jIKv54q5uGKuxV2KqeKr8WLkxV3DFW/hxZ O55NiuXFWlyCrsVXcU+3iq3FVq4q5cVdyxVd+zk1bxVb/kYqvX7eKtriqnxxVU44quxVbx+L FXJ/l4quxVb/AJf82Kr1bFVNvt4qvxVbxX+TFVyfYxVb9j48Vc3/AAmKqn/EsVU+Kv8AYxVe 2KuVcVcq8cVcrfDiqxsVX8cVdy54q5fjxV3LFWvs4q2yr9j9vFXKuKtYq2uKuXFXL8GKu48V xVzfa/y8Vc2Kr8VU8Vb44q5cVWfYxVeuKu/ZxVzfz4q1iqpiqzjirm44q1irfLFWsVWq3w4q vjb+fFWsVb5Mv2/t4q5lxVzYqs5YquxVtcVWLxxVey4qsZeOKu+Llirvg5Yq5cVXYq3yxVrF Vq8cVdz/AGMVdx5YquxV3J8VWt/wmKrPgTFV/LFV2KrVxVT/AOJYq0zfsZBV2KtKv8mLJ32s WLS4q2rYq1yxVv8AZxVrjirmxVr/AInk1d/r4q58VXNiq3FXZBk1zxYt4snL9rFVPFW2+PFV 32MWKx/sYslyZNVPFV2LFvliruWKuVuWKubFXM2KtYqt9NcVXtiqxcVXYqt+DFXf8RxVZx/b xVzfyYqv/wAvFVi+/wBvFXceGKrMVdxX7eKu4/t4q58VdwxV3FnxVZxxVzYq5lxVrFVrYq5s VXYqs5Piq1fjxVZzxa3cMWx328WtzKuLY5MVcy4qpN8eSYLviyKHNyxbGsVb/ZxVY38mKuZW xVdiq1sVU2xV3LFXcsVUcVVOX7GKu54qps3w88Vdi1reP8+KrWySVvw8fgyKG248eb4q1kku xVTfFX//1fs4qr9jLmle38mKu5fz4q7JJXZFDar8OLY5cVaxVUxV3PFV32sWS37GLFf8WKr/ AIv2MVXYqtXFXLiq77OKtquKtYqp/YyTBVX+fIs2sVdi1triq9MWx3FsWt2Fscy4GtdyxbF3 LFk7liq7lixc3w4ta7FsbVuWKtYq3+1irWKrV+3kmCsmRQ5vhxbHYq7FXNwxV3L48VdzxVy/ axV37OFV/LhgVVxVRbFXMrYquxVaq/t4qqM2Ku5Yqv5fDirv2sVWccVdyxVevH/YYq0uLJbi q5PsZBVRMVdy+PFVPFXYq7FV+LFvFk0mLFtMWTv8jJsV3+Riq1m/YGKr1/nyDJpl44sXfs4q 1yxVtmXFWmxVU44qt+y2TVdxfFW1X4sVU/8AUxVU/wAjFV2KrV/kxVzLiq7FVnHl9vFV+Kre WKr/APXxVr4P28VbVcVczYq5l/bxVZxxVyt/Pirl+1wTFV6/HirlxVrFVvHFV/HhirWKreX7 H7eKr+X7GKu/ZxVYzfFiq9l4Yq7lirl44q5lxVrFW+XDFXN9rg+Ku/axVrk+KtquKuZsVd/r /YxV3LnirWKtt8eKu44q5uOKu+LFVitiq/7D4q7/AF8Vc3LFWsVb44q1yfFW+LcsVWccVXr/ AD4q5sVdx4Yq7/IxV3H4nxV3+XiqxfsYq77HwYq7in28VXYq7FVvLFV2KrW/4TFV/wAWKtYq 2v8AJirWKt8fhxVzMuKtN9vFVrN+xiruP8mKuZsVXYqt44q5m/YxVSXIKqf5GKqf+pirfHv+ 3irS4qu5viyXccWK7FVrYqo88Vb+xiycy5Ni7nirlb4eGKr+XFsVU8gq1cWS9MVU8VVMVczd kxV2KuxVZ/qYq1k2K39vFV/LFWsVaVcWTeLF2Ku5pirsVWs2Ku5YquxVS4Piq9uWKubFVP8A y8WttW5fbxbHJ9vFVnLjiruX8+KuxVTxVUTFVzN8WKrft4qs44q5m/nxVrFXYq23H9jFVD/U xVWxVavxYq7Fko/aXFpWLy5YqvfFV/Lhi2LOX7eKuZsVU8Wt32cVaVsklpWyLNcn2MVVExVC riqp9j4MVczNiqnxxVy4q7jiq3FXYqsZv5MVaxVvlirWLWtXFVHjkkr1bIoWr/l5JK7lwyKF JMkl/9b7OcuHwZc0quLY3yxa3fDy+DFXLirv9fFsd+ziq/FVPFVTnirf+piyaVsWK5cVbVcV a5YqqccVUlbFkiP2cWLv+NMVWf6n7eKruP7GLW3yxVy4q1yfFWmbJJVeGBm7hga3L8WKu9Pn i2LlxVWxVT44sl3H+fFiuxa2+OLY1irbYq7/AF8VcrYqs/bwquwNav8AH+3i2LExV3PFXYqv 481xVZwxV37OKreWFVRl+LArlxVzYqvblx54q2rft4qpsq4qqKy4q5VxVy8vsYquxVZxfFVT liqxmXFXYsl3LFVR8grnxVz4q7FXYq5VxV3FsVcrYq7FXceOKu+3k2LTNwxVU+ziq3/XyCub FXNiq7FVTFVH4uWKqnL4sVW/abJqvbFXfY+3irv8vFViqyfYxVeq/wA+Ku+JvgxVyr+xiq9V xVZJ8f8Ar4qv5fDzxVrFW2xVY2Kr/t/YxVYuKu4/yYquxVa2Ku44q7lxxVeuKu5Yq5WxVpVX 9jFW/tLirlbFWvs4qtVcVXYq7FVvLFVbFVi4q0v28VVMVWLiruWKu5fsYqs/yMVVP+I4qtX7 eKtrirmZsVaxVtf8jFV+KqCqyYqrquKrP8jFXftYq5WxVrFXYq22Ku44q5lxV3HFWuL4q38W KtfaxV2KuxVb9jFV7cv2MVdy/bfFXccVU+T4q3/l4q7/AC8Vd/xHFV2KrfjxVyf5eKr2bFVj fYxV37Px4qvbFVkkmKrF/nfFV/x4q7/LxVZx/YxVrlirvs5BW248sWTX7Hx4sXfZ/wBTFWuW Krlb4eeLJbxxYu44q7jiratiqzFW+GTVcq/FiratzxVY3xYq7IMnfDirkxV2KtYsW/2cWTvs Yq77GKqeKtKuTVvFi7FW+OKubFXcsVaxVbiydyxYu/1MVdy/kxVdirsVUWxVv7OKrG+LFVzY q2n28VWcfh54q5m+LFXYq7iuKuaPFXKuKtYsZrVxZO/axVzYq5l/bxVy4qsXFXccVcuKqf8A kYqtxa3MuKu/yMVdzxbF3+RiqlxxVy/Bi1tcfhxV3H+TFW1xbHcsVczYqs4/Diq7FVHjiq7F XYq7FVNMVdiqnirsWtbx44q19vJMWviTFm0zfD8eRQ1kkreOKu5YqtxV/9f7Ocf28uaV/wBj FXfFyxVfy4Yq1x+HFW1Xji2NYqqJiqz9rFV+KuVcVdhVcq/FgVU44q7jirv9fFVnLhiq/li1 r29vsYtjv8jFVnqfFiq/jw+xi1u+LFWuPw4q3yX9vFscrYqvVcWt37OLYv8A2vjxVy/BhVfg ZLcWKpiqniqqq4q5cVdxxV3HFVjYqqLhVdga3ftYtjsVdzxV3+viruP8mKuX7Xx4q5mxVcrf DiqozYq79jFVnL4sVXtyxV3HFXfsYq5V4fHiq7FXYqt/y8VXYq3yxV3L+TFXLiq9fiyDJ2Ku 5NirvixV2Kub+R8Vd8X7eKu4Yqu+1ixWL8OKt88mrsVXMv7eKt8ueKrP9fIMl+LFr4lxVy/B irX+viq7FV3L4sVb5ZNVuKtcv2MVX/YxVy/Z4Yq7/LxVytyxVfyxV3H+fFXN/Pirf/EcVU+X /B4q7lxxVdirbYqsVsVXYqt+Ll8GKrm5N/qYq7FVi/bxVUXFXcfhxVzLirv8jFVjYqv44q1i rvtYq7FW+OKrP5OGKr+WKr8VWL/kYq743xVrFVq/YxVzLxxVy4qvZf5MVWcfi4Jiq9WxVy/5 GKtfZxVav2MVX8cVab7eKqmKrOWKuXlirlxV32PsYq5uWKrP9TFV6t+2+KrGbFV7fH8GKtYq 38P28Vdy/nxVYzYq5sVd/Jiq/wD1MVWfD9jFXcVbFV2Kt/tYqs/yMVXfZxVa3w4q7j8OKr/i ZcVUVXFVXFVqtirl+H40xVrlwX48Vb/18VXYqt5ccVd9hcVcuKqS5BW4/wCTFXcfixVvFWv9 T7GKt/6mLJrlirXLFi38OKt4q03LFVuTV2Kub+TFXc8VayCufFW+LfbxZOxV3HlirnxVpl7p ixb54slnLFWuOTVzYqtVcWK7FW15ft4qsxZLsWLsVW8cVd9jFXNirXF8VX4qt+H9vFXcsVU2 b9jFW2jbFVNvj+PFW2/18Vc+KuTFXL/PirsVdirl4Yq58VU8Vb/ZxVy/H9vFXccVdxb7eKrO WKu48cVcuKqPDFXJi1uxbHc8Vdwwq79nAqz/AF8Wt3+viq3jkkrl/kyLNy4q5lxVZ9j48Vcz Yqs+H7H7eKt4qt44qtxV2KrFxVy4qvxVZxxa1uSYtcsiyWM2KtZJLX7OKt4qp8eWKv8A/9D7 Pq3xfB9jLmlzLirpMVdy+HFXYoVsW1Txa2+WLYvxV2Kr/ixVy/BhVZgVfy4Yqv44q7jiqm2K qi4qv+39jFXcef28VUlbJMFX/XyKGuPw4q5/sYqp8sklEf6+BmqYFU8Wt2KrlxbFy4slTFi7 FVPFVTFXc0xV2KrePw4qv44q5sVXYsYNviydybFXYq7k/wDsMVX/AOX+xiqn8PL/ACcVXs3H /UxVyquKqnHFVNsVb+LFV/xPirlXFV2KqTf5b4qvVsVcuKr2xVrFW/2fgxVZ+xiq9v58VayD JfixbxZOxV2KrGxVemKtYsVrYsnfZxVfk2KpirXLhiqzFV+QVauKq2KqX2cVa5YqqccVWf6m TVtmblzxVr/LxV3LFVT/ACHxVZ9nFV/+RiruX8/wYq0vLj8GKr8VWr9j48Vcy4q7/XxV3HFV 2KreWKr+Xw88Vd/kYqs+H9jFXf5GKuZeP28Vd/r4quT7GKuxV2KtquKubFXenirv8vFXMuKu 5Yq1iq1f+ExVdirl+3irsVb4/DiruXxYqs/y0xV3L7fPFV/7WKrOLfsYqvb7XwYq5cVd/qYq 79rFXK2KrFxVe3+RiruOKubFWsVbXliqzj8XDFV/LFXcvixVyrirlxV37WKtYqqPiqxWxVYz Niq/krdMVU1+3iqpyxV3HFXftYq7/UxVZ6eKr+X7CYq5VxV3L9vFVnLFXfCvwYquxVav2/gx V37GKu44q79n48Vd9vFXNiq7FVJuS4qvbFVP4sgq/n+3iqz7WKr1xVZx54q6TFXcv5MVaXFX Liqo2KqfxccVaTJq7FXMv7YxVdxxVRyDJUfFXfYxV2Ku/axVpMWLfDFk7nirTLixWtiybyar cWLsVW8cVXYq7FXLiyW4q79jFi5sVXYqpcfixVVxVTxVdy5YqsX7GKr+H7GKqKYq5eeKr/tf HzxVZ8HDFXKuKuxVZ+1irXBMVbbFWsVbVv58VdxxVZ/r4q7jiq1WxZLmbFioq2LW7lxxbHYq 58Vd8P7GFVnHAqk2SYIhMihTxVb/AJGLYuxVbyb4MVU/8jFVT9jFVi/5GKu48MVWYqp4qqc8 WtZyxbHLiruWKqXLJMFVmyKHKvHFVH4sVWccklzYqv8AU4ZFClkkv//R+0OXNK3kvDFV7Yq1 wTFsbVuWLW5V54q7ji2NYqqftYq7nira4sl+LFpf8vFV/wAfx4tbuOLYtxVdyxVT/wAvFVdm xVfiqxeX7eKqXLJMF/HFW/sfHkUNccklvIoRGKreOLYt4Ytapi2N8sUQb5YpXYq7FVL4sVVc Vb44q1yxZN8sWLuOLW1i2Ki/axV3Ljirv8vFXcvgxV3DFV/H9jFVir+w+KrlX4sVbVsVcqt9 vFW8VVMVUf8AIxV3HFVTliro1xVcuLJtv58WLWKreWKub+fFV64qvfIMncMVc+Ku4YqsbFWs VVP9TFXNwxVyYq7niruPwYqu5ZNitb/XxV3DFWvsZBVTFWuPDFV7fDiqxVxVpcVXL/kZNVXF Vv7GKrGjxVvFVys2KrsVW/Biq/liqxW44q77eKr/ANnFVPk+Kr8Vb4t9vFVnD9vFV2Krfi/2 WKr1XFXcueKtYq7FW1xV3LFWsVb5fFirmXlirWKtq2Ku44q7l/JirWKuxVv4sVdx/nxV3H4c Va/Y4Yqu/wCI4qtxVvj8WKuVsVc2KtYq2vwfYxVeq/DiqxV/bxVyriq/4cVWfs4q5lxV3LFX LirXBMVd9rFW/ixV3LFXNiruOKuZvhxV3+XirlbFVirxxVdirfLFVH4sVVcVdiq3/IxVdiq3 h+xirmxVyriq/jiqxl/bTFVi/E1MVVcVWtiq7FVrYqp8sVVsVWt8K4qsZcVXt/w+Kqf+Rire QVytiyWrixdyxV3+virlxVdirlbFk7Fi5l4/GmLJ3L9v+fFVirk2LsVdirm+HFXftZBk77S4 q77GKuX7OKuTFXclxV3PFVjNirlxVcq4sWuPHJslvHFXYsVuLJeuLFZiycy4sXfsYq5f99vi q7FXYqtXFViriqriq3jiq3FVrYq39v7GKub/AC8VWf8AE8Vdx5Yqpp9jFVf/ACP2MVWYqsbF rUvt4tyqytixdyxV3H4cVc2KrPt4q5sVU2xVdiqm3+XirnxVT5pi1u+1irariruOKr+eKqfH 9vFXYtjuaYq3/kYq1hVarLgVTXFVuKuZsVd9vFXf8TxVZ/l4qvxVY2KrFX9vFrdw/bxVYy88 VX8f58VUeOSS3y/kxV3L4cVWc8Vf/9L7M8cyGpW/YyKHJ/l4quxVtcVc2KtYtipwxV3PFXcM VXxrireKuxVpWxVVxVaq4q7/AC8VXYq3xb9vFXcsVd+1i1rPjwti/gn2/wBvArl/nxV3HFrX 8VxVz4q5VxVUxbHYqvxRBvFK3Fk7jyxYrsVWrxxVdzTFW+WKubFV/JeWLW5eGLY5f58VXcfi 4YqtZeK4q7FXLx44q5uPHFV6/Biq7i+KreTcsVaXFW2/kTFVXFVJWb7eKr1bFXft4quxVarc sVXYqtX4vt4qvbFXccVXpiruTZBk7l8eKrOWKr+Px4q7FXPirlb+TFWsWLeLJ3L9hPsYq3/q YsWnyauZvi/yMVXNirm5ZBWmxVt/t4qvZcVWN/kYqvXFVjLxyaqit/PiruOKrcVXNiq/40xV rFW2bFVi/Dirvttirvh+xiruXLFV/HFVkeKr+OKqDYqqMuKu5Yq5VXjw/axVcv28VW8ePx4q 7kvDFV64q5sVcseKu/18VcuKu4/yYq0y/D8eKu+zirf+QmKrFbjiq9WxVZ8GKr1XFXSfHirl xV3LFXfFirWKtq3w4q79rFWsVbVsVcuKuX+TFXN/kYq5mxV3Hv8AsYq74sVcv8mKu+LFWsVd irsVbX48VaxVbxxVfyxVrFXYqt4fsYq5l44q5lxVdiq1lxV328VXfZxV2KuxVvj8OKrOWKrs VW8cVXfyc8Vd9rFW/hxVy/H8eKrOWKub/h8VXYqtT/IxVY3wfYxV3H+T7GKr/wDLTFVP7OQV rjirmxVdiruXD9jFktXFi0q/yYsl37Hx4sWlxVvjzXFXfZxVb/kZNXYq5eP7eKrW+LFkubnk Fd/l4q5v50xVyYq0rNxxYt4sncMVcmKuxV3DFVvDJqtxYuxVv9rFVJuX7GLJV/axYubFWuOL Jbx+HhixdyxVT5YqqcsVd9vFVnFuPwYqvf8Ay8VWfY+PFWv8vFVTjiqzj8WKrExVz4q7/XxV 3H/gMVczYqsbFrdyxbHL8eKubFXftYqs/YxV328VczYq5sVW4q7FVN8Wt2KqOSSuyKHJ9jFW +OKtYq2q/t4tjuS/YxVrFVHjiq7FWuPf9vFXL7/bxVYrYqsXFV/+XirsVWNirmxV3HFrcq4t izkvPFrUv2sklyrwxV3Hhiqz/ITFVV/t5FD/AP/T+zTLmQ1KnJ8ihU44qs9T/g8VX8v58Wxr 7WKt8sVX4q7nirsVdirsVXs2KtcsVbVsVVcVWsvxYquxVU54qs/axVZ/r4ta7j/Pirat8Xx4 tjXxpi1qi/6mLY79nFXcvgxV3+XiruX8+LWvX4MWxVxVavLFXMq/YxV37eKruPw4ta1l/bxb HYsl2LFa2Krl+PFE1Rl/b4Ypd/l4q5MVXcsVXYqoccVXt/Jiq3kqrkmCpyyLNteOKu+HFXfa xVeq/wAmKuXFXcuWKuXjiq7FVv8Al4quxV2KuxV2KtquKr/+J5Bk58Vdirv+J4q5MVcq4qvx YrP2sWSxmxVcrYsXYq3k1W8f28WTfPIMVTFWvtYqtbniyXfH+3ixabFVfJqp4qt44quxVcqq +Kqf+Xiqp9jFV2KrWVcVcuKu5Yq5cVa5cvsYq5m4t8eKr8Vb/wBfFWm+3iq1mXFV/Hniqzkr /YxVy/yYq74V+DFXcuOKr1xVZxTFV7f5eKtJ9jFW2XFXLirpP8vFXMuKtJ9jFW2bFWsVbbFW sVb/AGcVX4qsbFVn+piq7FXcnxVU4YqsZv2MVdyxVplZMVd9rFXYq38L/Hirvh+3iqn8X2MV X4q7FVqqv7eKrk+xirsVbXFXNirl+NsVWfYxVzYqv5cMVX/bxVYzL9tMVWL/AL8fFXKuKr1x V3LFVn2PsYq7j9jFV/HniruXJXxVY2Kr2X+fFWsVW8f5MVcvw4qv/wAvFXcV5Yqs4/yYqsZl +xiqriqiy8cVb+HFXcv2MVXp+xirXHIKsX7GKt/5GLJ2LFr4cVd9lfgxVy8cVa44qqsv/B4s lPjirmb4sWK3l8eTVa+LJdixdiqxsgyX4q5MVc3+RiruPxfHiqnirsVVFbFXJiqniq3Jqv5Y sXL/ACYq1irsVdiq3lirmbFV2KrVbliruPHFXf6mKqfLFVRsVU2xVU5fFiqzl8OKquKqP+Ri q34OeKufFVTFVPjxxV37fwYqos2KrvtYq7FXYq7FVv8Al4q7lirmXFV2KqeLWtbFVLjiq3jk kqqZFCzliq/hiqj8eKrsVbXFXcsWxy4qs/1MVWccKr2XAqjy44q7nirv+J4q7hiqxlXFWsWt tm44tixfibFrX/5GKtYqo/bb48Vc32uGKqbfyZJLuGKr2XFX/9T7N5kNTa/H8GRQv+xiq7mm LYt+3i1r+X8mLY5sVX/Z+xiqzliq/hirl+1i1uxbFTFVvHFXLiq7FVzfz4qvX+TFXccVa+zi q3n+xiq/ji1tYq23wYti9f8AUxV2Kuxa3Yq7FsXr8eLWvxbnfHixWsuLJd/kYWK7ArvtYq7F XYq1yZvgxZN/Y+PFhNUfFLkxV3+RirlVn+DFXN/Jirm/nxV2Kt8eGSYLmXnkWbvTxVr/AF8V dx+HnirmxVUVWxV3H+fFXJ/l4q7/AC8VXYqt+xirl44qvXFXLirlXl8eKu5fD/kZBkvxVz4q 5VxV2Ku+3irStixb4Ysmv2cWLsVXf6mKtc8mq7/IxV32cgrXHFW0+3irTYqqcsVU/wDXxVc3 8mTVytireKrWxVdiq7h+xiq5PsYqt5Yq5l44q7liq/j8WKuVsVWLiq9sVdy/nxVY2KuX+fFX LirmxVeuKrFxVezfsYqs44quxVv/AF8Vaf7GKuxVb+3iq/jzxV3LFXNirv8AIxVrFVq/vcVc uKr2ZsVdy+HFWsVbX/IxVrFW1b+TFXcsVWfYXFXMvxYqv/18Vcq/z4q7j8WKtfZxV2KrU/Yx VdyfFVqtiq/9rFWvtYq7FW+OKtYq3+1irmxVzfBirm/y8VdxxVzMq/bxVzYq1irf+W+KrFX+ TFV6t8Px4q7lwxVpPsYqt4/D8eKtL9vFW+T/AG8VX8ueKubliqxsVd9jFXK2Ku9P4cVc/wDk Yq7l8WKu5YqpriqouKuZvhxVbiq1WyCtNirmxVv7OKquKqeKtfZxVerYqs5fyYq0uKtv9vFW /t/Bk1Wc8VdirmXFXJkGTuGKuxVZxxVfzxVYuKuXFV/w4qp4qqYq7JsVjYq7jirS4sncsVdi xWriq7FW1xVY3xYq7jxxVzfCuKu4rzxVzYqptiq7FWlXFW8VU2XhiruXx4q7FXfFirueKu/4 niqxl/bfCrlwK5vgxVri+Kt8vixVYzfyYq0y/Dz/AGMWTfP9jFi0uKJtsqpilR+z9jFrcy/F iruGKqOSStZcVVW+PIoX/wDE8VWMuKtN/Jira/5eLY5f8jFWsVW/bxVbirsVU8Vd/r/bxVz4 qsbFWsWtUZsVUfjxVdiq1sVdy4N8eKqXHFDTZJktZfhxV3xYq//V+zK5kNS9Wb9vIoVlXjir uOKrMkldkWaozYq6PliqxuOKr8Vcv8+KufFV7LirX/EsVbZcVcvwfbxVf9jFV2FW1/YwK74s VdxxVT4virf2ckwdy4/BkUKyr8XPFsc3wfHhVytga3Yq5ueLYqYq7jiya+LFiu48fsYq3/r4 qvVcVcq4q5sVaxV2KtriibWKW1xVf/l4q7l+3iq/9r4MVU/i5f5WKt8m+3iq7/LxVtvjXFXK 2Kr2+HFVuKrVX+TFVTliruX8+KrsVWriq7FW/wDIxVrFVv2MVX8cVWYslZMgrsVc3Hjirvt4 qp4q2zYq1iq/7GLF2Kr/ALOKrV+LFk7/ACMmxcrYquVsgq37Xx4sl32cWLvgfFXL/l4quxZL n/y8mxc3HFXLirvjxV3L+fFXfD9t8Vd+3iq/l+3irWKrVb+TFV2Ku+zirsVWs3w/bxVeqtiq xsVXYqs+L7GKt/z4q5P8jFV7NxxVZ8eKr14riruOKu5Yq7jirmxV3LFXc0xVYn7GKr/9fFXM vLFWsVbbl9jFWm+3irfH4sVc3x4q5sVcuKtJ9jFW1XFWvs4q23LFWsVb48MVcuKrGxVcrfF8 GKuxVUfFVjL8WKubFVnH+TFV7LiruWKuVcVcvt9vFXcv28VaT7GKrf8AIfFV7Yq5uOKuX3+x iqxuX2MVcuKr+WKrGxV321xVdiruK8uGKt8sVcv8mKuZcVdy7/t4q5mxVZxxV3/EsVXtirSf YxVd/wARxVT+PFXcuOKrsVW/7DFVPliq1VxVe38+QZOxYuxVUxVRbFXcsVXYq1y/YxV37WKt f6+KuX7XPFWkyau5NiqpiqjiyVW+18eQVZy/kxVr4mxYt8MWTmbFXcMVdwxVTxVUxVTxVr7O TVVZcWKniq39jFV2KubFk3I2LFY2KrsVW8cVXYqt5Yq7lxxV3H4cVW4qu4fsYqp8cVd8Xx8M VU8kwXK2RZu5fBiq/wCD7GKrMVdiq9v8vFrUeOLY7lirWKt8cVWM2Ku+PFXcvixVa2LJpmxa ViYq7l8eLY79nFrd/wATxVb/AMSxVrl+3i2NYtbsWxtfjxVy/BiqxcKr+PH/AFMCrOP8mKrO WFXM2KrOXw8MCufFVn+RirmX9jFWsVb4/Fiqzli1uf8Ay8VXri2KGSYN8kyKFrfHkktf8RxV av2cVf/W+zeZDU0zN+3iqqvw5FDl+xiq7FXYqqcuWLY7FXL/AJeKuTFXYq77eKuVuP28VXt/ l4q79nFVZW+HhwxVSxVcuKrsVdiq1mxVtWyTBcy8/t5FDo8VbTJJXc8DN2BrdwxV3+Xiq7/I xbFTFkuxYuxVbywqv5YFaxVvliruWKtYq5cWM1+KwbxZO4Yq7hiruPHFXMuKr/tcMVWfDiq/ 7OKtNiq7FVvLFVRfsfBirmX+TFXcsVWckxVfxxV3+XirS/bxVUVcVc2KtYqtxZK3+RkFdirn xV3DFXKq/wCzxV32fgxV2KrGbFV+KrF+DFV68eOKur/l5Ni7FV3+QmQVzccVX8kxVZ8WKu5f z4q3+xwxZNccmxVGxVdiqkn28VX/AOXirmxVe3wYq1iq1VXFV64q0v28VWL9vFW24v8AYxVr i+KqjYqs/wCI4q5VxVe2KrFxVyf5GKu/1MVX8sVaxVbI3/B4qv5L9jFWsVbXFWsVbX2+3iru XPFXM2Ktc0xVvj/Jiqz/AC8VX/s4q7lirSx/z4q7FW+WKuVeOKub4/gxV3Hh8eKrP9fFVT/i OKtf6+Ku+HFXKvD7GKu/axVr7OKtq2KuVcVcv8mKt/8AEsVabFWvs4q7FW/8j9jFXcsVdx/Y xVZ9hsVdxVPt4qvX/IxVy/CtMVcyq+KuZsVWccVdw/bxVdiq3l8OKruaYq2q/wA+Ku/y8VWc uf8Ar4qvXFWsVW/sYqvX48VcuKrP9TFXN/w+Ku44quxVaq4q79jFXceP+wxVYrf8PirSrkFa Zf58Vbb7GKtNiqouKu5Yqt+HFkt/1MWLuOKqnx4qprirXDJqu5Yqt4Yq7/LxVyrzyDJ2KuxV 3PFVPFVRMVd/r4q7FVPFVTFXPk2LsVU8VW8vixVdirfHFWsVW8uOKu44q7liq7FVrLiq7FVq tiqz4Pt4q3irXLn8eKtMy4qp/wCvkmCqzZFmsZueKqmKqatirsVWM38+LW0q82xbHYq7FXYq t/18VXYqt+DFXcsVWcv58WtY+KuxV2KqeKuXlirbLwXhiq3jkkrmb4cihYq/8Bi2L1XFXM2K rPi/YxVzfa/ysVWceGFXMvxYqsb4cCuxVyYq5WxVZxxVrFVrfD9vFrXYqtXFVJVb9vJJdx54 qvyKFNuP2MVW/wDEMkl//9f7L/6mZDUu/wBfFVZV/n+xkWbuX/B4ta7FXYq2uLY1irasuKr8 Vd8WKuxVzfGuKr+PNcVd9nFV64qtxVcuKuVvixVdirbNiq/7X28Vc32sWtTxVvlwxVarZJKq q5Fm7jw+xirvt4qu5fDwxVUXFXLirv8AIxVdira4q1irsVdirsVbbFrXqq4tjuKpirv8vFXc MVc3/CYq7FV/2cVcvJsVd6atirm/kTFXfbTFWmX4sVb+LFWuOKqnH+TFV2KreWKu+L/ZYq5c VXYq7FW2+PFXccVX8v2MgyaxYrMWTsVbX4vgxVfiruGKuxVtcWLT4snL8TfBk2LueKuxVcy5 BWlxVtl4Lirm+H48VbxVbyxVWxVTVcmq/lirv9TFXfb+PFV2KrWxVdiq1eP7GKu/yExVzNir mVsVXrxxV3w4qsb4sVa4virfL/gMVXsvw4qs+3irv8jFWl+3iq/FXYq2y/bxVrFW5MVd/qYq 7jirlX4sVaxVuPFXLirXNMVdiqp9jFXfYxVTxV2KuxVtm/kxV3Ln8GKu44q5V+HFWsVc/wBj FW2bnirmxVrFW1XFXL/JirvhxVrFVqtxxVev+XirmXFXcsVWL8X7eKu+w2Kr/hxV37WKu5Yq 5mxVrFW5P58VWfBirlxV0a88Va4r/ssVVFxVYzL+3iq/9nFWsVb4/sfsYq74cVWN8X2MVXYq tXFV2Kt8ef8Ar4qsVuXx4q5sVc2KrGbhiq9cVWcv5MVX8sVa5ZBVPjirmxVfxfFVjYq7jiqt iql+1ireKtcf58VW4slTJsVPiuKu4Yq7IMnYq1ixbxZNYsVq4sl+Ku54qp4qv54sVmLJbk1X YsXYq7FXNy/YxZOxYt8cVWM38mKrsVUWxVU44q77GKrPixVf8eKu/wAh8VWNyxV37WKtcsVb +LFVmKu4Yq7FXfs4q7FXc8WtTxbG2xV3LFXfs4qp8nxVv/h8VdiyWrirXH9vFis/Zxa3f8Qx bHJi1uVcLY7A1rP8jFXccVW/5eSSuXjkWbuOKrOWLW5vixbF2KqTfYxV37OKrHxV3xYq79nF VnHFWsWta2KuXFXcf58VXYqosq4q7l8XDFVbFUO2SStxV//Q+z/H4cuaVnH+TFWv8jFVTjy+ PFV7Yqsbj/s8Vd8GKq3w4tiniqpiqniqpzxV3PFV3+RirlxVUXFVuKrVk/YxVUaTFVZv8vFV nHFXN/l4q7/IxVzcv2MWtZkkrsihU/yMWxyYtbuPP48WxevHjiqriqnxxZKmLF2FXYFb4/F8 eKu44q1irsVVF/y8Wtyti2O+LFXJirvg54q7FXcVxVzM2KojFVH/AC8Vb5d/2MVbxVr7OKqu Krf28VWcv2ExVfyxV3xf7HFW+Tcfg+3iyaVsWK7FW+OKtYq3+1iq/wDayDJz4q5eeKrF5Yqv TFXYq7nirWLFvFk7nirnybFz4q7FW+OQVdirsVa5JiqriqiuKqjYqvyareWKuZfixV32PgxV ezccVWccVXYqt4/yYq5/8jFV32cVdiratirlbFVjfDirlbFXcfi54quxVY328VbbjiruH7eK u+3irlxVzYqvX+fFWsVb/wAvFXcsVdy+HFVir8OKuZvhxVfyxVzYq74sVWKrL9vFV7LiqxsV X/DxxVy4q5VXFXcf28Vc2KuX48Va+1irfLnirl+L4MVd/qYq79rFXLirv9TFXNiruWKr1/kx VYuKtYq38WKu5Yq5mxVrFW+WKuZcVaf7GKu+zirf7OKrG44qv/axVZyxV3H/AIPFXccVXsrY qsZWZcVdxxVfy/YxV3w4qsXFXNiq7k+KuxVtvs/5GKrPjxV3L+TFXL8S4q7j/PiqxVxV3L9j FWv8jFW8grXHFk18XLFi2y/z4slnPFircsVWN9jFVmKr1/y8VabFVuKt/Dk1dirsVayCrftY slz4sW8WTmXFVPFW144qvxVZyxVfirm4YqpMuTVc2LFrFXYq5cWS37eLFfx/nxVy4qsbFV2K qLYqrYqt5YquxVb9vFVn2eGKr+XxYqsZmfFVn+virTcXxVvniruPLFXPiqxlxVfx5Ytani2O xV2KtriqxP8AIxVzYq7FkuxYod8Vdwxa3YtjueLW7FsWsuSYNLkUO5N+3irX2lxVvj+xi2Ob FVNvt4q2y4q7imKrG/nTFW8VU3xV2KuxVY2Kr+eLWs+LFWsVdiqH5ZJK9vjyKHN8GKtf8SxV T5fHkkuxV//R+zPLMhqVlbIoUuXPJJVf8vIoc2KuZsVX8sVcuLY7lzxV3HFV74q7niruGKr1 bFXcv+FxVvFV3x4q5m+LFWlVVxa1RfgxbHK3w4qvb+TFVnLhirv9fFWsWtUXnirv2cVdwxbH c8Wt328WxV/18UQX4pWsuKuXFV2FW1bArWKttirWKub7eKqyr/Jiq3jxxVzfz4qvX4V+PFVn PFXRtzxV2KojFVrYqs4/Dirv2cVX/wCX+xiruKYq7liqnyxV3/CYqrYqp8cWSpixcy8sWTar /scWKzl/s8VXYq7jkFb+1iyaxVvjiq9MVU8VVPt4q2uLFpmxZNcfjxYr+WTVbzxVUxVYzfz5 BV2KrY/8t8VdyxVtWxVe2Kr8mqzi+Krf2cVX/Y+PFViycMVVcVWL9vFW1bFV2KrVX+fFXLir vgxV3Fv2MVa5Piqpy+LFVnHliq/9nFXLirWKtriqxuOKu5Yq5cVXYqtX/ieKu44quxVv/XxV eqtiqzl8OKubFVnHjiq9mxVr7OKuxVtcVcuKu/ZxVZxxV3JU+PFV/LFVn99iq/lirlb4cVd/ l/sYq5cVaxV2KrWX9j9jFV6/BirWKtqvxYq7/LxV3Jft4q7jwxVYrYqv5Yq77S4q5sVc3HFX ccVWcvixVzYqvZsVWfBirl/kxVey8MVWM3w4q7+TFXL9jFV32sVdirfLFXKvxYqs/wBniq7F W+WKu5L9jFXccVcy4qs44q5VxVTbFVTj/Piqzj/Jiq9vixVS5ZBXLirlxVV/Z+D7GLJZixa5 c8VbxVpsWTeLFa2Kts2KqeTZLnxYr/hxVTyCt4smsWLf+Xiydy+DFXcv2MVab4cWLeLJzLwx Vy/8JirSt8OLFt8mqjiyXYsXYqtZcVWfs4qv5Yq7/LxV3+viq7FVJmxVe32MVXYqtXFV2Krf sfYxVZ8WKuVcVaZf2MVW/tcMVdxX+TFXYq77eKu+HFrUpGySV3+RkWblX9jFWsVWcXxVUZsV axVazYq7FksZsWLeKreOKrcWt3PFsdwxa1PFWuOSSubIoWcsWxe3+XirWKrft4q5v58VUcVV MVU3xV2Ku54qsXFXNi1rOOKr2VcVWNiqiq/sZJLuOKt8sixXfY+PFK1mySVjfFir/9L7NK3P MhqX/HiqmuKt/s4qiFbIoWM2Ku5fyYq7l/Piq/4eWLYvTFXfDirXwfbxVfyxVv7WKtLiqpyx Vy4quxVTxVVXFXcf5MVaX7eKt8f58VWtkmDWKq37XDIs3fFirkxV2LWuXFsXYqu48sVXYqtX FXfHiq7FW/8AUxVrFW/8jFXKv7eFV/DArvhxVyt8WKu5ft4q4fsYq74lxVyYqu/1MVbX4MVd 2TFV/wBvFVjLirm/yMVaXFVRlZcVcvxfbxVyrirv8vFV2Kt/FirWKrcWS9cWK/4WyDJ3DFVn LFWsVVMVd/l4qp4q7FVRv5MVXckxYrcWTnybFdyxV3ZMgrTYq3x/y8VVP9f7GLJSbFiqcsVX 5NVH/LxVUVf28Vd8L4q7liq9uPHFWuT4qt/bxVdirf2PsYq7lirWKttyxV3LniqxV/kxVzfb +PFVz/YxVarYq5l+LFXccVcy4qv+LFWsVW/Hiq7FW1xVrFXYq23x4q0/2MVd9nFVvxJirlX/ ACMVczYquxVtWbFWsVdirf8AkYq1irfpq+Kub/LxVyt8OKu5Yq74eWKu/wBTFXftYq19rFW+ OKrFxVdiqpiqz/UxVfiqzk37GKu/1MVX/wCRiqi2KuVsVVsVWNiruWKtN9vFXYq79jnirf8A l4q5v8vFVit/wGKu44q5cVd8SYq5fh+PFXcUxVdiq3lyXFXMvw4q7lxxVdiq37fx4q7liqm2 KqiriruWKrOPxYqv5fyYqp/8SxVvIK0y88VXr8H+viqnxxV3LFW1/kxVvb+TFkt/y8WLfFl4 Yq1yxVtfg+PFW/iyarHxV3PFXK2QZNM2LFvniydirWLFtW4/BiydirX2MWLf+Riyc+Ku54qp 5Ni7FW/9TFWv9TFktf8Ay8WLmb4cVcrYq5sVd/qYq5WxV32/sYquxVTxVa2Ktt8GKr2/4fFV Pjirf2cVWcmxVy/B9jFXf5GKr2/y/t4qp8uf28VayTBrlkWbuPDFWsVbX/LxVpvt4qpriyXY qp/6mLFU+39jFVHFXYtbl4/Bi2Oxa1jfa4YtizJMF8mRQ5eSti2LMkwXq2RZrGxV3Ljirvgx VzN+3+xiqj+zirueFXYFdirnxV3DFVnLFrdxxVy4qs5fDzxVS5L9vJJc3wLirX+viq1mb/YY q7/IxVzfDir/AP/T+zjcsuaXfZxVrj8WKFzcvsYquxV2Kt5JDS/78fIsl2LYqc8VU8VVlX4c VWt9nFXcMVX/AGcVXv8A5GKrsKuxVT44WCr/AKmRZtYq7FXYtbfL9jFsWrkmDbcsihUaPFsd +zi1uxVfy54ti/jiq3liyVMWK1sVXYtba4tjS/bxVtv5MVc38+Ktfaxa1TFsWN8GKr1bFXNx 5Yqv5c8VU/g+3irfL4eeKr+XPFXKuKtKvxYq3x5c+eKt4q0v+viq/wDYxV3wYquxV2KuxV2K ttiqzFkuxYt/tYq3iyW5BW1xVrFVTkuKrFxVfy/nxVYuKrsWLnxVpWbJslVv8jFi1x/nyCt4 qp4qvb4mrirfL9jFktbFiu+zk1bxVUxVYv28Vb/YxVyrw+3iq7FVvD9jFXM2KubFXcf58Vcz YqvbFXN8GKu44q5sVdy+LFVnHFXNirl+HFV2KrY/5MVa/Z588Vb4/wAmKuZfh+DFV7Yq7j8P wYq7u+KrG+HFV2Ktt8Hx4q7lirmxV3H+TFXccVaxVv4sVc2KtP8AYxVtsVaxVtWZ8VdyxVzY q7jiruOKu44q7jirvi44q1ira4q1xfFVnF8VX/ZxVvjirv2fjxV3H+TFWsVd9nFXYq3/AJGK ubliq/FVn2V+D7eKtKy8cVbZueKqLNiq/kmKujbFV2KuxVbG3DFV64qp/F8fDFW/2MVXYq7F W2xVZy/kxV37eKr2xVpvt4qt44qsZsVa/wAjFVbFVPFVvqcMgrl44q2/28WS3/UxYrsVWM2L JcrYsWlxVvlzXFXfH+xirS4qub4PsZNVmKqOLJWxYu/ayDJrhixbTFksZvixVfirsVWcsVd/ l4q5WxVzYq3k1WrirsWK1cVXriqxfhxVy4quxV2KqLMuKt8eeKquKuxV32sVU8VVMVUuPFsV czfFwfFVjfaxVd8XHFVvL+fFV3HFVuKuxVT+1irsVWriq/jirXLFkt+3ixXYqt44q5mxVY3w fBiqx8Vdx/4DFXMv/AYq5mxa1PFVT/UxVYq4q7liqxf58WxWVf2MVWfb+PFWsVUlXFV7Ni1q LNi2OfFrWLi2L8VcrNyxV3PFVjN8OKtYtany44odilUxVD/6+SS5sVW8uOKu4Yq//9T7Nckz Iam8VdyTFg2zZFkvbFWuT4q0v2ueKFXl8Xx4paxbFTniqzliq/kvHniq9vsYq7m+KrOS4qrf Y+xiq7Cqniq7kmBV/wDr4q71MVd6nPFXKzYtbuX7eLY1i1qmKrGbFV/L/gMVdy5Yti9fgxVv FV2LJYrf8BixX4snLixdyxVd6jNiyW4qv5fsYsWsWtUxbFPi+KONU/a54sFP/IxZcaIxZKar 3fFXN9nhhVzNga3cvh+3hbF6t8PwYq5f8jFVnJnxVf8As4FWep/l4qrccVX8sVWcuOKu/wAt 8VcrLirvgxVdirsVdiq3FkrYsXfYxVbiyW4sW1ZXyDJ3LhirWKqnLjiqniqo32cmxXf5GKqc a4sl2LFcuKt8vhxVvFWvhxVrlirbfYxV3w4q74P28Va+Hj8GKqnL+TFV/L4sVWM2Ku44qv5Y qp/tfHiqo2KrG+L48VczYq5fibFXNxxVdirf7WKu/axVrFVq/wAmKu5YqvbFVP8A1MWPG3yx YuXFsd9jFVZmxVZy+HFXNirvh+3iruWKr8VU0+xiq1eP7GKr29vsYq7lzxV3LniruS8f8jFX LxX7eKu/1/sYq1irsVb44q1irf23xV3L4sVdyxVZy+3iq/7D4q7/ACMVcrYq1irbYq19nFXY qqYqs/yMVcuKr3xVZy/bxVytyxVytirm/wAjFVn/ABHFXLiq9eOKtYqtVsVXcExVb+xirv2e eKu+y3x4q0y4seNt/wDIxYtccWXG5mXFiqNiqg3H9jFsVcWPGt44rxts37GLJYrfsPiq9mXF Xeov7GKrG4pirXLFWlb9vIK39nFV2TVTTFVy8uXx4sm2bFisxVdyxV3+pireQV3L+TJqsZlx V2KqmKqfPFXK3PIMmkxYtpiyU8Vb5YqtVsmqrxXFisXFV/8Al4qo4slZ8WKky4sm8WLsVdiq 1sVdxxVfyxVrFVrYq79jFXMuKubFVnxLiqriqi2KrsVU0xVezf5eKobJMF7fZ+PAzawK38X7 f2MKr+TYFcmKqP7GKrsVdirsVU+WLJ3LFV3x4sVNcVd/l4qtb4cWtzN+3irXJvt4q38fDFVP 7OKrckltWxVc0mRZrPi4YquxVby+HFVuKrf9TFW1XFVmKu54q58WtTxbHYq7FVrSYtbuWKqf xNihU5fyYpdy/wCAxVTySWvUxVZyXFXPir//1fs1y55kNTTN+xiq/wBTIoXtiruXHFsUlZeW SYKrLkULsWxtlV8Vcrc/jxa2sWxU+z8eKu54q5WxV3L+TFV3/EsVbXjhVy4qv+DFXfYxVyrg VzYq74OWFV6tga168v28VWM38mKr2b+fFsWK37eKr1bFrX8l+xi2O2/kxa3cv58VbxbF3LFV vwYsl3LFi5W5Yqu48MWMG/hxZL4/t4qs5Yo4F/PFg74sVc+LY3yGLHgW4rwN88WS/wCHFXK3 xfBiqz/IxVey4q1xxVvlzxVfyT7GKu5fz4q5sVWL8eKquKrVbFV2KtsuKrMWTsVXYsVuLJfx yCtYq7FVTnirvtfYxV32MVcv2cVc+TYr/h+DFVFcgyVeWTYrcVdirf8Ar5BWlXFku+HFi5VX FV/+Xiq34Hyau5L9hMVX/YxVzMuKuZVxVzYq5eKrirvTxV3LFWuOLHgd+3ivAvxZLOXH7eKt 8l54q5uK4quxVtlbFVkmKtftfBirfHlirmxVdxxY8CzjxxXgb+39vFkvZeGKub+RMVaxVtVb 7eKtfZxVU/y8VWcl+3irvixVZy+Lniq/9rFWsVb4/D8eKr2bFVFm5/YxVfyxVy4q5fgxVy8u OKub/LxVrFW+OKuX4MVcq/Diq/hiqxsVc3+XirWKts2KuZlxVytirWKtrirXNMVW/a/1cVcq 4qvX+fFXNirv8jFXN/l4qsVsVc/+RirvgxVdiqzl/kYseBy/bxYr8Wx2KrG+Bv8AIxY8Dv8A iOK8DuT4sV2LLgXf6+LJ3HFXL/kYqs5NyTniruf7GKu/Z4YqtxVa3H9jFW+XPFVzZBVnJMVa 44q7/UxVd8H7GLJpuK/Bixdy4fBirk+3irXHFV3LmuLJb8P8+TVrnixdirv+J4q7FVuLJcy4 sXcMgyU8VVPsYqs+1iruP7eKrvhxYtpk1W4slv2sWLbNxxVrFW1bFXNirWKrcWS5sVW/YxYr sVdiq3liruX8mKu+PFVjNiq/kmKrsVUuS/YxVZ8LLzxVy/Z4Yq18H28VbxVyYtakzfz5JKo3 fIpgtVcWTSriia3jil32/sYquxVauKubFVPliq7FVPlxxVZv/JiqzJMFblxyKFnLFWl/1MVc 0eKt8cVWNi2O+H7GKukbFVuKtK2FVL1sLBc+RZub7Px4qs5YtbuWKu+HFXLiqlyySVy5FCnk kruORYqbN/JkmS3niq9sixczZJk0rZFDuXHFX//W+zPH+RMuYu54VWq3xYWCI5ZFCxf5MVay SVq4qiOXw5FDfLt+xirv8v8AYxbHNi1ubFsd/r4qv/yH+xiq5cVW/Diqpiq3jiqp8GKrsVWs uKqfLFVfji1rP2MWxfxxVZG3L9vFV/p8PsYq5W/bxV3xYqvxa3ftc8Vdyb4MWxUxa2viXFV/ LFscq4q5l4/Biq/lzxVrFW2bnirWKt8cVXcuH2MVbVmxVy8MVcvw4q7nirlX4cVX/axVyrir eLW0vx4tjX+Rirf2sVVcVUo/i+N8VXp/l4q74MVczYqu+ziratirXLFk2vx4sXLirXFeXPFV ThkGTmbFVPFVRV54q74eXDFXcm+xirT4sW15c/8ALxZNcMWLb4sluTVVZsWLXHFXcv28grvt pirlZsVa44q7liq7/LTFkv4/z5Ni74MVWfH+xiq9P8jFXcfhxVzcsVXfaxV3L/IxVay/5GKr +OKu5fsYq1zTFVvLFV32sVb4/sPiqxVxV3H4sVXtiqxmxVfx5/BirWKrf8jFXfHiruX8mKr+ PPFXLirWKtq3xYq7jxX4MVaxV2Kt8fhxVe+KrGX+fFXceK4q5sVa5Ly54q2vwYqpt/l/bxVU bl+3iqxmxVdira4q1irfHFXfDxxVZxxVdirfH+fFWvtYq2q4q5uPLFXNiruPDFW/+I4q0v8A J+xirvt/bxVZ8X7eKr/tfH+xiqxVb/YYqrL8f2MVWcf20xVZ+xiq9o/i+DFXM2KrPt4q7jy5 4q5sVd+xiq7FVvFeGKuZv2MVXYq23FcVc2KtYqtX+RMVc32MVXYq7FVrK37eKuWT/gMVcvw4 qpKv7GQVdiq/liyU+Xb9vFi3irsVa+LFV6/Fiqjiq7lirTf5GLJ32WybFytiq3Fk1xyCr1Vv 28Vcv8+KuxVrnixbTFk7FXfZ+Phiqzjiq/FXPk2Kxv8ALxVy/wCRirWKrf2MVcvw4qvXFWsV W8sVdx5Yq7jirlZV+DFXMuKuVsVWfs4q5fsYq5VxV3H4cVWL9rFXMvxcMVd/qYq5lxV2Kuwq p4Fdira8vsYq74eWLW1hbFvx4FXYqt+xiqj6f7eKqfL9vFrVOX7eLYp4tapzxbFFv+HxVezL iq/FVNft4q7FVrYqs4/sYqvXFVjL8PDFXftYq7m+KrP2uGLW5v8AIxbHYqs/1MVc2LWsbnxx V3/GmKqbM2Ktr8fwYqsVf2Mklb/kYqq8viyKFv2cklTZuORQs/y8WxdirsKv/9f7Lb/z5cxX vi1rVXJJXq2Kr1xVcy8f9TIoW/6+SS1JkUL1+xiruWKu4fsYti7FVRWxV3DFVi/B8GKr+eKr PhxVfzxV2Kr1kxVpm+LFVRfsfHiruOKubCq9sCuVv58Vab7eKrWxVvj2/byTBv7ORQqcuOKu xV3xYtit8eKubFV2KrVxV3Ljiq/jirmxVzYq5sVaxa0Ri2Ka8v2MVcvJOGKuX/LxVyt8OKr3 +3irS4q18f2MKruX7GBXNybFVnPFV/7PNMVcyr+3ireKrvUxV32/2MVd+zzfFXYsl7Kz4sXL iruOKtYqqZBk5vhxVTxVUbnirsVcq4q7kvH7GKu/ZxV3xYq6Pjk2K3hiyXKuLFfy55Bk1+3w xYtf6+KtsrYqsTFVaTFW2bJqtxVcy4qp8v8AYpiqtiq1uWKuX7GKr1+NfgxVrFW/ixVzL8X2 MVU/i+3ira4q7+TFV/Ht+3iruPDFWsVdiq3liruP8+Kr1b4sVaxVbyTFXfbxVy/AvPFV7R88 Vcy4qs5/sYq79rhiruP8mKr1XFXN/PiruXw4q1irvtYq3x54q5f58Vdx/nxV32/sYq7l8PDF VnD9vFV/+pirvixVTZuXwJiqoy8MVczYq5l/bxVr9jhirsVbX4/jxVrFVTniqnirvs4q2rYq pr9vFVTj8PB8Va+D/Z4q2zL9j9jFXNirlVsVa/Y54q2vL9vFXLiqxV5Yq5lVMVc2KuXFV6ri qxfsYqv/AGcVd/lp9vFV7LiqxlxVZx/nTFV/d8VWccVd+xiq7FW+PBsVUY8VaXFVTj/Jiqmz f8HireQV3JvsYsljNiq5uOLFri37eKuXFXNiq7FV3+Xiqxm/nxZLePHJsXf6+Ku4Yq5vg+xi rX2f9fIK77K4q23x/Hiya54sW8WTmXFXfa+3iqz7OKr8Vdiq18mq3FitVeOKr+S/YTFVPi+K qn7OKu5Yqsb7GKu+DFVirwxVe2KrcVXcsVdxxVTZuP8AqYqt/axVf9n/ACcVc3+Xiqxv8jFX Mq4q7/IxVyYq7l+3iqizfyYta9WxbHMv7CYqsb+TFVzccWtauLY0328VbXFVjfz4qsfFrc3x /Bi2OXki4q74Wxa1Jckld9r9vIs1+LWp4q7FsWtirmwq1yfAq34sVa/y8VbZm4/5GKrMVabi +KtsuKqeKtr8GKtYta39jFXcuOKofJJXt8GKuZvhxVvFVrNy/YyKHcuK8MWxYzYVcrYFd/r4 ta5uL4q//9D7Msy5cxWfB9jJMFT9vhiqxMVdy5YqubFW1+18eKuVcVXL/JkUL+PFsVXriq34 P9nihVTFtWccVaxV2Kqn+XiqxWxVXxVa2Kq2Ktt/r4qoNiqurLi1u44tjXx/t4qs5cft4qv5 Pi1tri2O+LjwxVrFrVHxV3PFXJi2K2LJY3LFivbFVPliqvy54q5VxVrFW1ZsVWL8OKrsVdiq srLiqk2Ku/yMVXs3PFXfFirq/wCXiqt8eKu+PFVjNwxVfyxVTbFW24/t4q5v8vFXcufwYqvZ mxVdirfLFWuOLJ2LF2KuyDJUX+TFWv8AXxYrMWSovDFXL9rFW2xYtcMWTv2cVW8v28mq5fg+ 3ixWs2LJU/b4ZBi2y/Diyab/ACMWK9lVMVWfZxVpcVVfttk1WcHxVfy/4PFVnLn9v4cVd+zi q/jy+B8VdxxVeyqzYqs5K2Ku5YquxVvjw+DFVjSfyYqv/wAjFXLHiruXP7GKtYq7FXYqpcHx Ve3JsVdxxV3wcsVX8ueKub+TFXK3w4q5sVcvwYq7lirlxVy4qsT/ACMVXsqvirvtr8eKtYq2 vwYq1irfLFWl+3irsVb+HFXKuKrF/nxVevwYq1xZPgxVv/L/AGMVaxVby+HFXLyxVe2Ku+Fs VaxVvl/JiruPH/KxV3+XirWKt/6+Ku/y8VaxVtuXx4q5sVdy/YTFXM2KtMvw8MVb/wBTFWsV Wt/PirmX7eKrvs4qt+PFV6riqz9vFXL/AD4qu5pirbf5eKrOPL7GKrsVbX+TFVNvt4q23w4q 5ZMVU+Xw/Biqo2Kqf/EsVb4PkGTX2G+DFiv/AMvFVnL+fFXepirmb4sVXq3FsVWcuGKtf5GK rv2PjxZNccmxW8f5MVX8vhxVYq4qv5ftpkGTXwf7DFis54qt5YsmsVX8MWLfDFksbliq/wCF sVWfY+xiqzJquxYt/wCvirmxVbx4Ysly/EtcWLuOKtYqt+3irvh+3irlb9vFXcf5MVXYqpNx 5c8Vcq8P9fFXcuX+XiruTL0xVzNwxV3Fvt4qs+JsVdwxV328Vczf8BiqkuSYLmXj8GRZu5Yq 5f58VUW+3kmC9cizaZsWTeKrcWK3liq1lxa3Mv7YxbFPFrb+HFVLl/wGSSqfb+DIoWr/ACYW xey4FdyxVRVsVbxVdyxVbirXwv8A6+KrMVc+KrOOKuXFXM38+LW5cVWLiqiuSSuZuWRQpvkk qjZFCnxbJJdzxVrj/JgZtYFb5Ytblb/YYq5uX+vir//R+zOXNLlbFVqZJLm+ziq5vtYGa7Cw bkyLNerK32MWtT44q5l/bxVWxVaq/wA+Kr2bFWsWxtcVXqvPFXL9rFVi4qv+HFXM3xfBiq9W xV3qYqub7eKtt/PhVZy7/sYFXq3w4VczYGt3L+TFsXt/kYq5vtcMVWtyyTBVb7PDIs3fBzxV crccVa4/8LiyXq2Krvt4sV/7OKqDYqrq3w4tazkn2MWxfv8Az4q1ira8kxVy/Biq/j+3iqni qoqrirlXFXcvh4Pirv8ALxVfy5riq9mxVYrKmKrGZcVVuKfYxVdiql+zirl9vsYqvX4sVXc0 xVa2KrsVczccWS3FXYqv5ZBV/DFXcuWKqeKqiriruK4q5mxV3Ljirl4viq/b+fJsVjNzxVdy xVvIKub4sVd8eKu+z/q4qsVsVb/1/sYsl65Ni7in2MVczfFirlbFXL9jFXKuKub7PDFV/BMV WcsVXYq7FVv7PDFXfsYq5fhxVyt8OKtNx/3Z9vFVTliruOKrFXjirmbFXfbxVy4quxVteWKr P2eGKr/2cVczfz/bxV3+Rirvi+wj4q7l/Jirl5Yq71MVczYq1irf+piqxcVVP+I4q1x4/H+x iruP7GKu5c8Vcq4q7jiruX8+Ku488VWK2KuX4cVcq4qv+38GKu/axV3L+fFXcsVd8WKqa/bx VU/1/sYq00nLFVjLzbFV7KyYqsX7eKq/L48VWf6+KuXFVisuKu5Yq7/UxV3Hg3wYquxVvjwx VZx5Yq5m5fHiruX8+Kr1+1wxVyqz/HiqxlxVf/l4qs44qv5cMVd/r4q5fhWmKrOOKu5MuKu4 /D8GKrOLJ8aYq77fwYqv+3iqmyr+3kFX/wCwxVZ8D4q5l5fBirfL9jFku+DFiprirf7WKub+ TFVv/EMmruK4qv5viqzFWsgrfPFk79v7eKuZsVc+KuTFXfs8MVdirl+ziqxcVczfyZNit/Zx ZLlxYtYqtX+dMVcrYqu+ziq39jFV2KrVxVT44q7liqoy/Diqzl/kYq5fb7GKtLirbccWtYrf t/sYtjl+zirmXFV/w/bT7GKrP8vFVL43yTBvIs2/8jFXK2KuXFVL/UxZLvsYsXcn+xiqxvjx VZ/l4q7FXK2Ku54qp4tbfLv+3i2LMkwd/l5FC9sWx37OKrGbjiruPLFVnHCq9lwKtxVTVlxV 37XPFVP7OKqmKrGxV3HFrWKzYq77H28VUuyZJLbfz5Fip/s5JkqKq5FC3niq18klYzYqu5ZF m7ji1uZv2HxVZx5fBir/AP/S+y3LLmLv8vFVjfDiq9W+LFV7N8OLWt/1MklV/wAtMih3Li3+ RirXLFW1kxVvl/Pkkrl+LIodihcuKrW+L7GKVyyft4tjbYta/kvLFsWLiq//AF8Vd9r7GKuV uTYqvb7Xx4qsb/IxVd8XLFW19/t4qrcufwYta3jkktr/ACZFC3j/AD4qvVf5MVcvxfG+LYv/ AGeGKrI+OKqvLFW2XFV/wYqp4sly4qqYsXYq7FXYqtxZO44sVb/XxVzNirm+19jFXN8OKu4/ z4q7kuKr+Pb9jFWlX4sVXYqps3L4MVVmX4cVWNyxVfyxV32vg/YxV328Vdy/Y/bxVy/yft4q 7jiq7FW+OKrMWSsmQVYuKr1/4fFWh+xixb54snKuKuxV3L+TFXYq7hk2Ll+BsVW4slRfjyDF y/z4q3irXwt/qYq23L4+H2MWTTccWKp9jJq5sVWNxxVVxVbxxV32/sYqvbFVnLFXL+6xV3qY q5fixVzNxxVdiq1uSrirmxV32Pt4q7/UxVdirfL4cVWfE+Ku/wBfFXNyb/JxVcn2MVb+Hjir uOKu+y3DFWuCYqqL/Jiqnirf+XiruWKrOTLiruXL4MVXyf5GKrPg5Yqv/axV3H4sVaxV2Ktr /JiruWKrP8vFV/8Ar4q5vtcMVWf7PFVbFVFcVX/FirWKt8vixV3L4sVWMuKu4/FzxVfy+H/I xV3L4sVdxxVfiqz9nFWuL4q2v+XiqxP2MVXsv7eKrP28Vc32PgxVrj8PN8VVOWKubFVn7PwY q5l+LFVT/iWKtccVWcfsYq5V/nxVd+3wxVtvgxV37OKu5N+xiqxmxVy/Fiqzj/Piqriqlx58 ExVVxVbw/bxVTXly55BV6r/Piq37fwYslzfa/wAnFi7/AFMVbZfi4YsmuPHFipriq74cWSxl ybF3+Xirvj54q7hirXDIK3wxZNPixW/5eLJfzxVTxVvliq9MVcmKtYsW8mqzjiqz9vFXf6mK r+WKu5d/28Vc3wYqsVcVXYqtVsVWcuTYqv5cf2MVdyxVYq4q19r4ExVWxVRb7GLGa3Fk7j+3 iq7/AIliq1l+LFXYqpt/Pi1uxbG1xV3LFVnL4cVcvL7eKuXFV64qpYqp/H9vFXJiqzlirm+P FWsWttl/Y/bxbHcuGLW1irfHFsXt8OKoXlirbYVaXAq3FV7fBiqzFVPFVReP+riqniq1l44t a7FVrL8WKqeSS18D4q5fg+PFXMzfsYq1x4fBkUKKri2L/iwq5sDW1i2Oxa1v+Xiq5v58Vf/T +yzScMuaVn+WmKrsWxv7HwYVd/l4GtppOWLYuZskwa+P9vAzVFbjhYLlb4uGRQ5f58Vcn28V b5ZJLl/nxVczfsZFDlVfsYq7liq9WxbGsVbXFV+KuZsVcvDFV3+XirfJl6Yq0rNirv8ALxVU ZsVX/wCQmKtcvi4JirfLhi1uVvsPi2NJ9jFrVF+zirvhXFsdwxVW5YqsVsVbX7XPFkqYsVvL 4cVdxxVeuKu44q7jiqxm/YxVWTFXN9nFVPFVRuGKrl/b54qtxVf6nPFV/Ljiqz9r48VabFW/ t/bxVy/Hiq/jirl44q7lxxVtWxZL/wDiOLFTk+LFXLiruXHFV2KqmQZO+xiqzl8OKr+X/AYq 5f8AIxV32MVcvJ8VcmKrPtYqr5Ni0q4qsxVcy5BXfDiqozft4slP7CYsW8VXtk1XYqpftYqv +xirXF8Vb48cVd/kYq5v5P28VX/H9jFVitirS/D8GKt/t4q74V+3irm+HFV/H9v7WKrFb9vF Xcv5MVXq2KrOWKtL9vFV/wBnFW+X7GKtYq2rfsYqsZuOKr+OKr/j54qsZf2MVaxV2Ktt8GKr P8vFXNirm+1zTFV2Ku5Pira/HirWKt/tYq74cVaxVtcVdx+H48Vdy/YxVy4q5cVaxVb/AJaY quxVvj+3irvtviruOKr+GKqK/b+DFXep8OKr/wDL/YxVy/Biqxf58VXYqtVlxVdirbfCvDFW sVW/YxV3HjiruOKu4fsYqvb+TFVn2m54qvbjirmb4cVaxVbT4f8AIxV3FMVd/wASxVdirbL9 jFVnJPsYq77Xxviqz4cVX/ZbhirvsfYxVzfDirXFf9lirWKrW5cuGQVrjiq5Y+eLJa2LFv4v t4q7l/Piq9P8jFVjNyxV2TZNqvw/z4sVjc8Vdy/YxV3DIMljYqvxV37fx4q7l8XwYq7FVjYq vTFVnxYq79nFVrfHk1XMuLFZyxVz/wCXiq9WxVzf5GKrMWTm44sXf5f7GKu5Yq7/AFMVXYq7 FVqr/PiqzkqfYxVzLiqz/ieKu4/t4quVf+DxVb8P7GKu5fDzfFVNlb7D4tbvtYtjsVdiq1eW Kub962KuxZObFisZlb/XxVY0ir9vFVy4qtb7OKrP9RMVab+TFrW8v5MVXcf58VU/gySVyr8O RZu5Yqps37GKqi8cKrG/y8CrFXFXf6+KuZsVWNiq/wC03P8AbxVTxV2LWtT9jFXfBirmXliq jyySVb7GRQh/t5JLbcvt5FC1mxbFi4qvkbFWsVW8P28VWfs4VW8eLYWCvgZv/9T7Jcny5pVO aYqsVlTC2OXl9jFV7M3+wwNa/k2KqeLY2rfyYq23x/t5Jg7jyxV2KuTFV3HFXLiqryfIobXj iq7gmKuxVtWxbGsVbVsVa4JiqorYqsXi/wBjFV+Kr/s4q7j/AMNiq/0/2cVU/wDIxVUWThiq 9sWtZyf7GKr/ALC/Hiq3jkkquRQ58Wx3DFXfYxVWXFXYsnfsYsV2KuT7GKtquKtYq3+1irm/ 4HFrXqvPFsXquKqf2v8AUxVteX7GKr+D4qsVsVX+phVvAq5sVU1b+TFVRvixVysuKrsVW/6m KrsVWt/Jiq9W/YTFXNiqxfhxVfxxVf8AtYqs+HIMl+Ku/wAjFVi/zpiruWKr/s/bxVZ9rFV6 tirueTYu4Yq5MVX8ueKreWQVcqt9jFk1wfFi7imKtr/l5NV6r8XPFVjNiruPDFV/LFXLHiq/ jirv8vFVn2/sYqvb4vjxV3H4sVUX+3iq9f5MVdH8TYquxV2Krf2fgxV3w8cVX/FirpMVWMq4 quxVbxxVf8XLFVjR/DirXJ8VWr8Tc8VVmXFVi4qrceWKrGb+fFVn7GKr9/58VWfYxVdirci4 q5VxVyrzXnirv2sVWNirv9TFV2Ktsy4q7jirXLl+3irfHnirXF8Vb44q1irbcft4q1iqxuP8 mKqn2VxVYvFsVczYq5m/bfFXR/z4qvZfixVYy4qv44q0/wBjFVrfGvPFXLiruOKr+X8mKqat yXFW2X+T7eKrsVW8lVcVd6n8+KrsVb+LFVnHFXMzv/qYq1xfFXcnxVU/1MVdy/nxVZx/2GKu 5Yq7l9jFXK3w4q5l/kxVZ9r7f28VXr/r4q0ytkFWLyxVytirXHFV3H4cWS74fsYsXN/Jiqny xVY+TZLsWK/7K8MVWN8WKtPkFd8OKufFW+eLJTxVUZcVaZcWKzFkqYq77eTYrP2cVcq88VWc m/YxV2LJf/r4sXKvw4qsbFXfDxxVYzcfgxVeuKrsVWN8XwYqt488VVcVWs2Ku+PFVHl+3+3i rlbFXcf2P2MVdx/k+3iruP7eKrGxa3N/Ji2OVVxVrFVNcWS77eLF3HFVn7WKrGbCruX8mBXf 5GKrOS/sYq79rFrcyri2O9PFXM3HFrdwTFsawqpcv28Cr14ti1rcWxbxxVazYq79rFVit8OK uXFrX/Di2LGbjiqz/Lxa2mb/AIPFVjNyxVpfgySVVm/byKEO3xtkkqn2cixUmb9jC2tP9jAr a/Bi1rFxbHccVczYqtwqsb/UwsG8Vf/V+ya8my5pd9j4MVW8uLZJK77f2Mihbyb9jJJcrYq2 rfDkUKjNiq/FsU/2P8jFVTl+3z54qv8A8t8WtRVueSSq5Fi23HFLf2Mklcrc/gyKF/HFWsVW qy/t4qv5fFi2O5YqvX/LxV2KrGxVfzxVWZuOKrF+z/kYqq4qt+LhirmbFV64q5cWt37fx4qv fFsczYq5MVdiqpiqpirsVW4sl2LF2KuxVtcVdx/YxV3wriq/l+2+Ku/a/wAvFXYqqYqprwxV 2Ku45JgiMizU8VXL9jFXccVdxxVZ6mKquKreWKubFXYsl/wrixcuKrfjfFkv+xiq5V9L4Mgr sVaxYrf8vFkuxYt8v5MWTlX4sVdy5/Hiq/l9jJsWv+I4qtxVf+1kGS5WxYqbYqqcUxVb8OTV f6nD4MVU1xVUX+TFXcsVcrfFiruOKr2/kxVZy+LFV64q7j8XPFVnLFXft4q7/XxV32MVX/6m Kubliqxl/wAjFXepirlbFXLiruPxYq7jirmxV3H4eGKrsVW/E3wPirTfbxVv9vFXK3H/AFMV Xft88Vb44q7/AF/t4q7l+xirlxV37OKu5N+xirmb4cVd/r4q5W/4PFXNirvhxVZxxVerf8Bi q9f+ExVZ8MWKu/1MVdxxV3L4sVd9lcVcvFcVd9n4ExV3w4qsbFV6t+xiqzi32ExVe0fxfBir mXFXLiruX7eKrGXFXfb+3iq7FVqrxxV37eKu+3/k4qv44qs/yExV3Fv9liq9sVcvHFVnHiuK q2KqKrirmxVr9r4MVX4q22Ktc0xVa32MVU+OKqnx4q5vixV3FMVcOP8AsMVU1XIK7jiyc3Hj zxYu488VXs2KuXFVq/C1cWSly/4PJqq8f2MWKxmxVfyTFVCRv58gyVOTPirv+IYq74sVc32s VWLirWKqnH48Vd9jFXKuTYqbYsm1xYrMWTm5YsV7fHirWKt/6mKtYqpfE2Ktf8SxVU/18Vcq /wDAYq5mb9vFXNxXFVifbxV37OKukZeOKu/axVY3H48Vc32cVc3+viq39nJMGm+H40yLN3+v irWKreX8+FXNgVzfz4qs+BMVbxVTxVz4tbmbh8CYWxz4GtZxxVv/AIjiq3FsWqvxYqsZuf28 VX/sYquwqtZcDWo4ti7liq3FXK37BxV3FXxVRb7XBMVXt/r4q1i1rf2MVUmVcklyrireKtfs cMVWc8VXcvgyKFnL+fFsdy7fsYqsb4/9TFXccVcuFVnH9vFW8VW4WDsVf//W+x/qfsZkOO7l zxVpWxZuZuf28ixVVXFK7FVPjkkr1k+LFVzNy+39jIs3fDirm44qrcvhxa1jLira/wCRkkr+ WKrmbIoUuX8+SSr5FDsVb/1MVa+1i2O+2+LW3yxVfy5YtjuPNsVcvJMVXrI37GKu+ziq/wD4 liq3FWv2Pgxa1ZW/nxbGmb9hMVW/tcHxVdi1qnJsWxyYtbueKruWLY5VbFVbFVq4q7liq/ji qzFkuxYqjfC3x4qp4qqN8f28Wtr4f9niy422XFkvVlTFVnw4q5WxVb+zkmC7kvHhkWatyVsV cq/DiqnyxVU+DFXcsVU+OKqif5eKuX4sVcq8cVdyxV3HFV32cVb/AGcVa9Tj8eKqmQZLGxVf /qfYxVY38mKr+GKuX+d8VcmKuX7WKr0+3k2Kz7P7GKu54qq/YyCrP2PjxV32cVbb4vgyau/Z xV3H9vFVXFW+LJirlxVZy5fbxVf8X2HxV37WKu44q74cVaxV2Ktt/Jiqxm44quxVavLFV2Kt 8sVU+T4q39tsVXr9nniqzi3PFV/HFVFftfBiq/8A18Vd9hcVXMq/t4q7FW/hXFVnxPirlkZ+ b4q5ePP/AC8VXr/l4q7lirX2sVWN9vFVTl+xirm4tirv2sVdy4Yq19nFV3/EcVW4q3/kYq5v h/1MVdy/kxVrFVvqftYqv5ft4q7/AC8VdyxV3x/bxVY2Ku/1MVXYq3+ziqzkmKrsVW/sYqux VtcVWft4q77fwYq0y/7J8VVP2fgxVzfF8eKubFVirw+PFV7SL+xirSsvLFVrfb+PFV7YqsbF V/LFVn+pirSr8XwYq3x/nxVdira8v28VWLirl+HFVirirSyMuKubFW2+D7f28gyXfY+PFisX jiqzFV3H4uGKrsVdiqlwybJczYsV6rirm/yMVWLzyDJy/wDB4q0v+XixbZcWTuP7eKuVcVWL yxV32sVX4qt4tyyatNixW/DiyXMuLFZyxVdirmxZOxYrW/kxVdiq34MVXYqtWT+TFVNsVXYq u44qsb4MVd/kJiqxv58Vd/r4q58VX+piqG5Yqvbjirv8vFXccVWfbwquwK77OKqP+Ri1rcVc +KuxbHcv2MVU0+xi1tt/kYtiz7DYqvX/AC8Vd/l4tajy4fYxbG8VWtiq3nirsVWL/l4qvVcV WK37GKuZsWt3LFsaxa1r/wCRirm/18VU8kl2Kt8lfIoUl+HJJc0mKtNkWbv8vFrWcsWxYy4q v44VUf8AXwsHccVWq2KufFVi/wCRir//1/sesnBvgzIcdvFVvN8WazniqriwVFXFm1/qZFDn /wAvFXfYxbF/w/bwq1gVv1P5MKt4WDnxVev8+KqvJMihSVcklV+xkUO/yMVd9j4MVX/5eKuX Fscvx/Hirvi5YqvfFXcVZcVcmKqmKrWb/g8VVFxVY3L9jFV68cVWsuSYLlXIs3J/kYtbo8Wx W5fyYVU+X8+Brdiqorft4tjl+D7GLWqYti5WxVrk+Ktq2Kr2xVZ/kYquT7GKu4viqpzxa1PF sVOeKu/1/t4qubFVv28Vcy/tjFV/p/yYVX/bwK5cVWfZxVezfDirvsYqv/18VWf5f7GKr2bF VjcePPFV2Kt8cVaxVU54q7FXYqs/b4ZBkvb+TFXYq7FXJiq+NuPwYqsX/LybFfx5/YxVY+Kr /if4MVa5fz5BW2VsWTeTYruTft4qp/5GKuXFVT4V+3iq/wDy8VUOOKq/w4qsVsVcvxfAmKr/ APIxV3LiuKub4/gxVZ+3irlVsVdH9nFV7Liqzk37GKr1Xg2KrFXFXM3P7GKr25Yqsb7PPFV/ HnirmxVzYqsZl5Yqu+1irf7OKu/1MVWcmdfgxVevHFVjYqvZW+3iqmv28VVGbFXccVaxV2Ku xVvk3LFXccVWNirvt4q7kn2MVdyTFXf6mKtKvH4HxVtlXliq7mmKtriqz7GKr1/yMVWfY+PF V6tirlZcVWcVf/KxVzfD/kYqvVeH+piqz4UxVfy/kxVY2Ku/y8Vcv2ueKr+OKqKt/wALiq5W /wCDxVU/18VWccVXsvxYqs5fDiq7FW+6Yq1iq3/LxV3xN9vFV/LFVjNiqtiqGZsVXq3w/wCR iruLcfgxVT/1MVVP8jFXMvHFVP01+3kFXquKqa4quVcWTX2f8nFi77OKrVbJqv5ft4qsZcVc mKrFX9jIMlfFWvixVY+KuxVTxVU+xirXDFi3iyWccVWZNV7LixczYq1irl+3iqnyxZLm+LFi 77GKu+DFXK3xYqptiqovwriq7FVL9rFV/wDl4qs5c/t4qs+3iq/lwxVR488VXvirv9TFVnLF XcfixVrFW2VsVWfbxVbyxZLuP/C4sXcuWKrG+P7GKtf6mKrcWt37OLYsZea4q5l/bxa1NeL/ AOpirarybFsX/GmKrFxVpft4q1irX7WKu/ZxVR4/z4q7liq9mxVT5Pi1rV5J9vFscvw/bxa1 7YqsZuOKqar9vFXN/O+Kqa/ZySVPFVbngZu+P7GBVH7DYqvZuXx/sYVcuBVFsKrft/BhYL2x VR5ccVcy4q5V+HFXcv58Vf/Q+xi8MyHHaxZuX4cVcq/tnFV3LFW+SYq3x/k+xiwdx54q5si3 KitirfL9vJMG2/nyKG/8jFsWrkmCsvwZFis5cskyVOTft5FDXLhkkqrN8PD9vIs1itwbhiqs uLWsVv2MVXYq3y4YqvxbFnxYqvxVdxxVtfjxVvFVq4qrYqoriqtirsWttv8ALxbHNi1r0xbH ftYtbnxVzfzvi2L25Yq1/wASxVU5MuKu/wAjFVq4slX9nFpaxbG1xV3LFXf5GLWvTFsc+Ku5 f8BirueKu48PsYq5fg+3iq5V5Yq5cVc2Ku5YqrYqt/a4PiruPL4P2MVdz/YxV3LFV2KuxVb9 tcVdiydiq7FiqK3Z8gydiqzl8WKrsWK3/UxZL2ZcVXL/AD4sVqZNVuLJWxYtfZ54qt+HjkFb 4/F8eKtx5NVXFVHjiqov2MVW4quZsVXfaxVtcVdxxVYvxYq5vh4Yq5pMVcq4q77LfBirmXFX fY+3iruP8mKrsVW/YxVzfCuKr1X+fFWsVbk44qsVWxVdyfFVvLFXLx/YxVy/CuKu4qq4q5vi XFV/d8VWNiq/jiqz7GKr+XPFVNft4qv+zirbYq1iq3jxxVyx/t4qv48GxV3HFVnw/bxVe3wY qo8uGKqy4q79rFVnLl8GKu44q5mxV3wYq5eWKrsVWquKujXFXcuOKtM3xfHiqorN/s8VWfDx xV3w/sYqvb4MVWJ/l4qv5Yq16n/DYqt+wuKubFV64qoLiqvxxV37WKrOXw4q74v9jiq7FVv7 GKtN9vFVit8WKq2Krft4q7l8OKu/bxVYq8MVX/Hirm+JsgyU+P7eLF3L4cVc3FMVbxVpsmq3 nirmbFV3LFVvDIMncMVcv+viq/l+xiqzj+3iq77WLFbwxZLOX7GKq2LFQxZKnHh8eKufJsVj MuKtYqt+PFV/d8VaxV2KrWxV3H+fFV2Krft4q5v5MVUUxVe3t9vFV/7eKrF/nxVzNwxVYvPF XM37eKuaTFV3+piq3/L4Yq58VUVbFV7Lirv8t8VWccVcy/yYquxVTwqp/wCRgVz4tal/kZJL a/yZFDf+XirmxVTb7eLYqMv8+KrFXFXN+3wxVT44qqfF9hMVU2xVbirl+1irmbFVjYq5v8jF Xen/AMBi1rOXHFVHjkkubFXNiq3/AF8Vc+KrsihRb7GLYv5ft4qsf/IxV3/EcKrFXFXcsVWq 3w4WCznirmbFVTFVHl/PiwVeOKv/0fsSrc/9TMhx13L4MWba/wCRiwdirueKtrizbWRsVdx7 fsYq5WxVpW/4PFVZuWRZr42/kwq7ly+3irX2cCrVZv28kwVkyKFqrkkqmKrW/wCEyKF3H4fg xVy4qqM3HFV2Kt8f2MWx3LFXLiq/niqxf58VVmbFWv8AUxVtWxVvFWuPP4MVXrhVdyfA1uxV 2Krf2MLYvVsCu5cMWty/H9jFV/7OKr1ZXxbHKuKuxRBfxxStxVcuKr+WKu44q7jzxVzfBi1r 1+L4PsYtjv2cVcrM2KuxVfx+L48VczYq02Kqit/kYqsk49vsYqvVsVdx+HFXN9p3xV37GKrs Vdiq3jiq/lirl+1/kYq5VxVyrirv9fFW/wDXxZLv2eGQVy/a4Yq7/UxV32MVaxYrf9TFkv55 NivVsVa/1MVWr/l4q5lyDJe3L7GKrvsNixd+3iqzjk1b+LFV3J8VWyNiq/lirpMVd9n40xVz fFiruPw88Vdx4tirvi4Yq74uWKuVsVdxVcVcuKu+3iq7FVvHFXLy+3irvjxVpvh+PFW+KfYx V0mKu5Yq5uWKr2xVrFXYqtX+fFXcsVXYq238mKrPh/2OKuVuX+virm/18VdxxVdiq3n/AJeK uXjiq9eWKrOOKuVf28Vcv2MVXYqt48cVd/qYqv5MmKrF/kxVyf5eKuZsVd+3irmb4cVXsuKu +w+KuZsVWNiruf7GKr2j/n+LFXcsVWceOKub4cVaX4vjxVrFVVv5MVd8WKrGXFW2+BsWS7l2 /YxYrGXFV68VxVY3xYq5sVc3HFXcvixVYv8APiq//iWKrPs4qv44q03w5BVn7HDFWlxVU5cv t4qs5fDireKu+B8mqx8Vc38+Krf+J4sm8gxd8fPFW15csWTuXw8MVc3Jft4q0zNixb4tyxZO /wAvFXYq1x44sW+GLJRyat/tYq1y+LFi79jFXMvw8MVdJyxVzYqvb48VUWbFVXFVrLiqn/xL FVT/AC8VWM2KtcsVbVsVdIvw4qsZe6Yq7i37eKuxVx/bxV2Kub4cWtTxbG+WKrFxV3LFV2Ku xVTxVT5NiruGLW7/AF8WxT5fFi1t8sVWfbxVf8LNi2O/yMVUmbjkmC3jkWaovxYqsX/IxVzL iqx8VdzxVTX7eKt/Di1tYtjfwp8GKqfLj8f7eKtt/Ji1tKq4qt5Jiql+z/l5JLXFU6/bwM3M rYFcvL9jFXM2KrOWKu+FMVWKv7eFVq/BhYNq2LBZzxV3PFXMuKuxVYrYqvWTnir/AP/S+xMe ZDju5YqvTFXJirsVdirSr8X+Rizd+ziq/l3/AGMVaXFVbl/JgZu5YFcvx/6+Kr+X7D4q03Jm xa1Tk37f2MWxYrc8kwVF44qsVsVVVbIoWf5eSSrc/wBvIodz/YxVezYqsjXFVbFsWM2Kr/8A LxV2Kr1+L48VcrYq3irTccVXq3D4MWtfx5N8eKu/ZxVTX7eLYvVVbFW+S8cWt37fwYti7j8X NPsYq3irueKrlxV3LFVTjiq7FVFsVVPt4quxV32cVdirfL4sVXfBFi1r1xbFvJcVd9vFXfbx Vf8As4qq4qpKuKr/APIfFVPliqpxTFVjLiq/h+3irvsYquxVarfz/bxVplVsVbX4PsfBiq9l /wCAxVZiyX/tYsXfs5BkvXhirl5fsYqp4qqf8QxV37X+XirsVW5NV3PFivZcVU1bIKuXFVyq uLJrky9MWK9sVWfFx55NXcsVdyxVU5N+3iq7FXYqtb+fFV0n2eGKrWXFV/Lniqjy/YxVWZsV WfY+xiq9V+H/AC8VWMuKuZl/YxVzK2Ku+2uKuVufwYq0zL/s8Vb/AG8VXKvxc8Vb4/FzxVr7 OKt8v28VWcuWKu+xirv2MVd8eKrcVXfs/wCTirmbFXKvH/XxVy/zpiq//XxVZyxV3xN9jFVz /YxVbxxVy4q5ftcMVd8KYquxVbyVPsYq7l8OKr/2sVWcv+AxVzYqvVv58VaxVby+HFXccVd8 GKu5/t4q5v58VXYqt+xiq77OKreXw4q5lxV3+zxV3p4q5W/bxVy/Firm+xirSt/weKt8v+Ax VercsVWLiruXw4q5eWKuVf5MVdx/nxVzcOOKu+3iqmvH9vFW8gq/jiyUv8vFiuxVzcsWS3li xXcviyarOGKuxVz4q7/LyDJp8WK/jiyW/s/5eKu4/YxV2KuTFXYq77GKuX4Pt4q5V7viq3j/ AMHk1aX+fFi1iq3/AF8VXfaxVa2Ku5YquxVa3L7GKuf/AC8VWLIuKr2xV3+v9vFVuKrl/kxV Zx/nxVzNwxVpWbFW1bniqz4mxV0n28VdwxV3L9jFVkmLW7ji2OX4PsYq5sVWMuKrsVdiqH/a xV3PFXM38+Ku5Niql8PLJMHLxxVczZFm5cVc2KqPwft4qv5fyYqp/wCpiq1lxV2KrG/y8VX8 v58VUeXFsWterYtjX2sWt2LYtkXFrc32MVW/HkkqPPFWuX7GBm5uKYWDuXw4GbWBVvHl8GKu Xjiqzkv28KrVZcLBa+LB2KuZf2xiruX7eKqfNMVdirsVW/YxV//T+w3P9jMhx16r8OKuXFWs VbX4MVV8VU8Vcy/D8GKrlbFm5fgxV32/t4quXAzXrgVzYquxVcuFVuKt8mfFW2+HCwd/l4qq /A+RQvXFXcfhxVy8eP8AkYqvZcVcrfsYq7l8OLYv4/8AAYq5lxVYvx4qrcm+w+LW1/xLFsd9 v/Y4qqf5CYqps37GKrm+HJMFytgZr/hwNa1VySVyrkUNYq2v8j4qv/y8Wxfx54q3iq6P7PDF XYsnM2LF3+RirlxVe2Ku5f5eKtYqt5/sYqrK3JcVc3FVxVfy/YTFVjfH9vFXL8bYqvVsVdxZ euKu/ZxV3L0sVdG2Ktf6mKq2KreL/bxV32Pt4quxV32sVb5Yqsb+fFXfC/x/t4qvX4Pt4q7l wxVemQZLWbhixW4slTFXYq0mLFteGLJ2TYrlVsVdxxVvIK71P5PsYsl3HFisX+TFV/qNirWT VbyxVU+DFXLirlbFVzN8PPFVv+Xiq9cVWf5eKrsVbXFXft/Hiqzkv7HxYq7j8WKu4rzxVeuK rF/nxVeuKuX+fFVnHFXNxxV3+pirm58cVdx/y8VXqvPFVi4q6RcVdxxV3p8WxVyquKuX7XDF V7cl+xirl/yMVWckxV3Hn/r4qu4Jiq1VxVdiq3lxxV37PD7eKuVl+DFXM3D43xV32FxVzf8A CYq5/wDLxVqRVZsVVP8ALxVZ9vFV/wALYqs+Lhirv58Vc3H9jFXccVdyVsVc2Ku5cmxVdiq1 VxVfxxV3xYqs/wAt8VXYq7FVvx4quxVa2Krvs4q2y4qs+xirm44qp8cVVG+zzTFXNirTN/we KrW4/YyDJr4vsYsXL/Jiq/7GKqa4q19jFkv5fYybFvFVNWxV3xNiruP8+QZOX4sVXf8AEcVW fD+xixW8cWS/FXK2KuX+TFVnL/YYqv8A9TFVPFVTJsViriruWKrH/wAjFV64qsbFXccVXYqt 5Yq74MVdyVcVdx+HFVP/AFMVd/kYqqMuKrGZfgfFXM2KrG+1wxV32ft4q5W7Piqpiqm+KrFk xVrFVvp4quxVwySzdkVW8cVd/qYqskbCreBUPi1qmKuxbHL/AD4tbuX7eKrOX8mLY5sVaxa3 Yti1Wbji1qPxYti/4P28VWc8VdiqxcWt2/8APi2NYtan+xkkrvg/a+3kUOZcVU8UOVuOKVPl yySXM2KtNkWaxW/bxV3+XirmXCq3jhYLGbFVnxYq2mLB328VWK37GKuXFWsVbXFXep8PPFVj Nx+PFX//1PsMrc/t5kOOuxVv4sVcrfD/AJeKu5Yq7/UxVytyxVf/AJeKtYs3cWxV3PFVX9r4 8VWt/l4q1/r4GatxwKuxV32sVb5ft4Vcrft4FbVckwVsihTVl/bxVWVcVd/kYquxV2LY7Frb X4MWx3L+TFV6Yq5Wf7CYq7l8XNMVXyM3+zxVrlirfHniq9VxVzf6mKr+WLWsXjiq/wBTFXLi ruXPFXL9rniq/FsdxXliqpirSti1r+WLY1yX7f7WKt/s/wCViruWKr2kxVzf5eKuZsVdyxVa vx/YyTBVX+RMizd9vFV/7WKrOXwYq7niq/4cWtVxbFvJvgxV3HFV/JeWKqCr+xiqozcft4q7 kmKu+xiq/wDyMVa44sm2X+TFi7lz+PFXL8f28VXpirvtfHkGTXPFisxZKitirsVd8OKu+Fcm xdiqpiqxcgq74sWS7j8PDFi5uWKrGX4cVVFVcmrlZv58VXYqt+P4MVdw/YxV3Ljiq9l5YqsX 4cVd9n9jFXckxVzM3HFV7fa54qs+DFV7cmbFXLirWKrZFxV3+QmKuZcVXsv8+KrP+ExV3L/Z 4q5VVfjxVf8A5GKrP2uCYq5v99pirvU+LFXK2Krm+3irf7WKu/axVZy+HFXP/l4qv4/FirXF 8Vbb+T9jFXccVWKvw4qvVcVc32eeKrPhTFXKuKu/18VX8uf2MVaVeS4q2uKrOf7GKr/8jFXc cVWfYXFXccVd8GKuT9jFXLx5cMVdy44qu+1irsVW8sVXfB+xirlX9v8AbxVbyVsVd/lviq/l iruWKuZsVWN8WKrlVeWKreWKrOPPFV6tiruTft4qs+HFVXFVDlkFVOWKrOXDFWmX9vFVzLiy a+LFi7s+KqbcMmyVVXFi5WxVZzyDJ32WxVzfz4q7FXfbxVa3L7GLFd9jFk58VczYq5MVc3+v irlb/ZZNisZf9hirmxVZiyd/xLFiu/b/AMvFW/8AXxVZy4riq7FVLlwxVyrirl/y8VWL8bYq v5fyYq5Pt4qvf/IxVzNiqj8LYq5MVcrft4q1H9jFW1ZcVaX4PjxVbx/YfFXf5GKu/wAt8Vd8 OKrGxVbiqpiq1mbFVnB8VWM37eKqa/z4tap8OLYo5JguyKHL/kYq2yri2OX/ACMVWccVWcv5 8Va44q38f7eKrExVyriqzjwxa3NyxbFnLFrc2Kr+Pf8AYxVZy/4PFVi/B8eKrePDJJWL/wAP irsVU+ORZr+WKtYqpMuKrW/4nkmDuP8AwuKrMVc+Kt8eWLBYrfyYq1irf7OKtcnxVb/r4q5c Vc2Kv//V+warmQ46tyxVZx5YqvXFXcsVWLz44qrf6mKuxVy8MVXquKrMVXcsVaXFmvZcDNYu FgrLkWa7FW+Xq4q3xwq5sVXceOBrcq4qv+1iq3jzySVXIsXcv58Ur+X7eLYsb4sVXfZxa1T7 eKrOOLYvxV3H4MVVMVaT7eKquKqX2cVXqzYq7/LxVfy+Hnirlxa2sVVF/wAjFXK3/B4q5MVd /kYti7lirmb+fFVbFVvx4qtxVd+xiq9fgxV3LFWmVeOKtr8DYq5cVXt/kYq5vixV32ft4q5V xV3w/t4qv+D9vFW8VXK2KrPixVvFWuXFuGKquKreOKrsVW/t4q5WxVf8OKrOH7GKr1xVysuK u+zkGSs3+piqm+LFarYsl6tiq7j+3ixWL/Piqov2MmrSr+3iqz/IyCqn+viycvx/BirlbguK uX4/sYqu48f8pMWK1Vbjk1dG2Krm+L4MVb/YxVyt8WKub4ft4q5lxVf/AKmKrP8AUxVyx/tv irn/AMvFXcuX+RirlXFXcvixVfx/kxVZx5/sYquxV2KrZFxVfyxVzYq1iqlx54qvX9vFVyt8 XDFVqsuKu+JMVX8v28Vcy4qsX4fjxVf9v48VWM2Kr+XFeGKrGXFXLiq/l8P+RiqxvsYquxVb 8X2+eKr+P+RiruPb9vFVitxxVdirbYqs+PFXL8C8MVd+3iruSYqvXFVnx4quxVYys+Kt8kxV fy+LFXLiqxcVXs3xYqsVm+xirS/D+3ira4qv48MVdyxVZyxVzMzYq5uOKuVVVvg+xiq3FWpM Vc3+Riq9sVWZBVv+viruWKt8sWS/jixcy4qs+1iq18mq5W+HFW/ixVSxZLv8j9jIK1x+PFi2 zYsmsWLbNiyWN8fwYqv+18eKu4svwYq7hiq5WxYofJsl/LFi1iruWLJauLF32MVcy8sVXYqp fDirm/kxVpW/nxV3HFW1/wAvFWlZsVVPh/4LFVNV/YxVv9r48VU+PNcVbX7XPFV7/wCX9jFV nHl9j7GKufFXK3xYqsVsVcy/FiqxV44qu5fFzxRN2KVrLirl+xirvjxVRb/IxVzLi1uxVzfz 4tiz9nFrdxxVZyxbHL/qYqv5YqsVuKf5GKrFbCq9sDWo88Wx2KufFXYqs+LFrd8XLFsaxVvl i1rGxVS+1kktLiq1m5/b+xiq7l+xkULOWLYs5fyYqv5cGwq5m+HA1rMklTb/ACMWCxl/2OKu xV2KuxVYzYq5v5MVWNiruWKu/wAjFVvLnkWTfLFD/9b7DfbzIcd37PwYq7lyxVy/Z/lxV3P9 vFWvt/HizVOTfsYsHcsVdy+HFV6tiruX8+Kr2bhiqn9jFmvWTFV0fx4GbeKrlbFXL/JgVdy/ bxa21xVevxYqt/yMkl2KruXHIs22yTSqry/bwNzv2MDW7h+3iq9sVWNJx+xi2Ky/5GKuxVYu Kr+Kviq5cVcy8cWtU44tjvsfsYq7kmKrsVdx/Yxa1vLFV64q5fs/B9vFsXt/Pi1u54tjl+zi rm/y8VcmKq3w/wCyxVpW44sm/wDUxYu5ccVXYq3xxVyriruXPFWuCYqqYq5f8j4sVXqy/t4q sX4sVa/Y+PFW+PHFV/7WKtfDxxVbwxVW+LhiqnyxVUXFV2KuxV2KuxVtm/kxV3L9jFVmLJW/ ZxYuX4cgycrdnxVplxYqnqc8WSz4cVdiq7lk2LlxVtfg+xiqxMgyVl+zwxVvFipfYTFW/h44 smlb4cWKoy5NWuXD4ExVYq/sYq5sVVFbj9jFXM2KuX7fwYqu+1iq3j8OKr2/y8Va+ziq1lbj iro2xV32FxV3HFXJ/l4q77eKu4pirm+HFXfsYqvVsVczYq7lirmX+T9nFVn7eKu5YquxVb/q Yq71P2cVdxxVf+1iqnxfFW/ifFV/L/gHxV37fwYqs5YquxVv/IxVZyxV3H+TFV/+piqzlirl bFV7Yq7/AF8VWft4qv48MVd9j4MVWNiq7FVvxN8GKrk+xiq1lxVfx/kxV3xYqs4/5eKu5fYx VfxVV+PFVi/YxVfxxVYzYqptiqo3xNiruPxYqsb3+xiq9V+LFXft4qsyCrlxVZ9rFV/H4sVU 2xVU5ccVW4q5ftc8WS/lk2Kiq/tnFXYquXFVv7XPIMmm/wCHxYub7XDFXYq2rYsnK2KrPhxV dxXFi232sWTmbFXc8mxUcWTmX+fFiuxV2KrVxVf8OKqfJ8Vb/wBT7GKu+H7eKu48fgxV3L4u GKu5Yqp8sVVFX9vFVn+R/Liqz1OeKuH7GKu+xirXLguKtr8OKu+LFWl/nxY8bf8Al4slnHFX LiqxlXFV7fBiqz9jFXccVdyxVY3x4qps38n28Vb4Yq5v8vFWuPxfBiqzFrbf/L+3irm+L48W x3HFVLFVvLFW+XDFWmxVtmxV3w4qo8sVcy4q1iq1mxa12KqbfDkkrG9vt4q5VxVr/LTAzXYW CjkWbari1trhbFPlgVTVW45JpaZsWba8f9fFgs4Yq5m54q5m/YTFVjNw+PFVjclxVdiq37H2 8VayLJTb7XDFVr4odT/IxV//1/sCrZc0u5fsJirm5fY/bxVvl8WSS7liwbX41xVev2MVWcvi xVev8mKr/wDIxVpPsYqqcuf28VcmKu54q0zdkxZq2Bm2rfsYWlvlkWTvi/bwtjuWBV/7OKuX +R/s4qvX7XPFrWLx+3i2K3qc1+PFrX/t4qs/y0xVfy/n+3irl/nxV3L4sVXYq3x54qvTFsdi q7lirf2sVd9rFXeov+zxVezLirXJ8Vb5fyYqvVv8vFVnL4uGKruCYtapiqnx/kxVUxbFn+Ri qsvwYqs5f8Hiq7jiqtiq1VXFV2KuxVtcVaxVarfz4qrc8VcrYq5f8v7eKuxVfx5fbxVZzxVf GuKtcsVb4sv2MVd9tMVczK+Kr1xV3HFXNxXFXN8X2MVXYq2vL9vFXNirWKtq3w4qsxZK2LF3 JnyDJ32mxV3H9vFXc8VczYq77GTYuxVz4qvZsVaVePwZBW8VWtiq7FVzN+3+xiq1fjyar2xV TbFV6/bxVtsVc0mKr1xVY2Kr/wBrFVjNiq/l/JirWKrWb4sVX/s4qs/YxVcn2MVW8WXFXNiq 7FXfaxV2Ktt8K8MVWLxxV3Ll+xirXF8VX4q7FVrLiruX/B4q7i3+yxVdiq1lxVd8f7eKu4vi q1v58VX8eeKrG4q2Kr144qsf/LxVyr/JirTN8Xx4qvxVvliqzl8OKu4/Diq9eWKrG+LFXL9p MVXty/bxV3HFWsVWt/qYq5sVXs3HFXL8eKtYqtVvi+PFV/L+TFVPiv8AssVWM38+Kqiq3+ri rlX4eH28VWcv5/sYqvX/AIfFVnHt+xiq3jkFVG+HFVqt8WLJpVxYr1xVZ6f7GKub+TFWuOKt /s4qt/yMmq/7WKtMzO2Krf2cVd8OQZO/axVerYqsxVTxVUxVyYq7lxxVT45NW+WLFazYsmlb +TFiuxVr7OLJpsWLl+H7GKuVv2MVcuKr2xVR4tyxVfyxVYvLFXK2Ktf6mKtr/l4q7lx+NMVa /wBTFVrN8OKr5MVWYq7lyxVTb4m+DFVRfhxVTxVtsVcuKtYq2zcvsYqs5Yq5sVczfsYqpriq 3ni1uZeGKrF/kfFWl/kxVbkkr+WRQ1iq1lxbHccKu4fsYFWM2Kub/gcVWcMVcq4qs44q1iq1 mxVf/l4qs+xi1reOSStZfhyKFrScvsYti1W+HJMGmyLN3HFXN/PirWKqSt/weFV3D9vC0qOK u4txxV2Ku/yMVWcsVWP/AJGKrsVUuXxYq0zcsWbTL8XDIoU2/nxVW9Tg2SYqDMuLN//Q+vzN w+3lzSuVueKrWb+T7GKruX8+SYr1+0+KrOXwYq5ueKq3LFXJ/l4q5cVX8sVdy54q5eWKr8Va xZuTFVRm5LwxYLlXFmtVf58izVsVU1yTBUX/AC8ih32cWxdkmC7hkULlb4sVWtkkqzLz+PIo d8eKr3+xiqxfgbg+KrsVb44ti9MVdirv8jFV/JeOKtf6+Ku44quxVrl+xiqrirathVZ9jAq/ krdMWt3p4qv54tjsVdyX9jFV68sVd9nFW8VXL8WKub4F+PFXNiruWKr/APIxVr4/28Vdiqov w4q74sVcsf8AweKuxV3PFXf6mKuTFV6/5GKu+wmKtfFyxVtVxVVxVaq4q5WxVy/YxVy4qvZf 5MVdx4Yq1irX2sWS7jwxYuXj9jIMlyrixbfFk7/LxVrhixbZsWTX/E8WKoy5NVj4q79rFXMu QZO5NxxVezfsYqtZv2MWLTf5eLJeqryxVfyybFTbFXK3xc3xVtV4Yqq4qt4/DirvsrzxVe32 uGKub4MVWMuKuVcVczccVcq/t4qvbFXcW+PFVnFn+xirl+38GKr+WKrPsLiq9f58VaxVaq4q v4/7DFVnJf28VcuKr1xVRZvi/wAvFV/7eKrOPDFVbjiqxpPhxVf9n7f2MVWf5GKub7GKuZmx Vrly+xiqpx4fHiqiv8mKr/h/bxVzNiq9eWKu4/z4q1iq37eKr+WKub+fFXcuHwYqs/yMVdHi q/lz/wBfFVn28Vcy8cVXYqtX7GKuZW+3irvjxV3LFXJ/l4q5l4r8GKqfLFVT/LxV32MVUv8A LyCrsVXcv23xVbiq5VxVbirsVWYsm/8ALxYtr8GKrfj55NVTFWm48f8ALxVzfGuKrP2sgyc3 2sVdirvixV3Hlirlb9g4q7i2KufFVPJsW+X7GKubFVn+piq7FXYqt/1MVXYqpfb+PFV/x4q5 WxVTXFW+X8mKt4qu4/5eKqf+viqp/l4qot8OKrlb9vFVq/z4qvX+TFVP4Pt4q3x5YqvZsVQy qr4quxVtlxVfRf58VWM2KrGxVzYq7liq3FVPFXcv28VU8WtvlirTf5eKqf8AkZJKIZfi4YGa xsCqP7WKr+OKrcVU1XFXcMVWKuKr8VWcsVWL8WLW7j/Jiq7FVuSSpP8AbxVZy/nxVc3J/sfD kULVb+TC2Kbcf28VdyX9jFXKuKrW+xirv+I4WC1mZ/gxYLP2cVdiqxlbFXKy4q5sVWcf5MVW N9jFVv8Ar4s3c8ihSXJJaxVWyKFirir/AP/R+vS/D9jMhx10a4s1y8fsZFm1iq/j8PPJNLl4 Yq2smRZKmKtZJiqYqt4ft4qv44q7jiruOKr14Yqu44qtxVf6nw4quwNzuWFgu+3gZub4vsYF Xt9n4MVd6mKtq328kwcrdnxVfGuKtcsVXfYXg+RQ18WSSq/8SyKHfsYqt5ccklUT7GRZqi/F iruGKuxVf8WKu9TnirXLFW/2sVcrYq79rFV64VX/AA8cCrI2XFV32sWt32cVVP2eeLY5Wb9j FXfb+AfYxV3PFWv2PgxVX5Jiq7FVPFVv+XiqpyxVy4qrKvPFVFm/nxVcsmLWqfDirmbFsXf8 SxVvj3/bxVZiq9mxV32PsYq74sVX/YXFXfbxVc/2MVWriq7FXYq7FVuLJ2KrlxV3+viq74f2 8VVG9vt5BioYqq4snJirvhbFXL/wmKreX7D5NV3Hn8GLFzfDiq5cVX/tc8gq39jhiyW8cWK/ Fkt5fsYsW+P8mTVVX7eKrV+H48VWM2Kr+SYq7l/w2Kr/APX/AGcVWfs/Birl+xirvhX7eKu4 4quxVvlx+xirXwf7PFW2X+fFViqvHFXcv+AxVzNiq9sVd+1iqzl8Px4q7lxxVd/JwxVav8mK r1/y8VWfCmKr24/sYq1iq1fh+xiq7FW+P8+KuXjirlxVY38mKu+DFXcfh4Yq5sVcq8sVdx+L FXN9v48Vd/l4q6RuC4qv/ZxVY3w4quxVvlzxVZ8PHhiq7FVvLj9jFXNirl+D4HxV3L+TFXKz ft4q79jFXfyPiruX2MVXYqpN8XwYq0rccVbVl5Yqu+xkFWLiya5fD8eLF3+virv8jFW/s4qv 4/Diq3/XxZO/ZxVr7WLF3LJqp4slz4sXYq77eQZOX/LxVz4qsXFV/H9vFVnL9jFV+KqXL9vJ q3ixbb4lpiqz/YYquxVa2KuVVxV3LFWlZuWKt/Y+3iruWKuXFVNW+HFW1bFW8Va+2mKuf7eK ub4MVa5Yq3y/k+xiqz4uPwYq7l+w+Ku54q5MVd9jCqz/ACHwKsZuWKr/APIxVr7OKrVxV3/E sVcuKu5Yqotx/YxVc2KqKt8PDFVTni1rGXFWsWxb/wASxVe3L7eKub4MVWK2FVP/AF8CrsVa X4MVWN8WKu54qsX4MVd+1i1rPifFsd/xHFrXtJi2IfiqNkmCqv8APkULG/k54q22SSprwyLN TxVazYq7/UxVa2SYLWbhiwXMv7eLNby/YTFgsb7OKrGxVzYq5mXFVit8WKuZuH2MVU2XFm3y yKFNmXlkkruP7GRQp8v5MVVGZX+xiqxl/YfFX//S+vrZkOO5sVUcWa7/ACMVVOX7HPFgu54s 13L4fjyKFPl/Piqp/wASySW1xYNr/l4qv4r+3iq7FW+X7eKuXFV6/Fiq/wCHFXMuKtR/Biza /wBTFW/sfYxVVVsDNbgVV+38GKrGxVU5c2yTBUVv28ihr4vt5JLeKtK3PFXN8LUxVVZf2Mih erLi2LPsYta77WLYqK2Ku/ZxV3PFXc8VdiqpirX2cVd8OKuVsVXyNiruP2MVX/Fi1u44qvTF scmKu5c/jxVr7X+piq1v8vFVbkmLW5fj+3i2N/6mLJpvjxYr/i/bxVyt8OKu/wAvFV2KuxVc rZJgq/DkULMWx3H48Vd/xDFV6q32P2MVX/6+Kqar8WKt+o3HFXcuS/Hiq/l/PiruXw/Hiqxm xVVxVa2Ku5Yq7Fk5m/kxYr+X8+KtNiydkFVF+3/kYqsVf28VX/Enx4q5W+L/ACMVd/xDFXN/ J+3irlbl9vJsXYq5WxVbiyVfs/sZBWl/kTFivVeOKqa4qqt8P28WSxf9fJsV/wAXDFXf5HPF XN9jFXMrfsYq5uWKr/8AUxVrFW1xVZ9v7eKuXFXN8OKu44q5/wDLxVzLirlb4cVd6eKr/hxV ZyxVdirsVWp/l4qv+H7b4q5sVcq8m54qsZVxV3JWxVe3wfHiqxVxVe2Ku5c8VUeXw4qv4/Fi q9uKfbxVYrYq0v28VVP9TFVn2MVd+z8GKr+XxYqsVsVd9jFV7Yqs4/Diq7FW/wDUxVrFW/jT FXfFiqz9rniq7FXNJyxVbz/bxVTbFVRVXjiqz08VX8fixVT/AMvFXcu/7GQVr/LxVtW4fBir vsfbxV3H9hMVc2LJ3L4ueKtccWKpx/nxVY3HFXN9jFVqZNVzYq3+ziqnwyCtviyX8v58VUMV VFbFXcf58Vc+KuxVbk1W8sVW8cWLm+HFXfHirmxV3L+RMVd6f8+KubFXLiqxuWKr/wDIxVy/ Fiqz4lxVvFVNWxVf2TFVnLk3PFXYq5Y8Vd+x/Jiqpiqm+Ku4Ytani2N8W488Vdy/bxVY/wDl 4q7jyXFXccVc2Ku+x8eKqLfyYq5VxVcuKrVXni1qfH4sVaXJJa5f8HkWblXFXcn+xiqz7Hxv iq//AF8VUGbhirfPFXPirnxV2KrOWLW5cWxS+39vFqXScUX/AC8W13w/Yxa1Lkv28klzNiq5 fjyKFJmX7GSS0y8vgTAzX/YwNaizYqs+FfsYti39rJMHccWC34+GKu+HFXK3DFXYqp4qtXji q/IskL8WSS238+LBr9rnizXf5GRQp8v28Vcy8VxVYv8APkmK9vjbFX//0/r5mQ4639vFV68c VWccVX/6mKrOL/bxVd/kYs1VfiyKHcMVcq4qu48MkxcvL7GKquKreX8+Kr+Xf9vFXLiq98VW csVX88VX8vhxVpW+LFm3iqozYGblXArlb0mxVeuKu9RuP28Vb4/BkmDkxVU5ZFDTfHkktry/ byKFT48VWr8OSSqZFDuT4tjl44tbfHFscqtiq/niq9WxV37OKr+OKu4p9jFXKyr9jFV2KqbZ Jgqr/JkWbXH+TFrVP9fFXLzxV32W5/t4qp80xbFfg+Kt4q7FV3Lliq7FVJlxVeq4quxVv/Lx Vf8A6mKrGb9jFXK3Bv8AXxVev2eGKr2/y8VWL+3xxVcuKqif5eKrOP7GKr15fYxVTX+fniq7 FV3x4qpriqvx5rwxVay4smuXw88WK/4cVWfFyxVezft4qvTFVPFVR8gyWfaxVcmLFZiyVOXx 4q79v4MVd9n4MVa+wvN/gybFvhirsVVMVWq37eQZO5fFixa5YqrYqpfF9vFXKzZNVT4kxVYv wtXFV7YquxVvliqzlyxVy/Fiq7FVq4qv44qs+DFXLx+xirm+LFXKuKrvh5fB9vFW2xVZ/Piq 7FVq4q7j+wmKr2X9vFVjNiq/jiqx/wDIxV3H4eD4qvVvixV3LFVj/wCXiq7FXYq3/l4q1iqz i+Kqi4qprx4/HiqpxxVzccVWN/vtMVcy4q7lwX/LxV3+pirv8t8VdxXlzTFXNirm/kxV3FMV Xq3w4qs+xiruOKrPtYqvVsVWN/l4q5m/n+xirS/5GQVfyfFk74MWK3FVvHFVuKr/ALH28Vab FXf6+Krvs/GmLJr4fsPixbxVYzZNXPiruP7GKreX8+LJdzyCr/tYqs+H9vFWsWLfPFk7FVL7 OTVezYqpq2LFeuKu+HFXf5aYqsb4vsYqvVf2MVWcP28VdxxVpuPH4MVW8v28Va44qqf6+KrP ixVZzxVz4qv4piqz7eKuxV32fjTFXfC2KuTFXcm/YxVZ/l4q7lirm/nxV3H9vFWk+xiq34f2 8VczYq5vhxVT/wBTFrb/AGsWxYzM2Ku5Li1uZsVU2/nxVplySWlbjkWbuWKu/bxV3LFXfsYq s5fDiqriqkq4qos2KtYq3yxVYzYta/l/I+LYs/1MWtZ9rFsX4tSizK328W1Z9pvgxVv7GSYO 5YGbS4GtYy4Wx3JPt4FUuWSaVRm+LFVjfHiqzFXftYq5m+HFVjfHiqxVxVbzfIsli/Di2Okb FrWNiq/1P58VUuOSS22LBzYqp8nxVfir/9T69NyzIcdytiqxlxVvFVy/a54q5fhxVcrYs3cf 2MVaVviyKF6/Hiqry+L4PsZJi0rcv9TFW/8AI/bxV3L9t/2cVXq3JcVX/wCviruWKubliq9M VdzxVpWxZuZsVVePPAzXquKu5fz4Fd+3iqt+zhVb8P7eFg7lgZuTCwX/AAt9vFXep8Px4qub lkUNKrYqrq3LFVi4q7liq7FVThi2LOWKu5c8VXpiq/lwxVvFV32GxVZ9j48VX8cVdHirvsYt a7FW+XNsWxzLx+3irWLWqYq5WxV2LYv5cMVXtirv28VXYq2uKtYq2q4q0/2MVdiqoq4q5MVc 3xYqv5d/2MVWYqu/4liqo/8Al4qsZeeKu5fyYqv/ANfFXMrcvgxVdirarirWKtriqxsVXtiq xcVXLiyVOTZBVPFVf/UxVZy/nxV37fx4q77eKu+y38uKuVsVdy+DJsXYqtX7OLJUXFi7lkGT fH4cVcq8MVcrfsYqqYsVPl/Pk1Xr9jFXM2Kuk44q7/XxVZ9nFVb/AFMVWMvLFXfyJirlbFXf t4qvZcVWL/Jiq/jiqzjybFXftf62KuT/AC8VXr8fx4qsZldcVXqv8+KrGbFXcsVd9jFV/wAf 2MVa+P8A2GKrVX9vnirXFeXDFV6r+2+Ktr/O+KrOf7eKrsVW8kxV3Ljiq/7f2MVdxxVr9jhi ra8sVWNybFXLirm5fYxV3w8cVXryxVZIvxYquxVtfg+DFVjfyYqv/ZxVYzYq5fixVYvLl8GK rv2vjxVv9jFVjfHiq9sgyWf6+KtftYsV/JMVWcv5MVVFVnb/ACMWSz4sVVMWK1WxVbirsVWr y/YxVpmyar+D4qpt/O/28WTSYqu5fyZBWuXLFisxZKmKu4YqsbFW8mqnyxYuXFV32sVWtiq7 FW+OKrP8vFVPlirfxYqvb4cVczYqtxVrlx/bxVplXFXKy4q7jiq7FVNmxV32VxVzNirsVXNi qjirf+QmKu5Yq74cVcuKrGbFXL/r4quxVTxVTZsWt3FUxbHcMVc3PCq3/iOBraX3+xi2NYq2 ytiqzi3DFVnL4cVX8cVW4qps2KuxV3PFXN/JiqxsVWcuOLWvbFsUX+3i1tfDxxVWxVCpkkru Px5FC37Xxpkkrvs/bwM1PArS/wCvkmDeRZqOSYL5OHx4sFFWxV3DFXPirueKrOWKqKtiq9m+ HFVJvhyLc5vs4taxmxVr7b4q1yySW/8ALTFgsVsVXYqs5Piq/FX/1fromZDju4Yq5lxVeqri rXLFVbFVvJMVcrfbTFV/L4v5MVcv/EMiyVOPLFVnw4qvxVfx54q0vLJMVXFXYqtVsVXtiq9M Vdirv8jFXceH7GKuxVU+LA3Ob2+3iqrgVtZMVc3t9jFW1X/gMkwdx+DFXL8a4qq8v2Mihyt8 XwYqt+BMklfxZsVXYq6Ncihe3t9jFscvFv8AUxVXxVT+xirXHmuKqka4q5eWKuVf+AxVrliq ovLFXL/Piq7FXLy4/Hira/5eKrGb/gMVVlbs+KuTFXPi1r/s4tjeKuxVUxV2KreWKr1b4sVa xV2Kt8uHwYqvWTnirv8ALfFXMrYq7FV/L7GKu/axV3Hnirl+H9vFWv8AiWKt8vh4ft4qvVsV d+xirlZsVXNiyWr/AL8fFi74eXPFXfbXFXcuOKq3xYqt4Ysmlb+fIKv4rxxVz4q7FWlX+TFi 3y+PFk1ixbyaub+TFV3HFVv2VxVcuKtq2QZOVuOKtM2LFUZuWLJTXJsVT/UxVytx+PFXNxXF VnxYqvVm/YxV3Jf28VXr8K0xVzN+xirv8jFVn+R9jFV6qvHh9t8VWccVXYqtVsVczfFiq/lw bFVif5GKu9P+TFXL8P28VcuKuX7KYqv44q5sVaxVbJiq9lXFVn7eKr+PFcVdy+3irWKtt/kY qsbFXcX+3iruKriruWKr1xVr7WKtqv7H7eKrOX/B4qvVf2MVc2KrGxVfJiqxmxVezfFiqxmx Vy4qp8fh+PFVRWxVTX7X+XiruWKt5BVTFVLi3HFW+X7eLJrjzxYtLiq5vsYslq4sW+WLJvFi 0q/F8GKtf5GKttk1bXjiqn+zkFc+Kt4snPirsVaxYrWyatYq3y+LFWvs4q7FW2X9vFVnLFV6 tiqxmxVbiq7kv7eKu4/DirmVfsYq5vixVTbFW+yYq5WxVzccVWcuWKrmX4sVW8fi5virvU+L FXMvw4q7hiqn9rFXYq2vH9jFXNiruWLWs9PFsdiyU+WLF3LFVvPCruPHArsWtYy8MVa4virf w/8AA4tjl/kxVzYqsZsVc2Ku+Hj/AJeKrOX7eKrG/wAjFXM2KuTFXc8VWcueLW7li2LVbJMF zcuWRZrOXJsWtRbJJb5fDiqzFXN+6+PFWm+PIs3ccVWM2FWm+H48CqSt/JkmC7FXMq/sYsFn DFXc8VWLirlbFVjfDiq1m/kwNzuXPFW8DWp/YxVysyfYxVS/1MklZy5Yq2zYsHccVWcf28Vd yX/YYq1xxV//1vrorZkOOuXFVqYqv+1irmbFWmb9vFW/ixVf9tcVc3w4q7l8WKr/ALf28iyV FZv2MVWN8eKr0xVplyTFev8APiqovxZFk0q8ckxXriruOKr1bnirlb9vFVTFVPniq/FmqYq7 l+xHkWblxV3LFXcsKr1bj9jAq/lxxa13Li2Kqf7XPJJRGRYrMkhfz/byLJ3FPsYqrc8WxZ/r /bxVfzxV3PFXL9nFVP7OKq6t+wmKrF/y8VVMKruOBXLxxVyrhVfy7fsYGtYq4q7j/Ji2LsVb ZV+2mKrlbnirf2ft4q5eGKr+XDFV/wBv48VXYqtX4sVdz/bxVdirbcvtvirlX9jFWl/kxa1T /UxbHMvdMVd/r4q77eKr+X2MVdxX9jFXKuKtf8SxVey/8Hiq1W5fbxV3+omKr1xV32Pt4qvb FXftYq1iq3lwb4MVXrxxVy4quyCt/FiyWL/kYqv4Yq7hirkxVZ9lcVXsuKuZsmxd8OKuxV2K r8gq3liq5v8AIxZLVb+fFiuxVpm+HJqqfHiqxvjxVeuKuXFXN/wmKu/4liq/kvHFXSccVWL8 H+piq74P9hirbLirWKrWXFV7Yq7/ACMVcy4q0v28VWsy4q7ky4q5WxV3Hjirv2MVX8cVWccV aZf+DxVU+LFVnp4q5lxVzN+3irXLn8D4q23FcVc3HlwxVfxxV37OKuZvi+DFVnLFXM2Kr1b9 jFVnwYq77eKr2+PFWsVW/YxVev8APiqzimKqbYqqN8OKuZWxVTZv58Vbb4PsYq0y5BXJ9vFW uOKqnJlxVTbFV37WLJpf5MWLuPDFWlxVvl/JiqznirfPJq7/AC8Vc32sgycmKuTFVnLniq5v iXhixdiq37OLJ3L9jJsVrNiya5ccWK5vt4qtxZL+WLFzfBiqz9nnirlX4vsYq77X+rirv2eG Kubjirm/nxVZxZeuKrF+LFVzL9jFVNvtcMkwW4GaovDAq5vtcMVb48fsYqofaxVtl/kxa1/2 MVWLi2LFxVWfFVPFVjfbxVv/AC0xVyyYqs+1irXLFVvJnxa3f5GLYs4qvTFXK37GLW5sVdyb 7H8+LY1hVb8GBVkmLWrccWxZ/wARxVZ+1iqz/IxV3DFXKy4qsZuOKtfbfFrXZJKnirmXh9jI oUlXJJcrM2KrOeKubj/s8Va/ZyLNvJMFPlkWbuWKrF/yMKrFwsG244qt4/HiwXNiqk2Kub4M VWMzYqtblkWTeLYpsvFcVc32cWtzLiql/qfbySVvH/gMWDlZlxVzYqtxV2KtfaxV3+vir//X +uKrmQ469W+H/LxVzfaxVev2fg+xirvixVpcVXYqqYqpcv5MVVcVWtireLNWX4cihyrirkxV e3+XirSrkmKt/kYq5cVaxVv9rFV/7WKu5c2xV3xYqub/AIHFmu5fDzwM2sLB2Kqir+xkWblw quwNbsWxtWXFW+GSYL4+OKq+RQpLyxV37WKquKtq38mKuVmxbF6Yq5eT4q5MVdirueKr1ZV+ xirv2P8ALxVVxVTxVcvLFV7f5GKqTZJg5cVVWZsizX8lTFXMv/B4qp/axa1RMWxcuKqnLFXY snKv7GLF3LCq/jwwKsbFXf8AEcVX+ozYq1xfFVRvtYqvX4MVWfHwxVd/qYq23+RirvhxVf8A Biqm2Kq2KreXLFV2KuxV2Ktsrf7DFXK2KubFVmLJtVxVfirTNkFXqv7GKuZf2xiruXx4q77G Kt8sWLT4snfDk2LmX4cVdiq3Fkqr9jFi74uPDIMmvhxYubjiruWLJdk2LsVajZcVd9tvjxV3 2cVdx5/YxV3FkXFV7YquxVbx/nxV3/EsVab/AC/t4qqM38+KrPh4/BiruLc8Vc3wtiq/9p8V czYqsVufwYqvZsVWfs8MVXrJiruX7GKu4/FirvjfFWsVWqzYq7liruPxcMVXYq2zfz4qsZlf FXep/Jiq74/28VUuPpfHiq74vsYq39jFXfFyxVdiq1cVdy/kxVdyfFVvH+fFV/LhiqxsVd8e KruaYq7FVq/YxVRX7f8Al5Bk5MVXs3xYq03HFi77HwYq5VxV3w4qqcl/bxZKTYsVyx4sljN6 WKufJsVv/E8WS7nkFcrYq5vhxVpMWKzFk7FW/g/bxVrjk1cuKuxYu+1iq3liq5W/bxZLVXji xcq4q7j/ACYq7jy/bxVdiq1sVU2xVv8AyExV3HniruPxc0xVZ8HDFXKvPFXfD9h8Va/Y+PFW +eKqbMv7GLW7C2O+zga21xbHcv2MVdyxVZ8GKuZeWKu5YquxVa2KrcVa+B8VWMvH7eLWtVmy SVPFV/HIocy8/sYtjmXFrWccWxzYquxVSkbFXfZxVZirnxVzfaxVyYqp4q7FrW/sYq7n+3iq xf8AXxVarcFySVjcMVX/ABYqpfayLNa2Ku/YxVzN/PiqxsKrOOFg5sVafFg7kuKu/a54qs5f yYq1iqh/qYs2/wBv4MDNtVbA1reXx4q79rFVP/LyTF3LFVjYq7liq7FVPFWvt/bxVzN8OKrO eKv/0Priqr+xmQ47vsPiq9m/YGKrlxVbybFXfZXFV/8Ar4qvZv5MVWN8eKt4qqYqt44q1xxZ r/hxVvIoVlxVrlkmLfqft4qqLxyLJbyySW+XH7GLBf8A5eKuXFV7fFiq3lw+xizbxVesmKq+ Bmh1wsERkWbTNkmC5fjyLNtsKrcCt/5eFW+eFguXFVZf5MihbxySVzNkUO+39jFV68v28Wxy /wA+KtYqqf6+KuTFrXq2LY0zfz4q5m5YqqMrYq7lirvhZvgxVf8ADy54tbuXD48VWLi2K3xY tblXni2O/wCJ4q7ni1uX41xbF7NiruXPFrXr/Pi2LcVVfUxV3L/hsVa/Y54q23wYq5lb/YYt a98Vczc8Wx2Ku5NxxVe0eKt4quZsVdy+JMVWL/Jiq/7eKu+Dliq9WxVb+ziyXNixaVl44qt+ Nl/y8Vd9tcVX8sVX88Vd9vFXYqp5BkrN/kYsVnDFW+PwYsnK2KuX+fFVn2cVVuP7eTYreOLJ peeLFf8AaxVvIMljYsVTl+xzxVYrYqt+3iybb7XDFi3y+Dh+xiqriqmq5NV6t8PDFVNl44q7 liqvy5cMVcy/t4qpqyuz4q3y+LFXNybFXcfixVfx+LFVnxcsVXYqtj/ycVU+OKq32sVW8U+x iruS/bTFV2Kt/wCQmKrPi48MVXYqtVcVXYqtb4P9TFV64qs+3irm+1/LirmxVeyt+39jFVNv s/5WKtq2Ku+3iq/umKrPt4q748Vc2Ku/18Vc3JsVc2KuXFVnN8VXrirXLlkFcy4qs5fDiq9V xVv7f2HxZLP9TFWvT+HFi6PjxxVv025YslPFivbJqtfFVuLJcv2sgrS/yft4sW1Xk2LJYzYq v/18VaxYt8MWTnybFY3FF+DFWsVW8cVX/tYqs4piq7FVvLFXL8WKu+xiqxV5/bxVerceHDFV uKruP8mKuXFVHiuKr+X8mKrOTYq5MVd+zzxVr4PsYq5m4Yq1/wARwq1x+L/IwK1irsVbXliq xlxV322xV3LFV2KqeLW0zcMWxZi1u4YtjuP8mKqa8cWtpsklc2RQs+L9jFsb45JgsyLNc2Kr sVUuXw4q0zNiqkq4ta/4cWxTxVvli1rOLft4q1+18eKt5JKkq8fgxVv/ACMihT4ZJK5MDN3w c8VWf5b4qs5fsR4GtzcsWxZ6nPFXcf5MKrVbjhYLExVvlxxYLOX8mKu5ft4qsbliruWKtYG5 TVcCrT+3kmCziyYq5V/bxVv9nFgpYqqYqp4qp/a+xirlXFV6tiqgzM+Kt8V+xir/AP/R+uP+ QmZDjtYq3y7fsYqvZvhxVZy/n+3iro2xVesjfYxV3wrirv8AieKr/s4qvX+TFXK3HFV32sVb 5Yq5f5MVVOXx5Fkpr/l4qrq37H7eKrpMkxWK2Kr2xVf9j/UxV3L4cVcv8mKr1bFXYq1izdzx VEcsDNS5ft4WCquBm5cCr+XPCrTM37eBXYquXj9vJMF3PIoXNirfJXxVy/Z/y8VX8uWKrvs4 q2rYqv54tjl+zirvt4q7/iGKuVlxVf8AD9t8Vdy54q3iq7li1uVuWLYu5Piq39vFVbFrWfDi rS/5eKt/a/bxbF74qqYq00mKuVsVc38mKr+OKrfsYsly8cWK/jirmbniruWKqrYqtxVevJcV WJirvt4qrN8WKu4fsYqs/Y54qv8AjxVT/wAvFVbFVvLFV7Niq1vjxZNN/Pixdy+LFV3NMVbV vhxVyt8OKrMWTf2sVVUyCub4sVdJ9vFVPFXYqv8AsYsW8WTnybF3HjirmXFXfbxVen28gyc3 xfBirsWK9vg+NMWSly+LnixbbliruP8AJiq5ft4qu+03+Rk1WL/kYqv44q7/AF8Vd+zzxVe3 LFVi/YxV3x4qv44qsjxVeuKrF/1MVXfaxVazfz4q5cVc3LFVzfBwxVbx/nxVpfs/5OKtsy/Y TFXM2KtN9vFW/wBvFV7LiqxvsYqvZf2MVdv/ACYq7jiqliqry7/t4q5V4fBirv2cVa4Jiq37 fwYq5uWKu/1MVWepiq/h+3iqj8WKqvJ8Vb44qtyDJaqr9jFiv48/9fFVjNwxVfxxVbiqyNvi xZLviZcWK9WxVSVv28mqpirX2sVWcW45BksX+fFV+KuxVz4q1ixbWNsWTm5ccVcy/D8H28VW 8MmrS4sVmLJ3LFiuxVaq8cVXtyxVZ8eKuVsVcq4quxV2KqTK3LFWo/sYq3yTFVJuGSYLl5I3 x5Fm5VxV3H+TFVP7OKr17YsZrVXFk7k328VcrYq5cVcvx/Hiqzl/wGKuX+f9vFV2KuxV2KqP LFVr4q5Vxa1jN8WKtfaxVtvj+xi2LMkwab4fjyLNfiq3liqxf5MVaVf58Vc2KrW+ziqz/XxV yrxxVemLWp4tjfH4sVWMzYtbm+1zxVZkmLfwvizU2Zvt5FmtX+fJMGm48UyLNrFXfB/s8VWr iqzjhVeuKrG+L4MVUv8AXwsFRlxYKLNirmxVZy5r8eKtYG5pf58VWM2BrcrNxxV3PFVJmySX N7/bxVa2LBZ9nFXM2KuXl/sMVWPiqxvj+3iq/wD18VU/s4qqcuWKv//S+umZDjqPH4v8jFV6 riruXw8MVWf5b4qrftYqp4q2uKr0xVUxVrm+Kr1b9h8VdyxV3Ll9vFXcv58Vdy+HFVRsiyXq qtirm48fgxVdyxVpm/nyTFU/bxVy8OOKr1+P7eKr0xVTxVUxVdxxVZizXqq4qvwM1y4q5mwK vX4PsYq5V/bxVy4qv5csKtr8eFg0rKjf5GRZr/srzxa1qtkkqq8sihplZ8VbXFV6/wA+LYv5 fyYq7FXcfh/lxVy/GuKr2bFXcUxVey/zpiqzlwxVtZMkwVVb4sDNTX7eBVReOKr0xa1i/wCR i2Nfsf5eKqmKu+0uKrmxVU4ft4quxVTbFku+z/q4sXMuKubFVzfbxVcuFWmXAq/4sVdy+DFX c8Vc+Kr1XFXcvhxVerfFirlbFXf5GKu5Yq5cVXrirmxVZz/YxVfyxVr/AC8WTfL4eD4sWuaY q7k+KqnDIMln2sVXtwxVYrLiq9mxVz4q0mLFt8WTS/DixVcmqny/kxVfy+HFXN8Px4q038mQ Vy8vsYq38OLJpvjXFitxZN8kf7GLFtf8jFW1bJqv5csVd/sMVd9j4MVd+3irvt4qu5piq1vh +DFXMvxYquxV2KrVxVerYq5vgxVrFVrLiruPHFV7cv8AYYqsbFV/HhiruX8+KtfaxVvjiqzk mKr1/wAvFVn+Riq/l+x+3irv2sVWcuXDFV68ft4qs+DFXf6+KuZl/bxVTb+R8VbXkvx4qvbF VPliqouKt5BVH/XxVc3t9vFk5uX28VXf6+LF3L9iTFVHFV/wfsYq77WKreeTVzfDirvixV3L 4MVXcfi4JkFW9f8AKxZNcl+xixW/tYsnfaxV3HFV/wDr4q7FXKvd8VWSNiruWTYtNiyXNwxV bixdirbYqsZuOKrP2cVXMzI2Ktq3LFXfsYqprirlZsVcuKqnLliqHyTBc3KLIs3LJ/Piq7ji q3niruXLFVnHFXcv28VaxVtcVaxV2KuxVav/AAmKrG4/7PFraXFsWt/l/YxV37OKuVmxa3c8 WxY3874q77P7eKu48MWtzNw+DC2LGbAqz9j/AC8VVcVQ3H4vjxVU4/sYq6ReWKrMVU244tbf Lni2O5cMWtpV5fHiqk38+KrV/nySW/8AUyKFvLJJW/tf5GKrsDNb8OFgtyKHYqtZsVWL/Jhb FvwJhYLHxVzScPt4q3iwWNiqxWX9vFVP9nIpXccLasxV3L9vA1rFxVbkmK1cVU+WKqit8WKr cVdiqnzxVy/Fiqn9nFW24/bxV3L+fFWsVf/T+tfp5kOO0rYs2v8ALxVVZsWDuOKu+wvBMVX8 sVaT7GKttiq9vixVyriqpirXL4sVaXFXccVbjb4v8jFVb/LxV32siybVv2MVXsvxYq03wLir SrzySV64sFbFVitizX4sG1+D7eKr+X8mKu+FFxVzfEvPFVzSKmLNzfHiqrywM1NcCuXFVTli qo2FWl+PAq//AC0+xirat+2mSYOXjireKuj/AHv28izVFxa1/Lhi2NYq3y+LFV+Ku4/z4q5f 5MVX/scMVaVv2MVVFXn/AK+KuZmb7H28Ku5fDgV2SYL2X4cizdyxV3d8WtbyySVVWyLN3Lli rkxV3xYqv5cMVX8sVcy/Firvt4quxa21xbHKuKtYq2rfsYtbXNMWxUTFVnLFVZW/YfFXN9jF XMuKquKrf8tPt4q7/IxVZwfFV68sVdyxVezYq7l+xirl44qsZf58VdiyVv8AXxYuyDJY3x4q vX/LxV3+WmKuVcVd9jFVnLFV/PFXYq58VWpk1VfixYrOP8+KuX4cVc38+QZN8fh+DFiuVcWS 1sWK79r4MWSxv2ExVV48mxYt8cmrvsYq7in2MVWL8eKr/wBvFVifbxVeq4qv/axVYzfDiq7F W+XxcMVaxVa3xr8eKrsVW/5GKr1xVZ6nJcVcv8mKu4/yYq1yfFV+KreP8+Kr1xV37OKrOWKr sVWt8WKu/bxVri+KqirxxVYzcsVc/wDkYqp/6mKr/i+xiqzjirlZsVbyCrlxV321xVSxZL1b h9vFVzMuLFrFksXFiuxVpsmq3hiq5sVW5Bk7FXN/Jiq/4cVWcv28Vd/l4q58VWfH+3iq/nir WLFvhiyW88mrXLFi7jirv2sVaxVb/r4q7/UxVy4q6RsVXYqp4qtZvixVdiqpiqjxxVbxyTBz NkWbm+HFXfbxVzf6+KqeKtcf58kwXKvHIs3fDiq/l+wn2MVUeP8AP9vFXfbxVTbFVTliqz7O KrF5Piq7jiq3Frdy/bxVpl54tixmbli1t8f8jFsc3wYqs5fz4qp/5eKt8fhxVrlirbN/l4q7 l+xiqivLFV+KrOXw88VcrK32MWtytwxVyti2KbN8Xx4talyySW1XhirlbFVitiq5vtYGangV b8GKub7GKrP8jCq3j+3hYNt8C8MWCx8VdzxV2KrOaYq1iq3n+3iruPH48VUm48ciydyZMVUc klbyxVv9vFgtxVpv8jFV/wDxLFVn7OKrGbsmKrFxVzNirvU4Yq5sVd+1iqz7eKv/1PrWzLmQ 47XLFV2KrOOLNdy+Lhiwcv2vgxVUxZruXPFg77K4q74eOKr0xVy/DirnxVf9rFXKyviq/wCx 9jFXL/Jiq9fgxVbyyLJdiqo3L9vFVnLmuSSqq3xcMWDuX7GKr2b/AIPFXft4q7liqtzxV3qL +xirlb9g4quVcWazj+xiqpirfHAzaXAqozN+xiq9cVcv2ueKr42bFXfZ+PCq3/UwsF7fH9vF Wv8ALxVWVsihzfz4q748VX8sWxerYqs/1MVXvirkxVf+ziqxfhb4MVVuP/AYqtxVUxVb+3iq /wD18VWZJg7FV7ZFC9fiwtjl/wAv7eBXfZ+xi1r1+P4MWx3L+f7eKt8sWS5f5MWLsWSz7OLF V5PirsVb48MVW/F/PkmCqmRZu/ZxVfJirX+Xiq7FWuXxYqvX7fx4q7l/weKrsVdiq1cVX8cV axVb9j4MVX8sVaxVvj8XPFVsi88WSI9TIKo/ZxVfirsVcmKtYsW/ixZOTFXK38mKr/Ub9jFV itirnybFe3wfbxVZiq5sVX8fhyCqL4qvX+fFW8VW8cVXfZyar/sYqp8sVXq3/CYsm/tfGmLF YvLFVZv5MVWcsVcuKubFXfYxVf8AH9jFVn7GKuZsVXYqtZv28VczfyYquxVvliqzj/Piq7FV rNiruPH7eKrvg/YxVav/AAmKu/4jiqp/xHFVPl/weKu4/FirmxV3HFVnLkvDFVbjzbFVn7XP FV2KqK/HkFb+LFk1zfFivk/nxVyf5GKrOP8APirf7HwYsmvtYsV7Kv8AJiqgzZNkrYsXYqps 2Kr+Pw5Bks4tirXx88WLfH4vjxZO4Yq1zxYt4sli/wCRiruOKu44q7/UybFzYq7liqzjyxVd xxZN/s/BixdyxVrFXYqt44q79jFVnLniq9vsYqsVsVd+1irTYqptzyTBdkWbuGKuTFXYqsXF rdxxbGvtYq2zNirmbFVjYqtbFk18WLFvFrU2bFscy4q7FrU2/nxVbkktt/l4q3kUN8cVWcuO LY5m/kwqp/5eBVT9vFVHFXc8VWLJiq/FVPFW+WKuVsWt3Jf28WxDryyTB32sVVft5FCzlwXF VLJJczYqptkWa9eWFVn+RgVdiqlywqtb+TCwWviwdiqzjiruWKu5Yqs9TFVis2KrP2sVb4/D 8eRZO54qp/tZJisZsVXYqp4q7FVP/X+xirvsYqsVf5MVcsmKrG+LFWv8jFm7jirb/wCXiwdx TFX/1frQ3xZkOO5fs4q77GKr1+DFVmKr1b/gMVdy54qv+DFV6/5H2MVWcv5MVd/dfYxVfH8G Kq+KreWKt/FireKuxVbyxVWxVbyxVU5ZFk3yXJJXKrfb/ayKF/Jm64qujbJMVNcVX/Bizdyx VU/4TFg79nFV+Ku54q0rfDizXNirv8vFVblkWbl+3hVdgVteKZJg5VwM1/Lh8GKuk/nfA1r+ Sv8AHi2L/wBjFrXYti39jFrdxTFV6yLi2OXFWsVVOGKuX4cVVMVa/axVr/UxVdhVUwKtX4vt 4qv5YqvX7W37WKqStzbJMG2kyKF3PJJXMvxZFm7i2Ku+19jFVTFVyrirv2MVc2KrsVb44q1i rsVV/wBnFrWftYtiz/IxVdH9jFVT1OeKtf5eKtry5Yq0uKq/LFViriqzky9MVVlb9jFVnH+T FXfHiq7FW1xV3HFVi/a/ysVVvj+xirueQZOb7WKqeKt8vi+DFV/DFVzL8PwYsVJm/nxZL0xV rFi39lcWTlbFV/7SPk2Ll/y8VWfbxVpfhyCtviyX8kxVdx5YsVn7OKuZcVVP+N8WTvgybFZ9 lsVXt9rnirvi5Yq7n+3iq9v+J4qs5Yq74eOKuXlirvhX7GKr+X8+KrGXFV/+piqx/wDLxVeq 4qs+Fv8AXxVf+ziqxm4cMVX8vhxVYvw/HirpPtYq5m+LFXfsYq5sVdybj8eKtcnxVaq4q7l8 WKr+OKrP2sVXs3xYqsX/ACMVXccgrv8AUxVTXFW+SYq7liyX8cWLmZsVU1xVtvh+x9vFXf5H 7GKrUyar/s4qs54q58gyWNiq/wD1MVd8fDFWvi5cMVb+xirkxV3LlirWLFtWxZNfYX48mxU2 bFku5c8WLX2cVcuLJ2LFvjirWKrWX9vFVPjiqouKrsVUvhxV32cVX+piruWKqa4qtZeX+pir v+IYq74v28VXq2KodWyTBc2RZu5Yq1irsVWs2KuVsVW4qu5ccVU+WKreGLW77GKrGbFWsVbV fhxbHfFirUfL9vFVvwr8eKuZv2ExV328VWfb+NMVbxV2KqeKuTFVPFXYqtZuOKrsWtb9jFsU v8tMkwabFXNiq7FVuRQtZsklT5csizd+3irvsfbwq74vt4qo8sLBYvL7eKrmXFgs5YqvZsVU 8VUGxZr+WBmotgV3Fpfj/bxVY3HCrfHCwbVeeLBYvL7eKrcVWtiq3/LxV2KqeKttxxVYzNir lxVYrNiq9sVcrccVc0mKv//W+tHDMhx16x/DiqyONvsYqvVW+DFWuD4qqem2KuWNsVd6L4qv 9Nv2MVcqt+39jFV6xs/28Vd6b4q5Vb9vFV7QsmKu4t+xiq/02xV3p4q5YWxVeqtiq/03xV3o 8MVd6bfsZFk36bccWx3DFVZVbFrWUb+TFV/FueFsc0bYqu4t9jhhaVy8v2E4Ys2/TZcWC/i3 2MVU1XFmiOLc8DNasf8AweFgu48cizX+m3HFXemy/BirvixV3pvi1q3J/wBv4sWxS4ZJgq8W b9jIs2+OSYLuLft5FDlj/wAjFWuL4qqcWTFsaxVU4Yq7FXMrYq7hirsVVlVvt4qp8cVV2Vkw qs+L9vAqs3PFXen+3iqz4sVd8XLFWuPw4tapxZ8VczYti9Y2/bxV3Hhiq9ft4VX8cCrGXFV2 KqjK3LFVnHFXcfh54q5V+xhVV44Fb4/t4qs4Yqvbk32MVczMvx4qv44q0qtyxVZxb9jFVRY8 Vdx+H7GKu44q7Fkv+LFi7jirvTxV3HFVPi+KqnHFV6q32MVW/tYsl3DFi7hkGTuPwYq5ueKu bnirsVd8S4q7025Yq1ixb5Niydx/kybFzLwxVeq8MVWsuLJv4sgxXrHiqnxxVv4sVdx+HFXf E2Kqki/Fk1c0eKu44q5sVcy4q7jy+PFXcfh54qsbly+DFV/LFXNy+wmKqf8Al4qqccVX/Fxx VY3/AA+Ku+38eKr/AIsVWccVdxxV3FuGKuT/ACMVdxb7D4q702xV3HFXNyxV3HFWmyCu44q5 VxVYq4q7jwxVv4lxZLuOLF3H4fjxVb8X28WS3jixVFXFXcP28Vdx+LFVi/H9jFXcfi54q5mb Jq2sf7f7GKuf7eKrOP8APirmXumQZN8W/YxYrePLFW+LYsnf5eKu4Yq7i2KqbLixdiyVF/y8 mxWcsVWNyxVfxb7GKrMWS7i+LFvjirmXFVi8+OKtcXxVvjirmxV3H4sVU+OKqjK2Ku44qp8c Vb48FxVZx44q7hiq6NWxVZ8TYtbfFsWxT4vira+/2MVcy4qsZcVX8W/YxVr02+3iq37GKqf+ viq1lbFXMv8APiq/g+KrHxa3en8OKu4ti2OVWxVZxxa2m5IuKrfT5Ytjmj/nxVr4vsYq7i+K qXFv2MVdxbFXMrIuKuxVT4viruL4tbbR/t4til6bZJg7i3LhirTKzZFDm5P9vFXNDi2LGjbF Xem+LWs4t9jC2O9I4FWKrN9jFVvHJMFjLiruP7GKrWXj9vFg7i323TFVjcsVc3JfjxVS4Pgb nfFgVZxbCruLfbwKo8XyTBtlbFW/TfFgsaNuPPFVixty+xirXB8VW8WfFV/pt+xiqxo2xVY0 f8+KtNG2LN3oty+xirfpviwWNG2Kr1jbFVNlZcWb/9kKZW5kc3RyZWFtCmVuZG9iago4IDAg b2JqCjE3MTIxMgplbmRvYmoKMTIgMCBvYmoKPDwgL0xlbmd0aCAxMyAwIFIgL04gMyAvQWx0 ZXJuYXRlIC9EZXZpY2VSR0IgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBnZZ3 VFPZFofPvTe90BIiICX0GnoJINI7SBUEUYlJgFAChoQmdkQFRhQRKVZkVMABR4ciY0UUC4OC YtcJ8hBQxsFRREXl3YxrCe+tNfPemv3HWd/Z57fX2Wfvfde6AFD8ggTCdFgBgDShWBTu68Fc EhPLxPcCGBABDlgBwOFmZgRH+EQC1Py9PZmZqEjGs/buLoBku9ssv1Amc9b/f5EiN0MkBgAK RdU2PH4mF+UClFOzxRky/wTK9JUpMoYxMhahCaKsIuPEr2z2p+Yru8mYlybkoRpZzhm8NJ6M u1DemiXho4wEoVyYJeBno3wHZb1USZoA5fco09P4nEwAMBSZX8znJqFsiTJFFBnuifICAAiU xDm8cg6L+TlongB4pmfkigSJSWKmEdeYaeXoyGb68bNT+WIxK5TDTeGIeEzP9LQMjjAXgK9v lkUBJVltmWiR7a0c7e1Z1uZo+b/Z3x5+U/09yHr7VfEm7M+eQYyeWd9s7KwvvRYA9iRamx2z vpVVALRtBkDl4axP7yAA8gUAtN6c8x6GbF6SxOIMJwuL7OxscwGfay4r6Df7n4Jvyr+GOfeZ y+77VjumFz+BI0kVM2VF5aanpktEzMwMDpfPZP33EP/jwDlpzcnDLJyfwBfxhehVUeiUCYSJ aLuFPIFYkC5kCoR/1eF/GDYnBxl+nWsUaHVfAH2FOVC4SQfIbz0AQyMDJG4/egJ961sQMQrI vrxorZGvc48yev7n+h8LXIpu4UxBIlPm9gyPZHIloiwZo9+EbMECEpAHdKAKNIEuMAIsYA0c gDNwA94gAISASBADlgMuSAJpQASyQT7YAApBMdgBdoNqcADUgXrQBE6CNnAGXARXwA1wCwyA R0AKhsFLMAHegWkIgvAQFaJBqpAWpA+ZQtYQG1oIeUNBUDgUA8VDiZAQkkD50CaoGCqDqqFD UD30I3Qaughdg/qgB9AgNAb9AX2EEZgC02EN2AC2gNmwOxwIR8LL4ER4FZwHF8Db4Uq4Fj4O t8IX4RvwACyFX8KTCEDICAPRRlgIG/FEQpBYJAERIWuRIqQCqUWakA6kG7mNSJFx5AMGh6Fh mBgWxhnjh1mM4WJWYdZiSjDVmGOYVkwX5jZmEDOB+YKlYtWxplgnrD92CTYRm40txFZgj2Bb sJexA9hh7DscDsfAGeIccH64GFwybjWuBLcP14y7gOvDDeEm8Xi8Kt4U74IPwXPwYnwhvgp/ HH8e348fxr8nkAlaBGuCDyGWICRsJFQQGgjnCP2EEcI0UYGoT3QihhB5xFxiKbGO2EG8SRwm TpMUSYYkF1IkKZm0gVRJaiJdJj0mvSGTyTpkR3IYWUBeT64knyBfJQ+SP1CUKCYUT0ocRULZ TjlKuUB5QHlDpVINqG7UWKqYup1aT71EfUp9L0eTM5fzl+PJrZOrkWuV65d7JU+U15d3l18u nydfIX9K/qb8uAJRwUDBU4GjsFahRuG0wj2FSUWaopViiGKaYolig+I1xVElvJKBkrcST6lA 6bDSJaUhGkLTpXnSuLRNtDraZdowHUc3pPvTk+nF9B/ovfQJZSVlW+Uo5RzlGuWzylIGwjBg +DNSGaWMk4y7jI/zNOa5z+PP2zavaV7/vCmV+SpuKnyVIpVmlQGVj6pMVW/VFNWdqm2qT9Qw aiZqYWrZavvVLquNz6fPd57PnV80/+T8h+qwuol6uPpq9cPqPeqTGpoavhoZGlUalzTGNRma bprJmuWa5zTHtGhaC7UEWuVa57VeMJWZ7sxUZiWzizmhra7tpy3RPqTdqz2tY6izWGejTrPO E12SLls3Qbdct1N3Qk9LL1gvX69R76E+UZ+tn6S/R79bf8rA0CDaYItBm8GooYqhv2GeYaPh YyOqkavRKqNaozvGOGO2cYrxPuNbJrCJnUmSSY3JTVPY1N5UYLrPtM8Ma+ZoJjSrNbvHorDc WVmsRtagOcM8yHyjeZv5Kws9i1iLnRbdFl8s7SxTLessH1kpWQVYbbTqsPrD2sSaa11jfceG auNjs86m3ea1rakt33a/7X07ml2w3Ra7TrvP9g72Ivsm+zEHPYd4h70O99h0dii7hH3VEevo 4bjO8YzjByd7J7HTSaffnVnOKc4NzqMLDBfwF9QtGHLRceG4HHKRLmQujF94cKHUVduV41rr +sxN143ndsRtxN3YPdn9uPsrD0sPkUeLx5Snk+cazwteiJevV5FXr7eS92Lvau+nPjo+iT6N PhO+dr6rfS/4Yf0C/Xb63fPX8Of61/tPBDgErAnoCqQERgRWBz4LMgkSBXUEw8EBwbuCHy/S XyRc1BYCQvxDdoU8CTUMXRX6cxguLDSsJux5uFV4fnh3BC1iRURDxLtIj8jSyEeLjRZLFndG yUfFRdVHTUV7RZdFS5dYLFmz5EaMWowgpj0WHxsVeyR2cqn30t1Lh+Ps4grj7i4zXJaz7Npy teWpy8+ukF/BWXEqHhsfHd8Q/4kTwqnlTK70X7l35QTXk7uH+5LnxivnjfFd+GX8kQSXhLKE 0USXxF2JY0muSRVJ4wJPQbXgdbJf8oHkqZSQlKMpM6nRqc1phLT4tNNCJWGKsCtdMz0nvS/D NKMwQ7rKadXuVROiQNGRTChzWWa7mI7+TPVIjCSbJYNZC7Nqst5nR2WfylHMEeb05Jrkbssd yfPJ+341ZjV3dWe+dv6G/ME17msOrYXWrlzbuU53XcG64fW+649tIG1I2fDLRsuNZRvfbore 1FGgUbC+YGiz7+bGQrlCUeG9Lc5bDmzFbBVs7d1ms61q25ciXtH1YsviiuJPJdyS699ZfVf5 3cz2hO29pfal+3fgdgh33N3puvNYmWJZXtnQruBdreXM8qLyt7tX7L5WYVtxYA9pj2SPtDKo sr1Kr2pH1afqpOqBGo+a5r3qe7ftndrH29e/321/0wGNA8UHPh4UHLx/yPdQa61BbcVh3OGs w8/rouq6v2d/X39E7Ujxkc9HhUelx8KPddU71Nc3qDeUNsKNksax43HHb/3g9UN7E6vpUDOj ufgEOCE58eLH+B/vngw82XmKfarpJ/2f9rbQWopaodbc1om2pDZpe0x73+mA050dzh0tP5v/ fPSM9pmas8pnS8+RzhWcmzmfd37yQsaF8YuJF4c6V3Q+urTk0p2usK7ey4GXr17xuXKp2737 /FWXq2euOV07fZ19ve2G/Y3WHruell/sfmnpte9tvelws/2W462OvgV95/pd+y/e9rp95Y7/ nRsDiwb67i6+e/9e3D3pfd790QepD14/zHo4/Wj9Y+zjoicKTyqeqj+t/dX412apvfTsoNdg z7OIZ4+GuEMv/5X5r0/DBc+pzytGtEbqR61Hz4z5jN16sfTF8MuMl9Pjhb8p/rb3ldGrn353 +71nYsnE8GvR65k/St6ovjn61vZt52To5NN3ae+mp4req74/9oH9oftj9MeR6exP+E+Vn40/ d3wJ/PJ4Jm1m5t/3hPP7CmVuZHN0cmVhbQplbmRvYmoKMTMgMCBvYmoKMjYxMgplbmRvYmoK OSAwIG9iagpbIC9JQ0NCYXNlZCAxMiAwIFIgXQplbmRvYmoKMTUgMCBvYmoKPDwgL0xlbmd0 aCAxNiAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBpVbLctQwELz7K+Zo V7FeS36sfaIgCWQ5BAKuyoHikBgFDN4osTdJ8UF8Ele+hZGsGdv7IIHUHqzSYzTT3dPaGziF G4jwJyKZwCLLoVVwBlcwf6faSl2vb88baGvcZDeYnWaT+VYrmC9XAg41BpkfdMKrOojCWCZR IhdulMe41c6JIoWugvl71Zyv6zt1oBvd1iu1buvK3WDDChAyhSyTHl7wsoSFtNPuU+KlZYl7 oLyEj+B/DjC8BL8NYCaTsAD/3M1c4oxdWgee/c5aVdP2GQ30V9o209fupNoOtnZLugWKBm5K BPAJyjdwVFoshStC5pAWiQEJa4hFGEeLzC6Nxt6kGv9nAOW3zTiZxDiC4uSh6MGPeeRieITI 8ooqoqTV1gzlXnc06uoVld8EXhHm4P+gNYqjaYLBq27prtW+SzyfjjPSiuLQja2+CECkYQJ+ o1bd3CFbdx3HV5hpT2PN1VCYxxI38OShnB1PBt/EitnwxKgOowlHqDi+XvWFef69TV6Ar41w MJj/3VXA8Go+VXH1h4SdPu5Hnk8VDbzcs2RVE8CUFwanU8jILhFmBSQpNdJIeBNBTgrcLUIR xZAkBarQeyRKS2L9VwAJGgD4BotdObrYrtuxZaMoklBWW2QkeZhHmXEW6FOW7AInbwNIF+CX /RXeRi8O6dtm3CBZJDIs8tx05wQK5Jo0R56CMrVWohl6KpOYY1JPPhC9tHQReE7juiKBDGL+ shsdZDDOuP3/30YMBHFqGNwFgbFzVzv7yAsWb81WSqVQ1dstvTyissvA6/33FZ0a+oTha8hK aI+6IycYDIVYqIYu6oa2QEfuSdlKiljDBRbeqPPRoeXiAWgJlV5pk+ZAoAxsAtBBJNL0ILKs VtaINq5mkv+bSY4RdS/agCiVyPZCj90mKOzdA2UN2S/tJS7UbxfO89ms6CLaS2en1k2rHXFB xygtteOdeBZAbh0CTzNP5g/HCF+x2I/v9BUd/SfQj3iewGctdlhs/8RUlHanunF2tved7YNf Pd+TbwEijpyfPdF0BYr0H0x3q1E7HYDEB2lURV/i/aCDVu0vZHgZn2g9pozHOs9ycB7SEQlr 8MtZxRUQW+b1RSXhQ8xyY3NAZIowNU80haLQHIa1PvTn8ehhFpEV6Zlzm9fkcwie1cVEvad/ AAZ6WjAKZW5kc3RyZWFtCmVuZG9iagoxNiAwIG9iago4ODMKZW5kb2JqCjE0IDAgb2JqCjw8 IC9UeXBlIC9QYWdlIC9QYXJlbnQgMyAwIFIgL1Jlc291cmNlcyAxNyAwIFIgL0NvbnRlbnRz IDE1IDAgUiAvTWVkaWFCb3gKWzAgMCAxMDI0IDc2OF0gPj4KZW5kb2JqCjE3IDAgb2JqCjw8 IC9Qcm9jU2V0IFsgL1BERiAvVGV4dCAvSW1hZ2VCIC9JbWFnZUMgL0ltYWdlSSBdIC9Db2xv clNwYWNlIDw8IC9DczEgOSAwIFIKPj4gL0ZvbnQgPDwgL1RUMSAxMCAwIFIgL1RUMiAxOCAw IFIgPj4gL1hPYmplY3QgPDwgL0ltMSA3IDAgUiA+PiA+PgplbmRvYmoKMjEgMCBvYmoKPDwg L0xlbmd0aCAyMiAwIFIgL0ZpbHRlciAvRmxhdGVEZWNvZGUgPj4Kc3RyZWFtCngBpVVNT9ww EL37V8zRUbUfdpL9OBYKEj1UhUbiUHqA1LSpEgzJAuIH9Sf1/3TW8RursNsiVXtwYr88z7x5 M3tHp3RHc/6ZuS1ouVhR7+icbmj20fW1u93cX7bUNwwKgC1yC9qudUezk87QO88ks8PBqHqg +TS3xbywy/i0yhka9sy6pKGm2ZlrLzfNgzv0re+bzm36po43BFpDxpa0WFjFFxxUtLRhOy4V X1pVjKHqmj6T/poxvSXdZzSxxXRN+jLuXPNOONpkKqyT3jWAT/DgvwM28bfxS/eSbBOPfE9g o7hlM/pC1Xs6qoKWBknkVJbFViTOIV9OY/zpKWaiQib6Z0bVj+cc/H1ZmshRLAJzXJ7r8GlM Q2nfOUQmQSOxhgsUo4ZKXO24MwA+HimNd9e5G4iEPeHxIjN4ABFh+YaxAFcZmXJakG6dg/6N UP/KaMVOIQ0iL/iHGGLj7zM1FnXYrTorVhTlv1UP/lG7VWefFkX+KtXfIlmk2DoIK3IiHUA9 Nk6OoGqFh+PxTGlUzIkpW7c34zxf7s9Y/eGUvRnnOby632eK++0gluIeISMtZIX3VP4nrmwR KpvMdoM6euDx/WNqvgZnWJMPgR5txK4P1jKkH8VPgAzcEY8pmn6Pjlx1a1dx5qQuTU+v0NHk CyZZjMVQ+4XcDq4zCAjDSOBoDd8hhatMxcbx36L+OIJRvPgtdRSw0qyiltzFpYkzclxBW3On xfEpWK7CrkHHLWfs/P+EY/GNWb1Ktw9pdiBYKIh3HknraUna9+yy8U+hA6YFSFSuJdMdcw7o QQZPLVbCGahFZmyIckDGmit9fPisjHC4kIMDB0yxS3wWriyj9n/3Ww3GF1HxmA0ekDkNT/Vu SB2HQGRyIykcyFyLLa20JOP4X3O840K3HMdo5qeM7Jx0Oly/gecuMnww1pIbPI0FJkhSnP4G UzHTOAplbmRzdHJlYW0KZW5kb2JqCjIyIDAgb2JqCjcxNAplbmRvYmoKMjAgMCBvYmoKPDwg L1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3VyY2VzIDIzIDAgUiAvQ29udGVudHMg MjEgMCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzY4XSA+PgplbmRvYmoKMjMgMCBvYmoKPDwg L1Byb2NTZXQgWyAvUERGIC9UZXh0IC9JbWFnZUIgL0ltYWdlQyAvSW1hZ2VJIF0gL0NvbG9y U3BhY2UgPDwgL0NzMSA5IDAgUgo+PiAvRm9udCA8PCAvVFQxIDEwIDAgUiA+PiAvWE9iamVj dCA8PCAvSW0xIDcgMCBSID4+ID4+CmVuZG9iagoyNiAwIG9iago8PCAvTGVuZ3RoIDI3IDAg UiAvRmlsdGVyIC9GbGF0ZURlY29kZSA+PgpzdHJlYW0KeAGNVs1y0zAQvusp9ijP0CTyX5IT Ay0zwKG04JkeaA/BqGBq162dlukD8Vo8C2tL39rND83kYEXa32+/XemezumeZvwzszCmebqg xtIF3dL0zDa5vVs/rEpqChbqBTrJTqj75hVNP1SGTmo2Mj1ujcpbmk2iMJ7F4dyvFhGL9ntm mVCb0/SzLVfr4tEe12XdFJVdN0XuPfRmDRmOJJ0vFDt4m9E87Lf9J2OnWcYylF3TV9JZQMYs J0vST3cBewpJF/nKr0ryi0+BOurPIGObgI7CuNOD8NrL1g20jrFzy8K9es56yuvJZhvQFWUf 6V3Wg2l8FlFECSPlkojCSRwtXSajtXqWjv4TUPZr0w7bSNIEdpaTJO0dRLLyNhQg+YJo7SOD k0xi0jvSFWxufJaSTx0o1jKkf8sWEHmAaTnZod35HGkrvQcgYxKK5zEy240QjRFSuxEyyYwN hTAkwGxBJKw5CxTr6Bo1t5IPdgrQQnD67nEq2o47Mat7NJQGq0R5AB7IFRWEYDiHNETqa7AU OyeAu36PFY6kEjALazB/w1XkGC0UakkRO9ImMAHVvICxJ5btuK02uN0jboTcByAOH+UqUH0r STiyKGT1w0P9KqAFDw/Se0JWGoEW24jDY92Vi80wJSGNRMt25MGFBa2mDihk/NiuGyptMSD4 YqRKn77h3pv1XjNe8ahZkB55c1alwKfStGk8lrpS24OlAz9KpW8OAP9v6TJX40GwncTU5/oN Y6Osc/T3prTaTqaxqJuQk6vtEgXyfTHSZQfGE9yVrOfAh7T0XF5XlZCx2u7Scf0whFV3o2EI 91hxH/gpfABWuQTfrn1YdWXlTmjlGEzBdwfPRpV0CQKGn2jnxiJnHIHqA+A4sWVZOIS5jtIr uXR42095B67QNrfPMOq5bGExl8tssvcOC4c2//+EdvfP7gnNd1ho0oOroDSuXqAj6YI0rUBY S0VKjGhgOJo1pr/rn5C5aA8wg7xQ5i5waLkNpWF9mAMCPcKEzhATHMKq+6+0BGBb+3ov+CaU i38v+Gp4D+0F34TRIeAr96a68JlLjEhvM5mhNz0xx68px/jR1AQElXB+aKbGtji+1MU12gPQ IwCmgS/kZQB5nPG71cfN6k5qcFT4maZ0KWLDQw+VtW2x/S4cpqFl8slLTw1DhtmdLg/B179Z hbCe1QO1XgrgGVPO/wH+pm3TCmVuZHN0cmVhbQplbmRvYmoKMjcgMCBvYmoKOTAzCmVuZG9i agoyNSAwIG9iago8PCAvVHlwZSAvUGFnZSAvUGFyZW50IDMgMCBSIC9SZXNvdXJjZXMgMjgg MCBSIC9Db250ZW50cyAyNiAwIFIgL01lZGlhQm94ClswIDAgMTAyNCA3NjhdID4+CmVuZG9i agoyOCAwIG9iago8PCAvUHJvY1NldCBbIC9QREYgL1RleHQgL0ltYWdlQiAvSW1hZ2VDIC9J bWFnZUkgXSAvQ29sb3JTcGFjZSA8PCAvQ3MxIDkgMCBSCj4+IC9Gb250IDw8IC9UVDEgMTAg MCBSID4+IC9YT2JqZWN0IDw8IC9JbTEgNyAwIFIgPj4gPj4KZW5kb2JqCjMxIDAgb2JqCjw8 IC9MZW5ndGggMzIgMCBSIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4AaVVy27b MBC88yv2SB9ii3rZPhVokrbpoUgaATkUOaQK27Kxw0RyYvSD+p9dUTtU5LqBgcIH0avhanY4 u3ykC3qkhH8mSXOalwtqLF3RPc3ObVPbh83TzYoax6AA6JAdqHvWa5qdrQ2deE4yO26NqltK plmaJ3k6l9UiY2iImWVBbU2zz3Z1s3HP9tivfOPWdtO4Wr4Q0hpKy5zKMlX8gbcVzdMQlkfF H60qQ4aqb/SF9PmE06ekmwkdpfl0Sdo9S+hGnvUvmqgAOpaIv2d0iNR22BiD7YSuqfpIp1VQ xwitLKMiS4RVNp8Ko2E14qZ/T6j6uZtjnlPB2oTKVF6GzPIY7ebKTsDRf8CKhP+jPJ/wgqtQ KN+2gH1HuS6WhhAgG0DGAaV/ILVrbgVz9CALCNtJt0imhjTSsNL9cbwkr3qp8aqxrV/xGZli mpMO+ucJ6Y71PtVZsbwsDlJs68AjssdHo1KihNJ3wjRK4wMlLmYbQzPB7O4mXa9sVAHugjyD o/ZasRcIYL9ytbOD41TXj3Ac154Vy752Gnw2rEae2e84YwpOUoptX7fcJQ7dry2U20IW39XV ndSddBMQawdXRdlxDoB8FSFj1iixtbeSjhe9NNgUs9nG7vcGd2RahEHEc2JQJa7UAfqwxmm+ EI3/LY8adeTQY6h0IAv6Z6dQs8LiXf9O6S3ME3VAHuzGf48A1HFtHe3YctP0kw3wSMO1bwY5 TcIjmPSVRCKIhWVU7Do1cp7J0/93nsmWBzkP1fnIDXXvKKU0oADgPzpq3H4yZRi8I8J7npjh CojjEib1f4mJT9WRHVhhBKo4AllTMMI25Itnua+n4H0Vj+PFIOiaeC7XBo/D166N4W6DN05g v0+xv8Fsv2ZBFlTY3Z50rXAdXvwB0zCyywplbmRzdHJlYW0KZW5kb2JqCjMyIDAgb2JqCjY4 MAplbmRvYmoKMzAgMCBvYmoKPDwgL1R5cGUgL1BhZ2UgL1BhcmVudCAzIDAgUiAvUmVzb3Vy Y2VzIDMzIDAgUiAvQ29udGVudHMgMzEgMCBSIC9NZWRpYUJveApbMCAwIDEwMjQgNzY4XSA+ PgplbmRvYmoKMzMgMCBvYmoKPDwgL1Byb2NTZXQgWyAvUERGIC9UZXh0IC9JbWFnZUIgL0lt YWdlQyAvSW1hZ2VJIF0gL0NvbG9yU3BhY2UgPDwgL0NzMSA5IDAgUgo+PiAvRm9udCA8PCAv VFQxIDEwIDAgUiA+PiAvWE9iamVjdCA8PCAvSW0xIDcgMCBSID4+ID4+CmVuZG9iagozIDAg b2JqCjw8IC9UeXBlIC9QYWdlcyAvTWVkaWFCb3ggWzAgMCAxMDI0IDc2OF0gL0NvdW50IDUg L0tpZHMgWyAyIDAgUiAxNCAwIFIgMjAgMCBSCjI1IDAgUiAzMCAwIFIgXSA+PgplbmRvYmoK MzUgMCBvYmoKPDwgL1R5cGUgL0NhdGFsb2cgL1BhZ2VzIDMgMCBSID4+CmVuZG9iagoxOSAw IG9iagpbIDE0IDAgUiAvWFlaIDAgNzY4IDAgXQplbmRvYmoKMzQgMCBvYmoKWyAzMCAwIFIg L1hZWiAwIDc2OCAwIF0KZW5kb2JqCjExIDAgb2JqClsgMiAwIFIgL1hZWiAwIDc2OCAwIF0K ZW5kb2JqCjI5IDAgb2JqClsgMjUgMCBSIC9YWVogMCA3NjggMCBdCmVuZG9iagoyNCAwIG9i agpbIDIwIDAgUiAvWFlaIDAgNzY4IDAgXQplbmRvYmoKMTAgMCBvYmoKPDwgL1R5cGUgL0Zv bnQgL1N1YnR5cGUgL1RydWVUeXBlIC9CYXNlRm9udCAvSUxCV1VPK0dpbGxTYW5zLUxpZ2h0 IC9Gb250RGVzY3JpcHRvcgozNiAwIFIgL0VuY29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9G aXJzdENoYXIgMzIgL0xhc3RDaGFyIDIyMiAvV2lkdGhzIFsgMjc4CjAgMCAwIDAgMCAwIDAg MzMzIDMzMyAwIDY2MCAxNzcgMzEzIDE3NyAyODEgNTAwIDUwMCA1MDAgNTAwIDUwMCA1MDAg NTAwIDAKMCA1MDAgMCAwIDAgMCAwIDI4MSA4MDAgNjY3IDUzMSA2NzcgNzQwIDQ5MCA0Mzgg NzE5IDcxOSAyMDggMCAwIDAgMCA3NzEgODIzCjUxMCAwIDU3MyA0NjkgNTczIDAgMCAxMDMx IDAgMCAwIDAgMCAwIDAgMCAwIDQyNyA1MTAgNDE3IDUxMCA0NzkgMjQwIDQyNyA0OTAKMTg4 IDE4OCA0MjcgMTg4IDc3MSA0OTAgNTQyIDUxMCA1MTAgMzMzIDM1NCAzMDIgNDkwIDQyNyA3 MDggMCA0MTcgMCAwIDAgMAowIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwCjAgMCA1MDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAKMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDE3NyAwIDAgMCAwIDAgMCAwIDAgNDc5 IF0gPj4KZW5kb2JqCjM2IDAgb2JqCjw8IC9UeXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5h bWUgL0lMQldVTytHaWxsU2Fucy1MaWdodCAvRmxhZ3MgMzIgL0ZvbnRCQm94ClstNTMxIC0z NjggMTM1MSAxMTE1XSAvSXRhbGljQW5nbGUgMCAvQXNjZW50IDg5OCAvRGVzY2VudCAtMjM4 IC9DYXBIZWlnaHQKNjg3IC9TdGVtViA1MyAvWEhlaWdodCA0NTQgL1N0ZW1IIDQ0IC9BdmdX aWR0aCA1MTcgL01heFdpZHRoIDEzNzUgL0ZvbnRGaWxlMgozNyAwIFIgPj4KZW5kb2JqCjM3 IDAgb2JqCjw8IC9MZW5ndGggMzggMCBSIC9MZW5ndGgxIDE1MjY4IC9GaWx0ZXIgL0ZsYXRl RGVjb2RlID4+CnN0cmVhbQp4AcV7CXQUVb73vbV1Va/Ve5ImSTfNIjTQMU1ogtHUAIkgKhGB SZBgNmJAEAKEETQGjDESYBBjABlGEXEDlwZZgqKioCjuz9Fv3GbmvVFHRuJ4fA4ipCvvd6ub xVneN985c87X6dt1l6q6/+3+t3uzZFHTbGIlKwhPtNr51QuJ8XFuIYRuqF26JJhqi1PRvr9+ 4Q3zU23pe0KUJ2+Yt6w+1XbvIWTwRQ2zq+tSbdKL66gGdKTadCSuAxrmL7k51Va343pq3oLa 9Libjd82v/rm9PzkU7SDN1XPn526/5Jbcb1o4YLFS1LtMWx868JFs9P303JC+NOpsQt+KeqX kRnERG5C4YhKouTnhHCnlSeJQCj+gBYhK597e+n1jqK/0oBsPLxz9LvG9YO5A0aceSnpML8j 96BDNu5nI3jGFNUzCLGQMy+dOWN+59yI8Rx+LusmV0Xos5jlMJkcoS+SI2QxqSUlJEaCGJ4W eZG8QuaQ6T/peZVU/6SHvEheIrfhsWkXPPYyWUuWoEc796LDpPGnjz1LjmLiqZFucihY0jwn Y3w3GYdGYUS7lSwPLufIsrxlHFkUXJS3iK9qpMHG3zdyWl1ZHZdXp9UtrOurExbWUq12RS1H arXastq7a4VgdVl1VfWK6kS1GKw6VMWR6/Our7qe1yoXVnLByjxceDJTnRmcWTVTCF5H8a36 Ga3S7tYOaXxxYV1u4SV1ud19h555Pjt7lHHNzEpdHSq7anXPK7ZRjuccB6P7o93F+4u7J++f 3C2TA+Q5ru9A37Mcq+U+F31OUMgBKle0leVu7BqSO7nr+q4FXfwd06K50zqjuU+35Oeu75yY 29lSltveVpe7sqUut7VtQ25bS1Fuc8sGBoCW0TJuwqicm33Zv/D1W+oLNPmylvgyF/sW+jCb lpE9b4HP32/eAn9g3oLMG2/yBW68qWVR1lwPG+zLrp/j8farn+MN1M/JnN3gCcxuaGvMum/c 6dBGlE6U9ShrUVajrEJpR2lDaUVZidKC0oySf99MOXdjpZzbhdKJ+nqUtT+Xc1ejrEJpL5dz 21BaUVai3YLSjFJbLefWoORXXifnzkQpny7n/hylepqcW4WSfx1+pqO4RnodMa8136tc7JXy vHzUS0Z4hw13DI3YLxriGDTYPmCgo3/YHgw5cnLtgX7ZtozMLJvX57e53B6bQ3VarTa7VTFb rJJJtvKCaCWal3LWwCVyrmOMnMsXyrlktJxbFqMJ1yQyaerYhJvieu3YRCwyCeSaksiPTErI ZdeV76L0lxXoTXB3dVMyNSHc1c3h4ho347rybprJhtsCaJbvEmg3XdG2dm3gXK2iIpKdqJt0 bXliYXZFIp9V7s6uIJH/7UMjxjiNpK4RVNKff/Tc+VHclMhgc4xN3b5LYRjUTUk3jc4lkcis xbMWL16CCvssRtX44qcJVTQWE9IkMjXQJHrYxfj0XfDZxKf6T/SxodQvqw3R2e8FN/6L1bFk Lrma/Iwrg6K7l7uXu4a0cnM4vCqlzNhL/+lnJqkne8heMplcSn6g5fQ/aDtdzl3LPcH1cvfR N+k/A+G/6TrowPOfKu5ynt3bhK556dJAykkN6qz87YeZiRkoVShlKP8vnzZot7OfbWQbacBf C/6m46+B28YNJWQoXl5G6jD1PMJAculDYB82EZfYRFyEaIWj46MKRsbyL86Ljhg+LDJ0yEWD Bw0cEO4fCubmZPcLZGVm+H1ej9vlVB12m9ViVmSTJAo8R8kwmsiApGaaIoFQKFQxPN3O+mk7 wQ9UvwsliOsnNwV+etOufn/Tzv6bds659tUJ4kmUhseNZy/eRUq/TBB3gnoShM1C3VdhpjQk JXVzwyVzEpnj6qqq8MT4sBpMlH4bTYNiALzLYh4XHjfbPHwY2WW2oGpBDfcu3EVLL6NGhSst GbOLI7Jt+LCECwt3YAkrcxPa6ipUwuOBOkbc50egWddcOETwWOomgtuMGk1I4xImY97gnIRW nSCrg7uGHepY062SmqqItS5cVz2zPMFXg6i7CD+wpGEqWpgZpaohmBAwr/ETQE+wpCHYgTa7 rQq/4fF46h/2o1sZV94eOmSomPaShDOSuBxPXr788wDfUZIxJ8iaHR3twcTWa8ovHA2xeyoq KjKGDwt2lIQx0fjhw0rmjgWlM6KM3MJAfCfWhUvq5lQHEytq5oI2+FavYYQPdaiJ0pMgE2Wk Y6Wuai6Ddy7uFXAJdqyebeCzxoCfUZSWNIB51f+3uzo6Stik1XUMFLx5XEKbalzI1BmMZMES kHd8RborfQNGBGOkanwF+MFmmzSlfBxGS8LV4yGnTJbP9VSle9BRcnYwyOCcmNCqEsHaYIJM KQ/j4dHsZ/Zo0lE7msk6XkOHD5tUdv6phDhQDQc7/koStCrcc4JBfL6nOt0jDVT/Sthgabi0 qqOjNBws7ajqqO7uW1ETDqrhjl2TJnUsLKnCrGXlCYr+Z1cHEqVrKhJqVQMdA/4wKSmdUl4c CDmBR6pZdrZJIHYQPog50AEV8J2YvoAXZGp5KDguQaaVVwRAyHJWn4p66sqEDcI9GnKQJhuj 0WyGLCZi9XQ1FGISvLpbIzXDh4USK64pT7WDpCawm2jRCPhRxUYOnR3xTmMjK86OnHu8Kgzm 7DE8Sm9CHnTu61B97pKGMQnq+1+GZ6fGE+5x5XyAY4sCNS7As5o5Am1QlPBHUL8o0gG2vBtO qJGEWH4oUFQRVJ3QEox714YnXTOjPFjScU4KUj1nkYYRvkD0oRT+qfQHQh3OsCtYGK0YDvdz 2KRuopSl/IFu2tfWPZ5kHyAK4a+fheExw4LBkjnjISZoXDIMHUNDqBUNC5ammBuuCHYEOybW dQRLgw3VdYDBuEIOZ3dURMHIa8uxmBk7E1pF4Fx1dkXFGLznUvYePILbOyrwhrnpN+BqdEWT uOmyYZMg5YPKyqEJVoyHOIyvAKMhTocgd4ewECoYIsXnIAXEzL1OwawB5uKhGP9Z6i0g0wq8 oqKjg70TLW4QuN/REegAJkZPOASHKN3RTYx7oCC6qVZWzoa0cIiJX0k4FA4BjorxePdYsOfs 4oJXz0gqX0hSMh4kldMkHX8OUDxZAvDGGyQt/TeR9PJ/haQT/iWSTjwH6U9IegVgnshIOukc SbVAgpwjaRgL7W8ISv4phc+RXPsHJF+RIvmKf0DyK39C8qv+d5JffQ4RQD0Z4F9tkLzs30Ty a/4Vkk/5l0h+7TlIf0LyqYD5Wkbyaf8fST79ApLDfWOBN1eIuH0H2Y5iFyeQ1XQuWcytJFcb 12IiCYSMRUj/Bq5XoqxGyUaZitKMMpYrJjGpvq9XnE5koZhsF+eSOvEE2cafINv5lWSr+BKp R9lGd5CtUgRlA2kQPGSrsAH3vERm4SrLxX06P5dcgf4WHu4mrlP5D8gUeoL40T8Q72qhK8k6 urLvKNrLWB3vuoX1C6n7V+KZK4HDSu4DMpWb2/cRG8O9RNwBD3U6sQIHieGE92YC9VSOgiBD I9G70A4iJ/ATzxt9HHI3BAG/SCRkOWRoVDMSE1ZiI3biwAhB3uP8xwkP2E08xEt8xE8yMEsW CZwb7keySQ5auZgpZPT2Pzd2vhImA8hAMogMJheRIfC2I2QYGU5GILuSRy4m+chWjCQFZBSJ k9EEfCNjzj/6b61d8m9929+/rOjvui5N9/Qn/ckUcjt5irxN/oucpBl0Od1A/8wt5HbzKn87 /51wmciJs8RPpbHSGuk16ZRphqnDtNX0oTxB/qXcq2xQus1DzbstZkuV5aA1z7rcVmPbYfvU nmW/2b7Nfsox3rFb9ak3qwnnWOfdzo9dWa57XSfcVvcw972AAIEIMlBgNzhvIgHNYqICJSKv CERWf/cWviQaeyv61sV5IWfIORA/FDefXiGSM+xKUIEUbdeHcFvEdsjKYC1TChBBGjuBPEa6 cYNghlwghuRblWgyP9pY+TkpLr44j0qcU3X5w8SpUm7zobffPXSDvoCuE9uf1k36af2MLibo vVw/rh+9B++34/2S8f5BWgYWaIA8Kv1V4kTJKw2UCiRBks69vsh4vXsUIi5ucIy93n7oXbyd rtcX6EMS9AwV8fdjQp+X/DL5uc5CTEpWk33CQeFPBvwuRZEsXVjonCTJfJuZ40CBaFGyKD96 rnJxnjvkjDlD3pAz7Aytpidm0K917wzdw/WmK1jIeO/iPpWcQpApk36aTeB5OSG5BND6aTna o372JinuiTHSxr0eU8GognDBqbZI5OiWfbMnFM1DZEqhk+7nYlQHb2x7aCeIGAUMSVDPGyrg YnqA6lVVxjzAgs3DE8c+PsG5ydN8tAdvZ69mbz16lAW64FzfN9xg0JEHn7yEctw0nnh4nvBu Aq5zlOej/lgUFGwXR0Tam49gphgN09dn6cVVYvvpG5iGGNv3Df+CwQs/ma1dXWqd6JpurXAJ j1gfd+2zHnAJ1q5SiUpuV9dEzChU8NOVCsd0r3DAsc/7o+OkV0DOyFvoGOUVFIfk9fMZiuBo 5Q9meluV5zLUkz2q3tPYWFlJiit78K2sBAz5YCMX7g+JIe58xlij7uLIQcoln3+1lzp2bnnh wK/vffl5sV1v1x/RX9Bvpc00TltpzenXaRW1U5lerz+qf6N/re8klL4BRGKI4HmSpTk4F8/T tjwsOE7jKAcRBemYiIK3XKxBbDq9Grca9LsSLDgM3F2kRivBApGDcp4sPCwfko853pX/IH8r S5PsM+xz7adk4WP1zyond1lcRkpX7eIFRbG1VkkLpbslXgWFJAuyvhAtZ4xNyciO9VFZ3AOM SSWtbHQXjIrl+7wqhZgR58hB4f7SzF/t3PlNUuc6eldx7XvaytcIa29pOf6Y/kxyfxW3gLat TEww4FwNHi0AnP3Jw1pEyerCurbGA5qsxAMBB+/SbI64y+XpcrgJCQGwP/upP8Nmj1u7+77V 3A41rkhWKudkeLPiOaxf6u776hmHi12/1frL5jghTiVosceVQIDktEqSv1W1LrByCsFjVqsT SM2qnMVwSjoLo7EIMGQpLvRFImAs0GQl4nQVor+nEKsphapHMnkFp0cK9x9c4IvlI7EyyFRg XML9Ny1/Yv/x22+ljh92PnXv3Y+s3/Pi45tf2L9qg/B63YxXN9/0xCDhOv2HA78tqRq3vW3d 43zNAwsXbAQtOFghwr8CWphhxUq0sNVmq1DMHkUxK4LcxdlsZsllNQtmmwIpEFqtJpNydrk7 CwtJcawYUGL1F7IlITSrbE04Y94wW/gFlHdSnjt8uCHZyr3wM90jtvd+NTX5BRfoz1/R+xV3 VfKZlNxMBT8gSNCEN2jjmiSa5R3iKfTwGb4uTYS2paJoybTb1S6Lm+vK5Cvcc9375FflD2XR 3SxTzabGKc2TaVSmMt+SKWfao7FYtAdSA7qqPaBoD1MkjJxMkABgYyU0hNMQHw+5gJrh/iYn 79ddhfH3dF1/edtTh9dvePntnZW1YlO1Xqp8/erLuj7zF41HNmw/kMOtYbBzpBmw7wH9HKQf uV2bqlgyLWM4/rjleKCP8mMoVflA1zrxAdgokXiBARGWZ9wpb5Ce8Qiv2z+yf5J13HFSFi1E kh2OAOy6aPfYnXFedWW0yq5WO1ajjLB4r2KOyzIQi0Zi0Zjao/Y4Y7GIoQeKe4BYZTI/Hy3g 5id8CjGICVeguiWvJy0raB++VNcmdG579A9/ePLlrxqEPWtanniqZbvYfoV+WG+f/8m2nb+j lj9wRC8YEN7x1oO/uG1nCkem05alcVyhXfeh9WPH51b+OfcR7g13n0NwOFQuyMVpHicybO82 GEaJ29slWahFqLcvtS/N+CLjR1lUZArMWu3ADcrPXmbn7HbqkCfL18sL5FWyKEcrwbpKA0MD I0PNxRiCPTFwjgBHcTBxA7dBBSOBp8ur8mwdYPEbeNLBhfTtyx66++E/fPbE0T/N5x/deOvO h29F4pxeRevnfLZtxyf66T8mf6DvB3P2vPHQ8lsfNXgYg/L/BvhlwSMbrWXb7TmJbFdWVsZ6 XvBi+QZsNssdqgpvLfB0ThSiBHiYQEHIDBPFVisWaTxFdzvn9fhNAO8yzgDM5IaNiUUnjF/0 y4KnBg0eOHnglmEzimt/9nWbcPiBgVtbJzx0qj5SPDb7uurowjOri8oWzusVjjJ7xPX16s9K cwHXSKKR3dqcyWZ6UXx0bKRIBjPbNJh4Bg9mHgo/eLAyghtc4PFE4K5ccsfFF+cUdEWkrgED IpEc18YM68YcUqFMd3R4VgVWjehy3OcxHVD2OrjRo5XLmheMoCNGKA7PHV7vWOWOUGis445A FNIVZWLVwxZNpSFgbBkZfUVM+lIUKMJtkEPK7vLH2u0jIiI0AJp+KC0o6RgPrsTySYFKQkEY Kfy6Y5IQTtdZT7h/wcj44BQ/SSzfH6P5LoNsoKJP+EXzDuvFN1OHvkN/Vn9Cv4LugbXaf7y+ Ua/5Ub9Fz6Xv0410Jr1L37V3mSxs7r73VTriN+/MFPSrt3yxfsGO/3OPYO79bKR/OJ14inpo o36Z/iDM3xQ6+sU36Kd0JW2iZ/RK/U39T3rzwpzBwoFv9/2VLnkp6aa3HLplq/7Yix17DflA fl+8WmyBB2gmy7XxvKwonFkQRYUoHLeSEg+lxKSI4krJ5JEkEy/IQqdmNksKMQkcFSWYYpkX 6Asm0SwIygtB2DZQLisz6S/El2QUFxUVFRcxMc/qKVKL0t5F+4gM5mSY1KIiVi7OU2iYD/Fh hede59oaP0tO/6yRa6NX6O/rH4gtp1fSP+rZYkvvC9w9yZsANqz3dgQrLBNvRRwSIPdpsa/V r11/8X+dJczzf6J+4vokS/DxVPJ0OuzX2xfYebvmdMXtdqutk/DeTqtrqcCUz4lnoHyE9BXt k/vsatzZLLEuLdfpjgsabB68TJk7KZyUOUHIbJa7s+3eFuvefurJZBFcFkhRYyQS64GZS+lj 4BqpZLYNyrjSHYIh95gM2xZyO2NBpxrinSGYNjW0nYa/OPE6HZf8rX7DvA20WW+5h4aeeVav E5sOPX5sfqn++Y7XxUDyfeqj/uTNyaObV1IsVErq+r4RL8Ha8ZIl2uRufr/ymv2oR7CsV6w0 bYftdL1EvoUKJ/x6j6Cst7unS9Spmi1xUSqR7nJucn4piYooUflHJ7WOpdQvNd9AqXO/T9Ur e9S31c9hxGdVphGC2mKrxjDsTA97B6XFPH+gVzpbFYfr3+u9+jZIsfNzajv1g/6S/nO6mw47 IbqWtuv36z9g/JF1C1vpffRi+JZbGB85bL0QsQ18lImTjNPynZ2Ut3SaXIrdK1xhny4ss98p bBD2CQfsXwrH7ScFqySMEsaAnc1Ct9vcIu91pf3GFOmZd26swCHU7UzVQtvocbqYtuvN+hZd mEc7qIPOQfULsUlfrr+hv6c3iYEzxVCibmqjUxl9IVv8U4DJAq8hInY6BCpodgdkAa6UwOQI kg6fnDd1ml2CMhZRM29qsey1qt8ni6DjP4c/B7PMxAAiAU+cWWR4ckbh708u4prhNNzfe1Js mpF877rk6zMwF5t3K+ZdgLpCCrQcNm9UKBZ4QZDZZLJLFCnmUahF2WtWP3fG1GQRjCYcVkOJ XTBP2MkvSP6aG5z8aB6bomdGcgreSkk95OZqyE0mqdNUizhJbPNtFgVbp93uyiAQfm0YVgNZ Tym/PkNQbcp6lzvTu1TiDniPe095eZtNotTaou4LSM3e/VkQfUP64ecxnz2ZX8iMRY/h2wEY 6MjzchKHxxRynpeVGMTjB30r9Fvkt4/qH9F7f/hRf06/iu6k4z4V1eVr9a0Y/kF/cDpdNiN5 fCndQkfSfLoRODB5yTV4M0LzC50sYpN5TnKZuRa6z6aILRL4YCzMJOJBqJ5bwYcMRhzmtqEg dnOKufN7Z86bx29nHj63ITlXbErewrWleUCteD+LpwjPuZBYYaYwHRRQKyiaDgoMfoksQFDI pVqIk02mlTyHmIrjZRPHiS7FxHMyoLKY+BYRLDuZzGfFgApmxXArU5GWM8ygg7ERV88488m8 mUKYzSK8cuYSsenMJcIrWCcNfd9IUfDOgnzLzVr8Ee5x4XH5EbPgI5kSC8T+ZP3KJbnWfwUS Cdb1f2JhmMPj88cdqssTn+igDhUhgJdpOnTi+u0+9Jd6KatqNow5mvnuTG+zsj8jxdhIJZNe 7H+nozGDoxdYN3pBnb+CjqJP69fox7CgrqVP0kIE2jfo9yGYP6130RsRm12v/0b/QL+ePkgj dBh98PQbdDaF101n67+C1kjqvwKOTP6Pg55m6PRSLSp3Wq3U7LJAJUwTpkr1wlLhLftn9hNQ A7Ik+ARObf4DlqbgtSot5r0exnVoqcqeRkMXgO3gekr9SmFwHgohFVBspSs/+7rnC/2v8+ZR 4el9ux8Rm17d+eSx5GLo2jfvbV+5Ka2XhMOAxQnPqUWbstjUauo0fWsSiMnLc2aLZaWseGRZ kS1Os1Oyd67w3O3hPB74B1lMg8lm3qkoFX4G853CR/7j/pOCSRKov1kQ+rnVFufeQBpcQAun C5YSKgMgw26oRYg+zjochhFJISH6/DCSI0A/hksqRgpvo/X/+Y1+sqSJFrV8v/yu1ufnzftq 13Mv7BabDj/yXU1oj55NWw5dn6wBap+ta115t6FnZsHnnQ9ZCpG3tIysQLRfcT9+SKAwsCbQ Je82i0dMvzFx0AcntBAiwMysrDSuotvr9uXwiN2DnKxkZQqOoAv+u2b2ZsQRU653uChrluIh pkKC/HQJFJDm+IWl1mXZd1pXZW+w3pd9UjJJViWbk7OUTJYQ8bfkWb+0nrTyVmvY5ZKag9l5 2Vz2/v7qycaUI8qCSae/0AgIUI2wgAdKxl9Y2cioZDcCMxKprGxkCsdwloUc6v1JLDlgBDV8 aj62r/W2x+voZffUn9jxVPcbXbfunKsfXF194pGHxOgvbryv8Zrbby7btOzB3y1v6XqwqWLd rVeuXbD5I6YX4CcJayEPJpKt2eF5MJVMKdciiiYoYSg+aMAipiWg51l8KKxNfj8/+T307+kv xAA7pkD79L7v5LF4h5U8pP0cx2LOCpGVqQ5ixYkOq4SgaKUoeUQROS5BSCsUEZsxJqvFwlGX WVFMSCfBE1MsZqtJlpC8EXhR5GXZbMb6icYyo7GMaGZhFHoZSgZfiBN+DVdMhQumQiniBwT8 qTOW9snSF8MlozHF+NKwENIj2cl3FtC36QchuKbvLEi+nSWsPTNbbD2zTGhn5XQzWzdXQLZm 8TsQew8iWzTL8lAbkgMXWRxxf3ff29pExRE/5ngl/LHjg/C3GSLJoD7fIB+X22W3++Qclooc 2CX360K6zO12O7t8Kos5h1j4L/qf7M8RYpdy2qqyaFaWxc0kzebJiLvd/VujlskWzoK1wwQD GiBZVITfxlQAY/j06M3PZ658T6MRaUGzMdel/6C0ez5gYMFIRMipXIQTfv1g56BU1MXParmk f5a0fl3D3XDDuDdv37hlbfM2X7+u539suPq2rVOqhpcsuqt6w5O2poNNs2tuaUoejjbQXFPn Ig2nCUGPFtDjqMFzP6k6QPi+32nF/n7xI9JvpO8lXpA85qCZt/G+LlGlhKUBzG4qyT75S5mf 5LzOeaP3Fu8TzoNOyd0qH8zk7W3kAPSz4XdSSDzTGrC6OIMCX5NE4rBuqUgNwQfv9KWVRP+W ms4De77U/3T8vkmLFu4+vmfV9pg4NvnAhjOvfql/zXUn3498kXjoPwzdMB3wZoJ/XlKvXTzX PttzzPGxQ7A4BDdHurCsrV0PIPC1KF12N9/lUX3SIIlrcC5zHnN+7BSQJTqhuez2uDMTnoTF Qg/6pVbncz7DR0PaJ5KCGKvFcCih+9iCSS/aWH6csQSRpSuWz8t33Lj5pZe2Lb29Y+mxH88c vpFvnj/mw51PvVVQH6Xk3Y+oG7RluZVNoK0dHk2tFq43LzV/4edF/0AfFoqDV22ujC4R2UgL ti583qEyZ9g/t5fZv//SPNBTsgdw2hwINZ4NeFvl57IYpLAjRbB9IC5z4xAE5udjYSM+h+It AISkYCQL5zK5c4Dzm2pvu+eI/t9Uea1l/R13PfD2pw+vYBZ8wgzqPfYWVa/gvGeGc1Omv7/9 0d8B7imAex1o7Abca7XIn33fi9xS18PCbuFV9UNV9Im5mdFMnm50eO50copFcsKyWPxdTpWl S57xZ8bZVRuh2JA3kSAyin2Od5n9dftvveJxO/W2YpNJgco6GPDQ6Xw9/JFWO8MsWZmfr/Y2 5keRODIcNjDE8B2ROkrhV0lDKak3OAE8wQmfGELSVeLXJSP8pxuefvT+I0f13m/37TyRHM1N HfmXxofpNxkZmz9ctWA59XxwjCp/uY3a1kKUAIAfC+Ax2BkPmaLlH3C96fzIedwpWFyKrUuy OxBY8l1uOsZJJbPD3GZhOa6tlFKbDbmuhRCyaCUy0siYVKoscjQgRvoQCTmmZg3vsr/Tm8rH IQth6Hfusdpxv9+9u2bHjgN3ThSrZob1Py4q6+3mJ5RtfOAAYOLJQH0IPx2nuMLIR42mw7RH IT0+7oj9mHps5Ae24yO/tUhDXHSyn24PPDxgx1DenOmzZTp9AzKHDhowZKjpkpFNtlbbnQNW DRU3y12256R9ee9Ir+T9XjLZNhYgK1gwwCWbxvbbOEBTnfEBmtUeHzAgnLcx00VdAbpx6Maw WuqY4F3q+NAhbB7cNXxzbEfskbg4SsgzjckpDF4VGxuX/P2G4xx0a1AoE6qEFcLdAuxAMM5W lsXpjMc87KfVwSRAcbniDscYc2sWa2Vb1XhW1vBgvNXhjXpHe3mvt3B4qxrMC3LB5wrV71O5 DiPtEWHhXAQRq+EvwbwWps0ry7tDS0Yi338Zg7oE5aFk8AfxYOY1jFDWzrPsBSpYCcgEDSzA T7wgZV/5dMaWCZGb1UNBr4ef/l5L7arPx0yi7Xd9/PJL/0GtXd3Lmo89XzB7/fob6tf8csm6 x/VP9N38prIlKxbfeeklI/tflOdbMbd5XfuCPREhXFVdIAx4tH79/uSR9bNnr1tT13BPMrem bNsO7HVCxlrAVLjv8NOmMO16QlMyMuOWfIc7Lnb3/VbrJzviWdahVmY8OGuXoCqqy9xmetZN HG0qqLZXluPqAQSREUOnMt8c6rSYWQmoALhZhjqFRVdZAjXs/E9h8cEtz9acfmZ5DWKG1t2v PZ18i7PSy15J3gIgsLbXAarvUGV7apdhh4EzwVi7TA6KLGkb9OOhfQMGxzW45919LzJXnHU9 I9viEojeGGGCDrXDPEH4rkiuuTHnd7W1tWLTY4/p4d4GSC7XdxQnEb8x5rDBTx5gylGz4lKZ mhmXLlIscY6z8cpGOWBzsLQ2Z1MUoc2WnsUGrseizAdgsxiykMbUmAs8HXwZLXB+U1t7T4tv znXpWbknj0zl7tzI9wK/ZaD3HmNuhdypTUFMukS5W0koPFGCSpWyQoGfK4rtsskji4JsUpBK ameusijBWRZl9DhAGs4l4kZBk8rYlgi2pZE2kmXaxh0wI4jOT22MIJSOxRhHijNBD+SOZJY1 EpuPnKtADyxqrGQ0UriwQj+p4Xp0hStpTx6kvak4TQ/rk+AD/5Huhayc581ozYzQjtBWtu3D aBOLx40rmGNcwRnjCh3LgTPgTSoITPHjghjwFsSjT0GX55IrcAwJLs5FijVu8+W4OKmfR3Bm dcmCmuuwttme90neNt/zOTS7zZFDcw4E1ZNwVBi26vfs3dBr/nx4Zowfbi+TO/9Z2RvJDA2T PlZh18+EhXvfn377C+sSNbctmnbbuNrWm7Y21fCbtu357LM3H0++wZm7dtY3Jtdy1vsehmRC aM6vFcDqJDP2BswRMwfhe/sZxIFYKm8/I1vj8N//S+vnC8TtWKSC6nSw1eKBJlPa5H+2ZBAg gkNYNBFDkhpTsPu8APNv1sz+pQBx6+7XdiXfSS8ZAzCOMJ9DB1wstr1Dyxqi0noyR2K7igns Kr5qfd0l+6yZyDSyWNWHWFViway1i+00EtWhWm1GRKsNR2UgP0ThMh0+LzfDMc3Lsa1HztH6 On8cZpDtNBLlVeVLhTc2HJHpQrYLGg75OyNlAzYzVdeIbUcv2z1hlt7QY2lLz0Veoxb9r6+9 BlNve+1X7763ect77/E79G/eelP/C3W++RZ19W7/aPtDn3788HZEDUwfrIS9eQG4MR+lca+l f0aIUfl3mh+Vr/1Utbi6FLct4KB2R0YXNgcZB+xZgbg3g/kp6S24k3uxrpGuZ0YA5+rj0sEA VSFTB5CEgbOi6kyXp3CA8ko7hPAHIUiQoRQug8EQ/3mX8I+rO45QTj95qG1NTU3zyoff/O3D S/lNI0v17946ph8vSZ4UF9yTXFvy7uOPfWLgcSXw6EzjMV8bYPNke7i/eCh8LAfPvCy7g/lZ HLSO4UwNkVlm4cQzbl8q6QCgWVtzwemCo8XcLtmDTuZyfY+dQLbCDMfLcLoYBvC7SIoZABy2 Bn4h87oKMmmaGXASO2s2d770AxVeXnvPHXfe/8GRB9fym06v56yXU+7YBzQwRUsSrmrKn5/a /qoh/yvBkF4Dh9FakFiD1h0ij1Sjg2pmFrLCHbHBU1TNUpvpgCMVnzdHM1hqC74rSwEhp2XC 7DwginljcI643sLFpR2/rqkRHv71DP7SmXP0U8kX+E3fURwiwL8pYM99A+bLJUf22jTZHs+G qtE8qGTkWK1xOTMjo10BLRQZ4cwJzQ6lw7OcTWaG2xNXmLAPQrJxojIxs0KpyPxSETOUTFmw 55CNcMQ35qjqRqfTvdHutrBb+8HuBVT8GDdZAtTXxhz1kCq1qQGm4hyOuHHFzAGotFhPVH0b ScQe7B76Cw3hwcYIC65hFhBcM4Fi8XW7nR0GYNbwnKeetv7ndmoHpDasuGVrFl67qIQWVj21 YvWqh26bNv9y/Wjlk7c28jPnzpoxNjr55tvLbuycWjV1RmneNbcuu2JOJ2Lij0CjOuF1nCO6 Vsuz5CM0shcpKttm5j18F+cwW8zws9xU8Dj5yW5q5s1Cm/P37r+4OQSIiLwrVcadxrRNY/Vi ZkRjsJ+AmRo5V7ZLaHi0gwrgwccK4kg/c7oemTWhqrryuuWnTo0TXtffKUt+dse1w2dFG2Zy G8o+mc58C+iludBRHjJZs5zmf1Q5LgcAYq8cjoXqjkv58C7MbgdxOakda8BJ2jzP+ixtzD1n joV8wAvHAkqGpSIBGpR8ipKVoYKwnTL/CQGbsYfJIjdeFrT2hntfrlmzsKp9fM2mmVcfSnBj kq+tuKd8Hndnb4MhwyQNkwR6RVi2oP18tqA9lX4UKY6BSJLAOwQOWyAiLJR4Ni+QzgUUx0Aj bMv8NANwLubn5+pNl+qz6ugMeiW/qXc6v6P3R950dn5xB2hiJU9r1VY2v8XqsVisnMVsTs+v IGVt2HxZEZHZaJdE7ByJMm/hJYq8qOAiVivSGJLJYUXywmxRkL8wIZLhLRacQaOYhg/wER4f iWUzKpHOqMxENoPF73+f0DAQwc+/ks/ALlM6pSHu0BdH9S/0Pw7Xf1FFx9DgKJy+0hiu3NdJ L78j6eK+YcXA2QrdB9MFj65Zu5xH0C6JJs7EcOdMHnh4+K8O3sASiWiRB+UpFwC1RFFwjBYo w9pEmMUiRFoAf4PdJLDTNpVGqiYSA+9jCG+ABGMKsIzBw0l5Oql9sovzTHKRXATwjXwMX5Ms q6M/07FlczW91FB5q7gvk7dydwBcgCXRl7jT/B7YU+c+RYFRkdjxJRxowKKgbGs57b1T6d76 +ntZ4Z69obPzhvpOHDQCAxbzh8kpcdm5s0tSQgYvKH3alD67BA/tLeafXnB2SVy2ZV/d5Zfe eBQ2LxMcLEXc50Xttr047OU1zpcwd9c4Z+KHq1Fsp3Znl90qUGljptfkyBBcdqbGnPA+qORo s9v9bSsyDmVwGUxnWrFzlUE9fJuCM2BMmYGaAs4LxIzDWRHmSPVEo4YrUsQCRCg3psBYdoEd 10iHh0F3mNmObMpSdPQ/X6h57LHHt9KhrlrnkVsWcuFahCBGrLjowBFdT6zbsijlbzOi4n+q 6vFvTv/ocxk6edDaChvvwCnJvz8b2Q+ncf7RacfUKcfUGccxZDz+jbOUXE4mkInkCjKJXEmu wr9kTcb/IF2DU4LXkqn4f83p+M/TclKB/0yaSdrJfnLIAIjiVBJbNpAv0JxMvHLsz6dNjlw+ Z968a6tvWjz8yjk3NCwh/wPGYpn9CmVuZHN0cmVhbQplbmRvYmoKMzggMCBvYmoKMTA2OTYK ZW5kb2JqCjE4IDAgb2JqCjw8IC9UeXBlIC9Gb250IC9TdWJ0eXBlIC9UcnVlVHlwZSAvQmFz ZUZvbnQgL0tFS0tEVytHaWxsU2Fucy1Cb2xkIC9Gb250RGVzY3JpcHRvcgozOSAwIFIgL0Vu Y29kaW5nIC9NYWNSb21hbkVuY29kaW5nIC9GaXJzdENoYXIgNzggL0xhc3RDaGFyIDg0IC9X aWR0aHMgWyA5MDUKODUxIDAgMCAwIDAgNzY4IF0gPj4KZW5kb2JqCjM5IDAgb2JqCjw8IC9U eXBlIC9Gb250RGVzY3JpcHRvciAvRm9udE5hbWUgL0tFS0tEVytHaWxsU2Fucy1Cb2xkIC9G bGFncyAzMiAvRm9udEJCb3gKWy01NzQgLTQxMSAxNzk3IDExMzFdIC9JdGFsaWNBbmdsZSAw IC9Bc2NlbnQgOTIzIC9EZXNjZW50IC0yMzUgL0NhcEhlaWdodAo2ODIgL1N0ZW1WIDIwNCAv WEhlaWdodCA1MDEgL1N0ZW1IIDE2MiAvQXZnV2lkdGggNjMyIC9NYXhXaWR0aCAxODgzIC9G b250RmlsZTIKNDAgMCBSID4+CmVuZG9iago0MCAwIG9iago8PCAvTGVuZ3RoIDQxIDAgUiAv TGVuZ3RoMSAyNjQwIC9GaWx0ZXIgL0ZsYXRlRGVjb2RlID4+CnN0cmVhbQp4Aa1Wa2wUVRT+ zsydfbmUdi19LdgZpluhu+u2FDX4oJuyi2IJVouw64sW2to2baktEqqiNb7iIqLRGCVEhfgW yagbsuIPimg00caYaIxRQ/yhRiPEGDUGulPP7GzXIvXxw7u7c+553DPf+e7sPbNl+JYueDEG GdFNAx1DyA3X9SxqN23dotq61A5Qf/fQTQO2Ln8IiDtu6h/ttnXXw5a/p6uj09YxyfKCHjbY Oi1lWdMzsGWbrbtWsyzu37wp73fdw7pnoGNb/v74knV1sGOgy473LGK5aGjzyBZbd1v5Q0PD Xfl4SvD9HbZvxpV4LtAHZ84mcZ0OcCaJsecslp9/J16R9m+Ye8mv5HflzK+HfxizJp/21Sw8 1Tt5sKjd7eU4txWbGyydG81qYG7xqd7sI0XtBU8+ACKDc4J0CApeghqkw3gFflSiFHPh4Zja 4GHsRx00VLFt2vIq1NNicBgvnBH0IpZgMQeWoiif6CXU5BL9mfpl1mfeDIdwgIkIBDN4Xo1v 762IZVAaTEfXNSj16VBEBIvSi8ScIiWNRc+NKek7b71djKZHRsXwSFoZvnlIpIfWD4p16fUK bkd6jvcsjzvtcjpcjjdWoR47M/LUvQvKsLWuqqIpaA97UlUBJtzFQFdhPa5EtdlgnpgCTspe 0adsV56QjpJBB6iTrqdr6WpqpTW0mmLUTE10KV1MF1IjRShIi+lcClA1LSA/lZOPiqmIvOQh F0l0Er/jN/yCn/ETTuBHfI/v8A2+xjF8hS/wOT7Dx/gIEziKI8xCBgeRxuswmP3n8Sz24FE8 gp3YgQfQjY2odD3uuFM5KvaIu0WniIhq4ReVwidMuVIW8i/SE9Iu6QGpQfqM3mPcL9OztI+e oafocXqUdtD9dDdtp9voZhqgHq5qI7VzZevylV1Bl3NtTbQsV9d0VVY9RVyLRCasWn7mGiz0 H+MDRpvGPjyD3YxyB6NDHfnwDVNzLd/WRz28/z6zAT75JHxKH85Ozy3izUl73Lw5aUXIEhkI vUZyoFldqfZ0dBpyICfbEnpEz/oj+vFk+bLyS1QD1yQMuc6vJQ1aUXyaIRwq8ZUvC4fYGg4d CYeM+FaD9OUGig36xIDezFqzsWqrIamcZsVyg4rfWckTPcapWBrUzna9uc0IdOnb7PXTq6aX 4J+XqPGeWDgUDHMlSqC56fi/Q86V3JT998AzaEkyJ+FQk/XLhkOzui02znAU6JxJ5qxxx5n2 bPJ0jvnPGGrJwN2aeI3ooWSGpu7NxLDgTT5x5A03hjOYF1LVeC9T2s5KWYgNdRrPyhmItadX J/SkmlJTqzpTeWTC3mh2dKWSEd6BtkQvX9cmNCOa9BemXcnkRZynwsrDSzg8leQMffyoWBlY 5kyRLAdVhlpUQ65tTVyVMMZifiMaS/o1TY0b460JYzzGD0+So6oKSBmxddDYmP2MuaqO/fPt LG2cg1MkUykrJ2tSrWaMp1L+FFeSs+hahpA3ZJCLkQPxDEVbE5Yrqmt+Lj2ua7rGOJIxzr0g 1NKWiDMSzUJyzhmUIjaD0uoCUI5VGV51jlLtf6J04X+hVP9PlNYUkJ5GaYAx11iU1hYojfoN FCjVNWPsL4TibxkuUB6dhfIxm/KxWSg/dwblVqtFo/NSHHB8hLWOAFby+UT5zmh1Xu4GWMO9 mLgBTw85P1FxBR7jw9lqzo2APMHNXObY8qjbSQKK7BaITBR/NcHXyERDfWOJVhLQSrRGeffk t9LubLeDT88xhdcTtzo4dvF56EZNtMLtdTq8wi2Rm2gIzjkOGpaUOZKzrgFNkSb+1i8m4mQa Xxy7zAezDeZGGpEmaK8sJieVvizDYExrp044RpXtKEY19KgfVDafynxer3e+T7jPkpyDKPEM Vro8ucR1wXoqlYSu1kjnL/XVaEtEmU9Zep6kL3TMKy1rXLKcHKNvmE+Z5pS559X91EU0TuG3 O811591wX+LF8SMvjOxbKx182zw0/j6tPPQWxd8bPmpmd625a8P57zz99LvX7bVII4tf5RjX 6YQ/erZtEvOcXrdTdg+R7HEGuURGwrVZH+WYKcwNplCeFJWnvhOVdJVVV25MdXPzm23whqKB 3zcuzDkJvvxuOvjtAy3xlpbY+uBlvf39bR2DI+Hmzf389vcHEixrSAplbmRzdHJlYW0KZW5k b2JqCjQxIDAgb2JqCjE2MTYKZW5kb2JqCjQyIDAgb2JqCihJRVRGMTA0djMpCmVuZG9iago0 MyAwIG9iagooTWFjIE9TIFggMTAuMTMuNiBRdWFydHogUERGQ29udGV4dCkKZW5kb2JqCjQ0 IDAgb2JqCihLZXlub3RlKQplbmRvYmoKNDUgMCBvYmoKKEQ6MjAxOTAzMjcxMjUwMjVaMDAn MDAnKQplbmRvYmoKMSAwIG9iago8PCAvVGl0bGUgNDIgMCBSIC9Qcm9kdWNlciA0MyAwIFIg L0NyZWF0b3IgNDQgMCBSIC9DcmVhdGlvbkRhdGUgNDUgMCBSIC9Nb2REYXRlCjQ1IDAgUiA+ PgplbmRvYmoKeHJlZgowIDQ2CjAwMDAwMDAwMDAgNjU1MzUgZiAKMDAwMDE5Mzg3MiAwMDAw MCBuIAowMDAwMDAwMzcxIDAwMDAwIG4gCjAwMDAxNzk0MzggMDAwMDAgbiAKMDAwMDAwMDAy MiAwMDAwMCBuIAowMDAwMDAwMzUyIDAwMDAwIG4gCjAwMDAwMDA0NzYgMDAwMDAgbiAKMDAw MDAwMDYyNCAwMDAwMCBuIAowMDAwMTcyMDQwIDAwMDAwIG4gCjAwMDAxNzQ3OTggMDAwMDAg biAKMDAwMDE3OTc5OSAwMDAwMCBuIAowMDAwMTc5NjgwIDAwMDAwIG4gCjAwMDAxNzIwNjIg MDAwMDAgbiAKMDAwMDE3NDc3NyAwMDAwMCBuIAowMDAwMTc1ODEzIDAwMDAwIG4gCjAwMDAx NzQ4MzQgMDAwMDAgbiAKMDAwMDE3NTc5MyAwMDAwMCBuIAowMDAwMTc1OTIxIDAwMDAwIG4g CjAwMDAxOTE1NDUgMDAwMDAgbiAKMDAwMDE3OTYwMCAwMDAwMCBuIAowMDAwMTc2ODkyIDAw MDAwIG4gCjAwMDAxNzYwODIgMDAwMDAgbiAKMDAwMDE3Njg3MiAwMDAwMCBuIAowMDAwMTc3 MDAwIDAwMDAwIG4gCjAwMDAxNzk3NTkgMDAwMDAgbiAKMDAwMDE3ODE0OCAwMDAwMCBuIAow MDAwMTc3MTQ5IDAwMDAwIG4gCjAwMDAxNzgxMjggMDAwMDAgbiAKMDAwMDE3ODI1NiAwMDAw MCBuIAowMDAwMTc5NzE5IDAwMDAwIG4gCjAwMDAxNzkxODEgMDAwMDAgbiAKMDAwMDE3ODQw NSAwMDAwMCBuIAowMDAwMTc5MTYxIDAwMDAwIG4gCjAwMDAxNzkyODkgMDAwMDAgbiAKMDAw MDE3OTY0MCAwMDAwMCBuIAowMDAwMTc5NTUwIDAwMDAwIG4gCjAwMDAxODA0ODEgMDAwMDAg biAKMDAwMDE4MDczNiAwMDAwMCBuIAowMDAwMTkxNTIzIDAwMDAwIG4gCjAwMDAxOTE3NDAg MDAwMDAgbiAKMDAwMDE5MTk5NiAwMDAwMCBuIAowMDAwMTkzNzAyIDAwMDAwIG4gCjAwMDAx OTM3MjMgMDAwMDAgbiAKMDAwMDE5Mzc1MSAwMDAwMCBuIAowMDAwMTkzODA0IDAwMDAwIG4g CjAwMDAxOTM4MzAgMDAwMDAgbiAKdHJhaWxlcgo8PCAvU2l6ZSA0NiAvUm9vdCAzNSAwIFIg L0luZm8gMSAwIFIgL0lEIFsgPGY3NzBiYzEwMjA0MzU0ZmEzMmYzMzY0ZGFmOWU2YjgwPgo8 Zjc3MGJjMTAyMDQzNTRmYTMyZjMzNjRkYWY5ZTZiODA+IF0gPj4Kc3RhcnR4cmVmCjE5Mzk3 NwolJUVPRgo= --9jxsPFA5p3P2qPhR-- From nobody Wed Mar 27 11:50:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 15F00120368 for ; Wed, 27 Mar 2019 11:50:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.301 X-Spam-Level: X-Spam-Status: No, score=-4.301 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id d1Ss1tlC2Yuf for ; Wed, 27 Mar 2019 11:50:52 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23E1512035D for ; Wed, 27 Mar 2019 11:50:51 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 7D028BEE5; Wed, 27 Mar 2019 18:50:48 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 58DEQumc_U1R; Wed, 27 Mar 2019 18:50:47 +0000 (GMT) Received: from [31.133.146.21] (unknown [31.133.146.21]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 0497DBE20; Wed, 27 Mar 2019 18:50:46 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553712647; bh=ARhEadiV6uRthBSUs7OT9nRTu2ZUFlYqocXVy5PS1Gk=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=XZtIjqQZrL4qD1cqOVWrtwK/Qi5c7AhTNNlx3+Rz2KCGW8pjjyYjyC9/xtibJcmAX agztAStvnQ28cZkD2sB3Yax63eOl+8AyuJNPT+FHC5sZ1prCklO4Fhj0KZoGDCyoZ5 TEhb9C5I7oROa7Z/EEEAnNg6ftRzHiFai77BH1ws= To: Brian Dickson Cc: DoH WG References: From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> Date: Wed, 27 Mar 2019 18:50:41 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="EEclANeWaRfBvfHu5koEVMUUp9eR8IquV" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 18:50:55 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --EEclANeWaRfBvfHu5koEVMUUp9eR8IquV Content-Type: multipart/mixed; boundary="7y8oRPcrcDfSppQixcYNRus4KcAEGzC4k"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: DoH WG Message-ID: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> Subject: Re: [Doh] Mozilla's plans re: DoH References: In-Reply-To: --7y8oRPcrcDfSppQixcYNRus4KcAEGzC4k Content-Type: multipart/mixed; boundary="------------384C95FC15E4D7A9E8A0DE24" Content-Language: en-GB This is a multi-part message in MIME format. --------------384C95FC15E4D7A9E8A0DE24 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 27/03/2019 17:34, Brian Dickson wrote: > dissident mode=20 As stated at the side-meeting, I think the above phrase is counterproductive and inaccurate and it'd be a fine thing if we stopped using that kind of wording. S. --------------384C95FC15E4D7A9E8A0DE24 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------384C95FC15E4D7A9E8A0DE24-- --7y8oRPcrcDfSppQixcYNRus4KcAEGzC4k-- --EEclANeWaRfBvfHu5koEVMUUp9eR8IquV Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlybxgIACgkQWrL68XsX K+p8yA/+P2RuhBlBYvnh47XD33bmuDM7sfKYMzjuUndnmPRvnDQQmzpc42wypEqs UbU3NSArWRF5tWYsSzAqg4M+S7DHehc9+4Ptrjmx6MJoryTcDJQg6kWiFHIBbJAQ 2mV/CurXYO+caCC0uCG3+sz2wj0WVAEnWldljWWbuOXI+GRhsbzNKTEu8Prdi6GW c73hapT5OxrvzRVAbkGmgPZmeGjw/9n4zZ9PfU0rx3MQVe4rL+U/bCYpjYbxUSgz 5ps4YZ5lfdO+lTQsCCVXdB6RqrQiVdv2WtvK88MjfNmnuQErp7LZY7K9SHmgMRy6 RwVEdWFlP3Qg5mNhVXWIf5K3hqO5KvywZytJFoOjrNooZ0Etv8pjGZ+Cax1rsXkn dcj3wUTEekPLRQN77ZizV1rozQapmhhyzGvgLidlmyMA2wf/wi6baqiwQX6xmCgq IvTRoGfEDHKUVxWy853QnKB/15I3pdhy0Wo1YB14mP3Xfkcm2qlx3L6loTbFWu5y 26mWPHIjM8m91qNlkkCK2XpgBZxYzvnr2SXCUYSOSQ6YL8GYB+USRFyGPoIRJTeC P02G9RVylwxvhNCrNTgd9Z6s2dF+yvCYAPwShkdzn2YRT067F4yWdpB8yXV+zUK0 5t9YrvzRSHHChWt0AKmQLU+ivOYzWU6b0eX840km2pm1LMdQMOI= =eIAm -----END PGP SIGNATURE----- --EEclANeWaRfBvfHu5koEVMUUp9eR8IquV-- From nobody Wed Mar 27 12:12:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 336D912004F for ; Wed, 27 Mar 2019 12:12:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cdt.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tN3ESA33c9WX for ; Wed, 27 Mar 2019 12:12:09 -0700 (PDT) Received: from mail-oi1-x22b.google.com (mail-oi1-x22b.google.com [IPv6:2607:f8b0:4864:20::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0957D120073 for ; Wed, 27 Mar 2019 12:12:09 -0700 (PDT) Received: by mail-oi1-x22b.google.com with SMTP id v7so13802125oie.8 for ; Wed, 27 Mar 2019 12:12:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cdt.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=aM8e/9ujnWUQyZOUBtDU0bRZzD4t93zjb/BEKW5w9U0=; b=dkjJQ89woYqOBmtAmn8/ZL7vpDjdN4MgVdH7Q79k5RWdFb0NIGyL7ty1DmeJSzxy28 9dscToZSAp/pPHVMUgKnwfgRVbPNncZV4nWLJWDxt7cEhppeid1hWYWMlKVwRAIfr+J9 U9CfK3Zm3QTfp53kfGMcSoauaHrk3gnBZeNMM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=aM8e/9ujnWUQyZOUBtDU0bRZzD4t93zjb/BEKW5w9U0=; b=dd/UO5CR1oMPiAYmTxoTdw1hi5KDeABoukfdd3wvP4hIQQkPSXVqhRFdtFg0ySRNcv d7fuWgZ7PcZU5xytWdxL91FErRWVhYejRgfhyxHufp5f0jiWZvHTY/wNsGo3avgX4WH8 bhlxciHb19D3IevbzpaD+qmT3l27YggwqjxRwlJNtJNIrUXl2PxY5I2FLEuYfNbb0Ert bIUzYZvNnCeocA51L8S7PV31CXyYKpQMLtfKYV8psKJrLUYwLilPPSEDZcouLfZVV5n7 unwc95y4nHHInxqZrwYUAPTF+7VAgJa9xCpeueFKwoZ76bGQSl/rQMQ++yy0aYnuehcU EcMQ== X-Gm-Message-State: APjAAAX33HnkZ+uQx3Kjq8TXAB/22YNroNRBMZfs/YfnyJZ9jQZiJAiK J96Bre+q0lcycU2j8Gbtl77/edstrenzQljYJqOzmQ== X-Google-Smtp-Source: APXvYqwKS0Y2bKDyey1yR52IGtL7Y/kmLN8xALp/o7KsLRR5x8+c1pjGeZhmySbN3n0TTEAjQdlT/tkapGOLagunEGA= X-Received: by 2002:aca:de84:: with SMTP id v126mr20637072oig.5.1553713927781; Wed, 27 Mar 2019 12:12:07 -0700 (PDT) MIME-Version: 1.0 References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> In-Reply-To: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> From: Joseph Lorenzo Hall Date: Wed, 27 Mar 2019 20:11:57 +0100 Message-ID: To: Stephen Farrell Cc: Brian Dickson , DoH WG Content-Type: multipart/alternative; boundary="000000000000bf9774058518362e" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 19:12:11 -0000 --000000000000bf9774058518362e Content-Type: text/plain; charset="UTF-8" On Wed, Mar 27, 2019 at 19:50 Stephen Farrell wrote: > > Hiya, > > On 27/03/2019 17:34, Brian Dickson wrote: > > dissident mode > > As stated at the side-meeting, I think the above phrase is > counterproductive and inaccurate and it'd be a fine thing > if we stopped using that kind of wording. > +1! We don't call HTTPS dissent mode as it's now table stakes for safely browsing (e.g., https://https.cio.gov/everything/ ) -- Joseph Lorenzo Hall Chief Technologist, Center for Democracy & Technology [https://www.cdt.org] 1401 K ST NW STE 200, Washington DC 20005-3497 e: joe@cdt.org, p: 202.407.8825, pgp: https://josephhall.org/gpg-key Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10 1607 5F86 6987 40A9 A871 --000000000000bf9774058518362e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Mar 27, 2019 at 19:50 Stephen= Farrell <stephen.farrell@c= s.tcd.ie> wrote:

Hiya,

On 27/03/2019 17:34, Brian Dickson wrote:
> dissident mode

As stated at the side-meeting, I think the above phrase is
counterproductive and inaccurate and it'd be a fine thing
if we stopped using that kind of wording.

+1!

We don't call HTTPS dissent mode= as it's now table stakes for safely browsing (e.g.,=C2=A0
--
Joseph Lorenzo Hall
Chief Technolog= ist, Center for Democracy & Technology [https://www.cdt.org]
1401 K ST NW STE 200, Washington DC 20005-3497=
e: joe@cdt.org, p: 202.407.8825, pgp= : https://josephhall.org/gpg-key=
Fingerprint: 3CA2 8D7B 9F6D DBD3 4B10=C2=A0 1607 5F86 6987 40A9 A87= 1
--000000000000bf9774058518362e-- From nobody Wed Mar 27 13:08:51 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C4005120425 for ; Wed, 27 Mar 2019 13:08:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 09B0WYVWMxt1 for ; Wed, 27 Mar 2019 13:08:40 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BE941203F6 for ; Wed, 27 Mar 2019 13:08:40 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id z17so20391297qts.13 for ; Wed, 27 Mar 2019 13:08:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=xAqolm3BYR9Kou7budnzZN2OyTaJKyz+6nh8pfxWrG4=; b=sCmhS9Ix0Y+YHkPR/pu7f/xFMm0RPOTwH+X1f+K9JtbhDQiWghqdDl7HpK9sz3MVPp q1aR1d1FYZUKDGfWT0HrDnOyUC3yQ3caqi7rMe6hBvhPV5p/b9xERpq9RVk8sp+2/uKl VJHLUMwWKWgvcvvfGQCaLw9zA43UiQKx6aUAqJlLbJLLutxAGgQ1Y0PU9X/1XJ5g9TgP gWobutH6AhfpVb+m96sFHrMrh6Zb+f7Hmh3z84AsTVf1kzJ6EP2GIVcRiohIa4dpc+py 2/rqDGRjkXmgK3jSjH21ZaWY6lB4Ne9ux5IeivRNS4g6dG9/cLabVQLodaszBsmPS6nU qFvQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=xAqolm3BYR9Kou7budnzZN2OyTaJKyz+6nh8pfxWrG4=; b=OpHlC9rIToHQikzribUzGmtdGTi6fJVJmYkKnu2bHhWFV5upeGNf2DV+vHC7orBxlS UYENZMd3gGgUp2/v4zhzewgs5b8AMmBVKyVNX5u4MKmyLSSZQ1d0R0fDXbOFSio3cU5h JCzvM/k5ft9xRfeB3EGzQFTyzWsT98eq+sJTBOACeTsD5IiL0Mq8YXf8qEHfhZT+3x/3 fAlvH78bzNgWMDtwOs1gk7oZJiD9M1xWEEezCz1SmXeHsteJIL2ndo1OF9TPrBA50LW3 JosTfrGvAPEnJX4K/0zUiid4BJQpf4irTVZBXqVBjq7iGtD97l9QiWrFEbDEpJkfJFDg Mzig== X-Gm-Message-State: APjAAAWwQf3EhyF6gJ0AjtYqccSABtuC85+sm3RsfxfjF/dQZzL5HV34 xb90ZrVr2xFH+5eMIWOOw/YOJbaIu0lrjLe3hOWZ3CwIwSZ4fA== X-Google-Smtp-Source: APXvYqxcmPuGNp8pxjty6hSnw9EnfgvD3PjAzWoYDfjFbmVXEV+C3tU4zil6hljkOli8A7SuiMNdhIlv+D99WtnACPk= X-Received: by 2002:a0c:d413:: with SMTP id t19mr32107717qvh.8.1553717319673; Wed, 27 Mar 2019 13:08:39 -0700 (PDT) MIME-Version: 1.0 References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> In-Reply-To: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> From: Brian Dickson Date: Wed, 27 Mar 2019 21:08:27 +0100 Message-ID: To: Stephen Farrell Cc: DoH WG Content-Type: multipart/alternative; boundary="000000000000ebab190585190035" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 20:08:49 -0000 --000000000000ebab190585190035 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 27, 2019 at 7:50 PM Stephen Farrell wrote: > > Hiya, > > On 27/03/2019 17:34, Brian Dickson wrote: > > dissident mode > If you are going to quote me, please do me the courtesy of doing so correctly. I wrote ' "dissident mode" ', not 'dissident mode' (i.e. it was in quotes, to indicate that I recognize its connotations, but that there is no short phrase that captures the nuances.) I am open to alternate terms, provided they also capture the nuances. (I would also note that the person from the ACLU was specifically referring to dissidents, it was not me alone who used the term.) What I would like to distinguish is: - Persons whose safety requires that their communications and DNS usage be encrypted to trusted servers; persons who do not have alternative ways of accessing trusted DNS, and who by necessity must take actions (using third party encrypted DNS) which may be in violations of laws, contracts, or terms of service (which may be unconscionable but technically legal); persons who are acting in solidarity with the aforementioned folks, or participating in acts of civil disobedience, and - Persons who are taking advantage of legal, permissible, explicitly allowed, and openly available third party DNS over encrypted channels, and refraining from such usage if access is blocked. - From a technological basis, the desire is to facilitate this distinction at scale. One obvious mechanism would be to use distinct TCP port numbers, even if the DoH server is the same (and the same IP address and TLS certificate are used). To facilitate the ongoing discussions, we need some suitable label for the former. If you find the term I originally used objectionable, please provide one for the first group, DISTINCT FROM any corresponding label for the second group. Making assertions that the two groups are actually one group is much worse for the ongoing discussions, and would be materially inaccurate, deliberately conflating the two groups, highly counterproductive, and inflammatory. I would politely ask that you refrain from doing so. (I am not claiming that you have done so, I'm just trying to dissuade such in anticipation of the possibility.) I welcome any label you prefer for the first group. For the second group, any different label from the first group would be fine; I'd suggest "privacy-aware". They use privacy by choice, not by strict necessity (on threat of violence or death), and are freely able to make that choice with no personal consequences. What I am interested in pursing is ways to protect the first group, while enabling the ability for legitimate enterprise policy enforcement (e.g. blocking) to be done scalably. E.g. Make the traffic of the second group identifiable, and to encourage (or require) that how browsers implement the access to the third-party DNS services over encrypted channels, provide a scalable way for networks to block usage for the second group. Here is why having an easy way to distinguish the two groups, at a network level (i.e. TCP port), is important, IMHO: The best protection for the first group, is to have them easily distinguished from the second group. The logic is a bit non-obvious, so let me attempt to explain. The typical volume of traffic by all members of the second group, is likely to be significantly higher than the first group. If enterprise networks have ways of blocking the second group, and if the users in the first group only enable their specific "mode" for limited intervals, the occasional burst of traffic from the first group won't likely result in the enterprise wanting to attempt to block the first group. This has the benefit of not having persistent use of the mechanisms of the first group, and doesn't create the residual risk (e.g. of malware abuse of the first group's DNS traffic). On the other hand, if the exact same mechanism is used by both groups, and there is no practical/simple method of blocking only the second group, the resulting scenario is lose/lose/lose (possibly more "lose" terms). The enterprise would need to employ costly (due to not being scalable), possibly less reliable/available border enforcement, or risk any of the side effects of unconstrained/unblocked DNS carried outside the enterprise via encrypted transport. The impact to the users would be uniform; the second group would be inconvenienced, while the first group would lose their necessary (by definition) DNS privacy. > > As stated at the side-meeting, I think the above phrase is > counterproductive and inaccurate and it'd be a fine thing > if we stopped using that kind of wording. > > It may be counterproductive, but it is accurate. I am distinguishing two use cases, even when the same underlying technology is employed (DNS carried via HTTPS). One is where the user would like to use the technology, and where the access may or may not be permitted, and the user does not exceed the permissions (and thus either uses a different provided DNS service, possibly encrypted, possibly not, or does not user the network at all.) The other use case is where the user must use the technology without regard to whether this activity is permitted. The first group is best categorized as dissidents. From an online dictionary: > a person who opposes official policy, especially that of an authoritarian > state. > "a dissident who had been jailed by a military regime" > synonyms: dissenter, objector, protester, disputant; freethinker, > nonconformist, independent thinker; rebel, revolutionary, recusant, > renegade; subversive, agitator, insurgent, insurrectionist, > insurrectionary, mutineer; informal: refusenik > "a dissident who had been jailed by the regime" If you object to the phrase, please provide a semantically equivalent but inoffensive phrase. Brian P.S. It may not be clear, but I definitely am in favor of providing DoH to everyone who requires it, i.e. members of this specific group. P.P.S. I disagree with "conscripting" unaware users into using the same mechanism using opt-out, always-on resolution via DoH to third party providers. Doing so may place them in jeopardy of one form or another, and is especially objectionable when it is done without explicit and informed consent. The other reason for using technology to block only the second group, is to protect any users who accidentally leave an application or device in the "privacy" mode, when they are on a network which prohibits encrypted access to third party DNS providers. The blockage protects the network; the requirement for explicit user consent to break network policy (and bypass the blockage) is what protects the wayward, innocent user. --000000000000ebab190585190035 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


On Wed, Mar 27, 2019= at 7:50 PM Stephen Farrell <stephen.farrell@cs.tcd.ie> wrote:

Hiya,

On 27/03/2019 17:34, Brian Dickson wrote:
> dissident mode

If you are going t= o quote me, please do me the courtesy of doing so correctly.
I wr= ote ' "dissident mode" ', not 'dissident mode' (i= .e. it was in quotes, to indicate that I recognize its connotations, but th= at there is no short phrase that captures the nuances.)

I am open to alternate terms, provided they also capture the nuances.=

(I would also note that the person from the ACLU = was specifically referring to dissidents, it was not me alone who used the = term.)

What I would like to distinguish is:
<= div>
  • Persons whose safety requires that their communications and DNS= usage be encrypted to trusted servers; persons who do not have alternative= ways of accessing trusted DNS, and who by necessity must take actions (usi= ng third party encrypted DNS) which may be in violations of laws, contracts= , or terms of service (which may be unconscionable but technically legal); = persons who are acting in solidarity with the aforementioned folks, or part= icipating in acts of civil disobedience, and
  • Persons who are taking= advantage of legal, permissible, explicitly allowed, and openly available = third party DNS over encrypted channels, and refraining from such usage if = access is blocked.
  • From a technological basis, the desire is to fac= ilitate this distinction at scale. One obvious mechanism would be to use di= stinct TCP port numbers, even if the DoH server is the same (and the same I= P address and TLS certificate are used).
To facilitate the on= going discussions, we need some suitable label for the former.=C2=A0
<= div>If you find the term I originally used objectionable, please provide on= e for the first group, DISTINCT FROM any corresponding label for the second= group.

Making assertions that the two group= s are actually one group is much worse for the ongoing discussions, and wou= ld be materially inaccurate, deliberately conflating the two groups, highly= counterproductive, and inflammatory. I would politely ask that you refrain= from doing so. (I am not claiming that you have done so, I'm just tryi= ng to dissuade such in anticipation of the possibility.)

I welcome any label you prefer for the first group.

For the second group, any different label from the first group wou= ld be fine; I'd suggest "privacy-aware". They use privacy by = choice, not by strict necessity (on threat of violence or death), and are f= reely able to make that choice with no personal consequences.
What I am interested in pursing is ways to protect the first gr= oup, while enabling the ability for legitimate enterprise policy enforcemen= t (e.g. blocking) to be done scalably.
E.g. Make the traffic of t= he second group identifiable, and to encourage (or require) that how browse= rs implement the access to the third-party DNS services over encrypted chan= nels, provide a scalable way for networks to block usage for the second gro= up.

Here is why having an easy way to distinguish = the two groups, at a network level (i.e. TCP port), is important, IMHO:
The best protection for the first group, is to have them easily dist= inguished from the second group.=C2=A0
The logic is a bit non-obv= ious, so let me attempt to explain.
The typical volume of traffic= by all members of the second group, is likely to be significantly higher t= han the first group.
If enterprise networks have ways of blocking= the second group, and if the users in the first group only enable their sp= ecific "mode" for limited intervals, the occasional burst of traf= fic from the first group won't likely result in the enterprise wanting = to attempt to block the first group. This has the benefit of not having per= sistent use of the mechanisms of the first group, and doesn't create th= e residual risk (e.g. of malware abuse of the first group's DNS traffic= ).
On the other hand, if the exact same mechanism is used by both= groups, and there is no practical/simple method of blocking only the secon= d group, the resulting scenario is lose/lose/lose (possibly more "lose= " terms).
The enterprise would need to employ costly (due to= not being scalable), possibly less reliable/available border enforcement, = or risk any of the side effects of unconstrained/unblocked DNS carried outs= ide the enterprise via encrypted transport. The impact to the users would b= e uniform; the second group would be inconvenienced, while the first group = would lose their necessary (by definition) DNS privacy.


=C2=A0

As stated at the side-meeting, I think the above phrase is
counterproductive and inaccurate and it'd be a fine thing
if we stopped using that kind of wording.


It may be counterproductive, but it is= accurate.=C2=A0

I am distinguishing two use cases= , even when the same underlying technology is employed (DNS carried via HTT= PS). One is where the user would like to use the technology, and where the = access may or may not be permitted, and the user does not exceed the permis= sions (and thus either uses a different provided DNS service, possibly encr= ypted, possibly not, or does not user the network at all.) The other use ca= se is where the user must use the technology without regard to whether this= activity is permitted.

The first group is best ca= tegorized as dissidents. From an online dictionary:
=C2=A0a person who opposes official policy= , especially that of an authoritarian state.
"a dissident who had b= een jailed by a military regime"
synonyms: dissenter, objector, protester, disputant; freethinker, nonc= onformist, independent thinker; rebel, revolutionary, recusant, renegade; s= ubversive, agitator, insurgent, insurrectionist, insurrectionary, mutineer;= informal: refusenik
"a dissident who had been jailed by the regime= "

If you object to the phrase, please = provide a semantically equivalent but inoffensive phrase.

Brian=C2=A0

P.S. It may not be clear, but = I definitely am in favor of providing DoH to everyone who requires it, i.e.= members of this specific group.

P.P.S. I disagree= with "conscripting" unaware users into using the same mechanism = using opt-out, always-on resolution via DoH to third party providers. Doing= so may place them in jeopardy of one form or another, and is especially ob= jectionable when it is done without explicit and informed consent. The othe= r reason for using technology to block only the second group, is to protect= any users who accidentally leave an application or device in the "pri= vacy" mode, when they are on a network which prohibits encrypted acces= s to third party DNS providers. The blockage protects the network; the requ= irement for explicit user consent to break network policy (and bypass the b= lockage) is what protects the wayward, innocent user.
--000000000000ebab190585190035-- From nobody Wed Mar 27 15:46:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E29941202D4 for ; Wed, 27 Mar 2019 15:46:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9EWNo9KoxXsg for ; Wed, 27 Mar 2019 15:46:48 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9655712036D for ; Wed, 27 Mar 2019 15:46:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id E4EF1BEF6; Wed, 27 Mar 2019 22:46:44 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HpmA0_lVELKA; Wed, 27 Mar 2019 22:46:40 +0000 (GMT) Received: from [31.133.146.21] (dhcp-9215.meeting.ietf.org [31.133.146.21]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id 96CCABEE5; Wed, 27 Mar 2019 22:46:40 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553726800; bh=u71dIrxFTJ1iOik5b27W65yi1sBofMMm2Ay9HRfXkl4=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From; b=eT4d8HyLp2nexItDNC3u53nJMf+eWAWAGxiO+12EXu4LUr/V6s0NyYTPhY7PLkoW+ R2xIJY2dJosuQu6a6zMU/q4u+VZojNgLMZWbQQvp30ozDqCavZGttMLo5kcvbLzHHs KDW695ibQy2Q63Yb4hmEwojcMJOXzc4aHTG4ABWI= To: Brian Dickson Cc: DoH WG References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> Date: Wed, 27 Mar 2019 22:46:37 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="pVJElKS8NGp1sv315y9N3rhlYXZdCWAQg" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 22:46:53 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --pVJElKS8NGp1sv315y9N3rhlYXZdCWAQg Content-Type: multipart/mixed; boundary="88EpiFlPZ1lxBb739LEDyTPA2kosdk4g6"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: DoH WG Message-ID: <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> Subject: Re: [Doh] Mozilla's plans re: DoH References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> In-Reply-To: --88EpiFlPZ1lxBb739LEDyTPA2kosdk4g6 Content-Type: multipart/mixed; boundary="------------E219015855847E2F204E4F44" Content-Language: en-GB This is a multi-part message in MIME format. --------------E219015855847E2F204E4F44 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 27/03/2019 20:08, Brian Dickson wrote: > On Wed, Mar 27, 2019 at 7:50 PM Stephen Farrell > wrote: >=20 >> >> Hiya, >> >> On 27/03/2019 17:34, Brian Dickson wrote: >>> dissident mode >> >=20 > If you are going to quote me, please do me the courtesy of doing so > correctly. I did. > I wrote ' "dissident mode" ', not 'dissident mode' (i.e. it was in quot= es, > to indicate that I recognize its connotations, but that there is no sho= rt > phrase that captures the nuances.) There are no such quotes in your mail as rendered by my MUA. > I am open to alternate terms, provided they also capture the nuances. >=20 > (I would also note that the person from the ACLU was specifically refer= ring > to dissidents, it was not me alone who used the term.) >=20 > What I would like to distinguish is: >=20 > - Persons whose safety requires that their communications and DNS us= age > be encrypted to trusted servers; persons who do not have alternative= ways > of accessing trusted DNS, and who by necessity must take actions (us= ing > third party encrypted DNS) which may be in violations of laws, contr= acts, > or terms of service (which may be unconscionable but technically leg= al); > persons who are acting in solidarity with the aforementioned folks, = or > participating in acts of civil disobedience, and > - Persons who are taking advantage of legal, permissible, explicitly= > allowed, and openly available third party DNS over encrypted channel= s, and > refraining from such usage if access is blocked. I do not accept the above as a useful distinction for this topic. Those in the category of your first bullet can only be protected by technology when (essentially) all those in other categories use the same technology. (That said, I could quibble with your text, but won't for now:-) But, and it's a big but, those whose safety is not at risk (today), also have valid interests to protect, and mechanisms that we have to offer for such protection need to be widely deployed to be effective. > - From a technological basis, the desire is to facilitate this > distinction at scale. One obvious mechanism would be to use distinct TCP > port numbers, even if the DoH server is the same (and the same IP address > and TLS certificate are used). >=20 > To facilitate the ongoing discussions, we need some suitable label for = the > former. > If you find the term I originally used objectionable, please provide on= e > for the first group, DISTINCT FROM any corresponding label for the seco= nd > group. I won't, sorry. I don't accept your proposed dichotomy as valid. IOW, our disagreement isn't about the word, but the concept that such a (likely small) set of people are a usefully distinct set for this discussion. Cheers, S. PS: I won't respond to your other text below as I think doing so would be repetitive with the above or wouldn't further the discussion. >=20 > Making assertions that the two groups are actually one group is much wo= rse > for the ongoing discussions, and would be materially inaccurate, > deliberately conflating the two groups, highly counterproductive, and > inflammatory. I would politely ask that you refrain from doing so. (I a= m > not claiming that you have done so, I'm just trying to dissuade such in= > anticipation of the possibility.) >=20 > I welcome any label you prefer for the first group. >=20 > For the second group, any different label from the first group would be= > fine; I'd suggest "privacy-aware". They use privacy by choice, not by > strict necessity (on threat of violence or death), and are freely able = to > make that choice with no personal consequences. >=20 > What I am interested in pursing is ways to protect the first group, whi= le > enabling the ability for legitimate enterprise policy enforcement (e.g.= > blocking) to be done scalably. > E.g. Make the traffic of the second group identifiable, and to encourag= e > (or require) that how browsers implement the access to the third-party = DNS > services over encrypted channels, provide a scalable way for networks t= o > block usage for the second group. >=20 > Here is why having an easy way to distinguish the two groups, at a netw= ork > level (i.e. TCP port), is important, IMHO: > The best protection for the first group, is to have them easily > distinguished from the second group. > The logic is a bit non-obvious, so let me attempt to explain. > The typical volume of traffic by all members of the second group, is li= kely > to be significantly higher than the first group. > If enterprise networks have ways of blocking the second group, and if t= he > users in the first group only enable their specific "mode" for limited > intervals, the occasional burst of traffic from the first group won't > likely result in the enterprise wanting to attempt to block the first > group. This has the benefit of not having persistent use of the mechani= sms > of the first group, and doesn't create the residual risk (e.g. of malwa= re > abuse of the first group's DNS traffic). > On the other hand, if the exact same mechanism is used by both groups, = and > there is no practical/simple method of blocking only the second group, = the > resulting scenario is lose/lose/lose (possibly more "lose" terms). > The enterprise would need to employ costly (due to not being scalable),= > possibly less reliable/available border enforcement, or risk any of the= > side effects of unconstrained/unblocked DNS carried outside the enterpr= ise > via encrypted transport. The impact to the users would be uniform; the > second group would be inconvenienced, while the first group would lose > their necessary (by definition) DNS privacy. >=20 >=20 >=20 >=20 >> >> As stated at the side-meeting, I think the above phrase is >> counterproductive and inaccurate and it'd be a fine thing >> if we stopped using that kind of wording. >> >> > It may be counterproductive, but it is accurate. >=20 > I am distinguishing two use cases, even when the same underlying techno= logy > is employed (DNS carried via HTTPS). One is where the user would like t= o > use the technology, and where the access may or may not be permitted, a= nd > the user does not exceed the permissions (and thus either uses a differ= ent > provided DNS service, possibly encrypted, possibly not, or does not use= r > the network at all.) The other use case is where the user must use the > technology without regard to whether this activity is permitted. >=20 > The first group is best categorized as dissidents. From an online > dictionary: >=20 >> a person who opposes official policy, especially that of an authorita= rian >> state. >> "a dissident who had been jailed by a military regime" >> synonyms: dissenter, objector, protester, disputant; freethinker, >> nonconformist, independent thinker; rebel, revolutionary, recusant, >> renegade; subversive, agitator, insurgent, insurrectionist, >> insurrectionary, mutineer; informal: refusenik >> "a dissident who had been jailed by the regime" >=20 >=20 > If you object to the phrase, please provide a semantically equivalent b= ut > inoffensive phrase. >=20 > Brian >=20 > P.S. It may not be clear, but I definitely am in favor of providing DoH= to > everyone who requires it, i.e. members of this specific group. >=20 > P.P.S. I disagree with "conscripting" unaware users into using the same= > mechanism using opt-out, always-on resolution via DoH to third party > providers. Doing so may place them in jeopardy of one form or another, = and > is especially objectionable when it is done without explicit and inform= ed > consent. The other reason for using technology to block only the second= > group, is to protect any users who accidentally leave an application or= > device in the "privacy" mode, when they are on a network which prohibit= s > encrypted access to third party DNS providers. The blockage protects th= e > network; the requirement for explicit user consent to break network pol= icy > (and bypass the blockage) is what protects the wayward, innocent user. >=20 >=20 > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh >=20 --------------E219015855847E2F204E4F44 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------E219015855847E2F204E4F44-- --88EpiFlPZ1lxBb739LEDyTPA2kosdk4g6-- --pVJElKS8NGp1sv315y9N3rhlYXZdCWAQg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlyb/U0ACgkQWrL68XsX K+qMhBAAgshEIAt1ORomAO8fPjQJp6wDnav67gSXzj5xngGgX/oii5XAijPZoC5E bDbP2EXF7wTFMklcrgdrg4AnK/Gtm2Cl2jBocX9LEZJEneOQNzPGWPs0MfRS10IC 5eJIxLK6ZyAwtjHAoFOho6UPaxshcXHpdkL/mjTHSl/QcVwWe7GvtSMDlnP7G2TO 6yBiwLF2eMkBtpgorrGrX1vlOxHDS9H6/kc2xINl7AAhgvXKdwYY75Ii+p+R3wKf KAeCPTemqfKlX0tvNVxCNoFM9pW8a/tpab1399yheUhgT3R6b3I3zPOnrWNdRAkH QwojE3vKpmM9YUD54JMnkLr1ChaRVs+JR/V+/0AM9hcHzvmgzryFzio9vruSRypA 48XQvcLsqLpr0FCd/vblKo4f9xxYE8hpRJMVh1GFAyBdTc/vaQ8BEcYODj9MD1lm XrV/oAEXlZfROtX41rqyZQiETXTCI+KgiPcTuOlKSAbITB0yGMSXjkpvR/jUikYq ShAohXwSSyHain06UNldGSFVTI4PJ3Z0BdgSsBASXqEjZdmh50dBD9q3jG+MdkX9 1oRQEJSH+C8gSm2af77xfwpWdIfSFUo0zWvASMA1JoLuS7eQWhR27BWJFm6Hy/MA DPRaZQV9lrxx4ULwVAIu9MlB0aoTanzcWdVtkaeYV5iCHJl2Q04= =doN5 -----END PGP SIGNATURE----- --pVJElKS8NGp1sv315y9N3rhlYXZdCWAQg-- From nobody Wed Mar 27 16:16:39 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4EC00120094 for ; Wed, 27 Mar 2019 16:16:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3kzlJpUzw1vH for ; Wed, 27 Mar 2019 16:16:33 -0700 (PDT) Received: from smtp.guxx.net (smtp.guxx.net [IPv6:2a01:4f8:a0:322c::25:42]) by ietfa.amsl.com (Postfix) with ESMTP id 941D5120058 for ; Wed, 27 Mar 2019 16:16:33 -0700 (PDT) Received: by nyx.guxx.net (Postfix, from userid 107) id 5D1945F4120F; Thu, 28 Mar 2019 00:16:32 +0100 (CET) Received: from [172.19.152.18] (dhcp-9104.meeting.ietf.org [31.133.145.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by nyx.guxx.net (Postfix) with ESMTPSA id 356765F4039B; Thu, 28 Mar 2019 00:16:28 +0100 (CET) From: "Ralf Weber" To: "Eric Rescorla" Cc: "DoH WG" Date: Thu, 28 Mar 2019 00:16:26 +0100 X-Mailer: MailMate (1.12.4r5594) Message-ID: <1CAFC80D-D72A-417C-B165-F5630D20C7B1@fl1ger.de> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Mar 2019 23:16:38 -0000 Moin! On 27 Mar 2019, at 10:16, Eric Rescorla wrote: > 1. We have implemented DNS over HTTPS [RFC8484] and would like to > deploy it by default for our users. We intend to select a set of > Trusted Recursive Resolvers (TRRs) that we will use for DoH > resolution. TRRs will be required to conform to a specific set of > policies intended to protect user privacy. We’re still refining > the > final policy but we expect it to roughly match the one that > Cloudflare > has already agreed to use > (https://developers.cloudflare.com/1.1.1.1/commitment-to-privacy/).While > we expect the initial set of TRRs to be small, we’re interested > in > adding new providers who are able to comply with these policies. As said on the mic in the IETF DOH side session having a small list of providers will be a disservice to privacy. My colleague Jon Reed just counted the distinct IP addresses from resolvers we see to one of our service at Akamai over a day. It was 2.64 million. Having millions of different entities (or tens of thousands if you assume some of these will be run by the same entity) seeing the user traffic is far better privacy than have some large US cloud providers getting all of it, as at the moment these would be the only choices. And as another colleague of mine, Erik Nygren, said there is a cost associated of running such TRR at Internet scale, and companies usually don’t spend money without expecting a return on their investment. For ISPs the case is clear they get money and have a contract with the user and want to provide a good service, possibly better then there competitor (in a lot of european countries there are regular tests on the speed and service ISP provide). For the cloud providers the case is not so clear, but looking at the published privacy policies of Cloudflare and Google neither of them say that they will not look at the data, and 24 hours is a lot of time to convert it to get it into some machine learning, but having looked at lots of DNS data over the last decade even without the IP address this data, or the result of the analysis of the data has value. So to sum up I think opting in the users by default to a couple of big mostly US based cloud providers is a bad idea. If the interest really is in getting a secure private resolution for the user then reaching out to the ISPs and getting them to work with you IMHO is a better way than declaring them the attacker. > 3. Copies of Firefox will be configured with a set of TRRs. > Different > regions may have different TRR sets or different defaults. In > addition > we may have DoH/TRR on by default in some regions and not others, > especially initially. How do you decide which region the user is in? Does it move or is it based on the locale setting? > 4. The user will be informed that we have enabled use of a TRR and > have the opportunity to turn it off at that time, but will not be > required to opt-in to get DoH with a TRR. > > 5. Any given client will automatically select a resolver out of > that > set and use that for all resolutions [with the two exceptions > noted > below.] At any time, the user will have the option to select a > different resolver out of the list, specify their own resolver, or > disable DoH entirely. So the application provider gets to decide who does get to see all the user data, or will the use have to select one and as stated repeatedly most users will not be able to make that informed decisions. I don’t think anyone has problem of an informed user selecting what he believes is his best choice for resolving, we have that today already. But per default switching the resolution and thus all the browsing data that the user generates (even in private mode ;-) to a third party the user doesn’t have a contract with is the wrong way IMO. So long -Ralf —-- Ralf Weber From nobody Thu Mar 28 01:27:32 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16604120450 for ; Thu, 28 Mar 2019 01:27:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eGUk0U8V2fLu for ; Thu, 28 Mar 2019 01:27:10 -0700 (PDT) Received: from mail-qk1-x731.google.com (mail-qk1-x731.google.com [IPv6:2607:f8b0:4864:20::731]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F13F12025F for ; Thu, 28 Mar 2019 01:27:09 -0700 (PDT) Received: by mail-qk1-x731.google.com with SMTP id o129so11593963qke.8 for ; Thu, 28 Mar 2019 01:27:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LFfeBdQijlfGSBu2KgZxfZqLfGVDkECaH3Va8f2zEJc=; b=Ky4aeMemL6G4qnhD8mldH/S6UUrlttpz3zOw9Od+RxRKE0L3va+6Ko7nx5rkjy3ILK mv4hjx66Wad430psha0qru0IUJGg4cr6oyJW6AEg1WqZRYPolxF21vO7IS3/XyQ1/5lv h3bgewrAiyp3MwHvw0XTGtbyro18c3BATogFF9Ecvw6iTs49lw9QUZ+Zid5ebXHCHss1 iT+SceoRyakzLE58mHpFlBLSETNSC+N9HxNmccEqykR/aC2sy91l3dowvgoWwMiviBaS mInOlwly7uPT9y87GHcEQAtUERTLalZGTXtHuSEI7b0jOjAyRfcVk0XMTBK7wsNkOLth cGnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LFfeBdQijlfGSBu2KgZxfZqLfGVDkECaH3Va8f2zEJc=; b=X2Lrpko1Z0SNnfRV9TiDPNtSA2SpXTwpHJQNIBpOblksYtHkNLT8bMlLM6aNAYFK/G e/GJaHz10hETOYj6G9OMsCGOrNC3glkIbJg/NGYQjF3W0NxBup6lj0HVjBK4Sx2gPEPD puv+FP8rItERE3oQR1l0V7MOaxZuhMuJ+n1ooQFNw7cBV+uEsLin2J88T/sSgtTyIah6 VfxfcJOgXpwcp2wz28RSPY8EHMN1K8l6M08oosx0W6pfseoy0giljQwslB13Z9yTjPbq p3Mg7z/1huA5axumgXFB9uJ2xwrnSByeNX1CFVKT1txZZOy+zT64+JuggiroiPZVnT5H HbUA== X-Gm-Message-State: APjAAAUlkRJ+vP0O0w0UkY2mWH2OJjnAh1dlm/VjImN6XV/8dp9SxTpc qgzLrJosMO1fX4QzG8ma/IyKkrMb385g1uo4d9Yrfk7fVB8= X-Google-Smtp-Source: APXvYqzpxhvfYqbUqSVKuP7fNu4PTe6NuwsT3fJb6j5KOVyqcO/iVWPvE1crTiCPfOPovU5Nf6wJQB1S68MEv6AZukc= X-Received: by 2002:a37:d85:: with SMTP id 127mr32375774qkn.139.1553761628439; Thu, 28 Mar 2019 01:27:08 -0700 (PDT) MIME-Version: 1.0 References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> In-Reply-To: <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> From: Brian Dickson Date: Thu, 28 Mar 2019 09:26:54 +0100 Message-ID: To: Stephen Farrell Cc: DoH WG Content-Type: multipart/alternative; boundary="000000000000edc7aa0585235148" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 08:27:22 -0000 --000000000000edc7aa0585235148 Content-Type: text/plain; charset="UTF-8" On Wed, Mar 27, 2019 at 11:46 PM Stephen Farrell wrote: > I won't, sorry. I don't accept your proposed dichotomy as valid. > I would like to point out the consequences of your position. I'm interested in your position on the various implications. I don't want to put words in your mouth, but rather want you to use your own words. First question: Consider the two following URIs, for use by a DoH client (e.g. in a configured template): https://some-resolver.example.com/dns-query https://some-resolver.example.com:/dns-query (replace with a dedicated-to-DoH port number assigned by IANA) Let's presume the only server-side difference involved is the port the DoH server listens to. i.e. the DoH server listens only on 443, vs the DoH server listens on both 443 and NEW_PORT. Would you consider those two URIs to be "the same technology"? Second question: Consider the two following models for end-user access to DoH from within an enterprise network. 1. Escalation model: The user attempts to contact the DoH server via NEW_PORT. - If the user is unable to reach the DoH server over NEW_PORT, the user is given two options: - Don't use that specific DoH server (sub options: pick another DoH server, pick a DoT server, pick a Do53 server, don't connect to the network) - Make an informed (e.g. warnings and explicit user acceptance) choice to reach DoH over 443. This may have personal consequences for the user if DoH443 is prohibited and detected. - One possible version of this is that the browser facilitates a per-user, opt-in configuration, of always doing the escalation without further prompting. - Another possible variation is that the browser facilitates a per-user, opt-in configuration, of bypassing the NEW_PORT attempt. This is still distinguished from the "Blind Model" in that it is opt-in, and that the user makes a specific informed choice. 2. Blind model: No assessment of network posture regarding DoH is attempted. User contacts DoH on port 443. What are you saying about model 1? Are you rejecting it out-of-hand? I f you are, have you considered the consequences to users? Commentary on the second question and its implications: I see several benefits with model 1, to both the users, and the network operators: 1. It facilitates use of the user's choice of DoH server, when not prohibited by the network operator. 2. NEW_PORT is ONLY used for DoH, so the network operator blocking NEW_PORT is an unambiguous signal to the user: you do not have the permission of the network operator to access that specific DoH server. 3. It does not directly block access to the user's choice of DoH server, over OLD_PORT (443). 4. It requires the user's informed consent prior to enabling access to the DoH server on OLD_PORT, if NEW_PORT is blocked. 5. For network operators, blocking or allowing NEW_PORT access scales extremely well, since it is applicable only to DoH traffic. In particular, it is compatible with the use of white-lists as well as black-lists. In contrast, network-level blocking on OLD_PORT fundamentally only supports black-lists, unless the operator employs large-scale HTTPS white-lists. In contrast, here are my observations about model 2 (blind model): 1. The user is not provided any meaningful ability to provide informed consent. 2. The user is not able to infer network policy regarding permission to access any particular choice of DoH server. 3. Even if there were a mechanism to express network policy on permission to access particular DoH servers, there would not be any scalable enforcement mechanism. 1. The main issue is that white/black lists for web servers and DoH servers would be unavoidably commingled. Updates to DoH server permissions would have impact on web server access, and the management of those ACLs might typically be done by different groups with different permissions and different management systems (possibly incompatible). The bottom line is, that without a technical mechanism with similar semantics to the NEW_PORT stuff above, this has direct impact to both network operators (particularly enterprise network operators), and to users. Without the NEW_PORT mechanism (or something like it), the network operator who is required to block some or all DoH servers, must employ un-scalable methods, which may place significant NEW operational, performance, and cost burdens on the network operator. Without the NEW_PORT mechanism (or something like it), the network operator is unable to distinguish users who would otherwise have been interested in complying with the network operator's policy (think employees with binding restrictions which are legal in their jurisdiction). Without the NEW_PORT mechanism (or something like it), the network operator is unable to distinguish new DoH servers being access, from random HTTPS connections occurring. Contrast this with the NEW_PORT semantics: the network operator would see new failed attempts to reach DoH servers, and be able to determine whether this is abnormal (malware) or due to a new DoH operator, where the network operator may wish to facilitate access to the new DoH operator. I am interested in your feedback on the above, and whether this affects your view of the dichotomy. Sincerely, Brian P.S. Sorry about the confusion caused by your MUA. You might want to report that to the vendor as a bug. --000000000000edc7aa0585235148 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Wed, Mar 27, 2019 at 11:46 PM Step= hen Farrell <stephen.farrel= l@cs.tcd.ie> wrote:
I won't, sorry. I don't accept your proposed dichotomy as valid.

I would like to point out the consequence= s of your position.
I'm interested in your position on the va= rious implications.
I don't want to put words in your mouth, = but rather want you to use your own words.

First q= uestion:
Consider the two following URIs, for use by a DoH client= (e.g. in a configured template):
https://some-resolver.example.com:&= lt;NEW_PORT>/dns-query=C2=A0
(replace <NEW_PORT> with a dedicated-to-DoH port number = assigned by IANA)

Let's presume the only serve= r-side difference involved is the port the DoH server listens to.
i.e. the DoH server listens only on 443, vs the DoH server listens on both= 443 and NEW_PORT.

Would you consider those two UR= Is to be "the same technology"?

Seco= nd question:
Consider the two following models for end-user acces= s to DoH from within an enterprise network.
  1. Escalation mo= del: The user attempts to contact the DoH server via NEW_PORT.
    • = =C2=A0If the user is unable to reach the DoH server over NEW_PORT, the user= is given two options:=C2=A0
      • Don't use that specific DoH se= rver (sub options: pick another DoH server, pick a DoT server, pick a Do53 = server, don't connect to the network)
      • Make an informed (e.g. wa= rnings and explicit user acceptance) choice to reach DoH over 443. This may= have personal consequences for the user if DoH443 is prohibited and detect= ed.
        • One possible version of this is that the browser facilitate= s a per-user, opt-in configuration, of always doing the escalation without = further prompting.
        • Another possible variation is that the browser f= acilitates a per-user, opt-in configuration, of bypassing the NEW_PORT atte= mpt. This is still distinguished from the "Blind Model" in that i= t is opt-in, and that the user makes a specific informed choice.
        <= /ul>
    • Blind model: No assessment of network posture regarding DoH is= attempted. User contacts DoH on port 443.
What are you sayin= g about model 1?=C2=A0
Are you rejecting it out-of-hand? I
<= div>f you are, have you considered the consequences to users?

Commentary on the second question and its implications:
I see several benefits with model 1, to both the users, and the ne= twork operators:
  1. It facilitates use of the user's cho= ice of DoH server, when not prohibited by the network operator.=C2=A0
  2. NEW_PORT is ONLY used for DoH, so the network operator blocking NEW_= PORT is an unambiguous signal to the user: you do not have the permission o= f the network operator to access that specific DoH server.
  3. It does = not directly block access to the user's choice of DoH server, over OLD_= PORT (443).
  4. It requires the user's informed consent prior to en= abling access to the DoH server on OLD_PORT, if NEW_PORT is blocked.
    5. For network operators, blocking or allowing NEW_PORT access scales extrem= ely well, since it is applicable only to DoH traffic. In particular, it is = compatible with the use of white-lists as well as black-lists. In contrast,= network-level blocking on OLD_PORT fundamentally only supports black-lists= , unless the operator employs large-scale HTTPS white-lists.
= In contrast, here are my observations about model 2 (blind model):
  1. The user is not provided any meaningful ability to provide = informed consent.
  2. The user is not able to infer network policy rega= rding permission to access any particular choice of DoH server.
  3. Eve= n if there were a mechanism to express network policy on permission to acce= ss particular DoH servers, there would not be any scalable enforcement mech= anism.
    1. The main issue is that white/black lists for web servers= and DoH servers would be unavoidably commingled. Updates to DoH server per= missions would have impact on web server access, and the management of thos= e ACLs might typically be done by different groups with different permissio= ns and different management systems (possibly incompatible).
=
The bottom line is, that without a technical mechanism with simi= lar semantics to the NEW_PORT stuff above, this has direct impact to both n= etwork operators (particularly enterprise network operators), and to users.=

Without the NEW_PORT mechanism (or something like= it), the network operator who is required to block some or all DoH servers= , must employ un-scalable methods, which may place significant NEW operatio= nal, performance, and cost burdens on the network operator.
Witho= ut the NEW_PORT mechanism (or something like it), the network operator is u= nable to distinguish users who would otherwise have been interested in comp= lying with the network operator's policy (think employees with binding = restrictions which are legal in their jurisdiction).
Without the = NEW_PORT mechanism (or something like it), the network operator is unable t= o distinguish new DoH servers being access, from random HTTPS connections o= ccurring. Contrast this with the NEW_PORT semantics: the network operator w= ould see new failed attempts to reach DoH servers, and be able to determine= whether this is abnormal (malware) or due to a new DoH operator, where the= network operator may wish to facilitate access to the new DoH operator.

I am interested in your feedback on the above, and w= hether this affects your view of the dichotomy.

Si= ncerely,
Brian

P.S. Sorry about the conf= usion caused by your MUA. You might want to report that to the vendor as a = bug.

--000000000000edc7aa0585235148-- From nobody Thu Mar 28 01:44:21 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 792FC120469 for ; Thu, 28 Mar 2019 01:44:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xw2QZiBFn09j for ; Thu, 28 Mar 2019 01:44:06 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0C98A1203EB for ; Thu, 28 Mar 2019 01:44:05 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 5B43B6A274; Thu, 28 Mar 2019 09:44:03 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1553762643; bh=5HG3GO/fWIIzvjn35O+4hFcDAhwgEHGU4v+tMLGFiLY=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=0HitMDNTKQyucntfj68a1nNHG+JlWLK7PPlKOSOyzUbTVjxlzb4rzCjRK2Ex1fz6s sVdfhCP7CY65AV0fqS9QIHzk6vn5ln6R4Mxv3luC2nKlbwmx52f9eFz4ssfxe2YeDD fGwvTptfspoq/fS4r59/7wW1UwX2RAtojlUSeqX6gFmCF87JBCSSOYPq6Cld2MVwxO 5FANd4Z+kO4ywwiag7eUaee7/XWyc9XD/yJP35YPu95UQNcR/CaLlPDuSQYHxUkBpm hOi2IX1pRPdBo8VPh+c59Zj5d01PJRJKyFrl+1TKOhGXli499t5m7W2R1zTYbRWOta MsxB19KkPVXsQ== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 4CCD63C045E; Thu, 28 Mar 2019 09:44:03 +0100 (CET) Date: Thu, 28 Mar 2019 09:44:02 +0100 (CET) From: Vittorio Bertola To: Stephen Farrell Cc: DoH WG Message-ID: <1351299192.23919.1553762643258@appsuite.open-xchange.com> In-Reply-To: <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_23918_1038358775.1553762643253" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 08:44:20 -0000 ------=_Part_23918_1038358775.1553762643253 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 27 marzo 2019 alle 23.46 Stephen Farrell < stephen.farrell@cs.tcd.ie mailto:stephen.farrell@cs.tcd.ie > ha scritto: > > I do not accept the above as a useful distinction for this topic. > > Those in the category of your first bullet can only be protected > by technology when (essentially) all those in other categories > use the same technology. (That said, I could quibble with your > text, but won't for now:-) > > But, and it's a big but, those whose safety is not at risk (today), > also have valid interests to protect, and mechanisms that we have > to offer for such protection need to be widely deployed to be > effective. > The problem is that, in DoH's "obfuscated traffic mode" (is that better than "dissident mode"?), increased transport privacy for the individual (not necessarily increased privacy, but that's a different story) is obtained at the expense of network security. Other tradeoff points are possible, giving the user almost the same amount of privacy but also more security, so while I find it justified to push the tradeoff to the extreme side of privacy when someone's life and freedom could be at risk, I would prefer a more balanced tradeoff point (the one in which DoH traffic is clearly identifiable and can be blocked by the network if necessary) in other contexts, at least as the default. More generally, beware that if you build an Internet that is designed to work as if everyone on the planet were a dissident in an authoritarian country, it is not unlikely that you will then get an Internet regulatory and access environment that looks like the one of authoritarian countries, even in democratic ones. Ciao, -- Vittorio Bertola | Head of Policy & Innovation, Open-Xchange vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, 10144 Torino, Italy ------=_Part_23918_1038358775.1553762643253 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Il 27 marzo 2019 alle 23.46 Stephen Farrell < stephen.farrell@cs.tcd.ie> ha scritto:

I do not accept the above as a useful distinction for this topic.

Those in the category of your first bullet can only be protected
by technology when (essentially) all those in other categories
use the same technology. (That said, I could quibble with your
text, but won't for now:-)

But, and it's a big but, those whose safety is not at risk (today),
also have valid interests to protect, and mechanisms that we have
to offer for such protection need to be widely deployed to be
effective.
The problem is that, in DoH's "obfuscated traffic mode" (is that better than "dissident mode"?), increased transport privacy for the individual (not necessarily increased privacy, but that's a different story) is obtained at the expense of network security. Other tradeoff points are possible, giving the user almost the same amount of privacy but also more security, so while I find it justified to push the tradeoff to the extreme side of privacy when someone's life and freedom could be at risk, I would prefer a more balanced tradeoff point (the one in which DoH traffic is clearly identifiable and can be blocked by the network if necessary) in other contexts, at least as the default.

More generally, beware that if you build an Internet that is designed to work as if everyone on the planet were a dissident in an authoritarian country, it is not unlikely that you will then get an Internet regulatory and access environment that looks like the one of authoritarian countries, even in democratic ones.

Ciao,

-- 

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
vittorio.bertola@open-xchange.com 
Office @ Via Treviso 12, 10144 Torino, Italy
------=_Part_23918_1038358775.1553762643253-- From nobody Thu Mar 28 02:01:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84DC7120433 for ; Thu, 28 Mar 2019 02:01:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mn6mtxS5QRUc for ; Thu, 28 Mar 2019 02:01:33 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 57EBC120448 for ; Thu, 28 Mar 2019 02:01:33 -0700 (PDT) Received: from dhcp-9796.meeting.ietf.org (dhcp-9796.meeting.ietf.org [31.133.151.150]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2S91OSl077671 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 28 Mar 2019 04:01:27 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553763688; bh=I2aQIQiTw5MstmfxipDKPW6p3hfT2w9zI308XLe2Aic=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=n7tPI+CZ7zTTR3bZnd3OBZMA6ec9vSUSg4/Ny81briTx0QTaCbiKiWgIjWlygDhrz WRW/cxxh8jd2UgsXqMQZhhEZwNb6muQ8OBJcIaq2EzD7s0HbP2DV26w57LUfYfSTrK iOQHCLRFUlSV6skG+WrebmerS237BAgacpY4APeU= To: Vittorio Bertola , Stephen Farrell Cc: DoH WG References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> <1351299192.23919.1553762643258@appsuite.open-xchange.com> From: Adam Roach Message-ID: <098b5e41-4c95-59c8-02e3-8d81791bc013@nostrum.com> Date: Thu, 28 Mar 2019 10:01:24 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.0 MIME-Version: 1.0 In-Reply-To: <1351299192.23919.1553762643258@appsuite.open-xchange.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 09:01:46 -0000 On 3/28/19 09:44, Vittorio Bertola wrote: > More generally, beware that if you build an Internet that is designed > to work as if everyone on the planet were a dissident in an > authoritarian country, it is not unlikely that you will then get an > Internet regulatory and access environment that looks like the one of > authoritarian countries, even in democratic ones. This is getting pretty far off topic, but you're squarely confusing cause with effect. See BCP 188. /a From nobody Thu Mar 28 02:04:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C78E31200FB for ; Thu, 28 Mar 2019 02:04:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=telekom.de Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y7SnFfhMC_dO for ; Thu, 28 Mar 2019 02:04:26 -0700 (PDT) Received: from mailout41.telekom.de (mailout41.telekom.de [194.25.225.151]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2B93D12011C for ; Thu, 28 Mar 2019 02:04:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=telekom.de; i=@telekom.de; q=dns/txt; s=dtag1; t=1553763866; x=1585299866; h=from:to:subject:date:message-id:references:in-reply-to: content-transfer-encoding:mime-version; bh=Fi7fUAA80jAnskwdC42/bW0LAK615iRlyVptIPOpMNo=; b=ygKFD0ArpmyjEh69/DNp9Q0reX2vYRNGT0Qb0Kg4Njq7OJIVoQjw/PJs wi5cJEh2NuPybb30bA7mRccJhDqHFSx6bGd3IrRi5RziQ1uBpIwepRFAO TEvjOoe7w7CUm7DWOwS0tlpHqUcRoifbzHdLBO0hgP0UeCZQTYk7yM5q3 Z3b6NhE+PJ11PWwFCGieF11cEsVWYhEoQrSAJricQvSXgWj2YNgS9aHo/ 4k9KvMmaB2Pn3pc6eaaw9skCAGA7cwoUYUJXS0oVGQi9Fb3IlJkU85Q4y ZTU9c/po/UwKENdiSlDm8fPtK4e46KnLIO3A+uuhL+BSnrnpHmQSvrj+t Q==; Received: from qdezc2.de.t-internal.com ([10.171.255.37]) by MAILOUT41.dmznet.de.t-internal.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 28 Mar 2019 10:04:23 +0100 Received: from he105867.emea1.cds.t-internal.com ([10.169.119.44]) by qde0ps.de.t-internal.com with ESMTP/TLS/AES256-SHA; 28 Mar 2019 10:03:42 +0100 Received: from HE105702.EMEA1.cds.t-internal.com (10.169.119.23) by HE105867.emea1.cds.t-internal.com (10.169.119.44) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 28 Mar 2019 10:03:41 +0100 Received: from HE104162.emea1.cds.t-internal.com (10.171.40.37) by HE105702.EMEA1.cds.t-internal.com (10.169.119.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Thu, 28 Mar 2019 10:03:41 +0100 Received: from GER01-FRA-obe.outbound.protection.outlook.de (51.4.80.22) by O365mail04.telekom.de (172.30.0.231) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Thu, 28 Mar 2019 10:03:40 +0100 Received: from LEJPR01MB0377.DEUPRD01.PROD.OUTLOOK.DE (10.158.142.20) by LEJPR01MB0380.DEUPRD01.PROD.OUTLOOK.DE (10.158.142.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1730.18; Thu, 28 Mar 2019 09:03:41 +0000 Received: from LEJPR01MB0377.DEUPRD01.PROD.OUTLOOK.DE ([fe80::2440:a932:99b5:4c2d]) by LEJPR01MB0377.DEUPRD01.PROD.OUTLOOK.DE ([fe80::2440:a932:99b5:4c2d%6]) with mapi id 15.20.1730.019; Thu, 28 Mar 2019 09:03:41 +0000 From: To: , Thread-Topic: [Doh] Mozilla's plans re: DoH Thread-Index: AQHU5LhCCdDO08my+0ygyUoIXX2xRKYgvFVA Date: Thu, 28 Mar 2019 09:03:41 +0000 Message-ID: References: In-Reply-To: Accept-Language: de-DE, en-US Content-Language: de-DE X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=N.Leymann@telekom.de; x-originating-ip: [164.19.4.235] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 2dd89a54-47c1-49f4-321f-08d6b35c45fa x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:LEJPR01MB0380; x-ms-traffictypediagnostic: LEJPR01MB0380: x-microsoft-antispam-prvs: x-forefront-prvs: 0990C54589 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(396003)(136003)(366004)(376002)(346002)(39860400002)(189003)(199004)(7696005)(486006)(106356001)(74482002)(105586002)(72206003)(68736007)(11346002)(75402003)(8676002)(81166006)(110136005)(71200400001)(81156014)(476003)(5660300002)(71190400001)(66574012)(316002)(256004)(446003)(66066001)(26005)(55016002)(186003)(102836004)(86362001)(3846002)(53546011)(52396003)(14454004)(6116002)(53936002)(305945005)(33656002)(478600001)(8936002)(7736002)(2906002)(9686003)(76176011)(97736004); DIR:OUT; SFP:1101; SCL:1; SRVR:LEJPR01MB0380; H:LEJPR01MB0377.DEUPRD01.PROD.OUTLOOK.DE; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: telekom.de does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 1sAhHfw3WfrpdGRYkPK04qyupXkgFGvYNvz+LxMIs/qCOL0IBHFTR1XZFCjD1GufrUT5E1+/BaPgC4eQA2hF+XlSfc8K48p/EB5MI0tze8xnMmTotAqM9ohiVvXblJJnZ0nRdBxUsNUamNAbI84xSvOUr/BUt235xWAjKf8wHlK2vXns5Wgmbefhv9VVYeXXYs47hQxiU+98yC87/j5pJVrJzIRoT3gNcygNYPOEPo0c+7NG5ha6B8496W4cM76bmFKsNCoTJhwrNXsDmjtMBPG+1xZkF5tL/lfmnlxPZ7umrrR384kNOz5686m3OmQ5TNHtfleP2A/kCTpMzBC+idsob2XHSsoIU9NkBk865vSJYBcZUOdfykymQU36AgO+4+sztZqeZvTj+NqSbyF2a/1j3lGRJYnC00nWet6hduQ= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: 2dd89a54-47c1-49f4-321f-08d6b35c45fa X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2019 09:03:41.1331 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bde4dffc-4b60-4cf6-8b04-a5eeb25f5c4f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: LEJPR01MB0380 X-OriginatorOrg: telekom.de Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 09:04:29 -0000 SGksDQoNCi0tLS0tVXJzcHLDvG5nbGljaGUgTmFjaHJpY2h0LS0tLS0NClZvbjogRG9oIDxkb2gt Ym91bmNlc0BpZXRmLm9yZz4gSW0gQXVmdHJhZyB2b24gTmVpbCBDb29rDQpHZXNlbmRldDogTWl0 dHdvY2gsIDI3LiBNw6RyeiAyMDE5IDE3OjE1DQpBbjogRG9IIFdHIDxkb2hAaWV0Zi5vcmc+DQpC ZXRyZWZmOiBSZTogW0RvaF0gTW96aWxsYSdzIHBsYW5zIHJlOiBEb0gNCg0KDQoNCj4+IE9uIDI3 IE1hciAyMDE5LCBhdCAwOToyNCwgRXJpYyBSZXNjb3JsYSA8ZWtyQHJ0Zm0uY29tPiB3cm90ZToN Cj4+IA0KPj5Ob3cgd2l0aCB0aGUgbnVtYmVyZWQgbGlzdHMgY29ycmVjdGx5IGZvcm1hdHRlZDoN Cj4+DQo+PiBJ4oCZdmUgaGVhcmQgYSBudW1iZXIgb2YgcXVlc3Rpb25zIGFib3V0IE1vemlsbGHi gJlzIHBsYW5zIGFyb3VuZCBEb0guIA0KPj4gV2XigJl2ZSBtYWRlIGEgbnVtYmVyIG9mIHB1Ymxp YyBzdGF0ZW1lbnRzLCBidXQgaXQgbWlnaHQgYmUgdXNlZnVsIHRvIA0KPj4gdHJ5IHRvIHB1dCB0 aGlzIGFsbCBpbiBvbmUgcGxhY2UuDQo+PiANCj4+IEluIGNvbnRleHQsIHRoZSBwcm9ibGVtIHdl IGFyZSBhdHRlbXB0aW5nIHRvIHNvbHZlIGhlcmUgaXMgYXR0YWNrIG9uIA0KPj4gdGhlIHVzZXLi gJlzIG5hbWUgcmVzb2x1dGlvbiBmcm9tIGFuIGF0dGFja2VyIHdpdGggZnVsbCBvciBwYXJ0aWFs IA0KPj4gY29udHJvbCBvZiB0aGUgbmV0d29yaywgYXMgY29udGVtcGxhdGVkIGJ5IFNlY3Rpb24g MyBvZiBCQ1AgNzIgYXMgd2VsbCANCj4+IGFzIEJDUCAxODguIFRoZXJl4oCZcyBhbXBsZSBldmlk ZW5jZSBvZiBtb25pdG9yaW5nL21hbmlwdWxhdGlvbiBvZiB1c2VyIA0KPj4gdHJhZmZpYyB2aWEg dGhpcyB2ZWN0b3IgWzBdWzFdWzJdLiBJbXBvcnRhbnRseSwgdGhpcyBpbmNsdWRlcyBjYXNlcyAN Cj4+IHdoZXJlIHRoZSBlbnRpdHkgd2hpY2ggb3ducyB0aGUgbmV0d29yayBpbmZyYXN0cnVjdHVy ZSBtb25pdG9ycyBhbmQvb3IgDQo+PiBtb2RpZmllcyBETlMgcmVxdWVzdHMgYW5kIHJlc3BvbnNl cyB3aXRob3V0IHRoZSB1c2Vy4oCZcyBjb25zZW50Lg0KPj4gDQo+DQo+IEJ1dCBNb3ppbGxhIGRv ZXNu4oCZdCBrbm93IHdoZXRoZXIgdGhlIG1vZGlmaWNhdGlvbiBpcyB3aXRoIG9yIHdpdGhvdXQg dGhlIHVzZXLigJlzIGNvbnNlbnQuIEFzIHRoZSB2YXJpb3VzIGRyYWZ0cyB0aGF0IGhhdmUgYmVl biBwcmVzZW50ZWQgdGhpcyB3ZWVrIGF0dGVtcHQgdG8gDQo+IG1ha2UgY2xlYXIsIHRoZXJlIGFy ZSBhIGxhcmdlIG51bWJlciBvZiB1c2UgY2FzZXMgd2hlcmUgdXNlcnMgYWN0aXZlbHkgd2FudCB0 aGUgbW9kaWZpY2F0aW9uIG9mIHRoZWlyIEROUyAocGFyZW50YWwgY29udHJvbCwgZW50ZXJwcmlz ZSBuZXR3b3JrcywgDQo+IG1hbHdhcmUvcGhpc2hpbmcgZGV0ZWN0aW9uLCBib3RuZXQgQyZDIGNv bW11bmljYXRpb24gZGlzcnVwdGlvbiBldGMuKSwgaW5kZWVkIHRoZXkgbWF5IGV2ZW4gYmUgcGF5 aW5nIGZvciBzdWNoIGEgc2VydmljZS4NClRoYXQgaXMgYSB2ZXJ5IHZhbGlkIGFzc3VtcHRpb24u IEFuZCBpZiB0aGV5IHBheSBmb3IgdGhlIHNlcnZpY2UgdGhleSBhbHNvIGV4cGVjdCB0aGF0IHRo ZSBzZXJ2aWNlIHdpbGwgd29yayBhbmQgZG9lcyBub3QgYnJlYWsgaWYgdGhleSBpbnN0YWxsIGEg bmV3IGNsaWVudCAoYnJvd3Nlci9hcHAvLi4uKSBvbiB0aGVpciBlbmQgc3lzdGVtcy4gSW4gbW9z dCBvZiB0aGUgY2FzZXMgdGhleSBldmVuIGRvIG5vdCBrbm93IHdlcmUgYSBmdW5jdGlvbmFsaXR5 IGlzIGltcGxlbWVudGVkIGFuZCB0aGV5IGRvIG5vdCBjaGFuZ2UgZGVmYXVsdCBzZXR0aW5ncyAo d2hpY2ggaXMgZmluZSwgYmVjYXVzZSAiZGVmYXVsdCIgdXN1YWxseSBtZWFucyB0aGF0IG5vdGhp bmcgd2lsbCBicmVhaykuIEZyb20gbXkgZXhwZXJpZW5jZSBhIG5ldyBkZWZhdWx0IGRpc2FibGlu ZyBhbiBleGlzdGluZyBmZWF0dXJlIChtYWx3YXJlL3BoaXNoaW5nIHByb3RlY3Rpb24sIEROUzY0 LCBMb2FkIEJhbGFuY2luZywgLi4uKSB3aWxsIGxlYWQgdG8gcHJvYmxlbXMuDQoNClJlZ2FyZHMN Cg0KTmljDQoNCg== From nobody Thu Mar 28 02:12:04 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DC3012014E for ; Thu, 28 Mar 2019 02:12:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IOGuvpmsjD_f for ; Thu, 28 Mar 2019 02:11:58 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74F141200FB for ; Thu, 28 Mar 2019 02:11:57 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 543C6BEFF; Thu, 28 Mar 2019 09:11:54 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6LOWNG3NU3aw; Thu, 28 Mar 2019 09:11:52 +0000 (GMT) Received: from [31.133.128.194] (dhcp-80c2.meeting.ietf.org [31.133.128.194]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E3DD9BEFC; Thu, 28 Mar 2019 09:11:51 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553764312; bh=VAtNApL1NmgvjiczqsR79CIu083lXWkt4zrknQSMQb8=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=Gnfr2I4djTctV95LRpi+ysIuKnaJeQsxuUo0Clrh150Ay00amFA+vqELsn25/rKSE LVHokK2wHwIBPPiSPjKrRdMzQwykSQFaLXgdh3SOJeDRFWwvqX7ZSvWhq9lFR+sKF/ 3+SL/ZmVMFgcd+QWNODchXVF7SJG7nT3Rq/B/XyA= To: Brian Dickson Cc: DoH WG References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <997e33da-1e84-c263-f1b5-7aea2a3cf5a0@cs.tcd.ie> Date: Thu, 28 Mar 2019 09:11:50 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="t06H3NIHErxhawPdAweE37MEUC8YxzgEE" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 09:12:02 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --t06H3NIHErxhawPdAweE37MEUC8YxzgEE Content-Type: multipart/mixed; boundary="YCDa8okrDXoOznQ5orxUANrjjXGIntHHj"; protected-headers="v1" From: Stephen Farrell To: Brian Dickson Cc: DoH WG Message-ID: <997e33da-1e84-c263-f1b5-7aea2a3cf5a0@cs.tcd.ie> Subject: Re: [Doh] Mozilla's plans re: DoH References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> In-Reply-To: --YCDa8okrDXoOznQ5orxUANrjjXGIntHHj Content-Type: multipart/mixed; boundary="------------65C99A935418E21AB7FA6369" Content-Language: en-GB This is a multi-part message in MIME format. --------------65C99A935418E21AB7FA6369 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 28/03/2019 08:26, Brian Dickson wrote: > On Wed, Mar 27, 2019 at 11:46 PM Stephen Farrell > wrote: >=20 >> I won't, sorry. I don't accept your proposed dichotomy as valid. >> >=20 > I would like to point out the consequences of your position. I don't believe answers to your questions below reflect any consequences of my position that use of the term dissident in this discussion isn't a good plan. But happy to answer... > First question: > Consider the two following URIs, for use by a DoH client (e.g. in a > configured template): >=20 > https://some-resolver.example.com/dns-query > https://some-resolver.example.com:/dns-query >=20 > (replace with a dedicated-to-DoH port number assigned by IAN= A) >=20 > Let's presume the only server-side difference involved is the port the = DoH > server listens to. > i.e. the DoH server listens only on 443, vs the DoH server listens on b= oth > 443 and NEW_PORT. >=20 > Would you consider those two URIs to be "the same technology"? Yes. >=20 > Second question: > Consider the two following models for end-user access to DoH from withi= n an > enterprise network. >=20 > 1. Escalation model: The user attempts to contact the DoH server via= > NEW_PORT. > - If the user is unable to reach the DoH server over NEW_PORT, t= he > user is given two options: > - Don't use that specific DoH server (sub options: pick anothe= r > DoH server, pick a DoT server, pick a Do53 server, don't > connect to the > network) > - Make an informed (e.g. warnings and explicit user acceptance= ) > choice to reach DoH over 443. This may have personal > consequences for the > user if DoH443 is prohibited and detected. > - One possible version of this is that the browser facilita= tes > a per-user, opt-in configuration, of always doing the > escalation without > further prompting. > - Another possible variation is that the browser facilitate= s a > per-user, opt-in configuration, of bypassing the NEW_PORT > attempt. This is > still distinguished from the "Blind Model" in that it is > opt-in, and that > the user makes a specific informed choice. > 2. Blind model: No assessment of network posture regarding DoH= is > attempted. User contacts DoH on port 443. >=20 > What are you saying about model 1? > Are you rejecting it out-of-hand? I > f you are, have you considered the consequences to users? I have rejected nothing, neither in nor out of hand;-) I'd disagree with aspects of what you describe as model 1, e.g. "the user is given two options" seems overly prescriptive and we all know (I hope) that terms like "informed choice" seem to mean very different things to different people involved in this discussion. Anyway, allocating a new port for use of DoH seems like it's worth exploring, but I don't know if it'd work or not. (And I don't control any browser, nor recursive s/w, so am not really the right person to chat with for that anyway.) Fixating now on a new port as the-one-right-answer also seems unwise to me, given there are multiple dimensions to this overall topic. > P.S. Sorry about the confusion caused by your MUA. You might want to re= port > that to the vendor as a bug. Thanks for the sympathy but my MUA is just fine in that respect;-) There are no quotes around the word dissident visible at [1] either, so I just didn't misquote you at all. Cheers, S. [1] https://mailarchive.ietf.org/arch/msg/doh/wE-FqNjC67oyl_ZXKrHKClSqHVo= --------------65C99A935418E21AB7FA6369 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------65C99A935418E21AB7FA6369-- --YCDa8okrDXoOznQ5orxUANrjjXGIntHHj-- --t06H3NIHErxhawPdAweE37MEUC8YxzgEE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlycj9YACgkQWrL68XsX K+oafA//dle+IUQDQBz8ZJwxHQSoeXbNC6xX466t3eu5uIrbkqskUfGfFa430iPe 54VTW6sjBjJVlzH4kVd0ZOLg75Ky/rCpmLuyuxlHSbN2uKjrED3qVrMzDFdXAD5x 5XfGzCcI71HwsC9E5OC0TD6fzihpJcqVeG9Yf5j9U0ETzzw6JgROohxUy912MTnS RzpcQmiw58+VDMHppdZwkvSUxJIqcwcLmFtYNymVv2QHOCinRC0cX6zMILCBVjqG XKOXHBPTBR7Vnp1x9lhg1MqrxrI6+oqGTKrUcnLWPkvsyU2rm2N487TQdAXoESTG NCFqxc7a4VWPQD3DJjOyh/Up65aKsgDkECwWfTGNiiBS/F43maDgJpku0QvumYdn vgoT3ywQWb2K+QKk+aA0Tm3wAOW8slN6NShqe4kI/jNd2b1gUfslsHctzkJaTQUZ 3GZRAtGxw/0yFIpFNSVujkWgyonEsj8JGe6WkHYsD5xm2tlxYOYu+AAtgcf2agOJ tfQ/iuMwl8/AmuOyqldcKFrg6l74w+4THHrQi4Y77q6LXMr/sb1vcnsrA0uONT9O +KSkqkh6C8eJkFlSfpxIEqFiX03P3garp5ZAApA/ROjpcsi3StWwBTZlcwb/7+mH 7sJyQdmpqP5TVnwwtszPY4zNn6Z6TD7G1escInX2H+p+fGD/eJI= =y95m -----END PGP SIGNATURE----- --t06H3NIHErxhawPdAweE37MEUC8YxzgEE-- From nobody Thu Mar 28 02:18:20 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1283512014E for ; Thu, 28 Mar 2019 02:18:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cQFo74oLnYb5 for ; Thu, 28 Mar 2019 02:18:16 -0700 (PDT) Received: from mail-wr1-x42a.google.com (mail-wr1-x42a.google.com [IPv6:2a00:1450:4864:20::42a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BD85A12011C for ; Thu, 28 Mar 2019 02:18:15 -0700 (PDT) Received: by mail-wr1-x42a.google.com with SMTP id k11so14489125wro.5 for ; Thu, 28 Mar 2019 02:18:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ERlLQ0JcGhjnjdRKSFa2wkOXlnl6NPmGKFMpVgnXUIk=; b=r1OBJCdDJVKnItFdkivNARfLXDilE78irHQyfS6PaMaXAjSBrvoujelWCBYeyXsfxe PiizZkB6cbp4SUV3+VRpV24aJATSMVx0/Ljto+Jr88ndyBTHaU7taQOnzr9Ogx2MOeqU J+Sf/wo6q+rfR+00C3B+gS0hj3IQHZk5DHbkBVa2/BbXdHjNWBn0Y+hpYi7JAkr4F+QN F8841fPCE2m8sTDZt73eF7hK8iRLC57bzH0BnWjEt58Htdad36J5TolKZ2hLolWYgV1Q AkPmY43lg82t3XSGJugo0Ul7a43KmTJbLGbzXueAjhVwGYGw358da2odoR7cW201d4Mp epYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=ERlLQ0JcGhjnjdRKSFa2wkOXlnl6NPmGKFMpVgnXUIk=; b=i/pvQb/p0Xr1yMI/DMBEgxCyx92Kb5u8VpIg55oLejFmh81bCWFHDzaW0DZqUHFZ3D 7qQjoTloa14pz5szTZLdz4HnOEG2auqcxVaBXnVbstg8xZGgzPrOI6iV0kzekCgjNLF1 xjZvrOnO7cOSWiZc5RFpb6SCmmed31oJVUmc52n/aByM42UKdCvzjZX3a+WXackLKoSK fXTGR0l8dv3P83wtZhZVwr8q8r9KY4P/9NasAO3xjedL6xW8X+krQdsS1hgBwWUU/hRL 6akAaZqjbASV35od7pLPssIiPEK5VPaBqyu63vPncDWXyKSmPDQPhgR1pG2rNmGP6lbk MGDA== X-Gm-Message-State: APjAAAWYEyoEmBXoJuK5Ib3HPw6ZARRg4idaoNTjboh4QOQG8rkOcSz/ hxa4mPYHb31FhVbF2dtakXU= X-Google-Smtp-Source: APXvYqxvHf+5BdJOmj42xxrzuSeE/q7g+/dDQkI2rxTlAAgWPTMUVoW4PMYKqCofiqwfQQk070GTwg== X-Received: by 2002:adf:f64d:: with SMTP id x13mr27612470wrp.298.1553764694269; Thu, 28 Mar 2019 02:18:14 -0700 (PDT) Received: from [31.133.147.59] (dhcp-933b.meeting.ietf.org. [31.133.147.59]) by smtp.gmail.com with ESMTPSA id t187sm3423679wma.1.2019.03.28.02.18.12 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 28 Mar 2019 02:18:13 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (1.0) From: Brian Dickson X-Mailer: iPhone Mail (16D57) In-Reply-To: <997e33da-1e84-c263-f1b5-7aea2a3cf5a0@cs.tcd.ie> Date: Thu, 28 Mar 2019 10:18:01 +0100 Cc: DoH WG Content-Transfer-Encoding: quoted-printable Message-Id: <08839F0E-EA7B-4D10-9DE7-7E1E6E2F483E@gmail.com> References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> <997e33da-1e84-c263-f1b5-7aea2a3cf5a0@cs.tcd.ie> To: Stephen Farrell Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 09:18:18 -0000 Sent from my iPhone > On Mar 28, 2019, at 10:11 AM, Stephen Farrell w= rote: >=20 >=20 > Hiya, >=20 > There are no quotes around the word dissident visible at [1] either, > so I just didn't misquote you at all. >=20 Ah, I see the problem in my original email. I used quotes the first time I used the term, but not the second time. My apologies. Brian=20 > Cheers, > S. >=20 > [1] https://mailarchive.ietf.org/arch/msg/doh/wE-FqNjC67oyl_ZXKrHKClSqHVo >=20 >=20 > <0x5AB2FAF17B172BEA.asc> From nobody Thu Mar 28 04:31:19 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 70FC11204F3 for ; Thu, 28 Mar 2019 04:31:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.3 X-Spam-Level: X-Spam-Status: No, score=-4.3 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cs.tcd.ie Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eeTjdqMuxd79 for ; Thu, 28 Mar 2019 04:30:57 -0700 (PDT) Received: from mercury.scss.tcd.ie (mercury.scss.tcd.ie [134.226.56.6]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2A88B1202A1 for ; Thu, 28 Mar 2019 04:29:11 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mercury.scss.tcd.ie (Postfix) with ESMTP id 17ED4BF15; Thu, 28 Mar 2019 11:29:07 +0000 (GMT) X-Virus-Scanned: Debian amavisd-new at scss.tcd.ie Received: from mercury.scss.tcd.ie ([127.0.0.1]) by localhost (mercury.scss.tcd.ie [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bqvrtVb3YyVG; Thu, 28 Mar 2019 11:29:05 +0000 (GMT) Received: from [31.133.146.21] (dhcp-9215.meeting.ietf.org [31.133.146.21]) by mercury.scss.tcd.ie (Postfix) with ESMTPSA id E2449BF0F; Thu, 28 Mar 2019 11:29:04 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cs.tcd.ie; s=mail; t=1553772545; bh=wMKaX/UVD+2uey7x35AxpkP4LYHzJU/OiAYWIxVfh4Q=; h=To:Cc:References:From:Subject:Date:In-Reply-To:From; b=xq2mfvRQHVaxVxy8zRw8DkVQav/pXV6zwPPedede+EhzpGTA47Lq2aTt/xqcYZcDw ofu8s66DxcogNZNjoxVqhKHU5l67vXhRBP8TTG61NI2X+VWZ7e94Rkn5AEUfKmtgsU kNCeoW9u5/OBxISpJpugPKGfaUCqHP12enel6nE8= To: Vittorio Bertola Cc: DoH WG References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> <1351299192.23919.1553762643258@appsuite.open-xchange.com> From: Stephen Farrell Openpgp: id=5BB5A6EA5765D2C5863CAE275AB2FAF17B172BEA; url= Autocrypt: addr=stephen.farrell@cs.tcd.ie; prefer-encrypt=mutual; keydata= mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nemCP5PMvmh 5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kTq0IqYzsEv5HI58S+ QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtEgvw4fVhVWJuyy3w//0F2tzKr EMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy+pAh4EKzS1FE7BOZp9daMu9MUQmDqtZU bUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqO Vz+7L+WiVfxLbeVqBwV+4uL9to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJg b097ZaNyuY1ETghVB5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k 4LyM2lp5FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9tlyWxn5Xi HzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQABtDJTdGVwaGVuIEZh cnJlbGwgKDIwMTcpIDxzdGVwaGVuLmZhcnJlbGxAY3MudGNkLmllPokCQAQTAQgAKgIbAwUJ CZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAUCWj6jdwIZAQAKCRBasvrxexcr6o7QD/9m x9DPJetmW794RXmNTrbTJ44zc/tJbcLdRBh0KBn9OW/EaAqjDmgNJeCMyJTKr1ywaps8HGUN hLEVkc14NUpgi4/Zkrbi3DmTp25OHj6wXBS5qVMyVynTMEIjOfeFFyxG+48od+Xn7qg6LT7G rHeNf+z/r0v9+8eZ1Ip63kshQDGhhpmRMKu4Ws9ZvTW2ACXkkTFaSGYJj3yIP4R6IgwBYGMz DXFX6nS4LA1s3pcPNxOgrvCyb60AiJZTLcOk/rRrpZtXB1XQc23ZZmrlTkl2HaThL6w3YKdi Ti1NbuMeOxZqtXcUshII45sANm4HuWNTiRh93Bn5bN6ddjgsaXEZBKUBuUaPBl7gQiQJcAlS 3MmGgVS4ZoX8+VaPGpXdQVFyBMRFlOKOC5XJESt7wY0RE2C8PFm+5eywSO/P1fkl9whkMgml 3OEuIQiP2ehRt/HVLMHkoM9CPQ7t6UwdrXrvX+vBZykav8x9U9M6KTgfsXytxUl6Vx5lPMLi 2/Jrsz6Mzh/IVZa3xjhq1OLFSI/tT2ji4FkJDQbO+yYUDhcuqfakDmtWLMxecZsY6O58A/95 8Qni6Xeq+Nh7zJ7wNcQOMoDGj+24di2TX1cKLzdDMWFaWzlNP5dB5VMwS9Wqj1Z6TzKjGjru q8soqohwb2CK9B3wzFg0Bs1iBI+2RuFnxLkCDQRaPVAyARAA+g3R0HzGr/Dl34Y07XqGqzq5 SU0nXIu9u8Ynsxj7gR5qb3HgUWYEWrHW2jHOByXnvkffucf5yzwrsvw8Q8iI8CFHiTYHPpey 4yPVn6R0w/FOMcY70eTIu/k6EEFDlDbs09DtKcrsT9bmN0XoRxITlXwWTufYqUnmS+YkAuk+ TLCtUin7OdaS2uU6Ata3PLQSeM2ZsUQMmYmHPwB9rmf+q2I005AJ9Q1SPQ2KNg/8xOGxo13S VuaSqYRQdpV93RuCOzg4vuXtR+gP0KQrus/P2ZCEPvU9cXF/2MIhXgOz207lv3iE2zGyNXld /n8spvWk+0bH5Zqd9Wcba/rGcBhmX9NKKDARZqjkv/zVEP1X97w1HsNYeUFNcg2lk9zQKb4v l1jx/Uz8ukzH2QNhU4R39dbF/4AwWuSVkGW6bTxHJqGs6YimbfdQqxTzmqFwz3JP0OtXX5q/ 6D4pHwcmJwEiDNzsBLl6skPSQ0Xyq3pua/qAP8MVm+YxCxJQITqZ8qjDLzoe7s9X6FLLC/DA L9kxl5saVSfDbuI3usH/emdtn0NA9/M7nfgih92zD92sl1yQXHT6BDa8xW1j+RU4P+E0wyd7 zgB2UeYgrp2IIcfG+xX2uFG5MJQ/nYfBoiALb0+dQHNHDtFnNGY3Oe8z1M9c5aDG3/s29QbJ +w7hEKKo9YMAEQEAAYkCJQQYAQgADwUCWj1QMgIbDAUJCZQmAAAKCRBasvrxexcr6qwvD/9b Rek3kfN8Q+jGrKl8qwY8HC5s4mhdDJZI/JP2FImf5J2+d5/e8UJ4fcsT79E0/FqX3Z9wZr6h sofPqLh1/YzDsYkZDHTYSGrlWGP/I5kXwUmFnBZHzM3WGrL3S7ZmCYMdudhykxXXjq7M6Do1 oxM8JofrXGtwBTLv5wfvvygJouVCVe87Ge7mCeY5vey1eUi4zSSF1zPpR6gg64w2g4TXM5qt SwkZVOv1g475LsGlYWRuJV8TA67yp1zJI7HkNqCo8KyHX0DPOh9c+Sd9ZX4aqKfqH9HIpnCL AYEgj7vofeix7gM3kQQmwynqq32bQGQBrKJEYp2vfeO30VsVx4dzuuiC5lyjUccVmw5D72J0 FlGrfEm0kw6D1qwyBg0SAMqamKN6XDdjhNAtXIaoA2UMZK/vZGGUKbqTgDdk0fnzOyb2zvXK CiPFKqIPAqKaDHg0JHdGI3KpQdRNLLzgx083EqEc6IAwWA6jSz+6lZDV6XDgF0lYqAYIkg3+ 6OUXUv6plMlwSHquiOc/MQXHfgUP5//Ra5JuiuyCj954FD+MBKIj8eWROfnzyEnBplVHGSDI ZLzL3pvV14dcsoajdeIH45i8DxnVm64BvEFHtLNlnliMrLOrk4shfmWyUqNlzilXN2BTFVFH 4MrnagFdcFnWYp1JPh96ZKjiqBwMv/H0kw== Message-ID: <2f52bab4-128f-3e38-6d21-54485623a20b@cs.tcd.ie> Date: Thu, 28 Mar 2019 11:29:03 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <1351299192.23919.1553762643258@appsuite.open-xchange.com> Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="GL7EfmseBjuB44D9lJ2HC5jBNX9fzBSzn" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 11:31:14 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --GL7EfmseBjuB44D9lJ2HC5jBNX9fzBSzn Content-Type: multipart/mixed; boundary="s1gTZdgDQTFzNvSlG2C1nCwd8YKF6baaG"; protected-headers="v1" From: Stephen Farrell To: Vittorio Bertola Cc: DoH WG Message-ID: <2f52bab4-128f-3e38-6d21-54485623a20b@cs.tcd.ie> Subject: Re: [Doh] Mozilla's plans re: DoH References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> <1351299192.23919.1553762643258@appsuite.open-xchange.com> In-Reply-To: <1351299192.23919.1553762643258@appsuite.open-xchange.com> --s1gTZdgDQTFzNvSlG2C1nCwd8YKF6baaG Content-Type: multipart/mixed; boundary="------------8F947C1EC2E00636D07E9509" Content-Language: en-GB This is a multi-part message in MIME format. --------------8F947C1EC2E00636D07E9509 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hiya, On 28/03/2019 08:44, Vittorio Bertola wrote: >=20 >> Il 27 marzo 2019 alle 23.46 Stephen Farrell < >> stephen.farrell@cs.tcd.ie mailto:stephen.farrell@cs.tcd.ie > ha >> scritto: >>=20 >> I do not accept the above as a useful distinction for this topic. >>=20 >> Those in the category of your first bullet can only be protected by >> technology when (essentially) all those in other categories use the >> same technology. (That said, I could quibble with your text, but >> won't for now:-) >>=20 >> But, and it's a big but, those whose safety is not at risk >> (today), also have valid interests to protect, and mechanisms that >> we have to offer for such protection need to be widely deployed to >> be effective. >>=20 > The problem is that, in DoH's "obfuscated traffic mode" (is that > better than "dissident mode"?),=20 Better, but still not good:-) I'm not sure we ought think about different modes of operation at all tbh - that may be assuming that we're dealing with a single dimension when we're not. > increased transport privacy for the > individual (not necessarily increased privacy, but that's a different > story) is obtained at the expense of network security.=20 I'm not sure that conclusion has been established. (It has been asserted certainly.) What does seem true is that some deployment models for DoH are inconsistent with use of some current network security tools. That doesn't mean there's no other way to get the same benefits, even if it may be disruptive. > Other tradeoff > points are possible, giving the user almost the same amount of > privacy but also more security, so while I find it justified to push > the tradeoff to the extreme side of privacy when someone's life and > freedom could be at risk,=20 As I've said, I don't think that's a good way to help us analyse the situation. > I would prefer a more balanced tradeoff > point (the one in which DoH traffic is clearly identifiable and can > be blocked by the network if necessary) in other contexts, at least > as the default. It could be that making DoH traffic visible as being DoH traffic has some role to play, or maybe it won't turn out that way. It is not at all clear to me though that doing that to enable blocking DoH traffic would be a useful mechanism - ISTM some applications (and all malware) would just avoid that. > More generally, beware that if you build an Internet that is designed > to work as if everyone on the planet were a dissident in an > authoritarian country, it is not unlikely that you will then get an > Internet regulatory and access environment that looks like the one of > authoritarian countries, even in democratic ones. +1 to what Adam said. Cheers, S. >=20 > Ciao, >=20 > -- >=20 > Vittorio Bertola | Head of Policy & Innovation, Open-Xchange=20 > vittorio.bertola@open-xchange.com > mailto:vittorio.bertola@open-xchange.com Office @ Via Treviso 12, > 10144 Torino, Italy >=20 >=20 > _______________________________________________ Doh mailing list=20 > Doh@ietf.org https://www.ietf.org/mailman/listinfo/doh >=20 --------------8F947C1EC2E00636D07E9509 Content-Type: application/pgp-keys; name="0x5AB2FAF17B172BEA.asc" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="0x5AB2FAF17B172BEA.asc" -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBFo9UDIBEADUH4ZPcUnX5WWRWO4kEkHea5Y5eEvZjSwe/YA+G0nrTuOU9nem CP5PMvmh5Cg8gBTyWyN4Z2+O25p9Tja5zUb+vPMWYvOtokRrp46yhFZOmiS5b6kT q0IqYzsEv5HI58S+QtaFq978CRa4xH9Gi9u4yzUmT03QNIGDXE37honcAM4MOEtE gvw4fVhVWJuyy3w//0F2tzKrEMjmL5VGuD/Q9+G/7abuXiYNNd9ZFjv4625AUWwy +pAh4EKzS1FE7BOZp9daMu9MUQmDqtZUbUv0Q+DnQAB/4tNncejJPz0p2z3MWCp5 iSwHiQvytYgatMp34a50l6CWqa13n6vY8VcPlIqOVz+7L+WiVfxLbeVqBwV+4uL9 to9zLF9IyUvl94lCxpscR2kgRgpM6A5LylRDkR6E0oudFnJgb097ZaNyuY1ETghV B5Uir1GCYChs8NUNumTHXiOkuzk+Gs4DAHx/a78YxBolKHi+esLH8r2k4LyM2lp5 FmBKjG7cGcpBGmWavACYEa7rwAadg4uBx9SHMV5i33vDXQUZcmW0vslQ2Is02NMK 7uB7E7HlVE1IM1zNkVTYYGkKreU8DVQu8qNOtPVE/CdaCJ/pbXoYeHz2B1Nvbl9t lyWxn5XiHzFPJleXc0ksb9SkJokAfwTSZzTxeQPER8la5lsEEPbU/cDTcwARAQAB tCFTdGVwaGVuIEZhcnJlbGwgPHN0ZXBoZW5AamVsbC5pZT6JAj0EEwEIACcFAlo9 UYwCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AACgkQWrL68XsXK+qG CxAApYHWYgGOIL3G6/OpkejdAkQoCVQAK8LJUSf6vzwost4iVfxIKcKW/3RqKNKk rRl8beJ7j1CWXAz9+VXAOsE9+zNxXIDgGA7HlvJnhffl+qwibVgiHgUcJFhCSbBr sjC+1uULaTU8zYEyET//GOGPLF+X+degkE/sesh4zcEAjF7fGPnlncdCCH3tvPZZ sdTcjwOCRVonKsDgQzBTCMz/RPBfEFX44HZx4g1UQAcCA4xlucY8QkJEyCrSNGpG nvGK8DcGSmnstl1/a9fnlhpdFxieX3oY2phJ1WKkYTn6Advrek3UP71CKxpgtPmk d3iUUz/VZa0Cv6YxQXskspRDVEvdCMYSQBtJPQ4y2+5UxVR9GIQXenwYp9AP2niv Voh+ITsDWWeWnnvYMq07rSDjq0nGdj41MJkNX+Yb2PXVyXItcj5ybE3T2+y3pSBG FEZYJGuaL4NwtBJFMOdOtBmUOPbetS2971EL3Izxb7ibOZWDwexv+8R6SWYfP1wV N3p46RyBQuXqJV8ccE11m6vtZTGSYgnLUUFZMRQYH+0hwuYe0T3AA18xDdSYsa8v ovCCd3l5S4UNzIM2PMChqGrEzKapUpZg7+8ACcxRU3b9Ihd7WYjJ+pQPCoWYKozv tEvenbNpE/govO/ED3B14e+R2yevRPjRrsN7PJzSf15fQLuJARwEEAEIAAYFAlo9 UqAACgkQLzyHNoBfjaLrSwf+MIHbFRQ4O5cmLYR5sIByWelN3SuRN/gW8rpKo9Ok Cz6An8uV/iCXy5tNMLzzi0BFl8f22DwBcC5qy9qnlIAdogWam1qWoTAoAD8veEqm uKhYrqJsCcAyNrKYmK0hP3rpHxx1LySDmKYXmw/8qtBXKHTouMm+5tSsznhykRMT AAr2p7PSaHgo+hIVaW/rKSspHjDhhZS+G9mtOZad1IH29M6G1Q1NCO0Ywe8krKLQ IAQlFxtgvOqpPOZNzeKBa/+KbE8TGgMWrkOhC8OeEM5PVzdDhlhD9kPzB/pCKDF5 DofJ/ZRqnDpbKPQ0bsW38AOig3kOc0A27awiBEw3urqR1YkCMwQQAQgAHRYhBH4X CgRchM9GDit5oBDvedn9g1MSBQJbtyScAAoJEBDvedn9g1MSI/oP/0A9J9nrnBMq Zpm857lfYWw+rshLK+tyeP4OQeOqnDFvs9jePpcyJLG3DF2r6VbVKPQq+AE6Uf5h cJBDEN6BjEhRPSbLcqG3A1cz/nNwm8rPmNp+oKhmaBBQGxwciMLmzgynsDydnjPp MyEs04zvsbsl4vrp2095o105l8KcrrxQrioFjbwveGwHQK9bxJKhx9D+gIk+MouB ur45UDKTZkMZrr9FGrtkyXCGAxvKdcNC5Oa8z9sj1rcUJfG/OpVAMWhArdlZbFUQ yoX6pU2Zb1CR2qpWAVerGSfBhmfCyStjARqaKxlftjO+Bj3Jj73Cr5eqej3qB5+V 4BCsPjr4RLvVbYUCPsRdxWc+nBLlfVYkRURu21g1hFm5KFPjgUkyo1s4vjUOY8Dy I+xLGF7f/IhUBG6l+Vswhpwu7ydalZkeFiPx5xna5NfbEYxvsIf71DvipGvIOaHv X4egWoFgm8n/9c3rcMxJtpwHPSsUt5dgLsyu6VE0IbvOAc3dN7CWJ355DVFJq9Zg 2YVf0izSpyyzJeGsgkfjW6xpmdvZxuT2UcN4BTcm6vYqueASGrb3lfhzC5gpeVsc /MoSjTS65vNWbpzONZWMZuLEFraxWJzC0JrDK3NCd0VN3kstqGkVbUIiYOnUm8Vu 4zoVMLlGWzHLIGoPRG2nRezn1YyNfyb5iQGcBBABCgAGBQJbxcflAAoJEGo7ETk8 pK1gE7QL/ApC5P68W5DrI1787WJVZv1u4t/g39vTr7Xer3UMTVQg10vpa7pmqOGh jIDzDMg3Pe3K3M7fVzfAlUA1qw6ne4RCueVoRKpubeF4AlYbMr0K6hNCPjt5uAxm bBVuejKTc6pru5rv5gKL0nDbr+Snft5xt7juBLSSimw0/41sZnkjCxo9rF/RA/v6 +uWyK171RKmsEYu8fFtw1eqUNt/Xj792TUixE3pxXheNtQtZGk/9P3W83ChhG4Fh 5EQsn0pIh9wZIAbMRLpgRKyW87fWHZC8/YH8h7afarvn9Thl5pFUldCe22mNJj6K LChn2aEHQd+PdY1GBpZEcmNEUPuovwzatM0h64hCzTm41eDqRfihZVBT7TbfXQnv 8rywa42Mk756RGzzEZcQEhwQXZcMQUfxIQQ2VyJo0zG36VdZTQF7TF/4Lz7/3cJ5 6jOIm+dwPXtu+C2wAQuD4USOLt4JWPYpqzDfHYJIND/497P9Z9SuQeahr2ez3DRB g3qsHEjBV7QyU3RlcGhlbiBGYXJyZWxsICgyMDE3KSA8c3RlcGhlbi5mYXJyZWxs QGNzLnRjZC5pZT6JAkAEEwEIACoCGwMFCQmUJgAFCwkIBwIGFQgJCgsCBBYCAwEC HgECF4AFAlo+o3cCGQEACgkQWrL68XsXK+qO0A//ZsfQzyXrZlu/eEV5jU620yeO M3P7SW3C3UQYdCgZ/TlvxGgKow5oDSXgjMiUyq9csGqbPBxlDYSxFZHNeDVKYIuP 2ZK24tw5k6duTh4+sFwUualTMlcp0zBCIzn3hRcsRvuPKHfl5+6oOi0+xqx3jX/s /69L/fvHmdSKet5LIUAxoYaZkTCruFrPWb01tgAl5JExWkhmCY98iD+EeiIMAWBj Mw1xV+p0uCwNbN6XDzcToK7wsm+tAIiWUy3DpP60a6WbVwdV0HNt2WZq5U5Jdh2k 4S+sN2CnYk4tTW7jHjsWarV3FLISCOObADZuB7ljU4kYfdwZ+WzenXY4LGlxGQSl AblGjwZe4EIkCXAJUtzJhoFUuGaF/PlWjxqV3UFRcgTERZTijguVyREre8GNERNg vDxZvuXssEjvz9X5JfcIZDIJpdzhLiEIj9noUbfx1SzB5KDPQj0O7elMHa1671/r wWcpGr/MfVPTOik4H7F8rcVJelceZTzC4tvya7M+jM4fyFWWt8Y4atTixUiP7U9o 4uBZCQ0GzvsmFA4XLqn2pA5rVizMXnGbGOjufAP/efEJ4ul3qvjYe8ye8DXEDjKA xo/tuHYtk19XCi83QzFhWls5TT+XQeVTMEvVqo9Wek8yoxo67qvLKKqIcG9givQd 8MxYNAbNYgSPtkbhZ8SJARwEEAEIAAYFAlo9UqAACgkQLzyHNoBfjaLzHAgAlWT6 NXEGtw/r1miKNGcopzvzILQ9oB8rKI9U9EL6tOf/y2V5oYee/GyQDb3ZdoPxxYYc Jf+RyiH1nMoqUIZiZJaf3bJXinDZ5+AdfE++UR2NBvqaNyC6u3r24jo1B/sagKbY tWgsYtRqHLD4IWi37MZrVyjBuF7u14Q07+uhjq6mX2O/tHpCYw/Q82tbeTRPyUf1 WQOAfD1kfBpW9PvAva5Iw9FWeXpCXRzwxnCZhYfGfqtuSw6CPBYLdbikqML6FZ7E DuTBb/8um1wK7Y9bgeIQC+CYjhYB5RXa1tDJRab2Js4luCvSR0w/CgHw26293tlv e2Q6UTrmHxP5U22DlokCPQQTAQgAJwUCWj1QMgIbAwUJCZQmAAULCQgHAgYVCAkK CwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6tJpD/4rrILH+meP07vrx8wW5eYuqCiP GYnh/CXxIF8eLrfbe5d4QRgtq+w6UeQPMyzKRIRiCoBXB2oJLBZHyxBPxZlg33dT MrEGn8QWKx2iNuz9rZMXyOSWFetuO01d/aUPd5BnbLbIyK5of8xCQlXM6KH8bc+9 gQ7edR9mfLTdvBf2FR522hg8BRBM1imKc3vO8v39+qIHHRjuiwxBBCAOhHtHRsZX ripS0uFA07dM46Oi/E8osjx6fQt/lH5z/PN+2adxYSrLSAXfr1oD3RxYNhuWgyGF L64/VCQb1YGjf0Z5MBPnWm9jgUoOY5K9eNSS0L83WeJjlF5+Q/WOgB+rb49Prm2D Feo9+S9f2V53Llz1WIspXJg6f+n9lmHE94MfQj1GAHCzI0FeL19lvM+LhD8jJSCb hrC3+yobyy/AUOs5Z3E+njjX1FF/VCVAs6iOa6i+XG+Y1hh3ir2y1kckJ5auT10M SU8GEZu9ayU4M3o3N9yxOjaoP0NuQ4MMLL/n/u4u94AeZaHPNBXn/hVfVRRmpRXt GKvJtFAEppGEYezB+bLKIm6XlpPkhnwYzleLZ7AMEco2C6QM8QPB3g3JpS3sqRhA 5rEP4lL16BmijmF+CHoPE/zwgKZbKpyVDqvIW5IDgvfIC2X4pbZDRvGIUKaGSB4+ ksZgUUnNyvfQr2p7jokCMwQQAQgAHRYhBH4XCgRchM9GDit5oBDvedn9g1MSBQJb tySbAAoJEBDvedn9g1MSeKkQAJm44jt1kwHgQgeDBKdjdvl0AjE0xVEQxriZ6lP/ l//34YT0auFfzsYIrChSpQXAEtobBAr4Ohw1Us+BZe+H5P8vm6LRuPwozC3SjwfX 4Iec8+9ot6tIVg4sbedDSgb/CCFVjsmIGcQ1P73JLJTBJ6mxYCV/gn3QC6bwDOFo 7kD9FDHCjRN8XfhHQ4Q9cYyt06uF31qG/aumgWYC9geCGgAwiHgwxNYb9GoJ0iZj CROwbYvLTcQgsVUW2bTmsVR13UVKDsdl02sRV7qcVYW6R0a3Ra8KudX+nt25H5DR Gd382KZ5W8pydsy/viTvD9z6v0ulChBYxAedIvGIClrhbxlLEPmIg4ImVOLGqsUg Vm32J95WOjEkk4PEZ12xSDBtwhSJqmJNboWlfmw43KdIbY8zNhffIO3N6O7FsdGx mqyHeLoTpqY+ySVUPpbuyW8ujnI/J//+6hdTZ9dQsEJQlWngKuWOQ5ma58MPSN88 zllsqhZAFQjNxqnkSzL6ZQ+v/jvuRRe16B80AeO55DsmbWsMv/YLLD1mSi7+Khy2 EtMBhgojWwrGMvdLN6X3mnzNJEscYyLxM9tSk+iySP2sLthK0BVgpAzBSdaf/ezI z60P+neHDzteNFf8Mn7lmgYk1amvZoJ29s5+n2HwxyRL5dVMyMdyQmntubbctfqr Z0tIiQGcBBABCgAGBQJbxcflAAoJEGo7ETk8pK1gnCYMAJY4FeIYjlIXGghFWzsB 4fYwK1+iaFpU3fSto5qcrqVtVPjXpwqczqBWeXGyQxiB0kan4OVAXydIeaP8EAuF CA7paP3s9STLJBO3KurkwyRkPW5zo0X7xVqaVToRsX2Ul98KVJoHYQD1KdezEtwl vpNwiiBr42AYR751Vm6JBVAbQXuFpB3c8bUV0OkkRxNFtL8/2PieHar58n5dntGk bPlPkztahsFqktgacIgXHX5vaT+7YeeZ1DWLOYjGO0wNhkOSeroCmxwJUikU7joB p823L7r5KfpqWTPpSCzVstQKZUGmmoE1qCswY/Ud5wvp9SccpIILkRXj0rZRtfnE 5MpL3hjmtNzfDd9qIsJtBJlSB2hZwAsVm1l+EWN9hG3tqyA43niUMy2n6q690of3 berSiQ+kvY/aC9Hx8I+bKzOV9/J2VUTqfaPZa4Uy2rVX5Q2p69n/PMj7mEer0rCL 3j9V16J9c+s0BSkXoKdtYdB0TWVhBgUybd9qtYcwHWvhP7QuU3RlcGhlbiBGYXJy ZWxsIDxzdGVwaGVuQHRvbGVyYW50bmV0d29ya3MuY29tPokCPQQTAQgAJwUCWj1R WgIbAwUJCZQmAAULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAKCRBasvrxexcr6jsc EADEcB0WQEZn2AkrzDs1RhL0Lp6cZi0BigofkbcGfdhJyMSs19C0dhvncrAFClVI 6/Udw3yFtDyYtOCf2W3M3A1K6/RfEizCLzTsdFIhni9gOJLlUpXViQtgrlstjk7h qVV3Ooz4BlCqS4cG7rfqf4LQQPpTAuFUEV9I28FBUB2irqC+v4gTysIgpMw0bA1y BU9sX5jE/tRkzqnuzZrkwiobDtRFJ9qp+7O2JtcY4EsVtLAsaodJKc5cF8R4OvB1 n66vxxcgg9Eh4JNWZ47xsaCmAGo1Bcb2jIY35OtgAL7gCGLRSMKTtAaPy1/fEgIq hCljJ9x40Fkn/3r2BX21WC9HFSPFTBz2RluLRzxdgxOrkYK8EiHUPoE5b1AEzZKw 2AbeXfr57f5zYsN3IqfbQLUjMYtUN1wK3Pjb+idD972wyXMWt8uOzlI7b9Ocu+nY m2whBfJv9Pmp3QYTmPz+LB9lH65VNVUSxSXVr5iWXO3qx1HtEiGEqkporMQCTh3T 5Ud3PvMSRBFFKNs9WhJ/Lxz+SV30WLwG6dr5mQqlzAhb4Phc/zekZyXRdS/oDKrB LUucS36O//49JeyRi1QvOfxnfmIqRIAf/k3PoYJmTo5E82//r5Qj3YGlRu78ba0H Arxs+ACD6AnEHHcbswpbtVEKYzlSu0Ar0Dc7vRWM/IyQdIkBHAQQAQgABgUCWj1S oAAKCRAvPIc2gF+NosIsB/9f/29FNla3BJfGIEIDnhrqGD0i9bSa89SqBd++uG06 TQgW5wsqtNcrwn81yZTq6XE6i9VtD4GKfqC0d4KZJr9bnbeD81cI64VOdL8zJWJs 0vj5EIXCobKyX74Kb4uePUyZqwT2Q74I116u/HwA9/FXsPo5isbh4ZqD4t0VHpWk mfq1FPT9a/JPyX46qKqB2Fce/7Qy+SQP1NfkuUlbhUH/JG9aSSYvk3lznNiH41x9 M+FDlL106itXOubrl3oi2fT3fsSedq7uzt+IV0DQEeNaoQAUuwEhdB8IWOMqN2wo DjGVKJftfsSWY9ilZrnDBNDrp0vRqcx33LUMkIw4d7iBiQIzBBABCAAdFiEEfhcK BFyEz0YOK3mgEO952f2DUxIFAlu3JJwACgkQEO952f2DUxJjuw/6ApHSsVTWD4a0 H6FJ23A9Ftpy+aXZ4vYlzkSrfsn2ECrEfK3lXQh/uzwjJUDYZeB1/BQsFZtcYNQO JSSHbQ49BFRLwb1J/wBZG4bbmrkLxnNbKDKQvzxEpclkMW0Dj0J6o7kGrmzIGGrh B+JJN99AcineHRug8ZSFIERRCmigxdhAKU0BFD7P+5HNHltSL3DF1c2fFOf2JrgB KVoE+9RhMZjWNbYetFFLCkjXb5Rpay9zeMm1DxfSTGAnuOwUXW6qq4hnl5+VC/48 ceDZElLLfu7RQUZv44pkSTOWZs+iQoJiHMFHk9wPqyB2Vok1yJ2a2j27WhXrJlPw nZbgJO5RyWDG3p/eVmpl5Uuc2dsfIpR17KnAuWpghK6V+cyFncDoGCl/YG2Mvool sW08FiZh3Ej4dnJjj25TZkeFG74JJDXLvMYpJfSBGnmETv4Dhcm2xPqVMuFuL1qJ lMbVLrMo2GXeo03OzNyvbs+u8WLIaGm5hC7N1CXY8wZs4jo6OJ/expvnc07dEuws 4zT3AiWv3nIouWReRStZy9QkavDocqbyPmilcdPCYk4BsOlzpwwO74hNG7iyl0Kd AlwTxGQ7y0rJou6HYa1TmRhIEr3vKvlW+JfUUrqtjXgsuacTXo4+Ira2JUErL2cY zQMq1j4r1ZyhFnuz93s7Rsx/Nw0+0YuJAZwEEAEKAAYFAlvFx+UACgkQajsROTyk rWCJqwv+NLVPE4sD4sDA2/6Ek7UsRIUkg+S39fhqWsLc4rtw/mDunv8Un61I3K04 fZ2Ry4nF9hZM0a710UvXFbStvrzRJO3EAAcdJR9LTCd19e8UeruQbIee3YT91U4N kC9JMpecfq62/teOAU2e5P3fWYaLs5ZX7zCLwWuBcW2l3SyoljQczM85HhJ3XHm+ FnwQ6D9xRle+lvWTcuC9d1yAyUb8IOospcL2lJTmy8e3r79R24hPlSB4LDe0wEN8 AXbagrcAQZjwyaHyWxjJbTwZ0b43WGdfIqZ1ElOeoffbketPGRmWvx5xUvb2ALFB BdETzV270gs5XDJgJ1SIIKOyDADxwvroTe2jD8C/841eEql5QSow3s/U3zRqk3mt tto8Qw/DN71aeh6dmYSsvd2UjsHw/vofOPRBGxZLEkKTEvMnhmMW9hiKPkPia+Qg evYE020qpKSxLEdWA8nprHwxmGiDNesCfXSC6vm1qfyj5g8HzxSckq9ZaMhKMCo7 vxflUEDuuQINBFo9UDIBEAD6DdHQfMav8OXfhjTteoarOrlJTSdci727xiezGPuB HmpvceBRZgRasdbaMc4HJee+R9+5x/nLPCuy/DxDyIjwIUeJNgc+l7LjI9WfpHTD 8U4xxjvR5Mi7+ToQQUOUNuzT0O0pyuxP1uY3RehHEhOVfBZO59ipSeZL5iQC6T5M sK1SKfs51pLa5ToC1rc8tBJ4zZmxRAyZiYc/AH2uZ/6rYjTTkAn1DVI9DYo2D/zE 4bGjXdJW5pKphFB2lX3dG4I7ODi+5e1H6A/QpCu6z8/ZkIQ+9T1xcX/YwiFeA7Pb TuW/eITbMbI1eV3+fyym9aT7Rsflmp31Zxtr+sZwGGZf00ooMBFmqOS//NUQ/Vf3 vDUew1h5QU1yDaWT3NApvi+XWPH9TPy6TMfZA2FThHf11sX/gDBa5JWQZbptPEcm oazpiKZt91CrFPOaoXDPck/Q61dfmr/oPikfByYnASIM3OwEuXqyQ9JDRfKrem5r +oA/wxWb5jELElAhOpnyqMMvOh7uz1foUssL8MAv2TGXmxpVJ8Nu4je6wf96Z22f Q0D38zud+CKH3bMP3ayXXJBcdPoENrzFbWP5FTg/4TTDJ3vOAHZR5iCunYghx8b7 Ffa4UbkwlD+dh8GiIAtvT51Ac0cO0Wc0Zjc57zPUz1zloMbf+zb1Bsn7DuEQoqj1 gwARAQABiQIlBBgBCAAPBQJaPVAyAhsMBQkJlCYAAAoJEFqy+vF7FyvqrC8P/1tF 6TeR83xD6MasqXyrBjwcLmziaF0Mlkj8k/YUiZ/knb53n97xQnh9yxPv0TT8Wpfd n3BmvqGyh8+ouHX9jMOxiRkMdNhIauVYY/8jmRfBSYWcFkfMzdYasvdLtmYJgx25 2HKTFdeOrszoOjWjEzwmh+tca3AFMu/nB++/KAmi5UJV7zsZ7uYJ5jm97LV5SLjN JIXXM+lHqCDrjDaDhNczmq1LCRlU6/WDjvkuwaVhZG4lXxMDrvKnXMkjseQ2oKjw rIdfQM86H1z5J31lfhqop+of0cimcIsBgSCPu+h96LHuAzeRBCbDKeqrfZtAZAGs okRina9947fRWxXHh3O66ILmXKNRxxWbDkPvYnQWUat8SbSTDoPWrDIGDRIAypqY o3pcN2OE0C1chqgDZQxkr+9kYZQpupOAN2TR+fM7JvbO9coKI8Uqog8CopoMeDQk d0YjcqlB1E0svODHTzcSoRzogDBYDqNLP7qVkNXpcOAXSVioBgiSDf7o5RdS/qmU yXBIeq6I5z8xBcd+BQ/n/9Frkm6K7IKP3ngUP4wEoiPx5ZE5+fPIScGmVUcZIMhk vMvem9XXh1yyhqN14gfjmLwPGdWbrgG8QUe0s2WeWIyss6uTiyF+ZbJSo2XOKVc3 YFMVUUfgyudqAV1wWdZinUk+H3pkqOKoHAy/8fST =3DYzQY -----END PGP PUBLIC KEY BLOCK----- --------------8F947C1EC2E00636D07E9509-- --s1gTZdgDQTFzNvSlG2C1nCwd8YKF6baaG-- --GL7EfmseBjuB44D9lJ2HC5jBNX9fzBSzn Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEW7Wm6ldl0sWGPK4nWrL68XsXK+oFAlycr/8ACgkQWrL68XsX K+qo6w/7BV9UP6Gj1rVQxs2GYLswF69xXlZA9W6eQVUOqtIkddW+wsifngjtFMgN StIOkKa+q9TxAX7dSPYN8/RIcBqWpIxifO9jCxkM+yO4QQz447HUJ651CCR200Eu bFcs+jLoqTOH7smBYhvBdJKW2+ZkoiPL5tow5fTvhSqs5mp8kdwUd2NAdSqSbP9D kxn02SDKOJ30Hz1w979FLqCNJPbmf6bbpwTqpaLMT/z5W9Or0pvWtak+Xuc8b1JO 63XWoKugz5ZN9IBrECAWQmONLqKOnT9jdrIm+73FCIKMBHaQtJvViOojo+Z8h35K PY2bjke9OLVWbb04E7sYgvVpHqanfGMMs2MP67yWWnnKAYqDliYKM4r9Hpni4mvV bNf2I4ZpPWH6l2E6IeP/RZdXNSsQk3swuLkzVq0zMfYpT7/9LpV0+2aQq7um2cIn w4UJc4STO4o7es4a9/eht8CI2s5c6Bpy1wED7mX2Uv18saKT+74p5jNyOkPaxbb7 0+Vrmb2RqUFkPLbQz+US8fAM1gfbAF6i7YcQjFGqJ8l0w6veHNl4+2ERpUbLNiTa pSxGCSnWZaHj7+4D0L8vhDOdJ9ufdjoMWYxILdkz/0Oku9mBEZJeOz+k1bCZKmku Gp2uuPSRmMKCrAQ7crDVn0sIkAJqojwDK6coGYXUlQBk/qvOMyA= =7xUP -----END PGP SIGNATURE----- --GL7EfmseBjuB44D9lJ2HC5jBNX9fzBSzn-- From nobody Thu Mar 28 08:56:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23735120013 for ; Thu, 28 Mar 2019 08:56:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ducksong.com header.b=RKuXUHXY; dkim=pass (2048-bit key) header.d=outbound.mailhop.org header.b=lz/LavUE Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n2Dk2moKMYjQ for ; Thu, 28 Mar 2019 08:56:08 -0700 (PDT) Received: from outbound1f.eu.mailhop.org (outbound1f.eu.mailhop.org [52.28.59.28]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6412B120003 for ; Thu, 28 Mar 2019 08:56:07 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553788565; cv=none; d=outbound.mailhop.org; s=arc-outbound20181012; b=W5EPh8UZwN1snnk7ULgp05MXvdnVn+MPyl0kbCN5P40o5OCP/0ufbN9IdUuigP8u5UIupbGHeSUAv bRqpKXmPqbVB1k08pveGJ+pCrz9P1+KvjZN2TtWdIMV4sGPUvmyOfHoNmDy9RVwwFSUHbpLr5u07bT mnaM6RxguzJm9ouP7xD/RTBLMKRacW+3wx17dEw5tlHLNn2M3lo4LfrUBBbbKHfxJZDA0dsy/vXqJV 6X/peFz3SdLb0m+1A7r7K1nSj7EzGmteLvbDvmtjBWM0FujcjlIR3mJMMkY2nR6kr3QhTg68HvAYle CVT/QVWcSAyZsUceynNpomfXwqTIVFA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=arc-outbound20181012; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:dkim-signature:dkim-signature:from; bh=X4u204lVioXeth1noSIvFTeHalT6YWse+CC9NI+rpk8=; b=qZVl2OwqoWOm2/rVwDZmA4YXnL/ZbkHRGRx6PlpidWFpYYg25WF8AVjZh7VTqPHYGuWwoIy39xxJR qTq/NuuN4+yHITnXtKZU2mr23T3FBFYJFLEQHi9tbnk78yq+zG9EXTRGzVJo/B9kqrX7sFWqiMpCpp fdSETj7cAr8fMwUW22dsqGf6nCinudRsJrKWdCYZB3qiv/UtzPF4fTCh9RpQY82HvhB2Dk1U9rtXrJ 8wjNpf7cNfGbZ6H3NHWV7cODEEnD12WxajevTID7GbqsVh+nqRhdrgQQBOeyZ1oEHScwOVbyQvo/Lj zU0aKeBPQhGk4El8YxsiIVHiAM8IGIw== ARC-Authentication-Results: i=1; outbound2.eu.mailhop.org; spf=pass smtp.mailfrom=ducksong.com smtp.remote-ip=209.85.210.48; dmarc=none header.from=ducksong.com; arc=none header.oldest-pass=0; DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ducksong.com; s=duo-1537391512170-ea99bbb3; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=X4u204lVioXeth1noSIvFTeHalT6YWse+CC9NI+rpk8=; b=RKuXUHXYfin2pocG5E+mi+Vbj6lBmpRIefq8l+A4XVhKv7OWGLWF5zyQ65ZOa3KVAwpe/z0xNtwHL va167O2sFh4JBiCs6LdDiYy0BfsIXh4dJc5lvpjL0zdp92bP61nGmM6Vg7tMprdmc6iAs4WOKbt3io GMatZBaP9vGKeJ+Y= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=outbound.mailhop.org; s=dkim-high; h=content-type:cc:to:subject:message-id:date:from:in-reply-to:references: mime-version:from; bh=X4u204lVioXeth1noSIvFTeHalT6YWse+CC9NI+rpk8=; b=lz/LavUE9I21O5Cw38ZWlRANRKdhvxDMfSv+c9d36IDrmIUxsmMAFnTuiamF2bi2/Ivf8MoCCZIaj pRojlCZ4uODmU4cv7c5nWN+YzmKZOynszhm9nJ6kq+trgb/CHgVv90UHahoTS1kullSdROxRyNVTWh 557UQC3bgpN4ajInl90bztoBmuNXsOsS373m4lIK/a1ma1EIvojswdqMKAIT/K+LXEDYfLGIP2lFIg Lox1Nm2mI1uCPpmsKDSfKkJ2m7szRYOmDWxotO2drG05Z5jFinAuDXnLJgdFDWyYm13DabavhGOiBb s2vQvj6X0cz2ShQh2bsbmy8ik7YmwgQ== X-MHO-RoutePath: bWNtYW51cw== X-MHO-User: fc90aa87-5171-11e9-803b-31925da7267c X-Report-Abuse-To: https://support.duocircle.com/support/solutions/articles/5000540958-duocircle-standard-smtp-abuse-information X-Originating-IP: 209.85.210.48 X-Mail-Handler: DuoCircle Outbound SMTP Received: from mail-ot1-f48.google.com (unknown [209.85.210.48]) by outbound2.eu.mailhop.org (Halon) with ESMTPSA id fc90aa87-5171-11e9-803b-31925da7267c; Thu, 28 Mar 2019 15:56:03 +0000 (UTC) Received: by mail-ot1-f48.google.com with SMTP id e5so18758713otk.12 for ; Thu, 28 Mar 2019 08:56:02 -0700 (PDT) X-Gm-Message-State: APjAAAVhkaaEA2ycDMFmyry56A5ZsjbdwyHi8xIBkU99rQfA6xJdpWMg eCb6ejzsFWsOT6XSneuqO+AatkWVjO90+gzURMw= X-Google-Smtp-Source: APXvYqzZPH4yK3ghRV4pQDwEWTX5E35Lle9pxzAUnfor288TzK7D/pfhGF366RmAr7HIv2eBMBGNe9wpVYMP5qz5vRE= X-Received: by 2002:a05:6830:183:: with SMTP id q3mr32577633ota.204.1553788561963; Thu, 28 Mar 2019 08:56:01 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Patrick McManus Date: Thu, 28 Mar 2019 16:55:50 +0100 X-Gmail-Original-Message-ID: Message-ID: To: John Carr Cc: "paul.hoffman@icann.org" , "mcmanus@ducksong.com" , "doh@ietf.org" Content-Type: multipart/alternative; boundary="0000000000004ac1d605852997ea" Archived-At: Subject: Re: [Doh] DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 15:56:11 -0000 --0000000000004ac1d605852997ea Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi John - I cannot speak for the IETF, nor am I in a position to effectively summarize all of the inputs over the year long process in building RFC 8484. However the consensus opinion of that work is reflected in that document. I can also refer you to the datatracker page for the working group which includes the mailing list archives and minutes from in person meetings while doing the work. https://datatracker.ietf.org/group/doh/about/ The final consensus document does contain some related content in section 10. Best Regards, -Patrick On Thu, Mar 28, 2019 at 3:54 PM John Carr wrote: > Hi Both, > > > > I refer to the IETF project on DNS queries over HTTPS (DoH) > > > > Could you tell me if, in the course of the deliberations which have been > taking place within the IETF structures in respect of DoH, any > consideration was given, or is being given, to the implications of this > standard in terms of its likely impact on filtering solutions which have > been implemented either on routers within individual households, or by > ISPs or other access providers, where the purpose of the filtering is > either to restrict access to known illegal content or it is to restrict > access to content which is considered inappropriate, e.g. for younger > family members? > > > > Many thanks, > > > > John Carr > > Secretary > > Children=E2=80=99s Charities=E2=80=99 Coalition on Internet Safety > > > > www.chis.org.uk > > > --0000000000004ac1d605852997ea Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi John - I cannot speak for the IETF, nor am I in a posit= ion to effectively summarize all of the inputs over the year long process i= n building RFC 8484. However the consensus opinion of that work is reflecte= d in that document. I can also refer you to the datatracker page for the wo= rking group which includes the mailing list archives and minutes from in pe= rson meetings while doing the work.=C2=A0https://datatracker.ietf.org/group/doh/about/= =C2=A0The final consensus document does contain some related content in sec= tion 10.

Best Regards,
-Patrick

On Th= u, Mar 28, 2019 at 3:54 PM John Carr <john@johncarr.eu> wrote:

Hi Both,

=C2=A0

I refer to the IETF project on DNS queries over HTTP= S (DoH)

=C2=A0

Could you tell me if, in the course of the deliberat= ions which have been taking place within the IETF structures in respect of = DoH, any consideration was given, or is being given, to the implications of= this standard in terms of its likely impact on filtering solutions which have been implemented either =C2=A0on = routers within individual households, or by ISPs or other access providers,= where the purpose of the filtering is either to restrict access to known i= llegal content or it is to restrict access to content which is considered inappropriate, e.g. for younger family memb= ers?

=C2=A0

Many thanks,

=C2=A0

John =C2=A0Carr

Secretary

Children=E2=80=99s Charities=E2=80=99 Coalition on I= nternet Safety

=C2=A0

www.chis.org.uk

=C2=A0

--0000000000004ac1d605852997ea-- From nobody Thu Mar 28 09:09:01 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2C110120096 for ; Thu, 28 Mar 2019 09:08:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.199 X-Spam-Level: X-Spam-Status: No, score=-4.199 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id B26Aqi5LtpTt for ; Thu, 28 Mar 2019 09:08:57 -0700 (PDT) Received: from ppsw-33.csi.cam.ac.uk (ppsw-33.csi.cam.ac.uk [131.111.8.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4D4A212008A for ; Thu, 28 Mar 2019 09:08:57 -0700 (PDT) X-Cam-AntiVirus: no malware found X-Cam-ScannerInfo: http://help.uis.cam.ac.uk/email-scanner-virus Received: from grey.csi.cam.ac.uk ([131.111.57.57]:34194) by ppsw-33.csi.cam.ac.uk (ppsw.cam.ac.uk [131.111.8.139]:25) with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) id 1h9XaJ-000mnp-gF (Exim 4.91) (return-path ); Thu, 28 Mar 2019 16:08:55 +0000 Date: Thu, 28 Mar 2019 16:08:55 +0000 From: Tony Finch To: Brian Dickson cc: Eric Rescorla , DoH WG In-Reply-To: Message-ID: References: User-Agent: Alpine 2.20 (DEB 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 16:08:59 -0000 Brian Dickson wrote: > > If you do QNAME minimization and compare the delegations returned from the > system resolver and DoH server, if they don't have identical results, that > should point to the need to use the system resolver. There are situations where that isn't sufficient, e.g. our private zone has the same name servers for its internal and external views. (Also QNAME minimization in the client to a cloudy resolver is going to be really slow!) Tony. -- f.anthony.n.finch http://dotat.at/ Fair Isle: Southwest 7 to severe gale 9, veering west 6 to gale 8 later. Rough or very rough, occasionally moderate in southeast, but high at first in west. Occasional rain later. Good, occasionally moderate later, but poor at first in west. From nobody Thu Mar 28 09:29:53 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8FDA212008A for ; Thu, 28 Mar 2019 09:20:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=johncarr.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D3Rkw-UKf5ka for ; Thu, 28 Mar 2019 09:20:11 -0700 (PDT) Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60106.outbound.protection.outlook.com [40.107.6.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 46A24120096 for ; Thu, 28 Mar 2019 09:20:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=johncarr.onmicrosoft.com; s=selector1-johncarr-eu; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wDGESrIxtT3wbpPH9ncjkcK1bytscaX7zjTiE1qyejo=; b=j14GsW0o0f4mDlqrYbCtg7jcXYQoH1QH389xmfJhhZPfscX83b2g3gW2ypYeL10CPNePNJdhWTpdOc2Ybuk6uMfgR5e0J/acAxfxouYAEFSijOINmisuzOxL2neueb8u8/UnEQgumPsUibhm8YIPnRBwdaS81M1lad6RazRl73A= Received: from DB7PR03MB4698.eurprd03.prod.outlook.com (20.176.235.214) by DB7PR03MB4761.eurprd03.prod.outlook.com (20.176.236.13) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.15; Thu, 28 Mar 2019 16:20:07 +0000 Received: from DB7PR03MB4698.eurprd03.prod.outlook.com ([fe80::6cd4:7f3a:2e8e:670b]) by DB7PR03MB4698.eurprd03.prod.outlook.com ([fe80::6cd4:7f3a:2e8e:670b%5]) with mapi id 15.20.1750.014; Thu, 28 Mar 2019 16:20:07 +0000 From: John Carr To: Patrick McManus CC: "paul.hoffman@icann.org" , "doh@ietf.org" Thread-Topic: DoH Thread-Index: AdTldH+LSciD1yZYTp6B3rJaUBvVvQACjd8AAADBcIA= Date: Thu, 28 Mar 2019 16:20:07 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=john@johncarr.eu; x-originating-ip: [82.47.181.3] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: c7d14966-953f-43f5-ac20-08d6b3993e6e x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(7021145)(8989299)(5600127)(711020)(4605104)(4534185)(7022145)(4603075)(4627221)(201702281549075)(8990200)(7048125)(7024125)(7027125)(7023125)(2017052603328)(7153060)(7193020); SRVR:DB7PR03MB4761; x-ms-traffictypediagnostic: DB7PR03MB4761: x-ms-exchange-purlcount: 2 x-microsoft-antispam-prvs: x-forefront-prvs: 0990C54589 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(39830400003)(346002)(376002)(366004)(136003)(189003)(199004)(6506007)(4326008)(53546011)(55016002)(6916009)(186003)(9686003)(53386004)(53936002)(229853002)(486006)(236005)(790700001)(6116002)(54896002)(446003)(3846002)(11346002)(6246003)(102836004)(2906002)(76176011)(26005)(6306002)(316002)(606006)(25786009)(508600001)(54906003)(99286004)(476003)(7696005)(86362001)(106356001)(97736004)(5660300002)(966005)(14444005)(52536014)(66574012)(7736002)(221733001)(105586002)(33656002)(66066001)(6436002)(74482002)(14454004)(81156014)(68736007)(8936002)(71200400001)(74316002)(256004)(81166006)(7116003)(71190400001)(8676002)(3480700005); DIR:OUT; SFP:1102; SCL:1; SRVR:DB7PR03MB4761; H:DB7PR03MB4698.eurprd03.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: johncarr.eu does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: lBYZY3217nfcyddKBY/fYnGaitlgvUBfuin9q95k+23TqhhzyiAUYoFw1EPgHHy1MUYFnJwc38V/nGum9zrfIAwiapL9ejf+uaf644iC+O1kL5G9AAgC3IHvuT2ZS6mYTpPM8YeAVLrBcbzr7pw1wI+raq18rc5XjJPTVnfNluoA2nlEs8871nQdFIqM3/AVP4gxyD7R+hfQEb3FOz69yS+KazaAzURSC7Nd0tEiWIwgsTmQOsDBR0H9BLXKWYcQ7tYv5ly0Wds0W+ZvOBw7z/bBzVrScfFbjPBChztsZl00/CzemnBqJhjEqhE3G+GaUcvaVmyN8xhICc6DL/5hB7iz9g8YW16Pe2ycqLR+fhysl68yxn/cUEOn72MYU0eMiwpleqCWqOwGpokpo3LT7KeOUTNHE+hWdwd4gUOdKkI= Content-Type: multipart/alternative; boundary="_000_DB7PR03MB4698A645255E883C9CC07AC3C6590DB7PR03MB4698eurp_" MIME-Version: 1.0 X-OriginatorOrg: johncarr.eu X-MS-Exchange-CrossTenant-Network-Message-Id: c7d14966-953f-43f5-ac20-08d6b3993e6e X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2019 16:20:07.7992 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 116a4049-d222-4a18-a59e-1c70be95b47b X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB7PR03MB4761 Archived-At: X-Mailman-Approved-At: Thu, 28 Mar 2019 09:29:52 -0700 Subject: Re: [Doh] DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 16:20:14 -0000 --_000_DB7PR03MB4698A645255E883C9CC07AC3C6590DB7PR03MB4698eurp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 TWFueSB0aGFua3MuIEkgcmVwcmVzZW50IGNoaWxkcmVu4oCZcyBvcmdhbml6YXRpb25zIHdoaWNo IGRvIG5vdCBoYXZlICB0aGUgcmVzb3VyY2VzIHRvIHRyYWNrIHRoZSBjb21wbGV4aXRpZXMgb3Ig aW5zIGFuZCBvdXRzIG9mIHNvbWUgb2YgdGhlc2Ugc29ydHMgb2YgaXNzdWVzLg0KDQpQZXJoYXBz IHRoZXJlIGlzIHNvbWVvbmUgb24gdGhlIGxpc3Qgd2hvIGtub3dzIHRoZSBhbnN3ZXIgdG8gbXkg cXVlc3Rpb24/IE9yIGFyZSB5b3Ugc2F5aW5nIEkgbXVzdCB3YWRlIHRocm91Z2ggdGhlIHdob2xl IHNob290aW5nIG1hdGNoIGFuZCB3b3JrIGl0IGZvciBteXNlbGY/DQoNCkpvaG4NCg0KRnJvbTog UGF0cmljayBNY01hbnVzIDxtY21hbnVzQGR1Y2tzb25nLmNvbT4NClNlbnQ6IDI4IE1hcmNoIDIw MTkgMTU6NTYNClRvOiBKb2huIENhcnIgPGpvaG5Aam9obmNhcnIuZXU+DQpDYzogcGF1bC5ob2Zm bWFuQGljYW5uLm9yZzsgbWNtYW51c0BkdWNrc29uZy5jb207IGRvaEBpZXRmLm9yZw0KU3ViamVj dDogUmU6IERvSA0KDQpIaSBKb2huIC0gSSBjYW5ub3Qgc3BlYWsgZm9yIHRoZSBJRVRGLCBub3Ig YW0gSSBpbiBhIHBvc2l0aW9uIHRvIGVmZmVjdGl2ZWx5IHN1bW1hcml6ZSBhbGwgb2YgdGhlIGlu cHV0cyBvdmVyIHRoZSB5ZWFyIGxvbmcgcHJvY2VzcyBpbiBidWlsZGluZyBSRkMgODQ4NC4gSG93 ZXZlciB0aGUgY29uc2Vuc3VzIG9waW5pb24gb2YgdGhhdCB3b3JrIGlzIHJlZmxlY3RlZCBpbiB0 aGF0IGRvY3VtZW50LiBJIGNhbiBhbHNvIHJlZmVyIHlvdSB0byB0aGUgZGF0YXRyYWNrZXIgcGFn ZSBmb3IgdGhlIHdvcmtpbmcgZ3JvdXAgd2hpY2ggaW5jbHVkZXMgdGhlIG1haWxpbmcgbGlzdCBh cmNoaXZlcyBhbmQgbWludXRlcyBmcm9tIGluIHBlcnNvbiBtZWV0aW5ncyB3aGlsZSBkb2luZyB0 aGUgd29yay4gaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9ncm91cC9kb2gvYWJvdXQvIFRo ZSBmaW5hbCBjb25zZW5zdXMgZG9jdW1lbnQgZG9lcyBjb250YWluIHNvbWUgcmVsYXRlZCBjb250 ZW50IGluIHNlY3Rpb24gMTAuDQoNCkJlc3QgUmVnYXJkcywNCi1QYXRyaWNrDQoNCk9uIFRodSwg TWFyIDI4LCAyMDE5IGF0IDM6NTQgUE0gSm9obiBDYXJyIDxqb2huQGpvaG5jYXJyLmV1PG1haWx0 bzpqb2huQGpvaG5jYXJyLmV1Pj4gd3JvdGU6DQpIaSBCb3RoLA0KDQpJIHJlZmVyIHRvIHRoZSBJ RVRGIHByb2plY3Qgb24gRE5TIHF1ZXJpZXMgb3ZlciBIVFRQUyAoRG9IKQ0KDQpDb3VsZCB5b3Ug dGVsbCBtZSBpZiwgaW4gdGhlIGNvdXJzZSBvZiB0aGUgZGVsaWJlcmF0aW9ucyB3aGljaCBoYXZl IGJlZW4gdGFraW5nIHBsYWNlIHdpdGhpbiB0aGUgSUVURiBzdHJ1Y3R1cmVzIGluIHJlc3BlY3Qg b2YgRG9ILCBhbnkgY29uc2lkZXJhdGlvbiB3YXMgZ2l2ZW4sIG9yIGlzIGJlaW5nIGdpdmVuLCB0 byB0aGUgaW1wbGljYXRpb25zIG9mIHRoaXMgc3RhbmRhcmQgaW4gdGVybXMgb2YgaXRzIGxpa2Vs eSBpbXBhY3Qgb24gZmlsdGVyaW5nIHNvbHV0aW9ucyB3aGljaCBoYXZlIGJlZW4gaW1wbGVtZW50 ZWQgZWl0aGVyICBvbiByb3V0ZXJzIHdpdGhpbiBpbmRpdmlkdWFsIGhvdXNlaG9sZHMsIG9yIGJ5 IElTUHMgb3Igb3RoZXIgYWNjZXNzIHByb3ZpZGVycywgd2hlcmUgdGhlIHB1cnBvc2Ugb2YgdGhl IGZpbHRlcmluZyBpcyBlaXRoZXIgdG8gcmVzdHJpY3QgYWNjZXNzIHRvIGtub3duIGlsbGVnYWwg Y29udGVudCBvciBpdCBpcyB0byByZXN0cmljdCBhY2Nlc3MgdG8gY29udGVudCB3aGljaCBpcyBj b25zaWRlcmVkIGluYXBwcm9wcmlhdGUsIGUuZy4gZm9yIHlvdW5nZXIgZmFtaWx5IG1lbWJlcnM/ DQoNCk1hbnkgdGhhbmtzLA0KDQpKb2huICBDYXJyDQpTZWNyZXRhcnkNCkNoaWxkcmVu4oCZcyBD aGFyaXRpZXPigJkgQ29hbGl0aW9uIG9uIEludGVybmV0IFNhZmV0eQ0KDQp3d3cuY2hpcy5vcmcu dWs8aHR0cDovL3d3dy5jaGlzLm9yZy51az4NCg0K --_000_DB7PR03MB4698A645255E883C9CC07AC3C6590DB7PR03MB4698eurp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 IkNhbWJyaWEgTWF0aCI7DQoJcGFub3NlLTE6MiA0IDUgMyA1IDQgNiAzIDIgNDt9DQpAZm9udC1m YWNlDQoJe2ZvbnQtZmFtaWx5OkNhbGlicmk7DQoJcGFub3NlLTE6MiAxNSA1IDIgMiAyIDQgMyAy IDQ7fQ0KLyogU3R5bGUgRGVmaW5pdGlvbnMgKi8NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWws IGRpdi5Nc29Ob3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJ Zm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjt9DQph OmxpbmssIHNwYW4uTXNvSHlwZXJsaW5rDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xv cjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxpbmU7fQ0KYTp2aXNpdGVkLCBzcGFuLk1z b0h5cGVybGlua0ZvbGxvd2VkDQoJe21zby1zdHlsZS1wcmlvcml0eTo5OTsNCgljb2xvcjpwdXJw bGU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQpwLm1zb25vcm1hbDAsIGxpLm1zb25v cm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCgltc28t bWFyZ2luLXRvcC1hbHQ6YXV0bzsNCgltYXJnaW4tcmlnaHQ6MGNtOw0KCW1zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvOw0KCW1hcmdpbi1sZWZ0OjBjbTsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZv bnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0KLk1zb0NocERlZmF1bHQNCgl7bXNvLXN0eWxl LXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJ bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVM7fQ0KQHBhZ2UgV29yZFNlY3Rpb24xDQoJe3NpemU6 NjEyLjBwdCA3OTIuMHB0Ow0KCW1hcmdpbjo3Mi4wcHQgNzIuMHB0IDcyLjBwdCA3Mi4wcHQ7fQ0K ZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9uMTt9DQotLT48L3N0eWxlPjwhLS1b aWYgZ3RlIG1zbyA5XT48eG1sPg0KPG86c2hhcGVkZWZhdWx0cyB2OmV4dD0iZWRpdCIgc3BpZG1h eD0iMTAyNiIgLz4NCjwveG1sPjwhW2VuZGlmXS0tPjwhLS1baWYgZ3RlIG1zbyA5XT48eG1sPg0K PG86c2hhcGVsYXlvdXQgdjpleHQ9ImVkaXQiPg0KPG86aWRtYXAgdjpleHQ9ImVkaXQiIGRhdGE9 IjEiIC8+DQo8L286c2hhcGVsYXlvdXQ+PC94bWw+PCFbZW5kaWZdLS0+DQo8L2hlYWQ+DQo8Ym9k eSBsYW5nPSJFTi1HQiIgbGluaz0iYmx1ZSIgdmxpbms9InB1cnBsZSI+DQo8ZGl2IGNsYXNzPSJX b3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJl YXN0LWxhbmd1YWdlOkVOLVVTIj5NYW55IHRoYW5rcy4gSSByZXByZXNlbnQgY2hpbGRyZW7igJlz IG9yZ2FuaXphdGlvbnMgd2hpY2ggZG8gbm90IGhhdmUmbmJzcDsgdGhlIHJlc291cmNlcyB0byB0 cmFjayB0aGUgY29tcGxleGl0aWVzIG9yIGlucyBhbmQgb3V0cyBvZiBzb21lIG9mIHRoZXNlIHNv cnRzIG9mIGlzc3Vlcy48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFs Ij48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFy ZWFzdC1sYW5ndWFnZTpFTi1VUyI+UGVyaGFwcyB0aGVyZSBpcyBzb21lb25lIG9uIHRoZSBsaXN0 IHdobyBrbm93cyB0aGUgYW5zd2VyIHRvIG15IHF1ZXN0aW9uPyBPciBhcmUgeW91IHNheWluZyBJ IG11c3Qgd2FkZSB0aHJvdWdoIHRoZSB3aG9sZSBzaG9vdGluZyBtYXRjaCBhbmQgd29yayBpdCBm b3IgbXlzZWxmPzxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0 LWxhbmd1YWdlOkVOLVVTIj5Kb2huIDxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFu Zz0iRU4tVVMiPkZyb206PC9zcGFuPjwvYj48c3BhbiBsYW5nPSJFTi1VUyI+IFBhdHJpY2sgTWNN YW51cyAmbHQ7bWNtYW51c0BkdWNrc29uZy5jb20mZ3Q7DQo8YnI+DQo8Yj5TZW50OjwvYj4gMjgg TWFyY2ggMjAxOSAxNTo1Njxicj4NCjxiPlRvOjwvYj4gSm9obiBDYXJyICZsdDtqb2huQGpvaG5j YXJyLmV1Jmd0Ozxicj4NCjxiPkNjOjwvYj4gcGF1bC5ob2ZmbWFuQGljYW5uLm9yZzsgbWNtYW51 c0BkdWNrc29uZy5jb207IGRvaEBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogRG9I PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8 L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgSm9obiAtIEkgY2Fubm90 IHNwZWFrIGZvciB0aGUgSUVURiwgbm9yIGFtIEkgaW4gYSBwb3NpdGlvbiB0byBlZmZlY3RpdmVs eSBzdW1tYXJpemUgYWxsIG9mIHRoZSBpbnB1dHMgb3ZlciB0aGUgeWVhciBsb25nIHByb2Nlc3Mg aW4gYnVpbGRpbmcgUkZDIDg0ODQuIEhvd2V2ZXIgdGhlIGNvbnNlbnN1cyBvcGluaW9uIG9mIHRo YXQgd29yayBpcyByZWZsZWN0ZWQgaW4gdGhhdCBkb2N1bWVudC4gSSBjYW4gYWxzbw0KIHJlZmVy IHlvdSB0byB0aGUgZGF0YXRyYWNrZXIgcGFnZSBmb3IgdGhlIHdvcmtpbmcgZ3JvdXAgd2hpY2gg aW5jbHVkZXMgdGhlIG1haWxpbmcgbGlzdCBhcmNoaXZlcyBhbmQgbWludXRlcyBmcm9tIGluIHBl cnNvbiBtZWV0aW5ncyB3aGlsZSBkb2luZyB0aGUgd29yay4mbmJzcDs8YSBocmVmPSJodHRwczov L2RhdGF0cmFja2VyLmlldGYub3JnL2dyb3VwL2RvaC9hYm91dC8iPmh0dHBzOi8vZGF0YXRyYWNr ZXIuaWV0Zi5vcmcvZ3JvdXAvZG9oL2Fib3V0LzwvYT4mbmJzcDtUaGUNCiBmaW5hbCBjb25zZW5z dXMgZG9jdW1lbnQgZG9lcyBjb250YWluIHNvbWUgcmVsYXRlZCBjb250ZW50IGluIHNlY3Rpb24g MTAuPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJz cDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5CZXN0IFJl Z2FyZHMsPG86cD48L286cD48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+LVBhdHJp Y2s8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiBUaHUsIE1hciAyOCwgMjAxOSBhdCAzOjU0IFBNIEpvaG4gQ2FyciAmbHQ7PGEg aHJlZj0ibWFpbHRvOmpvaG5Aam9obmNhcnIuZXUiPmpvaG5Aam9obmNhcnIuZXU8L2E+Jmd0OyB3 cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpu b25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7cGFkZGluZzowY20gMGNtIDBjbSA2 LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6MGNtIj4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj5IaSBCb3RoLDxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+SSByZWZlciB0byB0aGUgSUVURiBwcm9qZWN0IG9uIEROUyBxdWVyaWVzIG92ZXIgSFRUUFMg KERvSCk8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFy Z2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkNvdWxkIHlvdSB0ZWxsIG1lIGlmLCBp biB0aGUgY291cnNlIG9mIHRoZSBkZWxpYmVyYXRpb25zIHdoaWNoIGhhdmUgYmVlbiB0YWtpbmcg cGxhY2Ugd2l0aGluIHRoZSBJRVRGIHN0cnVjdHVyZXMgaW4gcmVzcGVjdCBvZiBEb0gsIGFueSBj b25zaWRlcmF0aW9uIHdhcyBnaXZlbiwgb3IgaXMgYmVpbmcgZ2l2ZW4sDQogdG8gdGhlIGltcGxp Y2F0aW9ucyBvZiB0aGlzIHN0YW5kYXJkIGluIHRlcm1zIG9mIGl0cyBsaWtlbHkgaW1wYWN0IG9u IGZpbHRlcmluZyBzb2x1dGlvbnMgd2hpY2ggaGF2ZSBiZWVuIGltcGxlbWVudGVkIGVpdGhlciAm bmJzcDtvbiByb3V0ZXJzIHdpdGhpbiBpbmRpdmlkdWFsIGhvdXNlaG9sZHMsIG9yIGJ5IElTUHMg b3Igb3RoZXIgYWNjZXNzIHByb3ZpZGVycywgd2hlcmUgdGhlIHB1cnBvc2Ugb2YgdGhlIGZpbHRl cmluZyBpcyBlaXRoZXIgdG8gcmVzdHJpY3QNCiBhY2Nlc3MgdG8ga25vd24gaWxsZWdhbCBjb250 ZW50IG9yIGl0IGlzIHRvIHJlc3RyaWN0IGFjY2VzcyB0byBjb250ZW50IHdoaWNoIGlzIGNvbnNp ZGVyZWQgaW5hcHByb3ByaWF0ZSwgZS5nLiBmb3IgeW91bmdlciBmYW1pbHkgbWVtYmVycz88bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPk1hbnkgdGhhbmtzLDxvOnA+PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJn aW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1h bHQ6YXV0byI+Sm9obiAmbmJzcDtDYXJyPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0 OmF1dG8iPlNlY3JldGFyeTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5D aGlsZHJlbuKAmXMgQ2hhcml0aWVz4oCZIENvYWxpdGlvbiBvbiBJbnRlcm5ldCBTYWZldHk8bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1h bHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5ic3A7PG86cD48L286cD48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNv LW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPjxhIGhyZWY9Imh0dHA6Ly93d3cuY2hpcy5vcmcudWsi IHRhcmdldD0iX2JsYW5rIj53d3cuY2hpcy5vcmcudWs8L2E+PG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdp bi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_DB7PR03MB4698A645255E883C9CC07AC3C6590DB7PR03MB4698eurp_-- From nobody Thu Mar 28 10:09:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF8D91202AD for ; Thu, 28 Mar 2019 10:08:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.678 X-Spam-Level: X-Spam-Status: No, score=-1.678 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tV-Kmm2ajhvr for ; Thu, 28 Mar 2019 10:08:51 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F362C12002F for ; Thu, 28 Mar 2019 10:08:49 -0700 (PDT) Received: from dhcp-8111.meeting.ietf.org (dhcp-8111.meeting.ietf.org [31.133.129.17]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2SH8MaF061105 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 28 Mar 2019 12:08:25 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553792907; bh=a/sgZjTN8U113WxAFXzRQXdJ/fGEMOK8h00PwKc+ul8=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=k8sEN+WHjL5YqQERMnXM8GUjpQ3mbxoy1Ze1lHUegaQ+cOMV8pYR0UbF92fYF4+xD ngGNbrukoe+QX+CZZoVVknNbxXkWCxdZr7uPLJ+VSH10IEw6JItdknscfOUZNQda1E YIqmaFcLhTz1Uml6US+4DfD7HndQ3VxHIMw3967I= To: John Carr , Patrick McManus Cc: "paul.hoffman@icann.org" , "doh@ietf.org" References: From: Adam Roach Message-ID: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> Date: Thu, 28 Mar 2019 18:08:21 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------119E21806CBB1AC342FB0341" Content-Language: en-US Archived-At: Subject: Re: [Doh] DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 17:08:58 -0000 This is a multi-part message in MIME format. --------------119E21806CBB1AC342FB0341 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit [speaking as an individual contributor] John -- The issue you're raising is not inherent to the DoH protocol. Since the advent of public DNS servers, which started to gain significant popularity with Google's service offering a decade ago [1], the various DNS-based approaches of content restriction that you describe in your original message have been fairly easily circumventable (e.g. by changing the DNS settings on a local machine, using TOR browser, or by using a VPN). There has been significant discussion within the IETF, especially over the past few weeks, of some of the operational changes that result from the difference between DoH and other means of accessing DNS. These changes do have some bearing on sophisticated network operators, such as those who administer enterprise networks. For the types of home networks you mention, which generally lack professional and dedicated network administrators, DoH does not inherently represent any significant change to the decade-old status quo resulting from publicly-available DNS. There has also been some speculation about, and announcements of, future behaviors that some applications -- notably, web browsers -- may choose to exhibit. While the development of the DoH protocol might have focused and potentially accelerated the decisions made by the vendors of those applications, it should be noted that the behaviors enabled by DoH are possible without any standardized protocol, and that browser vendors in particular were almost certainly going to deploy equivalent technology regardless of whether such standardization took place. As the IETF itself only has that information that has been sent to the DoH mailing list, it seems unlikely that you could get any useful answers to the questions you raise except for by contacting the vendors of such applications through their official public comms channels. /a ____ [1] https://en.wikipedia.org/wiki/Google_Public_DNS On 3/28/19 17:20, John Carr wrote: > > Many thanks. I represent children’s organizations which do not have  > the resources to track the complexities or ins and outs of some of > these sorts of issues. > > Perhaps there is someone on the list who knows the answer to my > question? Or are you saying I must wade through the whole shooting > match and work it for myself? > > John > > *From:*Patrick McManus > *Sent:* 28 March 2019 15:56 > *To:* John Carr > *Cc:* paul.hoffman@icann.org; mcmanus@ducksong.com; doh@ietf.org > *Subject:* Re: DoH > > Hi John - I cannot speak for the IETF, nor am I in a position to > effectively summarize all of the inputs over the year long process in > building RFC 8484. However the consensus opinion of that work is > reflected in that document. I can also refer you to the datatracker > page for the working group which includes the mailing list archives > and minutes from in person meetings while doing the work. > https://datatracker.ietf.org/group/doh/about/ The final consensus > document does contain some related content in section 10. > > Best Regards, > > -Patrick > > On Thu, Mar 28, 2019 at 3:54 PM John Carr > wrote: > > Hi Both, > > I refer to the IETF project on DNS queries over HTTPS (DoH) > > Could you tell me if, in the course of the deliberations which > have been taking place within the IETF structures in respect of > DoH, any consideration was given, or is being given, to the > implications of this standard in terms of its likely impact on > filtering solutions which have been implemented either  on routers > within individual households, or by ISPs or other access > providers, where the purpose of the filtering is either to > restrict access to known illegal content or it is to restrict > access to content which is considered inappropriate, e.g. for > younger family members? > > Many thanks, > > John  Carr > > Secretary > > Children’s Charities’ Coalition on Internet Safety > > www.chis.org.uk > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh --------------119E21806CBB1AC342FB0341 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
[speaking as an individual contributor]

John --

The issue you're raising is not inherent to the DoH protocol. Since the advent of public DNS servers, which started to gain significant popularity with Google's service offering a decade ago [1], the various DNS-based approaches of content restriction that you describe in your original message have been fairly easily circumventable (e.g. by changing the DNS settings on a local machine, using TOR browser, or by using a VPN).

There has been significant discussion within the IETF, especially over the past few weeks, of some of the operational changes that result from the difference between DoH and other means of accessing DNS. These changes do have some bearing on sophisticated network operators, such as those who administer enterprise networks. For the types of home networks you mention, which generally lack professional and dedicated network administrators, DoH does not inherently represent any significant change to the decade-old status quo resulting from publicly-available DNS.

There has also been some speculation about, and announcements of, future behaviors that some applications -- notably, web browsers -- may choose to exhibit. While the development of the DoH protocol might have focused and potentially accelerated the decisions made by the vendors of those applications, it should be noted that the behaviors enabled by DoH are possible without any standardized protocol, and that browser vendors in particular were almost certainly going to deploy equivalent technology regardless of whether such standardization took place. As the IETF itself only has that information that has been sent to the DoH mailing list, it seems unlikely that you could get any useful answers to the questions you raise except for by contacting the vendors of such applications through their official public comms channels.

/a

____
[1] https://en.wikipedia.org/wiki/Google_Public_DNS

On 3/28/19 17:20, John Carr wrote:

Many thanks. I represent children’s organizations which do not have  the resources to track the complexities or ins and outs of some of these sorts of issues.

 

Perhaps there is someone on the list who knows the answer to my question? Or are you saying I must wade through the whole shooting match and work it for myself?

 

John

 

From: Patrick McManus <mcmanus@ducksong.com>
Sent: 28 March 2019 15:56
To: John Carr <john@johncarr.eu>
Cc: paul.hoffman@icann.org; mcmanus@ducksong.com; doh@ietf.org
Subject: Re: DoH

 

Hi John - I cannot speak for the IETF, nor am I in a position to effectively summarize all of the inputs over the year long process in building RFC 8484. However the consensus opinion of that work is reflected in that document. I can also refer you to the datatracker page for the working group which includes the mailing list archives and minutes from in person meetings while doing the work. https://datatracker.ietf.org/group/doh/about/ The final consensus document does contain some related content in section 10.

 

Best Regards,

-Patrick

 

On Thu, Mar 28, 2019 at 3:54 PM John Carr <john@johncarr.eu> wrote:

Hi Both,

 

I refer to the IETF project on DNS queries over HTTPS (DoH)

 

Could you tell me if, in the course of the deliberations which have been taking place within the IETF structures in respect of DoH, any consideration was given, or is being given, to the implications of this standard in terms of its likely impact on filtering solutions which have been implemented either  on routers within individual households, or by ISPs or other access providers, where the purpose of the filtering is either to restrict access to known illegal content or it is to restrict access to content which is considered inappropriate, e.g. for younger family members?

 

Many thanks,

 

John  Carr

Secretary

Children’s Charities’ Coalition on Internet Safety

 

www.chis.org.uk

 


_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh


--------------119E21806CBB1AC342FB0341-- From nobody Thu Mar 28 10:36:13 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 32C06120283 for ; Thu, 28 Mar 2019 10:36:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.096 X-Spam-Level: X-Spam-Status: No, score=-1.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RDNS_NONE=0.793, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IQ5iOX8qaHPs for ; Thu, 28 Mar 2019 10:36:07 -0700 (PDT) Received: from smtpe1.intersmtp.com (unknown [213.121.35.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADBA01202C4 for ; Thu, 28 Mar 2019 10:36:03 -0700 (PDT) Received: from tpw09926dag11h.domain1.systemhost.net (10.9.212.35) by BWP09926084.bt.com (10.36.82.115) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1531.3; Thu, 28 Mar 2019 17:35:57 +0000 Received: from tpw09926dag11h.domain1.systemhost.net (10.9.212.35) by tpw09926dag11h.domain1.systemhost.net (10.9.212.35) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Thu, 28 Mar 2019 17:35:59 +0000 Received: from tpw09926dag11h.domain1.systemhost.net ([fe80::31b2:6108:6eda:82cd]) by tpw09926dag11h.domain1.systemhost.net ([fe80::31b2:6108:6eda:82cd%12]) with mapi id 15.00.1395.000; Thu, 28 Mar 2019 17:35:59 +0000 From: To: , , CC: , Thread-Topic: [Doh] DoH Thread-Index: AQHU5Yj5ws0QKXF/kE2CC/ccxm7ktqYhTCtA Date: Thu, 28 Mar 2019 17:35:59 +0000 Message-ID: <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> In-Reply-To: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.9.202.243] Content-Type: multipart/alternative; boundary="_000_826904ddc23941d5be4d8872c4f2737atpw09926dag11hdomain1sy_" MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 17:36:11 -0000 --_000_826904ddc23941d5be4d8872c4f2737atpw09926dag11hdomain1sy_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 w5ggIEZvciB0aGUgdHlwZXMgb2YgaG9tZSBuZXR3b3JrcyB5b3UgbWVudGlvbiwgd2hpY2ggZ2Vu ZXJhbGx5IGxhY2sgcHJvZmVzc2lvbmFsIGFuZCBkZWRpY2F0ZWQgbmV0d29yayBhZG1pbmlzdHJh dG9ycywgRG9IIGRvZXMgbm90IGluaGVyZW50bHkgcmVwcmVzZW50IGFueSBzaWduaWZpY2FudCBj aGFuZ2UgdG8gdGhlIGRlY2FkZS1vbGQgc3RhdHVzIHF1byByZXN1bHRpbmcgZnJvbSBwdWJsaWNs eS1hdmFpbGFibGUgRE5TLg0KDQpJIGRpc2FncmVlLCB0aGVyZSBpcyBhIGZ1bmRhbWVudGFsIGNo YW5nZSBoZXJlLiAgSWYgLyB3aGVuIGJyb3dzZXJzIGVuYWJsZSBEb0ggYnkgZGVmYXVsdCwgaXQg c3VkZGVubHkgbWVhbnMgdGhhdCB2ZXJ5IGxhcmdlIG51bWJlcnMgb2YgdXNlcnMgd2lsbCBieXBh c3MgZmlsdGVyaW5nLCB3aGV0aGVyIGluIHRoZSBob21lIG9yIG90aGVyIGVudmlyb25tZW50cywg cG9zc2libHkgd2l0aG91dCBldmVuIGtub3dpbmcgdGhhdCBpcyB0aGUgY2FzZS4gIFRoaXMgcG90 ZW50aWFsbHkgZXhwb3NlcyB2dWxuZXJhYmxlIGdyb3VwcyBzdWNoIGFzIGNoaWxkcmVuIHRvIGhh cm0sIGFuZCBtYXkgYWxzbyBjb250cmF2ZW5lIGxvY2FsIG9yIHJlZ2lvbmFsIGxlZ2lzbGF0aW9u IOKAkyBhbiBpc3N1ZSBmb3IgdGhlIGJyb3dzZXIgY29tcGFuaWVzIGFuZCBEb0ggcmVzb2x2ZXJz LiAgVGhlc2UgcG9pbnRzIHdlcmUgdG91Y2hlZCBvbiBpbiB0aGUgRG9IIGRpc2N1c2lvbnMgdGhp cyB3ZWVrLg0KDQpUaGUgcmVhc29ucyB0aGlzIGlzIGRpZmZlcmVudCB0byB0aGUgc3RhdHVzIHF1 byB3aXRoIHB1YmxpY2x5LWF2YWlsYWJsZSBETlMgYXJlOiBhKSB0aGUgdm9sdW1lIG9mIHVzZXJz IGludm9sdmVkOyBiKSBpdCBpcyBiZWluZyBpbXBsZW1lbnRlZCB3aXRob3V0IHRoZSB1c2VyIHNl ZWtpbmcgaXQgb3V0OyBhbmQgYykgaXQgaXMgcG90ZW50aWFsbHkgYmVpbmcgaW1wb3NlZCB3aXRo b3V0IHRoZWlyIGNvbnNlbnQuDQoNCk5vIGRvdWJ0IHRoZSBkZWJhdGUgd2lsbCBjb250aW51ZSEN Cg0KDQpBbmRyZXcNCg0KRnJvbTogQWRhbSBSb2FjaCBbbWFpbHRvOmFkYW1Abm9zdHJ1bS5jb21d DQpTZW50OiAyOCBNYXJjaCAyMDE5IDE3OjA4DQpUbzogSm9obiBDYXJyIDxqb2huQGpvaG5jYXJy LmV1PjsgUGF0cmljayBNY01hbnVzIDxtY21hbnVzQGR1Y2tzb25nLmNvbT4NCkNjOiBwYXVsLmhv ZmZtYW5AaWNhbm4ub3JnOyBkb2hAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbRG9oXSBEb0gNCg0K W3NwZWFraW5nIGFzIGFuIGluZGl2aWR1YWwgY29udHJpYnV0b3JdDQoNCkpvaG4gLS0NCg0KVGhl IGlzc3VlIHlvdSdyZSByYWlzaW5nIGlzIG5vdCBpbmhlcmVudCB0byB0aGUgRG9IIHByb3RvY29s LiBTaW5jZSB0aGUgYWR2ZW50IG9mIHB1YmxpYyBETlMgc2VydmVycywgd2hpY2ggc3RhcnRlZCB0 byBnYWluIHNpZ25pZmljYW50IHBvcHVsYXJpdHkgd2l0aCBHb29nbGUncyBzZXJ2aWNlIG9mZmVy aW5nIGEgZGVjYWRlIGFnbyBbMV0sIHRoZSB2YXJpb3VzIEROUy1iYXNlZCBhcHByb2FjaGVzIG9m IGNvbnRlbnQgcmVzdHJpY3Rpb24gdGhhdCB5b3UgZGVzY3JpYmUgaW4geW91ciBvcmlnaW5hbCBt ZXNzYWdlIGhhdmUgYmVlbiBmYWlybHkgZWFzaWx5IGNpcmN1bXZlbnRhYmxlIChlLmcuIGJ5IGNo YW5naW5nIHRoZSBETlMgc2V0dGluZ3Mgb24gYSBsb2NhbCBtYWNoaW5lLCB1c2luZyBUT1IgYnJv d3Nlciwgb3IgYnkgdXNpbmcgYSBWUE4pLg0KDQpUaGVyZSBoYXMgYmVlbiBzaWduaWZpY2FudCBk aXNjdXNzaW9uIHdpdGhpbiB0aGUgSUVURiwgZXNwZWNpYWxseSBvdmVyIHRoZSBwYXN0IGZldyB3 ZWVrcywgb2Ygc29tZSBvZiB0aGUgb3BlcmF0aW9uYWwgY2hhbmdlcyB0aGF0IHJlc3VsdCBmcm9t IHRoZSBkaWZmZXJlbmNlIGJldHdlZW4gRG9IIGFuZCBvdGhlciBtZWFucyBvZiBhY2Nlc3Npbmcg RE5TLiBUaGVzZSBjaGFuZ2VzIGRvIGhhdmUgc29tZSBiZWFyaW5nIG9uIHNvcGhpc3RpY2F0ZWQg bmV0d29yayBvcGVyYXRvcnMsIHN1Y2ggYXMgdGhvc2Ugd2hvIGFkbWluaXN0ZXIgZW50ZXJwcmlz ZSBuZXR3b3Jrcy4gRm9yIHRoZSB0eXBlcyBvZiBob21lIG5ldHdvcmtzIHlvdSBtZW50aW9uLCB3 aGljaCBnZW5lcmFsbHkgbGFjayBwcm9mZXNzaW9uYWwgYW5kIGRlZGljYXRlZCBuZXR3b3JrIGFk bWluaXN0cmF0b3JzLCBEb0ggZG9lcyBub3QgaW5oZXJlbnRseSByZXByZXNlbnQgYW55IHNpZ25p ZmljYW50IGNoYW5nZSB0byB0aGUgZGVjYWRlLW9sZCBzdGF0dXMgcXVvIHJlc3VsdGluZyBmcm9t IHB1YmxpY2x5LWF2YWlsYWJsZSBETlMuDQoNClRoZXJlIGhhcyBhbHNvIGJlZW4gc29tZSBzcGVj dWxhdGlvbiBhYm91dCwgYW5kIGFubm91bmNlbWVudHMgb2YsIGZ1dHVyZSBiZWhhdmlvcnMgdGhh dCBzb21lIGFwcGxpY2F0aW9ucyAtLSBub3RhYmx5LCB3ZWIgYnJvd3NlcnMgLS0gbWF5IGNob29z ZSB0byBleGhpYml0LiBXaGlsZSB0aGUgZGV2ZWxvcG1lbnQgb2YgdGhlIERvSCBwcm90b2NvbCBt aWdodCBoYXZlIGZvY3VzZWQgYW5kIHBvdGVudGlhbGx5IGFjY2VsZXJhdGVkIHRoZSBkZWNpc2lv bnMgbWFkZSBieSB0aGUgdmVuZG9ycyBvZiB0aG9zZSBhcHBsaWNhdGlvbnMsIGl0IHNob3VsZCBi ZSBub3RlZCB0aGF0IHRoZSBiZWhhdmlvcnMgZW5hYmxlZCBieSBEb0ggYXJlIHBvc3NpYmxlIHdp dGhvdXQgYW55IHN0YW5kYXJkaXplZCBwcm90b2NvbCwgYW5kIHRoYXQgYnJvd3NlciB2ZW5kb3Jz IGluIHBhcnRpY3VsYXIgd2VyZSBhbG1vc3QgY2VydGFpbmx5IGdvaW5nIHRvIGRlcGxveSBlcXVp dmFsZW50IHRlY2hub2xvZ3kgcmVnYXJkbGVzcyBvZiB3aGV0aGVyIHN1Y2ggc3RhbmRhcmRpemF0 aW9uIHRvb2sgcGxhY2UuIEFzIHRoZSBJRVRGIGl0c2VsZiBvbmx5IGhhcyB0aGF0IGluZm9ybWF0 aW9uIHRoYXQgaGFzIGJlZW4gc2VudCB0byB0aGUgRG9IIG1haWxpbmcgbGlzdCwgaXQgc2VlbXMg dW5saWtlbHkgdGhhdCB5b3UgY291bGQgZ2V0IGFueSB1c2VmdWwgYW5zd2VycyB0byB0aGUgcXVl c3Rpb25zIHlvdSByYWlzZSBleGNlcHQgZm9yIGJ5IGNvbnRhY3RpbmcgdGhlIHZlbmRvcnMgb2Yg c3VjaCBhcHBsaWNhdGlvbnMgdGhyb3VnaCB0aGVpciBvZmZpY2lhbCBwdWJsaWMgY29tbXMgY2hh bm5lbHMuDQoNCi9hDQoNCl9fX18NClsxXSBodHRwczovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9H b29nbGVfUHVibGljX0ROUw0KDQpPbiAzLzI4LzE5IDE3OjIwLCBKb2huIENhcnIgd3JvdGU6DQpN YW55IHRoYW5rcy4gSSByZXByZXNlbnQgY2hpbGRyZW7igJlzIG9yZ2FuaXphdGlvbnMgd2hpY2gg ZG8gbm90IGhhdmUgIHRoZSByZXNvdXJjZXMgdG8gdHJhY2sgdGhlIGNvbXBsZXhpdGllcyBvciBp bnMgYW5kIG91dHMgb2Ygc29tZSBvZiB0aGVzZSBzb3J0cyBvZiBpc3N1ZXMuDQoNClBlcmhhcHMg dGhlcmUgaXMgc29tZW9uZSBvbiB0aGUgbGlzdCB3aG8ga25vd3MgdGhlIGFuc3dlciB0byBteSBx dWVzdGlvbj8gT3IgYXJlIHlvdSBzYXlpbmcgSSBtdXN0IHdhZGUgdGhyb3VnaCB0aGUgd2hvbGUg c2hvb3RpbmcgbWF0Y2ggYW5kIHdvcmsgaXQgZm9yIG15c2VsZj8NCg0KSm9obg0KDQpGcm9tOiBQ YXRyaWNrIE1jTWFudXMgPG1jbWFudXNAZHVja3NvbmcuY29tPjxtYWlsdG86bWNtYW51c0BkdWNr c29uZy5jb20+DQpTZW50OiAyOCBNYXJjaCAyMDE5IDE1OjU2DQpUbzogSm9obiBDYXJyIDxqb2hu QGpvaG5jYXJyLmV1PjxtYWlsdG86am9obkBqb2huY2Fyci5ldT4NCkNjOiBwYXVsLmhvZmZtYW5A aWNhbm4ub3JnPG1haWx0bzpwYXVsLmhvZmZtYW5AaWNhbm4ub3JnPjsgbWNtYW51c0BkdWNrc29u Zy5jb208bWFpbHRvOm1jbWFudXNAZHVja3NvbmcuY29tPjsgZG9oQGlldGYub3JnPG1haWx0bzpk b2hAaWV0Zi5vcmc+DQpTdWJqZWN0OiBSZTogRG9IDQoNCkhpIEpvaG4gLSBJIGNhbm5vdCBzcGVh ayBmb3IgdGhlIElFVEYsIG5vciBhbSBJIGluIGEgcG9zaXRpb24gdG8gZWZmZWN0aXZlbHkgc3Vt bWFyaXplIGFsbCBvZiB0aGUgaW5wdXRzIG92ZXIgdGhlIHllYXIgbG9uZyBwcm9jZXNzIGluIGJ1 aWxkaW5nIFJGQyA4NDg0LiBIb3dldmVyIHRoZSBjb25zZW5zdXMgb3BpbmlvbiBvZiB0aGF0IHdv cmsgaXMgcmVmbGVjdGVkIGluIHRoYXQgZG9jdW1lbnQuIEkgY2FuIGFsc28gcmVmZXIgeW91IHRv IHRoZSBkYXRhdHJhY2tlciBwYWdlIGZvciB0aGUgd29ya2luZyBncm91cCB3aGljaCBpbmNsdWRl cyB0aGUgbWFpbGluZyBsaXN0IGFyY2hpdmVzIGFuZCBtaW51dGVzIGZyb20gaW4gcGVyc29uIG1l ZXRpbmdzIHdoaWxlIGRvaW5nIHRoZSB3b3JrLiBodHRwczovL2RhdGF0cmFja2VyLmlldGYub3Jn L2dyb3VwL2RvaC9hYm91dC8gVGhlIGZpbmFsIGNvbnNlbnN1cyBkb2N1bWVudCBkb2VzIGNvbnRh aW4gc29tZSByZWxhdGVkIGNvbnRlbnQgaW4gc2VjdGlvbiAxMC4NCg0KQmVzdCBSZWdhcmRzLA0K LVBhdHJpY2sNCg0KT24gVGh1LCBNYXIgMjgsIDIwMTkgYXQgMzo1NCBQTSBKb2huIENhcnIgPGpv aG5Aam9obmNhcnIuZXU8bWFpbHRvOmpvaG5Aam9obmNhcnIuZXU+PiB3cm90ZToNCkhpIEJvdGgs DQoNCkkgcmVmZXIgdG8gdGhlIElFVEYgcHJvamVjdCBvbiBETlMgcXVlcmllcyBvdmVyIEhUVFBT IChEb0gpDQoNCkNvdWxkIHlvdSB0ZWxsIG1lIGlmLCBpbiB0aGUgY291cnNlIG9mIHRoZSBkZWxp YmVyYXRpb25zIHdoaWNoIGhhdmUgYmVlbiB0YWtpbmcgcGxhY2Ugd2l0aGluIHRoZSBJRVRGIHN0 cnVjdHVyZXMgaW4gcmVzcGVjdCBvZiBEb0gsIGFueSBjb25zaWRlcmF0aW9uIHdhcyBnaXZlbiwg b3IgaXMgYmVpbmcgZ2l2ZW4sIHRvIHRoZSBpbXBsaWNhdGlvbnMgb2YgdGhpcyBzdGFuZGFyZCBp biB0ZXJtcyBvZiBpdHMgbGlrZWx5IGltcGFjdCBvbiBmaWx0ZXJpbmcgc29sdXRpb25zIHdoaWNo IGhhdmUgYmVlbiBpbXBsZW1lbnRlZCBlaXRoZXIgIG9uIHJvdXRlcnMgd2l0aGluIGluZGl2aWR1 YWwgaG91c2Vob2xkcywgb3IgYnkgSVNQcyBvciBvdGhlciBhY2Nlc3MgcHJvdmlkZXJzLCB3aGVy ZSB0aGUgcHVycG9zZSBvZiB0aGUgZmlsdGVyaW5nIGlzIGVpdGhlciB0byByZXN0cmljdCBhY2Nl c3MgdG8ga25vd24gaWxsZWdhbCBjb250ZW50IG9yIGl0IGlzIHRvIHJlc3RyaWN0IGFjY2VzcyB0 byBjb250ZW50IHdoaWNoIGlzIGNvbnNpZGVyZWQgaW5hcHByb3ByaWF0ZSwgZS5nLiBmb3IgeW91 bmdlciBmYW1pbHkgbWVtYmVycz8NCg0KTWFueSB0aGFua3MsDQoNCkpvaG4gIENhcnINClNlY3Jl dGFyeQ0KQ2hpbGRyZW7igJlzIENoYXJpdGllc+KAmSBDb2FsaXRpb24gb24gSW50ZXJuZXQgU2Fm ZXR5DQoNCnd3dy5jaGlzLm9yZy51azxodHRwOi8vd3d3LmNoaXMub3JnLnVrPg0KDQoNCg0KDQpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KDQpEb2ggbWFp bGluZyBsaXN0DQoNCkRvaEBpZXRmLm9yZzxtYWlsdG86RG9oQGlldGYub3JnPg0KDQpodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RvaA0KDQoNCg== --_000_826904ddc23941d5be4d8872c4f2737atpw09926dag11hdomain1sy_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6dj0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTp2bWwiIHhtbG5zOm89InVy bjpzY2hlbWFzLW1pY3Jvc29mdC1jb206b2ZmaWNlOm9mZmljZSIgeG1sbnM6dz0idXJuOnNjaGVt YXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6d29yZCIgeG1sbnM6bT0iaHR0cDovL3NjaGVtYXMubWlj cm9zb2Z0LmNvbS9vZmZpY2UvMjAwNC8xMi9vbW1sIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv VFIvUkVDLWh0bWw0MCI+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIg Y29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxtZXRhIG5hbWU9IkdlbmVyYXRv ciIgY29udGVudD0iTWljcm9zb2Z0IFdvcmQgMTUgKGZpbHRlcmVkIG1lZGl1bSkiPg0KPHN0eWxl PjwhLS0NCi8qIEZvbnQgRGVmaW5pdGlvbnMgKi8NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6 V2luZ2RpbmdzOw0KCXBhbm9zZS0xOjUgMCAwIDAgMCAwIDAgMCAwIDA7fQ0KQGZvbnQtZmFjZQ0K CXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2IDMg MiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToyIDE1 IDUgMiAyIDIgNCAzIDIgNDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OkNvbnNvbGFzOw0K CXBhbm9zZS0xOjIgMTEgNiA5IDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25zICov DQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjowY207 DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KYTpsaW5rLCBzcGFuLk1z b0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Ymx1ZTsNCgl0ZXh0 LWRlY29yYXRpb246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xs b3dlZA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6cHVycGxlOw0KCXRleHQtZGVj b3JhdGlvbjp1bmRlcmxpbmU7fQ0KcA0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLW1h cmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjEyLjBwdDsNCglmb250 LWZhbWlseToiVGltZXMgTmV3IFJvbWFuIixzZXJpZjsNCgljb2xvcjpibGFjazt9DQpwcmUNCgl7 bXNvLXN0eWxlLXByaW9yaXR5Ojk5Ow0KCW1zby1zdHlsZS1saW5rOiJIVE1MIFByZWZvcm1hdHRl ZCBDaGFyIjsNCgltYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNp emU6MTAuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7DQoJY29sb3I6YmxhY2s7fQ0K cC5Nc29MaXN0UGFyYWdyYXBoLCBsaS5Nc29MaXN0UGFyYWdyYXBoLCBkaXYuTXNvTGlzdFBhcmFn cmFwaA0KCXttc28tc3R5bGUtcHJpb3JpdHk6MzQ7DQoJbWFyZ2luLXRvcDowY207DQoJbWFyZ2lu LXJpZ2h0OjBjbTsNCgltYXJnaW4tYm90dG9tOjBjbTsNCgltYXJnaW4tbGVmdDozNi4wcHQ7DQoJ bWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6 IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6YmxhY2s7fQ0KcC5tc29ub3JtYWwwLCBsaS5t c29ub3JtYWwwLCBkaXYubXNvbm9ybWFsMA0KCXttc28tc3R5bGUtbmFtZTptc29ub3JtYWw7DQoJ bXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2luLXJpZ2h0OjBjbTsNCgltc28tbWFyZ2lu LWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDowY207DQoJZm9udC1zaXplOjExLjBwdDsN Cglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjpibGFjazt9DQpzcGFu LkVtYWlsU3R5bGUxOA0KCXttc28tc3R5bGUtdHlwZTpwZXJzb25hbDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3aW5kb3d0ZXh0O30NCnNwYW4uSFRNTFByZWZv cm1hdHRlZENoYXINCgl7bXNvLXN0eWxlLW5hbWU6IkhUTUwgUHJlZm9ybWF0dGVkIENoYXIiOw0K CW1zby1zdHlsZS1wcmlvcml0eTo5OTsNCgltc28tc3R5bGUtbGluazoiSFRNTCBQcmVmb3JtYXR0 ZWQiOw0KCWZvbnQtZmFtaWx5OkNvbnNvbGFzOw0KCWNvbG9yOmJsYWNrO30NCnNwYW4uRW1haWxT dHlsZTIyDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJD YWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0KLk1zb0NocERlZmF1bHQNCgl7 bXNvLXN0eWxlLXR5cGU6ZXhwb3J0LW9ubHk7DQoJZm9udC1zaXplOjEwLjBwdDt9DQpAcGFnZSBX b3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2luOjcyLjBwdCA3Mi4w cHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24x O30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1saXN0LWlkOjE1NDE0 NzQzNTA7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE4 MDAxODMzMDYgMTU1MjU5MjQ3NiAxMzQ4MDc1NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1 NTUgMTM0ODA3NTU3IDEzNDgwNzU1MyAxMzQ4MDc1NTUgMTM0ODA3NTU3O30NCkBsaXN0IGwwOmxl dmVsMQ0KCXttc28tbGV2ZWwtc3RhcnQtYXQ6MDsNCgltc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674OYOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0K CWZvbnQtZmFtaWx5OldpbmdkaW5nczsNCgltc28tZmFyZWFzdC1mb250LWZhbWlseTpDYWxpYnJp Ow0KCW1zby1iaWRpLWZvbnQtZmFtaWx5OiJUaW1lcyBOZXcgUm9tYW4iO30NCkBsaXN0IGwwOmxl dmVsMg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6 bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9u OmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXci O30NCkBsaXN0IGwwOmxldmVsMw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJ bXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZl bC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFt aWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDQNCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9u ZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBw dDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw1DQoJe21zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWIt c3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVu dDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWw2 DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7 DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjps ZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBs aXN0IGwwOmxldmVsNw0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ674K3Ow0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1i ZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5 bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDgNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0 Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxl dmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1m YW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDkNCgl7bXNvLWxldmVsLW51bWJl ci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0 b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6 LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0Kb2wNCgl7bWFyZ2luLWJvdHRvbTow Y207fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowY207fQ0KLS0+PC9zdHlsZT48IS0tW2lmIGd0ZSBt c28gOV0+PHhtbD4NCjxvOnNoYXBlZGVmYXVsdHMgdjpleHQ9ImVkaXQiIHNwaWRtYXg9IjEwMjYi IC8+DQo8L3htbD48IVtlbmRpZl0tLT48IS0tW2lmIGd0ZSBtc28gOV0+PHhtbD4NCjxvOnNoYXBl bGF5b3V0IHY6ZXh0PSJlZGl0Ij4NCjxvOmlkbWFwIHY6ZXh0PSJlZGl0IiBkYXRhPSIxIiAvPg0K PC9vOnNoYXBlbGF5b3V0PjwveG1sPjwhW2VuZGlmXS0tPg0KPC9oZWFkPg0KPGJvZHkgYmdjb2xv cj0id2hpdGUiIGxhbmc9IkVOLUdCIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxkaXYg Y2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9 InRleHQtaW5kZW50Oi0xOC4wcHQ7bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjwhW2lmICFzdXBw b3J0TGlzdHNdPjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTpXaW5nZGluZ3M7Y29sb3I6IzFGNDk3 RDttc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+PHNwYW4gc3R5bGU9Im1zby1saXN0Oklnbm9y ZSI+w5g8c3BhbiBzdHlsZT0iZm9udDo3LjBwdCAmcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDsi PiZuYnNwOw0KPC9zcGFuPjwvc3Bhbj48L3NwYW4+PCFbZW5kaWZdPkZvciB0aGUgdHlwZXMgb2Yg aG9tZSBuZXR3b3JrcyB5b3UgbWVudGlvbiwgd2hpY2ggZ2VuZXJhbGx5IGxhY2sgcHJvZmVzc2lv bmFsIGFuZCBkZWRpY2F0ZWQgbmV0d29yayBhZG1pbmlzdHJhdG9ycywgRG9IIGRvZXMgbm90IGlu aGVyZW50bHkgcmVwcmVzZW50IGFueSBzaWduaWZpY2FudCBjaGFuZ2UgdG8gdGhlIGRlY2FkZS1v bGQgc3RhdHVzIHF1byByZXN1bHRpbmcgZnJvbSBwdWJsaWNseS1hdmFpbGFibGUNCiBETlMuPHNw YW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPjxvOnA+ PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xv cjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj48bzpwPiZuYnNwOzwvbzpwPjwv c3Bhbj48L3A+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQt c2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPkkgZGlzYWdyZWUsIHRoZXJlIGlzIGEgZnVuZGFtZW50 YWwgY2hhbmdlIGhlcmUuJm5ic3A7IElmIC8gd2hlbiBicm93c2VycyBlbmFibGUgRG9IIGJ5IGRl ZmF1bHQsIGl0IHN1ZGRlbmx5IG1lYW5zIHRoYXQgdmVyeSBsYXJnZSBudW1iZXJzIG9mIHVzZXJz IHdpbGwgYnlwYXNzIGZpbHRlcmluZywgd2hldGhlciBpbiB0aGUgaG9tZSBvciBvdGhlcg0KIGVu dmlyb25tZW50cywgcG9zc2libHkgd2l0aG91dCBldmVuIGtub3dpbmcgdGhhdCBpcyB0aGUgY2Fz ZS4mbmJzcDsgVGhpcyBwb3RlbnRpYWxseSBleHBvc2VzIHZ1bG5lcmFibGUgZ3JvdXBzIHN1Y2gg YXMgY2hpbGRyZW4gdG8gaGFybSwgYW5kIG1heSBhbHNvIGNvbnRyYXZlbmUgbG9jYWwgb3IgcmVn aW9uYWwgbGVnaXNsYXRpb24g4oCTIGFuIGlzc3VlIGZvciB0aGUgYnJvd3NlciBjb21wYW5pZXMg YW5kIERvSCByZXNvbHZlcnMuJm5ic3A7IFRoZXNlIHBvaW50cw0KIHdlcmUgdG91Y2hlZCBvbiBp biB0aGUgRG9IIGRpc2N1c2lvbnMgdGhpcyB3ZWVrLiZuYnNwOyA8bzpwPjwvbzpwPjwvc3Bhbj48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtj b2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPlRoZSByZWFz b25zIHRoaXMgaXMgZGlmZmVyZW50IHRvIHRoZSBzdGF0dXMgcXVvIHdpdGggcHVibGljbHktYXZh aWxhYmxlIEROUyBhcmU6IGEpIHRoZSB2b2x1bWUgb2YgdXNlcnMgaW52b2x2ZWQ7IGIpIGl0IGlz IGJlaW5nIGltcGxlbWVudGVkIHdpdGhvdXQgdGhlIHVzZXIgc2Vla2luZyBpdCBvdXQ7IGFuZCBj KSBpdCBpcyBwb3RlbnRpYWxseQ0KIGJlaW5nIGltcG9zZWQgd2l0aG91dCB0aGVpciBjb25zZW50 LiZuYnNwOyA8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+PG86cD4mbmJzcDs8L286cD48 L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZTox Mi4wcHQ7Y29sb3I6YmxhY2siPk5vIGRvdWJ0IHRoZSBkZWJhdGUgd2lsbCBjb250aW51ZSEmbmJz cDsgJm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImZvbnQtc2l6ZToxMi4wcHQ7Y29sb3I6YmxhY2siPjxvOnA+Jm5ic3A7PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTIuMHB0O2NvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48Yj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFj ayI+QW5kcmV3PC9zcGFuPjwvYj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpi bGFjayI+DQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVT Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8ZGl2Pg0KPGRpdiBzdHlsZT0iYm9yZGVy Om5vbmU7Ym9yZGVyLXRvcDpzb2xpZCAjRTFFMUUxIDEuMHB0O3BhZGRpbmc6My4wcHQgMGNtIDBj bSAwY20iPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiIHN0eWxl PSJjb2xvcjp3aW5kb3d0ZXh0Ij5Gcm9tOjwvc3Bhbj48L2I+PHNwYW4gbGFuZz0iRU4tVVMiIHN0 eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij4gQWRhbSBSb2FjaCBbbWFpbHRvOmFkYW1Abm9zdHJ1bS5j b21dDQo8YnI+DQo8Yj5TZW50OjwvYj4gMjggTWFyY2ggMjAxOSAxNzowODxicj4NCjxiPlRvOjwv Yj4gSm9obiBDYXJyICZsdDtqb2huQGpvaG5jYXJyLmV1Jmd0OzsgUGF0cmljayBNY01hbnVzICZs dDttY21hbnVzQGR1Y2tzb25nLmNvbSZndDs8YnI+DQo8Yj5DYzo8L2I+IHBhdWwuaG9mZm1hbkBp Y2Fubi5vcmc7IGRvaEBpZXRmLm9yZzxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0RvaF0gRG9I PG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPltz cGVha2luZyBhcyBhbiBpbmRpdmlkdWFsIGNvbnRyaWJ1dG9yXTxzcGFuIHN0eWxlPSJmb250LXNp emU6MTIuMHB0Ij48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPkpvaG4gLS08bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIGlzc3VlIHlvdSdyZSByYWlzaW5nIGlzIG5vdCBpbmhl cmVudCB0byB0aGUgRG9IIHByb3RvY29sLiBTaW5jZSB0aGUgYWR2ZW50IG9mIHB1YmxpYyBETlMg c2VydmVycywgd2hpY2ggc3RhcnRlZCB0byBnYWluIHNpZ25pZmljYW50IHBvcHVsYXJpdHkgd2l0 aCBHb29nbGUncyBzZXJ2aWNlIG9mZmVyaW5nIGEgZGVjYWRlIGFnbyBbMV0sIHRoZSB2YXJpb3Vz IEROUy1iYXNlZCBhcHByb2FjaGVzIG9mIGNvbnRlbnQNCiByZXN0cmljdGlvbiB0aGF0IHlvdSBk ZXNjcmliZSBpbiB5b3VyIG9yaWdpbmFsIG1lc3NhZ2UgaGF2ZSBiZWVuIGZhaXJseSBlYXNpbHkg Y2lyY3VtdmVudGFibGUgKGUuZy4gYnkgY2hhbmdpbmcgdGhlIEROUyBzZXR0aW5ncyBvbiBhIGxv Y2FsIG1hY2hpbmUsIHVzaW5nIFRPUiBicm93c2VyLCBvciBieSB1c2luZyBhIFZQTikuPG86cD48 L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNw OzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlIGhh cyBiZWVuIHNpZ25pZmljYW50IGRpc2N1c3Npb24gd2l0aGluIHRoZSBJRVRGLCBlc3BlY2lhbGx5 IG92ZXIgdGhlIHBhc3QgZmV3IHdlZWtzLCBvZiBzb21lIG9mIHRoZSBvcGVyYXRpb25hbCBjaGFu Z2VzIHRoYXQgcmVzdWx0IGZyb20gdGhlIGRpZmZlcmVuY2UgYmV0d2VlbiBEb0ggYW5kIG90aGVy IG1lYW5zIG9mIGFjY2Vzc2luZyBETlMuIFRoZXNlIGNoYW5nZXMgZG8gaGF2ZSBzb21lIGJlYXJp bmcNCiBvbiBzb3BoaXN0aWNhdGVkIG5ldHdvcmsgb3BlcmF0b3JzLCBzdWNoIGFzIHRob3NlIHdo byBhZG1pbmlzdGVyIGVudGVycHJpc2UgbmV0d29ya3MuIEZvciB0aGUgdHlwZXMgb2YgaG9tZSBu ZXR3b3JrcyB5b3UgbWVudGlvbiwgd2hpY2ggZ2VuZXJhbGx5IGxhY2sgcHJvZmVzc2lvbmFsIGFu ZCBkZWRpY2F0ZWQgbmV0d29yayBhZG1pbmlzdHJhdG9ycywgRG9IIGRvZXMgbm90IGluaGVyZW50 bHkgcmVwcmVzZW50IGFueSBzaWduaWZpY2FudCBjaGFuZ2UNCiB0byB0aGUgZGVjYWRlLW9sZCBz dGF0dXMgcXVvIHJlc3VsdGluZyBmcm9tIHB1YmxpY2x5LWF2YWlsYWJsZSBETlMuPG86cD48L286 cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwv bzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlIGhhcyBh bHNvIGJlZW4gc29tZSBzcGVjdWxhdGlvbiBhYm91dCwgYW5kIGFubm91bmNlbWVudHMgb2YsIGZ1 dHVyZSBiZWhhdmlvcnMgdGhhdCBzb21lIGFwcGxpY2F0aW9ucyAtLSBub3RhYmx5LCB3ZWIgYnJv d3NlcnMgLS0gbWF5IGNob29zZSB0byBleGhpYml0LiBXaGlsZSB0aGUgZGV2ZWxvcG1lbnQgb2Yg dGhlIERvSCBwcm90b2NvbCBtaWdodCBoYXZlIGZvY3VzZWQgYW5kIHBvdGVudGlhbGx5IGFjY2Vs ZXJhdGVkDQogdGhlIGRlY2lzaW9ucyBtYWRlIGJ5IHRoZSB2ZW5kb3JzIG9mIHRob3NlIGFwcGxp Y2F0aW9ucywgaXQgc2hvdWxkIGJlIG5vdGVkIHRoYXQgdGhlIGJlaGF2aW9ycyBlbmFibGVkIGJ5 IERvSCBhcmUgcG9zc2libGUgd2l0aG91dCBhbnkgc3RhbmRhcmRpemVkIHByb3RvY29sLCBhbmQg dGhhdCBicm93c2VyIHZlbmRvcnMgaW4gcGFydGljdWxhciB3ZXJlIGFsbW9zdCBjZXJ0YWlubHkg Z29pbmcgdG8gZGVwbG95IGVxdWl2YWxlbnQgdGVjaG5vbG9neQ0KIHJlZ2FyZGxlc3Mgb2Ygd2hl dGhlciBzdWNoIHN0YW5kYXJkaXphdGlvbiB0b29rIHBsYWNlLiBBcyB0aGUgSUVURiBpdHNlbGYg b25seSBoYXMgdGhhdCBpbmZvcm1hdGlvbiB0aGF0IGhhcyBiZWVuIHNlbnQgdG8gdGhlIERvSCBt YWlsaW5nIGxpc3QsIGl0IHNlZW1zIHVubGlrZWx5IHRoYXQgeW91IGNvdWxkIGdldCBhbnkgdXNl ZnVsIGFuc3dlcnMgdG8gdGhlIHF1ZXN0aW9ucyB5b3UgcmFpc2UgZXhjZXB0IGZvciBieSBjb250 YWN0aW5nIHRoZQ0KIHZlbmRvcnMgb2Ygc3VjaCBhcHBsaWNhdGlvbnMgdGhyb3VnaCB0aGVpciBv ZmZpY2lhbCBwdWJsaWMgY29tbXMgY2hhbm5lbHMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi9hPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxk aXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPl9fX188YnI+DQpbMV0gPGEgaHJlZj0iaHR0cHM6 Ly9lbi53aWtpcGVkaWEub3JnL3dpa2kvR29vZ2xlX1B1YmxpY19ETlMiPmh0dHBzOi8vZW4ud2lr aXBlZGlhLm9yZy93aWtpL0dvb2dsZV9QdWJsaWNfRE5TPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5PbiAzLzI4LzE5IDE3OjIwLCBKb2hu IENhcnIgd3JvdGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJt YXJnaW4tdG9wOjUuMHB0O21hcmdpbi1ib3R0b206NS4wcHQiPg0KPHAgY2xhc3M9Ik1zb05vcm1h bCI+PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5NYW55IHRoYW5rcy4g SSByZXByZXNlbnQgY2hpbGRyZW7igJlzIG9yZ2FuaXphdGlvbnMgd2hpY2ggZG8gbm90IGhhdmUm bmJzcDsgdGhlIHJlc291cmNlcyB0byB0cmFjayB0aGUgY29tcGxleGl0aWVzIG9yIGlucyBhbmQg b3V0cyBvZiBzb21lIG9mIHRoZXNlIHNvcnRzIG9mIGlzc3Vlcy48L3NwYW4+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0ibXNvLWZhcmVhc3QtbGFuZ3Vh Z2U6RU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpFTi1VUyI+UGVyaGFwcyB0aGVy ZSBpcyBzb21lb25lIG9uIHRoZSBsaXN0IHdobyBrbm93cyB0aGUgYW5zd2VyIHRvIG15IHF1ZXN0 aW9uPyBPciBhcmUgeW91IHNheWluZyBJIG11c3Qgd2FkZSB0aHJvdWdoIHRoZSB3aG9sZSBzaG9v dGluZyBtYXRjaCBhbmQgd29yayBpdCBmb3IgbXlzZWxmPzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFzdC1sYW5ndWFnZTpF Ti1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+ PHNwYW4gc3R5bGU9Im1zby1mYXJlYXN0LWxhbmd1YWdlOkVOLVVTIj5Kb2huIDwvc3Bhbj48bzpw PjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJtc28tZmFyZWFz dC1sYW5ndWFnZTpFTi1VUyI+Jm5ic3A7PC9zcGFuPjxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PGI+PHNwYW4gbGFuZz0iRU4tVVMiPkZyb206PC9zcGFuPjwvYj48c3BhbiBs YW5nPSJFTi1VUyI+IFBhdHJpY2sgTWNNYW51cw0KPGEgaHJlZj0ibWFpbHRvOm1jbWFudXNAZHVj a3NvbmcuY29tIj4mbHQ7bWNtYW51c0BkdWNrc29uZy5jb20mZ3Q7PC9hPiA8YnI+DQo8Yj5TZW50 OjwvYj4gMjggTWFyY2ggMjAxOSAxNTo1Njxicj4NCjxiPlRvOjwvYj4gSm9obiBDYXJyIDxhIGhy ZWY9Im1haWx0bzpqb2huQGpvaG5jYXJyLmV1Ij4mbHQ7am9obkBqb2huY2Fyci5ldSZndDs8L2E+ PGJyPg0KPGI+Q2M6PC9iPiA8YSBocmVmPSJtYWlsdG86cGF1bC5ob2ZmbWFuQGljYW5uLm9yZyI+ cGF1bC5ob2ZmbWFuQGljYW5uLm9yZzwvYT47IDxhIGhyZWY9Im1haWx0bzptY21hbnVzQGR1Y2tz b25nLmNvbSI+DQptY21hbnVzQGR1Y2tzb25nLmNvbTwvYT47IDxhIGhyZWY9Im1haWx0bzpkb2hA aWV0Zi5vcmciPmRvaEBpZXRmLm9yZzwvYT48YnI+DQo8Yj5TdWJqZWN0OjwvYj4gUmU6IERvSDwv c3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+PC9v OnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhpIEpvaG4gLSBJIGNhbm5vdCBz cGVhayBmb3IgdGhlIElFVEYsIG5vciBhbSBJIGluIGEgcG9zaXRpb24gdG8gZWZmZWN0aXZlbHkg c3VtbWFyaXplIGFsbCBvZiB0aGUgaW5wdXRzIG92ZXIgdGhlIHllYXIgbG9uZyBwcm9jZXNzIGlu IGJ1aWxkaW5nIFJGQyA4NDg0LiBIb3dldmVyIHRoZSBjb25zZW5zdXMgb3BpbmlvbiBvZiB0aGF0 IHdvcmsgaXMgcmVmbGVjdGVkIGluIHRoYXQgZG9jdW1lbnQuIEkgY2FuIGFsc28NCiByZWZlciB5 b3UgdG8gdGhlIGRhdGF0cmFja2VyIHBhZ2UgZm9yIHRoZSB3b3JraW5nIGdyb3VwIHdoaWNoIGlu Y2x1ZGVzIHRoZSBtYWlsaW5nIGxpc3QgYXJjaGl2ZXMgYW5kIG1pbnV0ZXMgZnJvbSBpbiBwZXJz b24gbWVldGluZ3Mgd2hpbGUgZG9pbmcgdGhlIHdvcmsuJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9k YXRhdHJhY2tlci5pZXRmLm9yZy9ncm91cC9kb2gvYWJvdXQvIj5odHRwczovL2RhdGF0cmFja2Vy LmlldGYub3JnL2dyb3VwL2RvaC9hYm91dC88L2E+Jm5ic3A7VGhlDQogZmluYWwgY29uc2Vuc3Vz IGRvY3VtZW50IGRvZXMgY29udGFpbiBzb21lIHJlbGF0ZWQgY29udGVudCBpbiBzZWN0aW9uIDEw LjxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOzxvOnA+ PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QmVzdCBSZWdh cmRzLDxvOnA+PC9vOnA+PC9wPg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPi1QYXRyaWNr PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+T24gVGh1LCBNYXIgMjgsIDIwMTkgYXQgMzo1NCBQTSBKb2huIENhcnIgJmx0OzxhIGhy ZWY9Im1haWx0bzpqb2huQGpvaG5jYXJyLmV1Ij5qb2huQGpvaG5jYXJyLmV1PC9hPiZndDsgd3Jv dGU6PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9u ZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0NDIDEuMHB0O3BhZGRpbmc6MGNtIDBjbSAwY20gNi4w cHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2luLXRvcDo1LjBwdDttYXJnaW4tcmlnaHQ6MGNtO21h cmdpbi1ib3R0b206NS4wcHQiPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBz dHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8i PkhpIEJvdGgsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNv LW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZuYnNwOzxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9w LWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5JIHJlZmVyIHRvIHRoZSBJRVRG IHByb2plY3Qgb24gRE5TIHF1ZXJpZXMgb3ZlciBIVFRQUyAoRG9IKTxvOnA+PC9vOnA+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1t YXJnaW4tYm90dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRv bS1hbHQ6YXV0byI+Q291bGQgeW91IHRlbGwgbWUgaWYsIGluIHRoZSBjb3Vyc2Ugb2YgdGhlIGRl bGliZXJhdGlvbnMgd2hpY2ggaGF2ZSBiZWVuIHRha2luZyBwbGFjZSB3aXRoaW4gdGhlIElFVEYg c3RydWN0dXJlcyBpbiByZXNwZWN0IG9mIERvSCwgYW55IGNvbnNpZGVyYXRpb24gd2FzIGdpdmVu LCBvciBpcyBiZWluZyBnaXZlbiwNCiB0byB0aGUgaW1wbGljYXRpb25zIG9mIHRoaXMgc3RhbmRh cmQgaW4gdGVybXMgb2YgaXRzIGxpa2VseSBpbXBhY3Qgb24gZmlsdGVyaW5nIHNvbHV0aW9ucyB3 aGljaCBoYXZlIGJlZW4gaW1wbGVtZW50ZWQgZWl0aGVyICZuYnNwO29uIHJvdXRlcnMgd2l0aGlu IGluZGl2aWR1YWwgaG91c2Vob2xkcywgb3IgYnkgSVNQcyBvciBvdGhlciBhY2Nlc3MgcHJvdmlk ZXJzLCB3aGVyZSB0aGUgcHVycG9zZSBvZiB0aGUgZmlsdGVyaW5nIGlzIGVpdGhlciB0byByZXN0 cmljdA0KIGFjY2VzcyB0byBrbm93biBpbGxlZ2FsIGNvbnRlbnQgb3IgaXQgaXMgdG8gcmVzdHJp Y3QgYWNjZXNzIHRvIGNvbnRlbnQgd2hpY2ggaXMgY29uc2lkZXJlZCBpbmFwcHJvcHJpYXRlLCBl LmcuIGZvciB5b3VuZ2VyIGZhbWlseSBtZW1iZXJzPzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+TWFueSB0aGFua3MsPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHls ZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPiZu YnNwOzxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvIj5Kb2huICZuYnNwO0Nh cnI8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxlPSJtc28tbWFyZ2lu LXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+U2VjcmV0YXJ5PG86cD48 L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0 OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG8iPkNoaWxkcmVu4oCZcyBDaGFyaXRpZXPi gJkgQ29hbGl0aW9uIG9uIEludGVybmV0IFNhZmV0eTxvOnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90 dG9tLWFsdDphdXRvIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwi IHN0eWxlPSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0 byI+PGEgaHJlZj0iaHR0cDovL3d3dy5jaGlzLm9yZy51ayIgdGFyZ2V0PSJfYmxhbmsiPnd3dy5j aGlzLm9yZy51azwvYT48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIHN0eWxl PSJtc28tbWFyZ2luLXRvcC1hbHQ6YXV0bzttc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0byI+Jm5i c3A7PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtmb250 LWZhbWlseTomcXVvdDtUaW1lcyBOZXcgUm9tYW4mcXVvdDssc2VyaWYiPjxicj4NCjxicj4NCjxv OnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwcmU+X19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX188bzpwPjwvbzpwPjwvcHJlPg0KPHByZT5Eb2ggbWFpbGluZyBsaXN0 PG86cD48L286cD48L3ByZT4NCjxwcmU+PGEgaHJlZj0ibWFpbHRvOkRvaEBpZXRmLm9yZyI+RG9o QGlldGYub3JnPC9hPjxvOnA+PC9vOnA+PC9wcmU+DQo8cHJlPjxhIGhyZWY9Imh0dHBzOi8vd3d3 LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZG9oIj5odHRwczovL3d3dy5pZXRmLm9yZy9tYWls bWFuL2xpc3RpbmZvL2RvaDwvYT48bzpwPjwvbzpwPjwvcHJlPg0KPC9ibG9ja3F1b3RlPg0KPHA+ PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwvaHRtbD4NCg== --_000_826904ddc23941d5be4d8872c4f2737atpw09926dag11hdomain1sy_-- From nobody Thu Mar 28 11:11:47 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 346B012037B for ; Thu, 28 Mar 2019 11:11:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.978 X-Spam-Level: X-Spam-Status: No, score=-1.978 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id b33lXqVjc46c for ; Thu, 28 Mar 2019 11:11:30 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 54BFD120322 for ; Thu, 28 Mar 2019 11:11:30 -0700 (PDT) Received: from dhcp-9796.meeting.ietf.org (dhcp-9796.meeting.ietf.org [31.133.151.150]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2SIBFv2072064 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 28 Mar 2019 13:11:20 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553796684; bh=fI0gMT9/fZ36Mv+Z5n8jO4jq0ul8cG3WuI/Bj09gf+I=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=nsWayv2ICUV/SLwXCcx/TXDyvN8aHISwPBXmf8JjZaLuTgHOKkkJ+a958aTHeTEM0 VAcg4GUXgNpkncXjjg1f1PQtahR9vrPu9BrSLfOO11KfKqMgugbh97ebxblylWqg9j tvHB3jMP9qinFvPEOOdOG4kXGj41ZVzdaRzW0Tz8= To: andrew.campling@bt.com, john@johncarr.eu, mcmanus@ducksong.com Cc: paul.hoffman@icann.org, doh@ietf.org References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> From: Adam Roach Message-ID: <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> Date: Thu, 28 Mar 2019 19:11:14 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> Content-Type: multipart/alternative; boundary="------------CE4C1FA68E292EE87A5254CD" Content-Language: en-US Archived-At: Subject: Re: [Doh] DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 18:11:45 -0000 This is a multi-part message in MIME format. --------------CE4C1FA68E292EE87A5254CD Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit On 3/28/19 18:35, andrew.campling@bt.com wrote: > > ØFor the types of home networks you mention, which generally lack > professional and dedicated network administrators, DoH does not > inherently represent any significant change to the decade-old status > quo resulting from publicly-available DNS. > > I disagree, there is a fundamental change here.  If / when browsers > enable DoH by default... > Yes, and this pertains to product decisions rather than the DoH protocol itself. I tried to make this point in the third paragraph of my response. I apologize if that point was insufficiently clear. /a --------------CE4C1FA68E292EE87A5254CD Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 8bit
On 3/28/19 18:35, andrew.campling@bt.com wrote:

Ø  For the types of home networks you mention, which generally lack professional and dedicated network administrators, DoH does not inherently represent any significant change to the decade-old status quo resulting from publicly-available DNS.

 

I disagree, there is a fundamental change here.  If / when browsers enable DoH by default...


Yes, and this pertains to product decisions rather than the DoH protocol itself. I tried to make this point in the third paragraph of my response. I apologize if that point was insufficiently clear.

/a
--------------CE4C1FA68E292EE87A5254CD-- From nobody Thu Mar 28 13:41:58 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BF7AA1202C0 for ; Thu, 28 Mar 2019 13:41:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=open-xchange.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xeF5_AvppwMt for ; Thu, 28 Mar 2019 13:41:51 -0700 (PDT) Received: from mx4.open-xchange.com (alcatraz.open-xchange.com [87.191.39.187]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36F2D120287 for ; Thu, 28 Mar 2019 13:41:50 -0700 (PDT) Received: from open-xchange.com (imap.open-xchange.com [10.20.30.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx4.open-xchange.com (Postfix) with ESMTPS id 360A56A273; Thu, 28 Mar 2019 21:41:48 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=open-xchange.com; s=201705; t=1553805708; bh=yMXWAwdpnDQNXBaSbDiA20cAcRwfsAk+mAqlRsMH/lQ=; h=Date:From:To:Cc:In-Reply-To:References:Subject:From; b=xA6Orl0smsj1LdqctZYQsuDY2P983SsfX8VoUH28D0mqmrt+e5QW+DiFj0g8t3LZU zthnY7b2a8y7HRihUhog82DnhxEoREjHmgSX5ag5PXSX/y3uXOr+5EZo7YwMYcgxP0 4uhej75FZOZmZvkIQ9RlqGUYyd4ZHqIBUevRnAVWRY8/HT+SBOjFot9/3fGLtgo9ns XIpjqNP4XqYGMQbcWkQnlZIPeTKs9/m24EleFre4hHJzOZSwc/NucgR1TfTGxz1uUp dlmOaFL+AJAjEbMAG+ksedRfmGiizTXU8k53PY5rW0SD0dykqVzpvgj/hDTrWF1Pf2 MzxGRoC6baQCA== Received: from appsuite-gw1.open-xchange.com (appsuite-gw1.open-xchange.com [10.20.28.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by open-xchange.com (Postfix) with ESMTPSA id 1DB213C02AF; Thu, 28 Mar 2019 21:41:48 +0100 (CET) Date: Thu, 28 Mar 2019 21:41:47 +0100 (CET) From: Vittorio Bertola To: Stephen Farrell Cc: DoH WG Message-ID: <662873599.26607.1553805708057@appsuite.open-xchange.com> In-Reply-To: <2f52bab4-128f-3e38-6d21-54485623a20b@cs.tcd.ie> References: <7d8c0bde-3393-7a48-ceeb-cf6db191f260@cs.tcd.ie> <24f0d96b-c6e3-97b8-7ead-b1853b4171f6@cs.tcd.ie> <1351299192.23919.1553762643258@appsuite.open-xchange.com> <2f52bab4-128f-3e38-6d21-54485623a20b@cs.tcd.ie> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_26604_751381821.1553805708032" X-Priority: 3 Importance: Medium X-Mailer: Open-Xchange Mailer v7.10.1-Rev9 X-Originating-Client: open-xchange-appsuite Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 20:41:55 -0000 ------=_Part_26604_751381821.1553805708032 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit > Il 28 marzo 2019 alle 12.29 Stephen Farrell < stephen.farrell@cs.tcd.ie mailto:stephen.farrell@cs.tcd.ie > ha scritto: > > > > Hiya, > > On 28/03/2019 08:44, Vittorio Bertola wrote: > > > > The problem is that, in DoH's "obfuscated traffic mode" (is that > > better than "dissident mode"?), > > > > > Better, but still not good:-) I'm not sure we ought think about > different modes of operation at all tbh - that may be assuming > that we're dealing with a single dimension when we're not. > Well, this is a discussion that we need to have, and having it without clear terminology makes it confusing. We could name the different technical deployment models that have been mentioned (port 443 on dedicated IP addresses, new protocol-specific port, or port 443 on existing web servers) without attributing them directly to any use case (this is why I agree that "dissident mode" is a bad name). Once we have them, we could discuss whether different use cases would benefit from different models. Same for the rest - I am happy to let you challenge my proposals, but first of all we should focus on an agreed statement of the issues. > > > > More generally, beware that if you build an Internet that is designed > > to work as if everyone on the planet were a dissident in an > > authoritarian country, it is not unlikely that you will then get an > > Internet regulatory and access environment that looks like the one of > > authoritarian countries, even in democratic ones. > > > > > +1 to what Adam said. > Ok, but is this off topic or not? I replied to Adam privately, I am happy to do it in public as well. Ciao, -- Vittorio Bertola Head of Policy & Innovation Cell: +39 348 7015022 Direct Chat: vittorio.bertola https://chat.open-xchange.com/direct/vittorio.bertola Email: vittorio.bertola@open-xchange.com mailto:vittorio.bertola@open-xchange.com Twitter: @openexchange http://twitter.com/openexchange - Facebook: OpenXchange https://www.facebook.com/OpenXchange - Web: www.open-xchange.com http://www.open-xchange.com Open-Xchange AG, Hohenzollernring 72, 50672 Cologne, District Court Cologne HRB 95366 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Director: Frank Hoberg US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system. ------=_Part_26604_751381821.1553805708032 Content-Type: multipart/related; boundary="----=_Part_26605_1983963226.1553805708032" ------=_Part_26605_1983963226.1553805708032 MIME-Version: 1.0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Il 28 marzo 2019 alle 12.29 Stephen Farrell < stephen.farrell@cs.tcd.ie> ha scritto:



Hiya,

On 28/03/2019 08:44, Vittorio Bertola wrote:
The problem is that, in DoH's "obfuscated traffic mode" (is that
better than "dissident mode"?),
Better, but still not good:-) I'm not sure we ought think about
different modes of operation at all tbh - that may be assuming
that we're dealing with a single dimension when we're not.
Well, this is a discussion that we need to have, and having it without clear terminology makes it confusing. We could name the different technical deployment models that have been mentioned (port 443 on dedicated IP addresses, new protocol-specific port, or port 443 on existing web servers) without attributing them directly to any use case (this is why I agree that "dissident mode" is a bad name). Once we have them, we could discuss whether different use cases would benefit from different models.

Same for the rest - I am happy to let you challenge my proposals, but first of all we should focus on an agreed statement of the issues.
More generally, beware that if you build an Internet that is designed
to work as if everyone on the planet were a dissident in an
authoritarian country, it is not unlikely that you will then get an
Internet regulatory and access environment that looks like the one of
authoritarian countries, even in democratic ones.
+1 to what Adam said.
Ok, but is this off topic or not? I replied to Adam privately, I am happy to do it in public as well.

Ciao,
--
Vittorio Bertola
Head of Policy & Innovation

Cell: +39 348 7015022
Direct Chat: vittorio.bertola
Email: vittorio.bertola@open-xchange.com

Twitter: @openexchange - Facebook: OpenXchange - Web: www.open-xchange.com
Open-Xchange AG, Hohenzollernring 72, 50672 Cologne, District Court Cologne HRB 95366
Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Michael Knapstein, Stephan Martin
Chairman of the Board: Richard Seibt

European Office:
Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718
Managing Director: Frank Hoberg

US Office:
Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA

Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.
------=_Part_26605_1983963226.1553805708032 Content-Type: image/png Content-Transfer-Encoding: base64 Content-ID: Content-Disposition: inline iVBORw0KGgoAAAANSUhEUgAAAL4AAAAnCAYAAACxHfIWAAAKL2lDQ1BJQ0MgcHJvZmlsZQAASMed lndUVNcWh8+9d3qhzTDSGXqTLjCA9C4gHQRRGGYGGMoAwwxNbIioQEQREQFFkKCAAaOhSKyIYiEo qGAPSBBQYjCKqKhkRtZKfHl57+Xl98e939pn73P32XuftS4AJE8fLi8FlgIgmSfgB3o401eFR9Cx /QAGeIABpgAwWempvkHuwUAkLzcXerrICfyL3gwBSPy+ZejpT6eD/0/SrFS+AADIX8TmbE46S8T5 Ik7KFKSK7TMipsYkihlGiZkvSlDEcmKOW+Sln30W2VHM7GQeW8TinFPZyWwx94h4e4aQI2LER8QF GVxOpohvi1gzSZjMFfFbcWwyh5kOAIoktgs4rHgRm4iYxA8OdBHxcgBwpLgvOOYLFnCyBOJDuaSk ZvO5cfECui5Lj25qbc2ge3IykzgCgaE/k5XI5LPpLinJqUxeNgCLZ/4sGXFt6aIiW5paW1oamhmZ flGo/7r4NyXu7SK9CvjcM4jW94ftr/xS6gBgzIpqs+sPW8x+ADq2AiB3/w+b5iEAJEV9a7/xxXlo 4nmJFwhSbYyNMzMzjbgclpG4oL/rfzr8DX3xPSPxdr+Xh+7KiWUKkwR0cd1YKUkpQj49PZXJ4tAN /zzE/zjwr/NYGsiJ5fA5PFFEqGjKuLw4Ubt5bK6Am8Kjc3n/qYn/MOxPWpxrkSj1nwA1yghI3aAC 5Oc+gKIQARJ5UNz13/vmgw8F4psXpjqxOPefBf37rnCJ+JHOjfsc5xIYTGcJ+RmLa+JrCdCAACQB FcgDFaABdIEhMANWwBY4AjewAviBYBAO1gIWiAfJgA8yQS7YDApAEdgF9oJKUAPqQSNoASdABzgN LoDL4Dq4Ce6AB2AEjIPnYAa8AfMQBGEhMkSB5CFVSAsygMwgBmQPuUE+UCAUDkVDcRAPEkK50Bao CCqFKqFaqBH6FjoFXYCuQgPQPWgUmoJ+hd7DCEyCqbAyrA0bwwzYCfaGg+E1cBycBufA+fBOuAKu g4/B7fAF+Dp8Bx6Bn8OzCECICA1RQwwRBuKC+CERSCzCRzYghUg5Uoe0IF1IL3ILGUGmkXcoDIqC oqMMUbYoT1QIioVKQ21AFaMqUUdR7age1C3UKGoG9QlNRiuhDdA2aC/0KnQcOhNdgC5HN6Db0JfQ d9Dj6DcYDIaG0cFYYTwx4ZgEzDpMMeYAphVzHjOAGcPMYrFYeawB1g7rh2ViBdgC7H7sMew57CB2 HPsWR8Sp4sxw7rgIHA+XhyvHNeHO4gZxE7h5vBReC2+D98Oz8dn4Enw9vgt/Az+OnydIE3QIdoRg QgJhM6GC0EK4RHhIeEUkEtWJ1sQAIpe4iVhBPE68QhwlviPJkPRJLqRIkpC0k3SEdJ50j/SKTCZr kx3JEWQBeSe5kXyR/Jj8VoIiYSThJcGW2ChRJdEuMSjxQhIvqSXpJLlWMkeyXPKk5A3JaSm8lLaU ixRTaoNUldQpqWGpWWmKtKm0n3SydLF0k/RV6UkZrIy2jJsMWyZf5rDMRZkxCkLRoLhQWJQtlHrK Jco4FUPVoXpRE6hF1G+o/dQZWRnZZbKhslmyVbJnZEdoCE2b5kVLopXQTtCGaO+XKC9xWsJZsmNJ y5LBJXNyinKOchy5QrlWuTty7+Xp8m7yifK75TvkHymgFPQVAhQyFQ4qXFKYVqQq2iqyFAsVTyje V4KV9JUCldYpHVbqU5pVVlH2UE5V3q98UXlahabiqJKgUqZyVmVKlaJqr8pVLVM9p/qMLkt3oifR K+g99Bk1JTVPNaFarVq/2ry6jnqIep56q/ojDYIGQyNWo0yjW2NGU1XTVzNXs1nzvhZei6EVr7VP q1drTltHO0x7m3aH9qSOnI6XTo5Os85DXbKug26abp3ubT2MHkMvUe+A3k19WN9CP16/Sv+GAWxg acA1OGAwsBS91Hopb2nd0mFDkqGTYYZhs+GoEc3IxyjPqMPohbGmcYTxbuNe408mFiZJJvUmD0xl TFeY5pl2mf5qpm/GMqsyu21ONnc332jeaf5ymcEyzrKDy+5aUCx8LbZZdFt8tLSy5Fu2WE5ZaVpF W1VbDTOoDH9GMeOKNdra2Xqj9WnrdzaWNgKbEza/2BraJto22U4u11nOWV6/fMxO3Y5pV2s3Yk+3 j7Y/ZD/ioObAdKhzeOKo4ch2bHCccNJzSnA65vTC2cSZ79zmPOdi47Le5bwr4urhWuja7ybjFuJW 6fbYXd09zr3ZfcbDwmOdx3lPtKe3527PYS9lL5ZXo9fMCqsV61f0eJO8g7wrvZ/46Pvwfbp8Yd8V vnt8H67UWslb2eEH/Lz89vg98tfxT/P/PgAT4B9QFfA00DQwN7A3iBIUFdQU9CbYObgk+EGIbogw pDtUMjQytDF0Lsw1rDRsZJXxqvWrrocrhHPDOyOwEaERDRGzq91W7109HmkRWRA5tEZnTdaaq2sV 1iatPRMlGcWMOhmNjg6Lbor+wPRj1jFnY7xiqmNmWC6sfaznbEd2GXuKY8cp5UzE2sWWxk7G2cXt iZuKd4gvj5/munAruS8TPBNqEuYS/RKPJC4khSW1JuOSo5NP8WR4ibyeFJWUrJSBVIPUgtSRNJu0 vWkzfG9+QzqUvia9U0AV/Uz1CXWFW4WjGfYZVRlvM0MzT2ZJZ/Gy+rL1s3dkT+S453y9DrWOta47 Vy13c+7oeqf1tRugDTEbujdqbMzfOL7JY9PRzYTNiZt/yDPJK817vSVsS1e+cv6m/LGtHlubCyQK +AXD22y31WxHbedu799hvmP/jk+F7MJrRSZF5UUfilnF174y/ariq4WdsTv7SyxLDu7C7OLtGtrt sPtoqXRpTunYHt897WX0ssKy13uj9l4tX1Zes4+wT7hvpMKnonO/5v5d+z9UxlfeqXKuaq1Wqt5R PXeAfWDwoOPBlhrlmqKa94e4h+7WetS212nXlR/GHM44/LQ+tL73a8bXjQ0KDUUNH4/wjowcDTza 02jV2Nik1FTSDDcLm6eORR67+Y3rN50thi21rbTWouPguPD4s2+jvx064X2i+yTjZMt3Wt9Vt1Ha Ctuh9uz2mY74jpHO8M6BUytOdXfZdrV9b/T9kdNqp6vOyJ4pOUs4m3924VzOudnzqeenL8RdGOuO 6n5wcdXF2z0BPf2XvC9duex++WKvU++5K3ZXTl+1uXrqGuNax3XL6+19Fn1tP1j80NZv2d9+w+pG 503rm10DywfODjoMXrjleuvyba/b1++svDMwFDJ0dzhyeOQu++7kvaR7L+9n3J9/sOkh+mHhI6lH 5Y+VHtf9qPdj64jlyJlR19G+J0FPHoyxxp7/lP7Th/H8p+Sn5ROqE42TZpOnp9ynbj5b/Wz8eerz +emCn6V/rn6h++K7Xxx/6ZtZNTP+kv9y4dfiV/Kvjrxe9rp71n/28ZvkN/NzhW/l3x59x3jX+z7s /cR85gfsh4qPeh+7Pnl/eriQvLDwG/eE8/vMO7xsAAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMA AAsSAAALEgHS3X78AAAAB3RJTUUH4gcYDycZBSfu0QAADv5JREFUeNrtnXu0XUV9xz/ncROe4VUo jVBBBUckhCXhEbACGkxlwqOVl9ZWqCirllJZA4KoYbEgFayjrfShq2VRtBVEIwqZCkoIuKjGQALx USeAgKHQEAIEkCTce885/WN/hwx7nXvvOZf7ataZtc7a5+679+zZM9/fb76/329+cyrGOgBi8Bjr 0nF74M3AB4B3AvsC05jYshl4FFgGfBt4PAY/aKyrxOBbxro6UAOWALOBV4BKB/W2gD5gJXBKqlPn icF31LisHZcB5wONLp5fAbYAH4rBL0/93isTVyoZ2Pti8APGuhOAy4FjplhblwCXx+BXpbYKgLsA ywEzijqXA++OwW9WXQwH/qyvpsXg+411VwGfHsVzNwEnxeDvMtZVY/DNHhQnGPga0HYD2cqvmcTS ytqwGbgwBv9VY10VaAqI04FfaJZqAdUu6l0OvAuoxuBfGUr7JqEAajH4hrHu74ELSu0bqQxqZjou Bn9/An1P4098qarT+411iwT6gQzwlakinCp14CvGurPbaMm3Ag93CPpUbws4CvgRMCDKg7EuB/pr ZgGB/mqBvtlFH7UE/PcI9Oj+HugnUeP/IfB9gb7v/0G7NwGHAI9lWr8OTAd+CrxdoOpECAYlUD8B jo/Bv1LS8GV6cwWwsEtND/CyQP9TY10tBt/owW9yOf4OwN3A4R1orIniorUOrrk5Bn+mAD+YAXQH YHWXtCcJyY+B44CKQP7qTCMj+IvAhV2CvimKdnwM/r4evZk6wH+HPBwjDWZrAjn9SGBNWnp34CVg MIHIWDdNHpYIvGUUz/+JDPsq0MjqvQb4ZBczCWrHoDj98txA7pXJLXXgQx1e+2PgS8CMcaZeG4Ab gJ3Uvra2iY4fj8EvMtZVjHXJHdkv8B8KrAAO6kJDN4C5wL3S0A2BdWGXoM9dlvPksqzlgtQrkw/8 Yzv03jwbg188EY0y1jUEwvoIhuk8YJGoSSszSvslAEcCD4j2dALamp57tOjf0ca6zwMXd0GbUtko Tr+qx+mnJvDf2KkHqGz0jYfGj8F3op0rMsTfkgttKQiHNO7bgDXAm7q0L+Ya69YAB3bJ6QdEb46N wf9M7Wn0KM7UA37XEdnxGsAuhaqtBs7bJoN0OjBLdozpAsQtCVa39OYV4BiBvkrPZTllgb/NFmnZ 5J48UuDvlPZUOqSA+fUvZJq+R2+mcKluqy+Wa1jNJC/J0P0N3QW5Oin9FC7LY2Pwq3N60ys94E8q +GU71AT+hzJ68npKun8QmCvQV8abEvZKj+p0S3u2ZLRnBXAA3fnl280IGylcn6t79Kan8ac07YnB b6RY8rBWfTAazd+kWDoxNwb/oJYp9+hND/hTE/yZEFRk6D5J94vxGhm9iaNZz98rPeBPKN3RcZrW 4F8FvGGUFGcacIWxrh6Db2Wxg17pAX9Kgr6qqO61wCWjpDmJHp0KfE/1Tu+Bv2fcTkmqIx7eNNb9 DUW6YLdLi8tavwWcaKy7LQZ/UqI84x2lLUWnh3rXSaFdnbStB/yJHYiUWnkl8ClenzcnB/8AsMBY t4QinfA1zx3H90nLO4a8Rt/Tco7WBPb1kOmUabHeZAvBNh+5TZ0t0Kd0wbEAfSp9qs8Ct0kIpg+X xjhWoDfW7QycR7EOaZAiA+3fYvAvpWsT4CdiFkqCpll1V4rchXcBO1IEDr8Sg1+atX/SwL9NAz+b 8hvGus+xNUd2rG2bxPmtse7WGPzJaZ3OWA5uCfR/BHxH2nNLRtm+rO91YFCbB/xvDP4Xw9GQTuyT DuhVattZwI0UEe11FG7fE4HTjHVXxuAX5gk5w9XdJgI/JK0bqa68vm0S+G3ozeXApaPg9A2KaG+n a3sGgJMS529HPcbgvVrGun0E+pXAeTH4lfr/oWxdsTporNsJ+AHFMusyIF5DlUYKvmnJd/menFIl IJ8p0N8J/GUM/iH9f1dgMfBZY90PgXvzZ5afn88KuYLJKVTKwyjTK3naBtvZHel7fVsEfYnepHTB bjOnGsAJwNcp9hXq5P4+3bcgM3hTru5YTusfVXuuicGvTEZ1DP5B4EFds6Oo17PADGPd0cCjMfh1 CRjGug8DewC3xuAfMdYZitWl64B3UOQybMo0ZctYtx/FKtd7YvCbM2A2jXW7AzcB/wXMlyDUdP9G Y915qvMLMfgjgYax7v3AWqVlnkKR/fZADP7GEpjT7hZzgIOBdTH42zOBbBrrTgceUzL/bNHP3wL/ qGsGU3vrFEnQO48GXJNc0hJgck9Kid5czdYc2U5BP6i658fgf2SseyvF2p59O7w/redfYKz7Xgz+ lJQXPIbg30XHTen9E9VQ208U6FO5lSLuMEug3sNY97CEowFcY6z7AEVSzz9olrgXOC0Gv1iatQJs D3wT2DMG/yZjXZ9mudTvV+vvKzPN3Mgw8xjFdi7zsnNfAxYa6y4CzkgKxlh3RAz+QglOBagb6+6R YLQo0mYfoMgVr2jcvkYRWzmDInko7YJxRQx+t7y9dYokjb07BMR4GyOt0nG46/qAX5W5W6bNPstW P32lyzacEIO/Wzy9QbG84X62JrBXOuyvkxP4x5j23A78NXCxse6+GPz6LLWxBSwx1u0P/FIGpcue PwP4OcUS6rOApTp+S5csEWA26L0XZzbMe4AjgEPaJPlvD7wbeCYGf0c2C+Xv3TDWvZS9xxzV/RdS YvvE4J+UE+ITUlp9Mfgtxrr7KZKm5iqV81zgX4ADFD2fo3H5MPA0sHcM/mlj3d8CFxnr5sXg70zt qgM/pEg/HGlA9zPWfYoiF3Y8tfjzEsjhaFhTmvW7uaBkoP98JvGdavqmBvK9Mfh7srqamqaP0DTd Ke2pl8Gf2RyjBr+m/9uV/H4JsMJY98UY/JeNdVW1F+APgB0E7JwDLwT2BA6Owf9SbbrBWHc+MCcG /5ixbg/gGeAwPXZ6DH6Tse5m4Nsx+J+LeuQcfDYwMxOgodyteeLT4RrHnYHZMfiXdf4/gAuMdW+L wf/KWHex6n9fStqX8CLDHuBI1fXbGPxx2TPWDDU4N1GE7kfSYofqM5XKdUosTxx6cJQ5sgO6dr5A n+rKDcIXxG0fpvNlDkl4TzbWfTcGf+rrAb/a0hRfvdRYtwy4BfiSse5EYEFGMQ7Rcam0XFUG5seA xQJ9XTSxrpltlZ7zrLHuSYENgf6TmmW9zpXTKfcWFXqwPGtndteOwF6yO1Ib+wAXg3+5TZ9sVtv+ HFgtga8Ap1NsSLCCYqFhqqsOfCQ3jtmacnpXPktVdeMtHVKApo7j+elk754acHWmpWsCxacz0Fe6 nGneK3pTa+dKk8ehIaPvqQ4pWU57TjHW3ZL2/Hw9tpI0bTUGf0cMfgdx8vly16Yg0UHAC8pA69M7 zpR2/WoWSKpmtGNZ9pingH1U306aKb6TNrltA9K0Ednz7TxsmXAcrPYC7K/3+XcphPw6YvCPS5O/ QfSqoTG/jmKpyAkyausUudFrlf3WJxugT8K7QQqhmp5R1UBcqsHZMgI4qmzdWnC8Pp1o6SeAz+na ZO0v0szV7BL0A+rAu0RvGkPtnRmD74/BrxfPXZ8pgk40/yBwqrEu0bPaaNb2ZMZ7U9RmGvC+pPUE 6D01O9+WGb8Danea/iuZsjlMymRZlkjzSCacl8kQ/lg7pZDbgMBu7YJa6oNjNCtca6ybKWN7ae6g UDlGTpckBDtrbM+g2PDLxODPisG/qLp/VwC/KTOoKxRb4RwO/Gc6rz6rpL0zHwJOArYbAfyTXbao g20M/kWK7QMHRG8u65Le9Au486Xpyd1dwwVRYvBPUuzV+eIogoVJ8ze6WdiWtGzm5UBarJa1L3l5 9pB2v700M+1W+nuaBOJGKYAn2nDjI4Bzgati8M+L27dr4lrgOeBPSt6tinDVBP5VdGqlKM9Miq3g U5umaffrc6XVX/UKAUti8Itj8PfIAK5mQrqX3u372RLxquzRPYEfZMGtZtL4rxpMkqbBEr2ZCp9U ngNmZcYV2p8+d111Wl9N9GaZvDcM57Vqc36zpten23ikhvskzb84JcJ3SHvSbPg7JaNxi7HuQn2/ W0DZLtfaWVmv44wY/KDiC9cJgI/rXVLdv06CCuwKXKWYRGMI5bCSYve6w4x1H1H9acnEDHmY6sAF Mfh+YD/denRGJZPxvTvwhcwFOgCc08almwzlA3RcmZ1riFZBsRlan2aVc4A/rpQXFhnr9gY+Q7HD 2i5TRNM/BVwvrbMlMxDTtn7dlibFDmfLylG+TmMYmZtuX4qNan9vlG7JU3MBGOa50wXojZrSfy0g HSWv3M3AnwokBwqEq2RsLo3Bf0MR3ycUl7hFs3y/zs2Mwc/J8LC7BKEJfCIG/89D/X5Ads/vU2w+ fJAozBpp49NEXT4Yg79V9/yT3J8pUT9I8R4PnByDvy2r/+vC47fkwn6j3vnMGPwKY91Nig3sI8A3 JaDXA2cr7rDBWPdBeYyolzgjMfh1wPnaFXiWKtyPzjZyHcvSLw/KHcDDMfjnsk5OP2DxZgVUuuH0 64FrY/AP5dG8Tj0sOTXRfU8Y695Oscx5VoecP81M2wPvN9Z9Yxj3X26LDAIp0DNXf/+3AlZLswjx GkUxnYTgBrX9f4x1xypIdY7OXyJFt6HkMn3OWNeUkFxffvc2fVKJwa811h0FLFD975Sg/hXwzRj8 M9mPeswDfgb8mTxFH9WscGgMfnXJMD5HAbWPy9h9hGJL+1Vqwn1SIv1Z/6L/35kZ3I+KDi4aKtxf MdbVcw/HZBW1o57vXpB/H2WdtXZ74I+inlfbOAH9MGR7xXdr2XWVIe6vlP+Xt13/T99PN9a1jHVn j0TF8ralvh1iHNPMheq+aIixqZT6tzbEcyv5s4b7Xm5TZagXyULgVSbvByJyF2p5JV6V0a2ybDFG m7eWVgPWRtlPTTrYbS0buGppTNL7tErtqWqWbmUR3dzDQkYJavqertlO2rcRgz+wUzrYZmwq2Rg2 2brH6WxRsAUx+KDnV8vv0ma8azku8nU8ZVd4dk96z/TufUBjKvziSa9MgaLfFThOAPyMKMX+8ta0 xiKRJVtxeRFwBXCYlhtM+Lr8am/Ie0VlO+Dv5PvfS37x30irjlX2VlK08+RFenSkmW68yv8BXSm7 LkwwJDUAAAAASUVORK5CYIIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA== ------=_Part_26605_1983963226.1553805708032-- ------=_Part_26604_751381821.1553805708032-- From nobody Thu Mar 28 14:41:23 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DC651203DE for ; Thu, 28 Mar 2019 14:41:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.99 X-Spam-Level: X-Spam-Status: No, score=-1.99 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sky.uk Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GwnDa5Nuhof3 for ; Thu, 28 Mar 2019 14:41:04 -0700 (PDT) Received: from EUR03-DB5-obe.outbound.protection.outlook.com (mail-eopbgr40085.outbound.protection.outlook.com [40.107.4.85]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 23D7C1204A0 for ; Thu, 28 Mar 2019 14:41:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sky.uk; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=okK6pyaMl1PvTCRGRcNiAHtKfiB27pKOePcofC2WQ8w=; b=bhYZPt3nalKyClLVBdhRdJdaofpKZL4wWEdfLz2/s65Tyh5CWWeGeRz0ZnaGPwuaYf4KN8rn7+SjHXc965J1fha3L17P2vIMdVT8bZmqD65zgNi1aAIrUtly6GG85nhsVDN/DflMDOaRko+BP5WOCnwTmqfwCwX9aHtkl6noFJY= Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com (10.168.51.153) by DB6PR0601MB2661.eurprd06.prod.outlook.com (10.168.81.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.15; Thu, 28 Mar 2019 21:40:59 +0000 Received: from DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93]) by DB6PR0601MB2184.eurprd06.prod.outlook.com ([fe80::5cb7:e589:692e:7d93%9]) with mapi id 15.20.1730.019; Thu, 28 Mar 2019 21:40:59 +0000 From: "Winfield, Alister" To: Adam Roach , "andrew.campling@bt.com" , "john@johncarr.eu" , "mcmanus@ducksong.com" CC: "paul.hoffman@icann.org" , "doh@ietf.org" Thread-Topic: [EXTERNAL] Re: [Doh] DoH Thread-Index: AQHU5X7LvjmRyUKPZkqOPQ5z7FEB8qYhOTmAgAANeoCAAAe4gIAACdoAgABLXAA= Date: Thu, 28 Mar 2019 21:40:59 +0000 Message-ID: <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> In-Reply-To: <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.1.190326 authentication-results: spf=none (sender IP is ) smtp.mailfrom=Alister.Winfield@sky.uk; x-originating-ip: [88.208.109.142] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 5eb65502-0e1f-4be5-c0d9-08d6b3c6112d x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DB6PR0601MB2661; x-ms-traffictypediagnostic: DB6PR0601MB2661: x-microsoft-antispam-prvs: x-forefront-prvs: 0990C54589 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(366004)(346002)(396003)(136003)(376002)(39860400002)(189003)(199004)(81166006)(14454004)(6246003)(2201001)(25786009)(86362001)(72206003)(5660300002)(478600001)(8676002)(4326008)(93886005)(83716004)(81156014)(2501003)(33656002)(106356001)(105586002)(5024004)(74482002)(11346002)(71190400001)(68736007)(186003)(71200400001)(99286004)(58126008)(97736004)(7736002)(6512007)(476003)(14444005)(486006)(6116002)(3846002)(2906002)(53546011)(256004)(102836004)(6506007)(66574012)(2616005)(110136005)(6436002)(6306002)(446003)(8936002)(82746002)(53936002)(236005)(316002)(26005)(36756003)(66066001)(76176011)(229853002)(6486002)(54896002)(54906003); DIR:OUT; SFP:1101; SCL:1; SRVR:DB6PR0601MB2661; H:DB6PR0601MB2184.eurprd06.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:0; received-spf: None (protection.outlook.com: sky.uk does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 80HuTXtclY9VWLY63roGe3a8aUfN1/U1NiYzZX0YYzBo00BGgZQ1H0sIgd/EFWx8psDn81B1lRGYUxt5kKHdRWrcdhBFZQ2MUypyXgvEe6W4j9kQsaBUq0n206QSb322c4VqBCqk3paVxkF4gE5pQzGjRkkS32ap+6ZVIoCfOqHR3faBXFdK96ybSVh6Awiaa62uw3s4KHYHKQi11It93kDKYoPjHtn0oDsuprsZcrrSt9SISw87IWO71hBIYaDfOX3oA9/onoYhLjr/jh+fr0bJWKIYo0FD4P4Kj9l1DKHm/C79mMdU4CIUyJwlu6xTsNTHoWesWmt9uiyBMbxYtfZVvAulaQUmo/LxPYTHrJeT6zIH4fLPOABLWX+TtMuphy32OjFl0NaE7fleVew4erajxbZucxbg486rqJpL5iQ= Content-Type: multipart/alternative; boundary="_000_9E29A232BA75478D96BF5D6164142BDDskyuk_" MIME-Version: 1.0 X-OriginatorOrg: sky.uk X-MS-Exchange-CrossTenant-Network-Message-Id: 5eb65502-0e1f-4be5-c0d9-08d6b3c6112d X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Mar 2019 21:40:59.1130 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 68b865d5-cf18-4b2b-82a4-a4eddb9c5237 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0601MB2661 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 21:41:21 -0000 --_000_9E29A232BA75478D96BF5D6164142BDDskyuk_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VG9wIHBvc3Rpbmcgb24gcHVycG9zZSDigKYuDQoNCknigJl2ZSB0cmllZCB0byByZXNwb25kIHR3 aWNlIHRvIHRoaXMgYW5kIEkgdGhpbmsgdGhpcmQgdGltZSBJIG1pZ2h0IGdldCBjbG9zZXIgdG8g bXkgdGhpbmtpbmfigKYNCg0KVGhlIERvSCBzb2x1dGlvbiAobm90ZSBub3QgbmVjZXNzYXJpbHkg cHJvdG9jb2wpIGlzIG1pc3NpbmcgYXQgbGVhc3QgdHdvIGtleSBlbGVtZW50cyB3aGljaCB0b2dl dGhlciB3b3VsZCBoYXZlIHJlZHVjZWQgdGhlIGltbWVkaWF0ZSBwYW5pYyBpbiB0aGUgaW1wbGVt ZW50YXRpb24uIE5vdCB0byBzYXkgdGhlcmUgYXJlbuKAmXQgb3RoZXIgdGhpbmdzIHRoYXQgbmVl ZCB3b3JrIGp1c3QgdGhlIHJlYWxseSBwcm9ibGVtYXRpYyBpc3N1ZXMgY291bGQgYmUgY29udGFp bmVkIG9yIGRlZmVycmVkLg0KDQpUaGUgY3VycmVudCBhY3RpdmUgd29yayBvbiBkaXNjb3Zlcnkg YW5kIHNvbWVob3cgZGVmaW5pbmcgYSB0cnVzdCBhbmQgcHJpdmFjeSBtZWNoYW5pc20gc3Vycm91 bmRpbmcgVFJS4oCZcy4NCg0KV2l0aCB0cnVzdGVkIGxpc3RzIG9mIFRSUuKAmXMgeW914oCZZCB0 aGVuIGJlIGFibGUgdG8gdXNlIHRoZSBvdXRwdXQgb2YgYSBmdW5kYW1lbnRhbGx5IGluc2VjdXJl IGRpc2NvdmVyeSBtZXRob2QuIElmIHRoYXQg4oCYdHJ1c3QgYW5kIHByaXZhY3nigJkgd2VyZSB0 byBiZSBzZWxlY3RhYmxlIHNheSBieSBjaG9pY2Ugb2YgcHJvdmlkZXIuIFlvdSBnZXQgdGhlIG9w dGlvbiB0byBhbGxvdyB0aGUgbG9jYWwgbmV0d29yayBwb2xpY3kgLyBvciBub3QuIFlvdSBjYW4g Y2hvc2UgdG8gYWxsb3cgdHJ1c3RlZCBjb2ZmZWUgc2hvcHMgYnV0IG90aGVycyBtYXkgYmUgbm90 IGluIHlvdXIgbGlzdCBiZWNhdXNlIHRoZXkgZG8gdGhpbmdzIHRoYXQg4oCYeW914oCZIGRvbuKA mXQgbGlrZS4gUGFyZW50cyBjYW4gY2hvc2UgdG8gdHJ1c3Qgb25seSB0aG9zZSBETlMgcHJvdmlk ZXJzIHRoYXQgZ2l2ZSBzdHJvbmcgcGFyZW50YWwgY29udHJvbHMuIFdoYXRldmVyIGdyb3VwIHlv dSBhcmUgaW4gbWFueSB0aGluZ3Mgd291bGQgYmUgbGVzcyBjb250cm92ZXJzaWFsLiBPaCwgaXTi gJlzIG5vdCBlYXN5IGJ1dCBhdCBsZWFzdCB3ZSB3b3VsZG7igJl0IGJlIGluIHRoZSBjdXJyZW50 IHBvc2l0aW9uIHdoZXJlIGl0IGlzIGFsbW9zdCBjZXJ0YWluIHRoYXQgYSBzdWRkZW4gY2hhbmdl IHdpbGwgb2NjdXIgdG8gYSBrZXlzdG9uZSBvZiB0aGUgSW50ZXJuZXQuDQoNCldvcnN0IGNhc2Ug ZXhhbXBsZSBpcyB0aGF0IGdpdmVuIHRoZSBiaWxsaW9ucyBvZiBxdWVyaWVzIHBlciBzZWNvbmQg d2UgYXJlIHRhbGtpbmcgYWJvdXQgaGVyZSBhbmQgdGhlIGxvY2FsaXNhdGlvbiBvZiBjb250ZW50 IGRlbGl2ZXJ5IGl0IGltcGFjdHMsIG1hbnkgdGVycmFieXRlcyBwZXIgc2Vjb25kIG9mIHRyYWZm aWMgY291bGQgLyB3b3VsZCByYXBpZGx5IG1pZ3JhdGUgdG8gbGVzcy1vcHRpbWFsIENETuKAmXMu IFRoZSBkaXN0cmlidXRpb24gb2YgdGhpcyBtaWdodCB3ZWxsIGJyZWFrIG5ldHdvcmtzLCBzYWRs eSB0aGVyZSBpcyBubyByZXNlYXJjaCB0aGF0IGNhbiByZWxpYWJseSB3b3JrIG91dCB0aGUgZnVs bCBpbXBhY3QuIFNtYWxsIHRyaWFscyByZWFsbHkgZG9u4oCZdCBoZWxwIGJlY2F1c2Ugd2UgYWxy ZWFkeSBoYW5kbGUgc21hbGwgcGVyY2VudGFnZXMgb2Ygbm9uLWxvY2FsIEROUyB1c2UuIEl04oCZ cyB0aGUgdW5rbm93biBvZiB3aGF0IGhhcHBlbnMgaWYgODAlIG9mIHRoZSB1c2VycyBpbiBhIHNp bmdsZSBzb2Z0d2FyZSB1cGRhdGUgY2hhbmdlIHRvIGEgbm9uLWxvY2FsIEROUyBwcm92aWRlciAo ZXNwZWNpYWxseSBpZiBpdOKAmXMgb25lIHRoYXQgZG9lc27igJl0IGZvcndhcmQgZ3JhbnVsYXIg ZW5vdWdoIEVETlMgY2xpZW50LXN1Ym5ldCBkYXRhIGJlY2F1c2Ug4oCYcHJpdmFjeeKAmSkuDQoN CkkgYWRtaXQgdGhhdCBsYXN0IHBhcmFncmFwaCBtYXkgYmUgRlVELCBidXQgaW4gdGhpcyBjYXNl IHRoZSByaXNrIHRvIHRoZSBzdGFiaWxpdHkgb2YgdGhlIEludGVybmV0IGlzIHBvdGVudGlhbGx5 IGF0IHN0YWtlIHNvIGxhcmdlc3QgcG9zc2libGUg4oCYd2XigJkgb3dlIGV2ZXJ5b25lIGEgbGl0 dGxlIHRpbWUgZXhwb3NpbmcgdGhlIHBvdGVudGlhbCBpc3N1ZXMgaW4gZGV0YWlsIHdpdGggYW55 IG1pdGlnYXRpb25zIGlmIHRoZXkgZXhpc3QuIFByZXBhcmluZyB0aG9zZSB3aG8gd2lsbCBiZSBp bXBhY3RlZCBmb3IgY2hhbmdlIGFuZCB0aGVuIHNvbWVob3cgY29udGFpbmluZyB0aGUgaW5pdGlh bCAgY2hhbmdlIHNvIGlmIGl0IHJlYWxseSBkb2VzIGNhdXNlIGhhcmQgdG8gY29udGFpbiBpc3N1 ZXMgd2UgaGF2ZSBhIHNtYWxsIGVub3VnaCBwcm9ibGVtIGl0cyBzb2x2YWJsZSBpbiByZWFzb25h YmxlIHRpbWVmcmFtZXMuIEFueW9uZSB3aG8gaGFzIGRvbmUgb3BlcmF0aW9ucyB3aWxsIHRlbGwg eW91IHRoYXQgYmlnIGNoYW5nZXMgdGhhdCBoYXBwZW4gZmFzdCBhcmUgdGhlIG5pZ2h0bWFyZSB5 b3UgZmlnaHQgaGFyZGVzdCB0byBhdm9pZC4NCg0KT25lIG1vcmUgdGhpbmcgSeKAmWxsIHJlcGVh dCBvdGhlcnMgd2FybmluZy4uIGJld2FyZSB1bmludGVuZGVkIGNvbnNlcXVlbmNlcyB0aGlzIG11 c3Qgbm90IGVuZCBpbiBhIGZpZ2h0IGJldHdlZW4gbmV0d29ya3MsIG9yIGdvdmVybm1lbnRzIGFu ZCBEb0ggcHJvdmlkZXJzLiBJZiB0aGlzIGdvZXMgd3JvbmcgYW5kIGNvcnBvcmF0ZXMgYW5kIG90 aGVyIHBsYXllcnMgZGVjaWRlIHRoaXMgaXMgYSBzdGVwIHRvbyBmYXIgYmVjYXVzZSBvZiB0aGUg aW1wYWN0cyB3ZSBhbGwga25vdyB0aGUgb3V0Y29tZSBjb3VsZCBiZSB2ZXJ5IG1lc3N5IGFuZCBJ IGZvciBvbmUgd291bGQgcmF0aGVyIHdvcmsgdG8gZ2V0IGEgbGVzcyBwYWluZnVsIGFuZCBtb3N0 IGxpa2VseSBsZXNzIHByaXZhY3kgaW1wYWN0ZnVsIHJlc3VsdC4NCg0KTkI6IERvbuKAmXQgYml0 ZSBJIGRvIGxpa2UgdGhlIHByb3RvY29sIGFuZCBJIGFncmVlIHRoYXQgdGhlcmUgYXJlIHNvbWUg dGhhdCBuZWVkIGl0IHRvIGV4aXN0Lg0KDQotLQ0KQWxpc3RlciBXaW5maWVsZA0KDQpGcm9tOiBE b2ggPGRvaC1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgQWRhbSBSb2FjaCA8YWRhbUBu b3N0cnVtLmNvbT4NCkRhdGU6IFRodXJzZGF5LCAyOCBNYXJjaCAyMDE5IGF0IDE5OjEyDQpUbzog ImFuZHJldy5jYW1wbGluZ0BidC5jb20iIDxhbmRyZXcuY2FtcGxpbmdAYnQuY29tPiwgImpvaG5A am9obmNhcnIuZXUiIDxqb2huQGpvaG5jYXJyLmV1PiwgIm1jbWFudXNAZHVja3NvbmcuY29tIiA8 bWNtYW51c0BkdWNrc29uZy5jb20+DQpDYzogInBhdWwuaG9mZm1hbkBpY2Fubi5vcmciIDxwYXVs LmhvZmZtYW5AaWNhbm4ub3JnPiwgImRvaEBpZXRmLm9yZyIgPGRvaEBpZXRmLm9yZz4NClN1Ympl Y3Q6IFtFWFRFUk5BTF0gUmU6IFtEb2hdIERvSA0KDQpPbiAzLzI4LzE5IDE4OjM1LCBhbmRyZXcu Y2FtcGxpbmdAYnQuY29tPG1haWx0bzphbmRyZXcuY2FtcGxpbmdAYnQuY29tPiB3cm90ZToNCg0K ICAqICAgRm9yIHRoZSB0eXBlcyBvZiBob21lIG5ldHdvcmtzIHlvdSBtZW50aW9uLCB3aGljaCBn ZW5lcmFsbHkgbGFjayBwcm9mZXNzaW9uYWwgYW5kIGRlZGljYXRlZCBuZXR3b3JrIGFkbWluaXN0 cmF0b3JzLCBEb0ggZG9lcyBub3QgaW5oZXJlbnRseSByZXByZXNlbnQgYW55IHNpZ25pZmljYW50 IGNoYW5nZSB0byB0aGUgZGVjYWRlLW9sZCBzdGF0dXMgcXVvIHJlc3VsdGluZyBmcm9tIHB1Ymxp Y2x5LWF2YWlsYWJsZSBETlMuDQoNCkkgZGlzYWdyZWUsIHRoZXJlIGlzIGEgZnVuZGFtZW50YWwg Y2hhbmdlIGhlcmUuICBJZiAvIHdoZW4gYnJvd3NlcnMgZW5hYmxlIERvSCBieSBkZWZhdWx0Li4u DQoNCg0KDQpZZXMsIGFuZCB0aGlzIHBlcnRhaW5zIHRvIHByb2R1Y3QgZGVjaXNpb25zIHJhdGhl ciB0aGFuIHRoZSBEb0ggcHJvdG9jb2wgaXRzZWxmLiBJIHRyaWVkIHRvIG1ha2UgdGhpcyBwb2lu dCBpbiB0aGUgdGhpcmQgcGFyYWdyYXBoIG9mIG15IHJlc3BvbnNlLiBJIGFwb2xvZ2l6ZSBpZiB0 aGF0IHBvaW50IHdhcyBpbnN1ZmZpY2llbnRseSBjbGVhci4NCi9hDQotLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0KVGhp cyBlbWFpbCBpcyBmcm9tIGFuIGV4dGVybmFsIHNvdXJjZS4gUGxlYXNlIGRvIG5vdCBvcGVuIGF0 dGFjaG1lbnRzIG9yIGNsaWNrIGxpbmtzIGZyb20gYW4gdW5rbm93biBvciBzdXNwaWNpb3VzIG9y aWdpbi4gUGhpc2hpbmcgYXR0ZW1wdHMgY2FuIGJlIHJlcG9ydGVkIGJ5IHNlbmRpbmcgdGhlbSB0 byBwaGlzaGluZ0Bza3kudWsgYXMgYXR0YWNobWVudHMuIFRoYW5rIHlvdQ0KLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0N Cg0KSW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzIG1h eSBiZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5 IGZvciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUgb2ZmaWNp YWwgcG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5 b3UgaGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlIG5vdGlmeSB0aGUgc2VuZGVyIGJ5 IHJldHVybiBlLW1haWwgYW5kIGRlbGV0ZSBpdCBmcm9tIHlvdXIgc3lzdGVtLiBZb3Ugc2hvdWxk IG5vdCByZXByb2R1Y2UsIGRpc3RyaWJ1dGUsIHN0b3JlLCByZXRyYW5zbWl0LCB1c2Ugb3IgZGlz Y2xvc2UgaXRzIGNvbnRlbnRzIHRvIGFueW9uZS4gUGxlYXNlIG5vdGUgd2UgcmVzZXJ2ZSB0aGUg cmlnaHQgdG8gbW9uaXRvciBhbGwgZS1tYWlsIGNvbW11bmljYXRpb24gdGhyb3VnaCBvdXIgaW50 ZXJuYWwgYW5kIGV4dGVybmFsIG5ldHdvcmtzLiBTS1kgYW5kIHRoZSBTS1kgbWFya3MgYXJlIHRy YWRlbWFya3Mgb2YgU2t5IExpbWl0ZWQgYW5kIFNreSBJbnRlcm5hdGlvbmFsIEFHIGFuZCBhcmUg dXNlZCB1bmRlciBsaWNlbmNlLg0KDQpTa3kgVUsgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5vLiAy OTA2OTkxKSwgU2t5LUluLUhvbWUgU2VydmljZSBMaW1pdGVkIChSZWdpc3RyYXRpb24gTm8uIDIw NjcwNzUpLCBTa3kgU3Vic2NyaWJlcnMgU2VydmljZXMgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5v LiAyMzQwMTUwKSBhbmQgU2t5IENQIExpbWl0ZWQgKFJlZ2lzdHJhdGlvbiBOby4gOTUxMzI1OSkg YXJlIGRpcmVjdCBvciBpbmRpcmVjdCBzdWJzaWRpYXJpZXMgb2YgU2t5IExpbWl0ZWQgKFJlZ2lz dHJhdGlvbiBOby4gMjI0NzczNSkuIEFsbCBvZiB0aGUgY29tcGFuaWVzIG1lbnRpb25lZCBpbiB0 aGlzIHBhcmFncmFwaCBhcmUgaW5jb3Jwb3JhdGVkIGluIEVuZ2xhbmQgYW5kIFdhbGVzIGFuZCBz aGFyZSB0aGUgc2FtZSByZWdpc3RlcmVkIG9mZmljZSBhdCBHcmFudCBXYXksIElzbGV3b3J0aCwg TWlkZGxlc2V4IFRXNyA1UUQNCg== --_000_9E29A232BA75478D96BF5D6164142BDDskyuk_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1m YW1pbHk6Ik1hbGd1biBHb3RoaWMiOw0KCXBhbm9zZS0xOjIgMTEgNSAzIDIgMCAwIDIgMCA0O30N CkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q29uc29sYXM7DQoJcGFub3NlLTE6MiAxMSA2IDkg MiAyIDQgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseToiXEBNYWxndW4gR290aGlj Ijt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3JtYWwsIGxpLk1zb05vcm1hbCwg ZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGNtOw0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglm b250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNv bG9yOmJsYWNrO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXByaW9y aXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQphOnZp c2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5Ojk5 Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnByZQ0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVk IENoYXIiOw0KCW1hcmdpbjowY207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6 ZToxMC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3IjsNCgljb2xvcjpibGFjazt9DQpw Lk1zb0xpc3RQYXJhZ3JhcGgsIGxpLk1zb0xpc3RQYXJhZ3JhcGgsIGRpdi5Nc29MaXN0UGFyYWdy YXBoDQoJe21zby1zdHlsZS1wcmlvcml0eTozNDsNCgltYXJnaW4tdG9wOjBjbTsNCgltYXJnaW4t cmlnaHQ6MGNtOw0KCW1hcmdpbi1ib3R0b206MGNtOw0KCW1hcmdpbi1sZWZ0OjM2LjBwdDsNCglt YXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToi Q2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjpibGFjazt9DQpwLm1zb25vcm1hbDAsIGxpLm1z b25vcm1hbDAsIGRpdi5tc29ub3JtYWwwDQoJe21zby1zdHlsZS1uYW1lOm1zb25vcm1hbDsNCglt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJbXNvLW1hcmdpbi10b3AtYWx0OmF1dG87DQoJbWFyZ2lu LXJpZ2h0OjBjbTsNCgltc28tbWFyZ2luLWJvdHRvbS1hbHQ6YXV0bzsNCgltYXJnaW4tbGVmdDow Y207DQoJZm9udC1zaXplOjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp ZjsNCgljb2xvcjpibGFjazt9DQpzcGFuLkhUTUxQcmVmb3JtYXR0ZWRDaGFyDQoJe21zby1zdHls ZS1uYW1lOiJIVE1MIFByZWZvcm1hdHRlZCBDaGFyIjsNCgltc28tc3R5bGUtcHJpb3JpdHk6OTk7 DQoJbXNvLXN0eWxlLWxpbms6IkhUTUwgUHJlZm9ybWF0dGVkIjsNCglmb250LWZhbWlseTpDb25z b2xhczsNCgljb2xvcjpibGFjazt9DQpzcGFuLkVtYWlsU3R5bGUyMg0KCXttc28tc3R5bGUtdHlw ZTpwZXJzb25hbDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJpZjsNCgljb2xvcjp3 aW5kb3d0ZXh0O30NCnNwYW4uRW1haWxTdHlsZTIzDQoJe21zby1zdHlsZS10eXBlOnBlcnNvbmFs Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmOw0KCWNvbG9yOiMxRjQ5N0Q7fQ0K c3Bhbi5FbWFpbFN0eWxlMjQNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9u dC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNv Q2hwRGVmYXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAu MHB0O30NCkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjYxMi4wcHQgNzkyLjBwdDsNCgltYXJn aW46NzIuMHB0IDcyLjBwdCA3Mi4wcHQgNzIuMHB0O30NCmRpdi5Xb3JkU2VjdGlvbjENCgl7cGFn ZTpXb3JkU2VjdGlvbjE7fQ0KLyogTGlzdCBEZWZpbml0aW9ucyAqLw0KQGxpc3QgbDANCgl7bXNv LWxpc3QtaWQ6MTU0MTQ3NDM1MDsNCgltc28tbGlzdC10eXBlOmh5YnJpZDsNCgltc28tbGlzdC10 ZW1wbGF0ZS1pZHM6MTgwMDE4MzMwNiAxNTUyNTkyNDc2IDEzNDgwNzU1NSAxMzQ4MDc1NTcgMTM0 ODA3NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTcgMTM0ODA3NTUzIDEzNDgwNzU1NSAxMzQ4MDc1NTc7 fQ0KQGxpc3QgbDA6bGV2ZWwxDQoJe21zby1sZXZlbC1zdGFydC1hdDowOw0KCW1zby1sZXZlbC1u dW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvg5g7DQoJbXNvLWxldmVsLXRh Yi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5k ZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzOw0KCW1zby1mYXJlYXN0LWZvbnQt ZmFtaWx5OkNhbGlicmk7DQoJbXNvLWJpZGktZm9udC1mYW1pbHk6IlRpbWVzIE5ldyBSb21hbiI7 fQ0KQGxpc3QgbDA6bGV2ZWwyDQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCglt c28tbGV2ZWwtdGV4dDpvOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1u dW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5 OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3QgbDA6bGV2ZWwzDQoJe21zby1sZXZlbC1udW1iZXItZm9y bWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5v bmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4w cHQ7DQoJZm9udC1mYW1pbHk6V2luZ2RpbmdzO30NCkBsaXN0IGwwOmxldmVsNA0KCXttc28tbGV2 ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674K3Ow0KCW1zby1sZXZl bC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0 LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OlN5bWJvbDt9DQpAbGlzdCBsMDpsZXZlbDUN Cgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJ bXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0 Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpA bGlzdCBsMDpsZXZlbDYNCgl7bXNvLWxldmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1s ZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVt YmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpX aW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2ZWw3DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1 bGxldDsNCgltc28tbGV2ZWwtdGV4dDrvgrc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJ bXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJ Zm9udC1mYW1pbHk6U3ltYm9sO30NCkBsaXN0IGwwOmxldmVsOA0KCXttc28tbGV2ZWwtbnVtYmVy LWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6 bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4 LjBwdDsNCglmb250LWZhbWlseToiQ291cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsOQ0KCXtt c28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1z by1sZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsN Cgl0ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpvbA0KCXtt YXJnaW4tYm90dG9tOjBjbTt9DQp1bA0KCXttYXJnaW4tYm90dG9tOjBjbTt9DQotLT48L3N0eWxl Pg0KPC9oZWFkPg0KPGJvZHkgbGFuZz0iRU4tR0IiIGxpbms9ImJsdWUiIHZsaW5rPSJwdXJwbGUi Pg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij5Ub3AgcG9zdGluZyBvbiBwdXJwb3NlIOKApi48bzpw PjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29s b3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPknigJl2ZSB0cmllZCB0byBy ZXNwb25kIHR3aWNlIHRvIHRoaXMgYW5kIEkgdGhpbmsgdGhpcmQgdGltZSBJIG1pZ2h0IGdldCBj bG9zZXIgdG8gbXkgdGhpbmtpbmfigKY8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndp bmRvd3RleHQiPlRoZSBEb0ggc29sdXRpb24gKG5vdGUgbm90IG5lY2Vzc2FyaWx5IHByb3RvY29s KSBpcyBtaXNzaW5nIGF0IGxlYXN0IHR3byBrZXkgZWxlbWVudHMgd2hpY2ggdG9nZXRoZXIgd291 bGQgaGF2ZSByZWR1Y2VkIHRoZSBpbW1lZGlhdGUgcGFuaWMgaW4gdGhlIGltcGxlbWVudGF0aW9u LiBOb3QgdG8gc2F5IHRoZXJlIGFyZW7igJl0IG90aGVyIHRoaW5ncyB0aGF0DQogbmVlZCB3b3Jr IGp1c3QgdGhlIHJlYWxseSBwcm9ibGVtYXRpYyBpc3N1ZXMgY291bGQgYmUgY29udGFpbmVkIG9y IGRlZmVycmVkLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+VGhl IGN1cnJlbnQgYWN0aXZlIHdvcmsgb24gZGlzY292ZXJ5IGFuZCBzb21laG93IGRlZmluaW5nIGEg dHJ1c3QgYW5kIHByaXZhY3kgbWVjaGFuaXNtIHN1cnJvdW5kaW5nIFRSUuKAmXMuDQo8bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 d2luZG93dGV4dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPldpdGggdHJ1c3RlZCBsaXN0cyBv ZiBUUlLigJlzIHlvdeKAmWQgdGhlbiBiZSBhYmxlIHRvIHVzZSB0aGUgb3V0cHV0IG9mIGEgZnVu ZGFtZW50YWxseSBpbnNlY3VyZSBkaXNjb3ZlcnkgbWV0aG9kLiBJZiB0aGF0IOKAmHRydXN0IGFu ZCBwcml2YWN54oCZIHdlcmUgdG8gYmUgc2VsZWN0YWJsZSBzYXkgYnkgY2hvaWNlIG9mIHByb3Zp ZGVyLiBZb3UgZ2V0IHRoZSBvcHRpb24NCiB0byBhbGxvdyB0aGUgbG9jYWwgbmV0d29yayBwb2xp Y3kgLyBvciBub3QuIFlvdSBjYW4gY2hvc2UgdG8gYWxsb3cgdHJ1c3RlZCBjb2ZmZWUgc2hvcHMg YnV0IG90aGVycyBtYXkgYmUgbm90IGluIHlvdXIgbGlzdCBiZWNhdXNlIHRoZXkgZG8gdGhpbmdz IHRoYXQg4oCYeW914oCZIGRvbuKAmXQgbGlrZS4gUGFyZW50cyBjYW4gY2hvc2UgdG8gdHJ1c3Qg b25seSB0aG9zZSBETlMgcHJvdmlkZXJzIHRoYXQgZ2l2ZSBzdHJvbmcgcGFyZW50YWwgY29udHJv bHMuDQogV2hhdGV2ZXIgZ3JvdXAgeW91IGFyZSBpbiBtYW55IHRoaW5ncyB3b3VsZCBiZSBsZXNz IGNvbnRyb3ZlcnNpYWwuIE9oLCBpdOKAmXMgbm90IGVhc3kgYnV0IGF0IGxlYXN0IHdlIHdvdWxk buKAmXQgYmUgaW4gdGhlIGN1cnJlbnQgcG9zaXRpb24gd2hlcmUgaXQgaXMgYWxtb3N0IGNlcnRh aW4gdGhhdCBhIHN1ZGRlbiBjaGFuZ2Ugd2lsbCBvY2N1ciB0byBhIGtleXN0b25lIG9mIHRoZSBJ bnRlcm5ldC4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+V29y c3QgY2FzZSBleGFtcGxlIGlzIHRoYXQgZ2l2ZW4gdGhlIGJpbGxpb25zIG9mIHF1ZXJpZXMgcGVy IHNlY29uZCB3ZSBhcmUgdGFsa2luZyBhYm91dCBoZXJlIGFuZCB0aGUgbG9jYWxpc2F0aW9uIG9m IGNvbnRlbnQgZGVsaXZlcnkgaXQgaW1wYWN0cywgbWFueSB0ZXJyYWJ5dGVzIHBlciBzZWNvbmQg b2YgdHJhZmZpYyBjb3VsZCAvIHdvdWxkIHJhcGlkbHkNCiBtaWdyYXRlIHRvIGxlc3Mtb3B0aW1h bCBDRE7igJlzLiBUaGUgZGlzdHJpYnV0aW9uIG9mIHRoaXMgbWlnaHQgd2VsbCBicmVhayBuZXR3 b3Jrcywgc2FkbHkgdGhlcmUgaXMgbm8gcmVzZWFyY2ggdGhhdCBjYW4gcmVsaWFibHkgd29yayBv dXQgdGhlIGZ1bGwgaW1wYWN0LiBTbWFsbCB0cmlhbHMgcmVhbGx5IGRvbuKAmXQgaGVscCBiZWNh dXNlIHdlIGFscmVhZHkgaGFuZGxlIHNtYWxsIHBlcmNlbnRhZ2VzIG9mIG5vbi1sb2NhbCBETlMg dXNlLiBJdOKAmXMNCiB0aGUgdW5rbm93biBvZiB3aGF0IGhhcHBlbnMgaWYgODAlIG9mIHRoZSB1 c2VycyBpbiBhIHNpbmdsZSBzb2Z0d2FyZSB1cGRhdGUgY2hhbmdlIHRvIGEgbm9uLWxvY2FsIERO UyBwcm92aWRlciAoZXNwZWNpYWxseSBpZiBpdOKAmXMgb25lIHRoYXQgZG9lc27igJl0IGZvcndh cmQgZ3JhbnVsYXIgZW5vdWdoIEVETlMgY2xpZW50LXN1Ym5ldCBkYXRhIGJlY2F1c2Ug4oCYcHJp dmFjeeKAmSkuPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNw YW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij5JIGFk bWl0IHRoYXQgbGFzdCBwYXJhZ3JhcGggbWF5IGJlIEZVRCwgYnV0IGluIHRoaXMgY2FzZSB0aGUg cmlzayB0byB0aGUgc3RhYmlsaXR5IG9mIHRoZSBJbnRlcm5ldCBpcyBwb3RlbnRpYWxseSBhdCBz dGFrZSBzbyBsYXJnZXN0IHBvc3NpYmxlIOKAmHdl4oCZIG93ZSBldmVyeW9uZSBhIGxpdHRsZSB0 aW1lIGV4cG9zaW5nIHRoZSBwb3RlbnRpYWwgaXNzdWVzDQogaW4gZGV0YWlsIHdpdGggYW55IG1p dGlnYXRpb25zIGlmIHRoZXkgZXhpc3QuIFByZXBhcmluZyB0aG9zZSB3aG8gd2lsbCBiZSBpbXBh Y3RlZCBmb3IgY2hhbmdlIGFuZCB0aGVuIHNvbWVob3cgY29udGFpbmluZyB0aGUgaW5pdGlhbCAm bmJzcDtjaGFuZ2Ugc28gaWYgaXQgcmVhbGx5IGRvZXMgY2F1c2UgaGFyZCB0byBjb250YWluIGlz c3VlcyB3ZSBoYXZlIGEgc21hbGwgZW5vdWdoIHByb2JsZW0gaXRzIHNvbHZhYmxlIGluIHJlYXNv bmFibGUgdGltZWZyYW1lcy4NCiBBbnlvbmUgd2hvIGhhcyBkb25lIG9wZXJhdGlvbnMgd2lsbCB0 ZWxsIHlvdSB0aGF0IGJpZyBjaGFuZ2VzIHRoYXQgaGFwcGVuIGZhc3QgYXJlIHRoZSBuaWdodG1h cmUgeW91IGZpZ2h0IGhhcmRlc3QgdG8gYXZvaWQuDQo8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4dCI+PG86cD4m bmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOndpbmRvd3RleHQiPk9uZSBtb3JlIHRoaW5nIEnigJlsbCByZXBlYXQgb3RoZXJzIHdh cm5pbmcuLiBiZXdhcmUgdW5pbnRlbmRlZCBjb25zZXF1ZW5jZXMgdGhpcyBtdXN0IG5vdCBlbmQg aW4gYSBmaWdodCBiZXR3ZWVuIG5ldHdvcmtzLCBvciBnb3Zlcm5tZW50cyBhbmQgRG9IIHByb3Zp ZGVycy4gSWYgdGhpcyBnb2VzIHdyb25nIGFuZCBjb3Jwb3JhdGVzIGFuZCBvdGhlciBwbGF5ZXJz DQogZGVjaWRlIHRoaXMgaXMgYSBzdGVwIHRvbyBmYXIgYmVjYXVzZSBvZiB0aGUgaW1wYWN0cyB3 ZSBhbGwga25vdyB0aGUgb3V0Y29tZSBjb3VsZCBiZSB2ZXJ5IG1lc3N5IGFuZCBJIGZvciBvbmUg d291bGQgcmF0aGVyIHdvcmsgdG8gZ2V0IGEgbGVzcyBwYWluZnVsIGFuZCBtb3N0IGxpa2VseSBs ZXNzIHByaXZhY3kgaW1wYWN0ZnVsIHJlc3VsdC4NCjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij48bzpwPiZu YnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0i Y29sb3I6d2luZG93dGV4dCI+TkI6IERvbuKAmXQgYml0ZSBJIGRvIGxpa2UgdGhlIHByb3RvY29s IGFuZCBJIGFncmVlIHRoYXQgdGhlcmUgYXJlIHNvbWUgdGhhdCBuZWVkIGl0IHRvIGV4aXN0Lg0K PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9 ImNvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij4tLTxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5k b3d0ZXh0Ij5BbGlzdGVyIFdpbmZpZWxkPG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOndpbmRvd3RleHQiPjxvOnA+Jm5ic3A7PC9v OnA+PC9zcGFuPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci10b3A6c29saWQg I0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBjbSAwY20gMGNtIj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5Gcm9tOiA8L3NwYW4+PC9i PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0Ij5Eb2ggJmx0O2RvaC1ib3VuY2VzQGlldGYu b3JnJmd0OyBvbiBiZWhhbGYgb2YgQWRhbSBSb2FjaCAmbHQ7YWRhbUBub3N0cnVtLmNvbSZndDs8 YnI+DQo8Yj5EYXRlOiA8L2I+VGh1cnNkYXksIDI4IE1hcmNoIDIwMTkgYXQgMTk6MTI8YnI+DQo8 Yj5UbzogPC9iPiZxdW90O2FuZHJldy5jYW1wbGluZ0BidC5jb20mcXVvdDsgJmx0O2FuZHJldy5j YW1wbGluZ0BidC5jb20mZ3Q7LCAmcXVvdDtqb2huQGpvaG5jYXJyLmV1JnF1b3Q7ICZsdDtqb2hu QGpvaG5jYXJyLmV1Jmd0OywgJnF1b3Q7bWNtYW51c0BkdWNrc29uZy5jb20mcXVvdDsgJmx0O21j bWFudXNAZHVja3NvbmcuY29tJmd0Ozxicj4NCjxiPkNjOiA8L2I+JnF1b3Q7cGF1bC5ob2ZmbWFu QGljYW5uLm9yZyZxdW90OyAmbHQ7cGF1bC5ob2ZmbWFuQGljYW5uLm9yZyZndDssICZxdW90O2Rv aEBpZXRmLm9yZyZxdW90OyAmbHQ7ZG9oQGlldGYub3JnJmd0Ozxicj4NCjxiPlN1YmplY3Q6IDwv Yj5bRVhURVJOQUxdIFJlOiBbRG9oXSBEb0g8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6d2luZG93dGV4 dCI+PG86cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+T24gMy8yOC8xOSAxODozNSwgPGEgaHJlZj0ibWFpbHRvOmFuZHJldy5jYW1w bGluZ0BidC5jb20iPmFuZHJldy5jYW1wbGluZ0BidC5jb208L2E+IHdyb3RlOjxvOnA+PC9vOnA+ PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luLXRvcDo1LjBwdDttYXJnaW4t Ym90dG9tOjUuMHB0Ij4NCjx1bCBzdHlsZT0ibWFyZ2luLXRvcDowY20iIHR5cGU9ImRpc2MiPg0K PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGNtO21zby1s aXN0OmwwIGxldmVsMSBsZm8yIj5Gb3IgdGhlIHR5cGVzIG9mIGhvbWUgbmV0d29ya3MgeW91IG1l bnRpb24sIHdoaWNoIGdlbmVyYWxseSBsYWNrIHByb2Zlc3Npb25hbCBhbmQgZGVkaWNhdGVkIG5l dHdvcmsgYWRtaW5pc3RyYXRvcnMsIERvSCBkb2VzIG5vdCBpbmhlcmVudGx5IHJlcHJlc2VudCBh bnkgc2lnbmlmaWNhbnQgY2hhbmdlIHRvIHRoZQ0KIGRlY2FkZS1vbGQgc3RhdHVzIHF1byByZXN1 bHRpbmcgZnJvbSBwdWJsaWNseS1hdmFpbGFibGUgRE5TLjxvOnA+PC9vOnA+PC9saT48L3VsPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVh c3QtbGFuZ3VhZ2U6RU4tVVMiPiZuYnNwOzwvc3Bhbj48bzpwPjwvbzpwPjwvcD4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdCI+SSBkaXNh Z3JlZSwgdGhlcmUgaXMgYSBmdW5kYW1lbnRhbCBjaGFuZ2UgaGVyZS4mbmJzcDsgSWYgLyB3aGVu IGJyb3dzZXJzIGVuYWJsZSBEb0ggYnkgZGVmYXVsdC4uLjwvc3Bhbj48bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPHA+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cD5ZZXMs IGFuZCB0aGlzIHBlcnRhaW5zIHRvIHByb2R1Y3QgZGVjaXNpb25zIHJhdGhlciB0aGFuIHRoZSBE b0ggcHJvdG9jb2wgaXRzZWxmLiBJIHRyaWVkIHRvIG1ha2UgdGhpcyBwb2ludCBpbiB0aGUgdGhp cmQgcGFyYWdyYXBoIG9mIG15IHJlc3BvbnNlLiBJIGFwb2xvZ2l6ZSBpZiB0aGF0IHBvaW50IHdh cyBpbnN1ZmZpY2llbnRseSBjbGVhci48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3Jt YWwiPjxzcGFuIHN0eWxlPSJjb2xvcjp3aW5kb3d0ZXh0Ij4vYTxvOnA+PC9vOnA+PC9zcGFuPjwv cD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJ0ZXh0LWFsaWdu OmNlbnRlciI+PGI+PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3Vh Z2U6RU4tVVMiPi0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjwvYj48bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiIGFsaWduPSJjZW50ZXIiIHN0eWxlPSJ0ZXh0LWFsaWduOmNlbnRlciI+PGI+ PHNwYW4gc3R5bGU9ImNvbG9yOiMxRjQ5N0Q7bXNvLWZhcmVhc3QtbGFuZ3VhZ2U6RU4tVVMiPlRo aXMgZW1haWwgaXMgZnJvbSBhbiBleHRlcm5hbCBzb3VyY2UuIFBsZWFzZSBkbyBub3Qgb3BlbiBh dHRhY2htZW50cyBvciBjbGljayBsaW5rcyBmcm9tIGFuIHVua25vd24gb3Igc3VzcGljaW91cyBv cmlnaW4uIFBoaXNoaW5nIGF0dGVtcHRzDQogY2FuIGJlIHJlcG9ydGVkIGJ5IHNlbmRpbmcgdGhl bSB0byBwaGlzaGluZ0Bza3kudWsgYXMgYXR0YWNobWVudHMuIFRoYW5rIHlvdTwvc3Bhbj48L2I+ PG86cD48L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIiBhbGlnbj0iY2VudGVyIiBzdHls ZT0idGV4dC1hbGlnbjpjZW50ZXIiPjxiPjxzcGFuIHN0eWxlPSJjb2xvcjojMUY0OTdEO21zby1m YXJlYXN0LWxhbmd1YWdlOkVOLVVTIj4tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLTwvc3Bhbj48L2I+PG86cD48L286cD48 L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDs8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K SW5mb3JtYXRpb24gaW4gdGhpcyBlbWFpbCBpbmNsdWRpbmcgYW55IGF0dGFjaG1lbnRzIG1heSBi ZSBwcml2aWxlZ2VkLCBjb25maWRlbnRpYWwgYW5kIGlzIGludGVuZGVkIGV4Y2x1c2l2ZWx5IGZv ciB0aGUgYWRkcmVzc2VlLiBUaGUgdmlld3MgZXhwcmVzc2VkIG1heSBub3QgYmUgb2ZmaWNpYWwg cG9saWN5LCBidXQgdGhlIHBlcnNvbmFsIHZpZXdzIG9mIHRoZSBvcmlnaW5hdG9yLiBJZiB5b3Ug aGF2ZSByZWNlaXZlZCBpdCBpbiBlcnJvciwgcGxlYXNlDQogbm90aWZ5IHRoZSBzZW5kZXIgYnkg cmV0dXJuIGUtbWFpbCBhbmQgZGVsZXRlIGl0IGZyb20geW91ciBzeXN0ZW0uIFlvdSBzaG91bGQg bm90IHJlcHJvZHVjZSwgZGlzdHJpYnV0ZSwgc3RvcmUsIHJldHJhbnNtaXQsIHVzZSBvciBkaXNj bG9zZSBpdHMgY29udGVudHMgdG8gYW55b25lLiBQbGVhc2Ugbm90ZSB3ZSByZXNlcnZlIHRoZSBy aWdodCB0byBtb25pdG9yIGFsbCBlLW1haWwgY29tbXVuaWNhdGlvbiB0aHJvdWdoIG91ciBpbnRl cm5hbCBhbmQNCiBleHRlcm5hbCBuZXR3b3Jrcy4gU0tZIGFuZCB0aGUgU0tZIG1hcmtzIGFyZSB0 cmFkZW1hcmtzIG9mIFNreSBMaW1pdGVkIGFuZCBTa3kgSW50ZXJuYXRpb25hbCBBRyBhbmQgYXJl IHVzZWQgdW5kZXIgbGljZW5jZS4NCjxicj4NCjxicj4NClNreSBVSyBMaW1pdGVkIChSZWdpc3Ry YXRpb24gTm8uIDI5MDY5OTEpLCBTa3ktSW4tSG9tZSBTZXJ2aWNlIExpbWl0ZWQgKFJlZ2lzdHJh dGlvbiBOby4gMjA2NzA3NSksIFNreSBTdWJzY3JpYmVycyBTZXJ2aWNlcyBMaW1pdGVkIChSZWdp c3RyYXRpb24gTm8uIDIzNDAxNTApIGFuZCBTa3kgQ1AgTGltaXRlZCAoUmVnaXN0cmF0aW9uIE5v LiA5NTEzMjU5KSBhcmUgZGlyZWN0IG9yIGluZGlyZWN0IHN1YnNpZGlhcmllcyBvZiBTa3kgTGlt aXRlZCAoUmVnaXN0cmF0aW9uDQogTm8uIDIyNDc3MzUpLiBBbGwgb2YgdGhlIGNvbXBhbmllcyBt ZW50aW9uZWQgaW4gdGhpcyBwYXJhZ3JhcGggYXJlIGluY29ycG9yYXRlZCBpbiBFbmdsYW5kIGFu ZCBXYWxlcyBhbmQgc2hhcmUgdGhlIHNhbWUgcmVnaXN0ZXJlZCBvZmZpY2UgYXQgR3JhbnQgV2F5 LCBJc2xld29ydGgsIE1pZGRsZXNleCBUVzcgNVFEDQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_9E29A232BA75478D96BF5D6164142BDDskyuk_-- From nobody Thu Mar 28 15:12:04 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D2291203A2 for ; Thu, 28 Mar 2019 15:12:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.667 X-Spam-Level: X-Spam-Status: No, score=-1.667 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, T_KAM_HTML_FONT_INVALID=0.01, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aKoFhhqFsYeb for ; Thu, 28 Mar 2019 15:12:01 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B0C671203A5 for ; Thu, 28 Mar 2019 15:12:00 -0700 (PDT) Received: from [31.133.150.196] (dhcp-96c4.meeting.ietf.org [31.133.150.196]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2SMBjqk011994 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Thu, 28 Mar 2019 17:11:46 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553811112; bh=y0bU+L6kQGWskUpKHvEOcEaOPXB0s3vOyoTscK+zgyU=; h=Subject:From:In-Reply-To:Date:Cc:References:To; b=XbD3Sg4TfVp8AJYdsjbnKCx3SfAKJf+cW+mMBhjX0SriRQ+KSM+Kc4Ve1AzAsjAew mujUIfW4epkUNA8nFm0qAlGfmzK+S5mBO1B2nltMKPHyzvYKfn6J7yLW3/TeBG2eSp GmR+ai2cHTItassFHHW3Dr7B4i4kswOMCGMlVvBE= X-Authentication-Warning: raven.nostrum.com: Host dhcp-96c4.meeting.ietf.org [31.133.150.196] claimed to be [31.133.150.196] Content-Type: multipart/alternative; boundary=Apple-Mail-55BC499A-08C9-404F-AEBF-2D64DC1C8A01 Mime-Version: 1.0 (1.0) From: Adam Roach X-Mailer: iPhone Mail (16D57) In-Reply-To: <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> Date: Thu, 28 Mar 2019 23:11:44 +0100 Cc: "andrew.campling@bt.com" , "john@johncarr.eu" , "mcmanus@ducksong.com" , "paul.hoffman@icann.org" , "doh@ietf.org" Content-Transfer-Encoding: 7bit Message-Id: <0E079DEB-DEFC-4DE7-BEAE-AAD02BB61D56@nostrum.com> References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> To: "Winfield, Alister" Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Mar 2019 22:12:03 -0000 --Apple-Mail-55BC499A-08C9-404F-AEBF-2D64DC1C8A01 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable > On Mar 28, 2019, at 22:40, Winfield, Alister wrote: >=20 > NB: Don=E2=80=99t bite I do like the protocol and I agree that there are s= ome that need it to exist. >=20 Not going to bite, but I=E2=80=99ll point out that your response is largely u= nrelated to the query that started this thread. Perhaps you meant to reply t= o a different message? /a= --Apple-Mail-55BC499A-08C9-404F-AEBF-2D64DC1C8A01 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable

On Mar 28, 2019, at 22:40, Winfield, Alister <= ;Alister.Winfi= eld=3D40sky.uk@dmarc.ietf.org> wrote:

NB: Don=E2=80=99t bite I do like the protocol and I agree that there are= some that need it to exist.


Not going= to bite, but I=E2=80=99ll point out that your response is largely unrelated= to the query that started this thread. Perhaps you meant to reply to a diff= erent message?

/a
= --Apple-Mail-55BC499A-08C9-404F-AEBF-2D64DC1C8A01-- From nobody Fri Mar 29 03:58:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1EF1B12027D for ; Fri, 29 Mar 2019 03:58:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w9W7orLcQ-qj for ; Fri, 29 Mar 2019 03:58:06 -0700 (PDT) Received: from smtpe1.intersmtp.com (smtpe1.intersmtp.com [62.239.224.237]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 82A8412025F for ; Fri, 29 Mar 2019 03:58:05 -0700 (PDT) Received: from tpw09926dag11e.domain1.systemhost.net (10.9.212.11) by RDW083A010ED66.bt.com (10.187.98.36) with Microsoft SMTP Server (TLS) id 14.3.408.0; Fri, 29 Mar 2019 10:57:28 +0000 Received: from tpw09926dag11h.domain1.systemhost.net (10.9.212.35) by tpw09926dag11e.domain1.systemhost.net (10.9.212.11) with Microsoft SMTP Server (TLS) id 15.0.1395.4; Fri, 29 Mar 2019 10:58:02 +0000 Received: from tpw09926dag11h.domain1.systemhost.net ([fe80::31b2:6108:6eda:82cd]) by tpw09926dag11h.domain1.systemhost.net ([fe80::31b2:6108:6eda:82cd%12]) with mapi id 15.00.1395.000; Fri, 29 Mar 2019 10:58:02 +0000 From: To: , , , CC: , Thread-Topic: [EXTERNAL] Re: [Doh] DoH Thread-Index: AQHU5Yj5ws0QKXF/kE2CC/ccxm7ktqYhTCtAgAAMBQCAADqbgIAA2wYA Date: Fri, 29 Mar 2019 10:58:01 +0000 Message-ID: <6bebaadff9b54dc1a906c237a756d476@tpw09926dag11h.domain1.systemhost.net> References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> In-Reply-To: <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-exchange-transport-fromentityheader: Hosted x-originating-ip: [10.216.161.27] Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 10:58:09 -0000 T24gTWFyIDI4LCAyMDE5LCBhdCAyMjo0MCwgV2luZmllbGQsIEFsaXN0ZXIgPEFsaXN0ZXIuV2lu ZmllbGQ9NDBza3kudWtAZG1hcmMuaWV0Zi5vcmc+IHdyb3RlOg0KDQo+IFRvcCBwb3N0aW5nIG9u IHB1cnBvc2Ug4oCmLg0KDQo+IEnigJl2ZSB0cmllZCB0byByZXNwb25kIHR3aWNlIHRvIHRoaXMg YW5kIEkgdGhpbmsgdGhpcmQgdGltZSBJIG1pZ2h0IGdldCBjbG9zZXIgdG8gbXkgdGhpbmtpbmfi gKYNCg0KPiBUaGUgRG9IIHNvbHV0aW9uIChub3RlIG5vdCBuZWNlc3NhcmlseSBwcm90b2NvbCkg aXMgbWlzc2luZyBhdCBsZWFzdCB0d28ga2V5IGVsZW1lbnRzIHdoaWNoIHRvZ2V0aGVyIHdvdWxk IGhhdmUgcmVkdWNlZCB0aGUgDQo+IGltbWVkaWF0ZSBwYW5pYyBpbiB0aGUgaW1wbGVtZW50YXRp b24uIE5vdCB0byBzYXkgdGhlcmUgYXJlbuKAmXQgb3RoZXIgdGhpbmdzIHRoYXQgbmVlZCB3b3Jr IGp1c3QgdGhlIHJlYWxseSBwcm9ibGVtYXRpYyBpc3N1ZXMgDQo+IGNvdWxkIGJlIGNvbnRhaW5l ZCBvciBkZWZlcnJlZC4NCg0KPiBUaGUgY3VycmVudCBhY3RpdmUgd29yayBvbiBkaXNjb3Zlcnkg YW5kIHNvbWVob3cgZGVmaW5pbmcgYSB0cnVzdCBhbmQgcHJpdmFjeSBtZWNoYW5pc20gc3Vycm91 bmRpbmcgVFJS4oCZcy4gDQoNCj4gV2l0aCB0cnVzdGVkIGxpc3RzIG9mIFRSUuKAmXMgeW914oCZ ZCB0aGVuIGJlIGFibGUgdG8gdXNlIHRoZSBvdXRwdXQgb2YgYSBmdW5kYW1lbnRhbGx5IGluc2Vj dXJlIGRpc2NvdmVyeSBtZXRob2QuIElmIHRoYXQgDQo+IOKAmHRydXN0IGFuZCBwcml2YWN54oCZ IHdlcmUgdG8gYmUgc2VsZWN0YWJsZSBzYXkgYnkgY2hvaWNlIG9mIHByb3ZpZGVyLiBZb3UgZ2V0 IHRoZSBvcHRpb24gdG8gYWxsb3cgdGhlIGxvY2FsIG5ldHdvcmsgcG9saWN5IC8gb3IgDQo+IG5v dC4gWW91IGNhbiBjaG9zZSB0byBhbGxvdyB0cnVzdGVkIGNvZmZlZSBzaG9wcyBidXQgb3RoZXJz IG1heSBiZSBub3QgaW4geW91ciBsaXN0IGJlY2F1c2UgdGhleSBkbyB0aGluZ3MgdGhhdCDigJh5 b3XigJkgZG9u4oCZdCANCj4gbGlrZS4gUGFyZW50cyBjYW4gY2hvc2UgdG8gdHJ1c3Qgb25seSB0 aG9zZSBETlMgcHJvdmlkZXJzIHRoYXQgZ2l2ZSBzdHJvbmcgcGFyZW50YWwgY29udHJvbHMuIFdo YXRldmVyIGdyb3VwIHlvdSBhcmUgaW4gDQo+IG1hbnkgdGhpbmdzIHdvdWxkIGJlIGxlc3MgY29u dHJvdmVyc2lhbC4gT2gsIGl04oCZcyBub3QgZWFzeSBidXQgYXQgbGVhc3Qgd2Ugd291bGRu4oCZ dCBiZSBpbiB0aGUgY3VycmVudCBwb3NpdGlvbiB3aGVyZSBpdCBpcyANCj4gYWxtb3N0IGNlcnRh aW4gdGhhdCBhIHN1ZGRlbiBjaGFuZ2Ugd2lsbCBvY2N1ciB0byBhIGtleXN0b25lIG9mIHRoZSBJ bnRlcm5ldC4gDQoNCj4gV29yc3QgY2FzZSBleGFtcGxlIGlzIHRoYXQgZ2l2ZW4gdGhlIGJpbGxp b25zIG9mIHF1ZXJpZXMgcGVyIHNlY29uZCB3ZSBhcmUgdGFsa2luZyBhYm91dCBoZXJlIGFuZCB0 aGUgbG9jYWxpc2F0aW9uIG9mIA0KPiBjb250ZW50IGRlbGl2ZXJ5IGl0IGltcGFjdHMsIG1hbnkg dGVycmFieXRlcyBwZXIgc2Vjb25kIG9mIHRyYWZmaWMgY291bGQgLyB3b3VsZCByYXBpZGx5IG1p Z3JhdGUgdG8gbGVzcy1vcHRpbWFsIENETuKAmXMuIFRoZSANCj4gZGlzdHJpYnV0aW9uIG9mIHRo aXMgbWlnaHQgd2VsbCBicmVhayBuZXR3b3Jrcywgc2FkbHkgdGhlcmUgaXMgbm8gcmVzZWFyY2gg dGhhdCBjYW4gcmVsaWFibHkgd29yayBvdXQgdGhlIGZ1bGwgaW1wYWN0LiBTbWFsbCANCj4gdHJp YWxzIHJlYWxseSBkb27igJl0IGhlbHAgYmVjYXVzZSB3ZSBhbHJlYWR5IGhhbmRsZSBzbWFsbCBw ZXJjZW50YWdlcyBvZiBub24tbG9jYWwgRE5TIHVzZS4gSXTigJlzIHRoZSB1bmtub3duIG9mIHdo YXQgDQo+IGhhcHBlbnMgaWYgODAlIG9mIHRoZSB1c2VycyBpbiBhIHNpbmdsZSBzb2Z0d2FyZSB1 cGRhdGUgY2hhbmdlIHRvIGEgbm9uLWxvY2FsIEROUyBwcm92aWRlciAoZXNwZWNpYWxseSBpZiBp dOKAmXMgb25lIHRoYXQgDQo+IGRvZXNu4oCZdCBmb3J3YXJkIGdyYW51bGFyIGVub3VnaCBFRE5T IGNsaWVudC1zdWJuZXQgZGF0YSBiZWNhdXNlIOKAmHByaXZhY3nigJkpLg0KDQo+IEkgYWRtaXQg dGhhdCBsYXN0IHBhcmFncmFwaCBtYXkgYmUgRlVELCBidXQgaW4gdGhpcyBjYXNlIHRoZSByaXNr IHRvIHRoZSBzdGFiaWxpdHkgb2YgdGhlIEludGVybmV0IGlzIHBvdGVudGlhbGx5IGF0IHN0YWtl IHNvIA0KPiBsYXJnZXN0IHBvc3NpYmxlIOKAmHdl4oCZIG93ZSBldmVyeW9uZSBhIGxpdHRsZSB0 aW1lIGV4cG9zaW5nIHRoZSBwb3RlbnRpYWwgaXNzdWVzIGluIGRldGFpbCB3aXRoIGFueSBtaXRp Z2F0aW9ucyBpZiB0aGV5IGV4aXN0LiANCj4gUHJlcGFyaW5nIHRob3NlIHdobyB3aWxsIGJlIGlt cGFjdGVkIGZvciBjaGFuZ2UgYW5kIHRoZW4gc29tZWhvdyBjb250YWluaW5nIHRoZSBpbml0aWFs IMKgY2hhbmdlIHNvIGlmIGl0IHJlYWxseSBkb2VzIGNhdXNlIA0KPiBoYXJkIHRvIGNvbnRhaW4g aXNzdWVzIHdlIGhhdmUgYSBzbWFsbCBlbm91Z2ggcHJvYmxlbSBpdHMgc29sdmFibGUgaW4gcmVh c29uYWJsZSB0aW1lZnJhbWVzLiBBbnlvbmUgd2hvIGhhcyBkb25lIA0KPiBvcGVyYXRpb25zIHdp bGwgdGVsbCB5b3UgdGhhdCBiaWcgY2hhbmdlcyB0aGF0IGhhcHBlbiBmYXN0IGFyZSB0aGUgbmln aHRtYXJlIHlvdSBmaWdodCBoYXJkZXN0IHRvIGF2b2lkLiANCg0KPiBPbmUgbW9yZSB0aGluZyBJ 4oCZbGwgcmVwZWF0IG90aGVycyB3YXJuaW5nLi4gYmV3YXJlIHVuaW50ZW5kZWQgY29uc2VxdWVu Y2VzIHRoaXMgbXVzdCBub3QgZW5kIGluIGEgZmlnaHQgYmV0d2VlbiANCj4gbmV0d29ya3MsIG9y IGdvdmVybm1lbnRzIGFuZCBEb0ggcHJvdmlkZXJzLiBJZiB0aGlzIGdvZXMgd3JvbmcgYW5kIGNv cnBvcmF0ZXMgYW5kIG90aGVyIHBsYXllcnMgZGVjaWRlIHRoaXMgaXMgYSBzdGVwIA0KPiB0b28g ZmFyIGJlY2F1c2Ugb2YgdGhlIGltcGFjdHMgd2UgYWxsIGtub3cgdGhlIG91dGNvbWUgY291bGQg YmUgdmVyeSBtZXNzeSBhbmQgSSBmb3Igb25lIHdvdWxkIHJhdGhlciB3b3JrIHRvIGdldCBhIA0K PiBsZXNzIHBhaW5mdWwgYW5kIG1vc3QgbGlrZWx5IGxlc3MgcHJpdmFjeSBpbXBhY3RmdWwgcmVz dWx0LiANCg0KPiBOQjogRG9u4oCZdCBiaXRlIEkgZG8gbGlrZSB0aGUgcHJvdG9jb2wgYW5kIEkg YWdyZWUgdGhhdCB0aGVyZSBhcmUgc29tZSB0aGF0IG5lZWQgaXQgdG8gZXhpc3QuIA0KDQoNCkkg YWdyZWUgd2l0aCB0aGUgdGhydXN0IG9mIHlvdXIgYXJndW1lbnQsIHRoaW5rIHRoYXQgdGhvc2Ug dGhhdCBzZWVrIHRvIGRpc3Rpbmd1aXNoIGJldHdlZW4gdGhlIHByb3RvY29sIGFuZCBpdHMgaW1w YWN0IGluICANCnJlYWwtd29ybGQgaW1wbGVtZW50YXRpb24gc2NlbmFyaW9zIGFyZSBtaXN0YWtl bi4gIFRoZSBjdXJyZW50IGRlc2lnbiBpcyBpbmNvbXBsZXRlIGFuZCBsYWNraW5nIGluIGZ1bmN0 aW9uYWxpdHkgYW5kIA0KbmVlZHMgbW9yZSBlbmdpbmVlcmluZyBlZmZvcnQgaW4gb3JkZXIgdG8g YWRkcmVzcyB0aGUgc2hvcnRjb21pbmdzIGlkZW50aWZpZWQgaGVyZSBhbmQgZWxzZXdoZXJlLiAg V2l0aG91dCBmdXJ0aGVyIHdvcmssIA0KRG9IIHdpbGwgc2ltcGx5IHNlcnZlIHRvIHVuZGVybWlu ZSBwcml2YWN5IGFuZCBzZWN1cml0eSwgYXMgd2VsbCBhcyBsZWF2aW5nIGFwcGxpY2F0aW9uIGRl dmVsb3BlcnMgYW5kIHJlc29sdmVycyB0aGF0IHVzZSBpdCANCmluIGEgcG9zaXRpb24gd2hlcmUg dGhleSBtYXkgYmUgbm9uLWNvbXBsaWFudCB3aXRoIGxlZ2lzbGF0aW9uIGluIG51bWVyb3VzIGNv dW50cmllcyAgLSBhbmQgc28gb3BlbiB0byBsZWdhbCByZWRyZXNzLiAgIA0KDQpJIGhvcGUgdGhh dCB0aGUgSUVURiByZWNvZ25pc2VzIHRoYXQgdGhlc2UgYXJlIGxlZ2l0aW1hdGUgY2hhbGxlbmdl cyB0aGF0IG5lZWQgdG8gYmUgZGVhbHQgd2l0aCBzbyB0aGF0IERvSCBjYW4gZGVsaXZlciANCml0 J3MgaW50ZW5kZWQgYmVuZWZpdHMuICANCg0KDQpBbmRyZXcgDQoNCg== From nobody Fri Mar 29 04:03:37 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 567BE120264 for ; Fri, 29 Mar 2019 04:03:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=algebras-org.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zsCAPxiaLxwU for ; Fri, 29 Mar 2019 04:03:31 -0700 (PDT) Received: from mail-io1-xd2e.google.com (mail-io1-xd2e.google.com [IPv6:2607:f8b0:4864:20::d2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1786E120258 for ; Fri, 29 Mar 2019 04:03:31 -0700 (PDT) Received: by mail-io1-xd2e.google.com with SMTP id d201so1366643iof.7 for ; Fri, 29 Mar 2019 04:03:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=algebras-org.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=bMHrzu+Rnc973Fd+YuIHeZrtVgIYyJUPBSdy7LFIXYY=; b=oBSviGjqQENwdv0WPY2Udmj7UPWTvzFXAd8a0ruF1zkEDlz6pEa56joGNwkMHW0elu 0KywHguoEd6hcxkmLNhqPM6a8RUlegl1gy4TwSz9QCzz9iU+/1TSyfa+17a9Rudv5A2t 1J5Qrq2bm22lgPNRYtjwThi65nuR6zLSZ31KcoKB0GQs3Hv+wG+6rkegwDhQGUZqATLd eQ/meW6CC/Arr7Wyfefw7AMDFiULVIHLgn9lceGjB+tkE0AEST7Yw7AVG5sA69pAaUAJ s3yc3nMWjxgCePlWZ1JuveKsjw/myoD7n2nOu11gsX4ovbBWwzxrVmckZaF8//TjEQ4i 7ecQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=bMHrzu+Rnc973Fd+YuIHeZrtVgIYyJUPBSdy7LFIXYY=; b=pecaT7a12MkDRf/Uq0iyndKCS3cbyVbjutkdxtTii9AICUtvHGwZzWmdviI9QdNRpk AxXSJwhOYF/fm65r8G25dLWgZ3Znh6+xj1SvHHyPkWW4O1C0YsizHxiSojHP0NtbVzPO XQ+1Cxz7+o7Ptk8kqSVEzGDItCD4GnQPa+GL8rj2r3NZ4X+wFRqbtpOwt8h18WVb4Won CKP1e1dzDXVjyUDY9gDveczMZ2/nFJy54spTMknCBJEUtzcHzXtxNs/LZd1nAfSOA2fI f8MgFbEwn27um7mZgzFk4W+ATD7EDBLiq6IGW2sqpGHtPNo2Wjyfg1hXvc6Kri42dcWk oShg== X-Gm-Message-State: APjAAAXHmLkLhXU/teAK5DpRkczqNRa//HemLdNOyUSxdLREH3mg6/mW 7Cpgp+XRxwPfRT75wI984bUKrD7tBrclU02CBrX6JA== X-Google-Smtp-Source: APXvYqzBmog9nVxSkC/AtLcBb0gq+nnK2AGyMngeprWrANvdj8L6FqxhJtOrmu0fMlxQADPsDgicPxTzPFaa5+0vMTU= X-Received: by 2002:a5d:899a:: with SMTP id m26mr35597515iol.268.1553857410308; Fri, 29 Mar 2019 04:03:30 -0700 (PDT) MIME-Version: 1.0 References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> <6bebaadff9b54dc1a906c237a756d476@tpw09926dag11h.domain1.systemhost.net> In-Reply-To: <6bebaadff9b54dc1a906c237a756d476@tpw09926dag11h.domain1.systemhost.net> From: George Michaelson Date: Fri, 29 Mar 2019 12:03:19 +0100 Message-ID: To: andrew.campling@bt.com Cc: Alister.Winfield@sky.uk, adam@nostrum.com, john@johncarr.eu, mcmanus@ducksong.com, Paul Hoffman , DoH WG Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 11:03:35 -0000 Do you believe there are substantive differences in respect of the legal challenge to Operators of DoH compared to say DoT and DoC? As to its protocol maturity and risks, Because DoH moves out of strict 53 framing and processing, I think it does have qualitative differences to DoT and DoC in these terms because it is less likely to be classic DNS processing by a resolver client. But, I might ask the same question: Do you see risks different in scale and type to DoT and DoC? -George On Fri, Mar 29, 2019 at 11:58 AM wrote: > > On Mar 28, 2019, at 22:40, Winfield, Alister wrote: > > > Top posting on purpose =E2=80=A6. > > > I=E2=80=99ve tried to respond twice to this and I think third time I mi= ght get closer to my thinking=E2=80=A6 > > > The DoH solution (note not necessarily protocol) is missing at least tw= o key elements which together would have reduced the > > immediate panic in the implementation. Not to say there aren=E2=80=99t = other things that need work just the really problematic issues > > could be contained or deferred. > > > The current active work on discovery and somehow defining a trust and p= rivacy mechanism surrounding TRR=E2=80=99s. > > > With trusted lists of TRR=E2=80=99s you=E2=80=99d then be able to use t= he output of a fundamentally insecure discovery method. If that > > =E2=80=98trust and privacy=E2=80=99 were to be selectable say by choice= of provider. You get the option to allow the local network policy / or > > not. You can chose to allow trusted coffee shops but others may be not = in your list because they do things that =E2=80=98you=E2=80=99 don=E2=80=99= t > > like. Parents can chose to trust only those DNS providers that give str= ong parental controls. Whatever group you are in > > many things would be less controversial. Oh, it=E2=80=99s not easy but = at least we wouldn=E2=80=99t be in the current position where it is > > almost certain that a sudden change will occur to a keystone of the Int= ernet. > > > Worst case example is that given the billions of queries per second we = are talking about here and the localisation of > > content delivery it impacts, many terrabytes per second of traffic coul= d / would rapidly migrate to less-optimal CDN=E2=80=99s. The > > distribution of this might well break networks, sadly there is no resea= rch that can reliably work out the full impact. Small > > trials really don=E2=80=99t help because we already handle small percen= tages of non-local DNS use. It=E2=80=99s the unknown of what > > happens if 80% of the users in a single software update change to a non= -local DNS provider (especially if it=E2=80=99s one that > > doesn=E2=80=99t forward granular enough EDNS client-subnet data because= =E2=80=98privacy=E2=80=99). > > > I admit that last paragraph may be FUD, but in this case the risk to th= e stability of the Internet is potentially at stake so > > largest possible =E2=80=98we=E2=80=99 owe everyone a little time exposi= ng the potential issues in detail with any mitigations if they exist. > > Preparing those who will be impacted for change and then somehow contai= ning the initial change so if it really does cause > > hard to contain issues we have a small enough problem its solvable in r= easonable timeframes. Anyone who has done > > operations will tell you that big changes that happen fast are the nigh= tmare you fight hardest to avoid. > > > One more thing I=E2=80=99ll repeat others warning.. beware unintended c= onsequences this must not end in a fight between > > networks, or governments and DoH providers. If this goes wrong and corp= orates and other players decide this is a step > > too far because of the impacts we all know the outcome could be very me= ssy and I for one would rather work to get a > > less painful and most likely less privacy impactful result. > > > NB: Don=E2=80=99t bite I do like the protocol and I agree that there ar= e some that need it to exist. > > > I agree with the thrust of your argument, think that those that seek to d= istinguish between the protocol and its impact in > real-world implementation scenarios are mistaken. The current design is = incomplete and lacking in functionality and > needs more engineering effort in order to address the shortcomings identi= fied here and elsewhere. Without further work, > DoH will simply serve to undermine privacy and security, as well as leavi= ng application developers and resolvers that use it > in a position where they may be non-compliant with legislation in numerou= s countries - and so open to legal redress. > > I hope that the IETF recognises that these are legitimate challenges that= need to be dealt with so that DoH can deliver > it's intended benefits. > > > Andrew > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Fri Mar 29 04:05:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3427E1203E1 for ; Fri, 29 Mar 2019 04:05:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.019 X-Spam-Level: X-Spam-Status: No, score=-6.019 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, LOTS_OF_MONEY=0.001, RCVD_IN_DNSWL_HI=-5, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JjohGHyXTM2Q for ; Fri, 29 Mar 2019 04:05:05 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5532D1203DB for ; Fri, 29 Mar 2019 04:05:05 -0700 (PDT) Received: from pc-cznic19.fit.vutbr.cz (unknown [IPv6:2001:67c:370:128:1d50:ab32:aa3f:f88c]) by mail.nic.cz (Postfix) with ESMTPSA id 1D5576055B; Fri, 29 Mar 2019 12:05:03 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1553857503; bh=ejUy8S1JWmTMYQFhHCKUiOf4FQ+siN5T0UksiOgUtLA=; h=To:From:Date; b=Lnj2GMbG5Ql3vqAMEDw4xkIhumBL8nswnVKSM0EZ/J6uxq0RXJVSU0oaNBhvRdp+4 DNoo8DrAu557GtP/ISmh1P54N5Al8WToIoehgDjDrdBQG47q5/ubxl+HvOO9nviHJa dUXxVEw3ZR82l1iYH4eQbGDyhsUppBliZlj4QB0k= To: Eric Rescorla , Tony Finch Cc: DoH WG References: From: =?UTF-8?B?UGV0ciDFoHBhxI1law==?= Openpgp: preference=signencrypt Autocrypt: addr=petr.spacek@nic.cz; prefer-encrypt=mutual; keydata= mQINBFhri/0BEADByTMkvpHcvPYwyhy0IDQ1B2+uU6AWP0QJQB3upM/YqxoJBeMQ5SxpO+W6 BsU0hTIF90AKIgiiDtMH1oNhHnzRXqePKORIgL3BbH5OxGcbqCYk1fIKk43DliCN1RcbTyRV REnCRQGWMTUbRS/jQ3uyTAX4rT0NhPWhPy6TMLGEg6WJJz0IzhBEw3TitvAlq6XHbi5EZYwU AHqIcuqr3sS+qkWqlIBlahu1hqhTcmYGz7ihjnWkOFi1rjRfLfudAtgFpUSmsixh2tifdy+C d8OBQbtF2kM7V1X5dUzw/nUBXm1Qex2qohRmCspwqivu7nlDMrLoilmPaeoR5evr5hpIDdfP cJAPTJk4n56q6MTHFJWkGa0yq13AJHLANNjQ/dF+W6Dhw9w2KBpuw0iGZQBBf5G9SQ1xJ+tU 9filaldsTAX1gMkVso//kGEbuRIJnJr7Z8foE/zofFyoAv21VWy2vpgQ3CnEWOZMSmYH7/gZ qcM7nfkjk4zAijpjYA3qlXoWa44/nrkAGvt7sAMsxY1C2H7tr3h3/rwyfbBqQ9nMpNwYLXXa Dil7uzyqlpKDjwWCzYd3sH7ATyT4htrd0BY5+IFimSfHyLwixhakH8E14YYyV9tzkrB7fiWd g7+zDThLtZMvtrehtkjVDPT50xg8TMr68hd3GRWBUJHszMTnlQARAQABtCBQZXRyIFNwYWNl ayA8cGV0ci5zcGFjZWtAbmljLmN6PokCVAQTAQgAPgIbAwULCQgHAgYVCAkKCwIEFgIDAQIe AQIXgBYhBL4m67nL4FmzkQyjW86N1qGlCiHkBQJcEOXhBQkFp4LgAAoJEM6N1qGlCiHkxNwQ ALFyQ7Rrghf0rM9GN2+kgP92Qvot21h8/Je3bRTvoLyhYUXcAMRmODZQ/0EsjExFc+pRwn+E 0GD2TpiorDnRMpJYEmHqenYGIrZ5TE0lHwwu0fi/X3evDY4j68OFlim5Q6+7pHOlZWaRsSm5 T6blSwIaNDFYtBhI0X1ZXTGqbXIUBFuGxolo/xEgUkeDy+6D4R8yT17CTHkuGYYrfUYnoBTr j3xMVil/lNMievaklAL8kRNVl0It4M8VzHTyEdMq7pG0CJ0CfU8COizCsu4+zy8dsxMVE0Su hju05LSsClZ9X1csxSK9HjKq+TG1Hx2qciFHRB1qC2mNIvWTm10Gkj4tLTWcJp3k2Wyv+1K2 sLFxreGOwbx0uR7XtIIBTiiZAiVsjBH0D39qG2ZLz+bJkQvlTDZQuXzsMS51wROvTVxPYcXX p069hON2+/QqJasmpOHhOydGkB3uokA0crqvMOnK+EcueKQQspvdLGiFLefJPuM8VVyR9fFZ YjnX2vfGZbE+MxY8wG4mDbhgxsUORAEtNUH/G0dvTv66fzKpl5q9GIZs7el+1IU31w7KivgS 7fsWcOsdzq4KzZzNBRJtEDoxX4b9lQ8P6ttMlPi7PnQ+iN0OUxKSnAnKQiqKMFRO1zH22vn7 iiF4JMO32//0HcpsyV8oEdjDkSJsFRnDfLW2uQINBFhri/0BEADFp4ZfxSoKTAad0IkFK9CV oZ6XKywYLFNPPhzw++gbvHL2EX7QqhEsqbsWMYpH4jc/Kq55OYYU/lIcULuD0Y9oDR26XFQo u0FeSNnzRGb607U8OFOPQ+ei92Mm1YPQ33GPj8GqbQpkAp35sfjJ64TH/EQY38RN33jsHRkh wtWU/6yo+RZs7cFRuihuLl8FuoP0A5u/x+lNNeIBk8f27LVYrF81NSDDDYjnObCah+QLzGAw GDtjWkBVawpoHWwq58OQSx5piwyOCnFJeFONRcTRgOz239rsEA5LeYfmOGcnNwG6CHoJ5ZdW Jw5OV9BoA7UTHG95xVHV5QiEm6q6igI6wKV2RtFS7Roe0Wt8H7gC41JeqaKTUsGkz6uJraF8 mmKyS8E+mSh3djmqdJNHF1pJqKxAxPYA9Y0jPnYWeEH4fPeOR2YvBjztsye9nOv1AuKNu03d uzocyU95DfP/lwNJr5SH918Vf1t7WcJj9dg6J9Jc5LOwg13Qr31TuZijrMdqM7LJKC/0tOkS eXNoMlHJOIqbqm7N414I0HytbENf7AiyDxNA5TzJKkB0eBPLm2FMQCHLfasJHgbCrQut6nYw 3f3Gn3+PDzGEHI9sfQv/mYvO77oRSGw+3Hy1ToxIncIirAyRpa5KdPLklDpADvpfkXjuL6If ZZ0OIWKLSRa/DQARAQABiQI8BBgBCAAmAhsMFiEEvibrucvgWbORDKNbzo3WoaUKIeQFAlwQ 5fcFCQWngvoACgkQzo3WoaUKIeTg+w/9Gyp5EcB4AoR3vKVxP0SAh1zBher3bh9uGaKTAWt0 +0v8fyZYGEPqZr//9rkodPnXbQnr9ogzjJmZpsPvGPyRZikWjYIwkfM2Vb4BCyr5wQ9++9KB kob5zCQmUw2o7s/gISpFsCC5B0eYusArVDnrCyrroyaxbN6MpUb5lzVMEOCzYljtdrPRAXPL FKRm3ijLV0RcYPzJJVOPV5EzUfCtGsGTXXRI9Y9O/7lFaJ+iWnwygo/Xoi0IgBHvOAj9Gp3Q 0BY+sI6Rgzm9dbddm8gYJ4+FjfZivI7fbdfSubTWvrtFmFdHovIPJYLvXK7hUG22ww4CneIF D4oZSVy9xUoqJf0qQNruzEqTr7y7lbZIzxgPCSVmH0jpgJ1po6RLaJllNA+ZklOQ76fCMiaD 5yQuJluwD5w+acPWTbmZX6DijGHPZSjzeUkiMKctYSRqVUo6JmK0dgwwm3l1/Orb4D3YsLVP QDa4ZrCfSldrGC3zkEJ8iCVSYQwlc0JfIxyn8C3LLxToPYeFv/bQTeDYBjaV7a0SQ/xKUdpg RFzrGrxj7CM2WHcpxCLVK0agobuUO7YXoufHRM6y0rfMwT10baDjh+hLKMshxTqsP55lWvtM SleSGjheVTiZChb3jK0rUPCC4Rg3gDTEQsptC3TgN48PtLpmhsNc4JPm64zlrreInZQ= Organization: CZ.NIC Message-ID: Date: Fri, 29 Mar 2019 12:05:36 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: cs Content-Transfer-Encoding: 8bit X-Virus-Scanned: clamav-milter 0.99.2 at mail X-Virus-Status: Clean Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 11:05:20 -0000 On 27. 03. 19 17:56, Eric Rescorla wrote: > > > On Wed, Mar 27, 2019 at 9:32 AM Tony Finch > wrote: > > Eric Rescorla > wrote: > > > >     4. At any time, the user will have the option to select a > >     different resolver out of the list, specify their own resolver, or > >     disable DoH entirely. > > Will Firefox inform its users whether the local resolver supports DoT or > DoH? > > > We don't currently expect to do so. As noted above, we don't think > secure transport to the local resolver is sufficient to ensure the > privacy and security guarantees we are trying to provide. > > > > > However, there are two more restricted cases in which we do think some > > network control of the resolver is reasonable. > > What about allowing Firefox users to access private / internal domain > names? > > > If a name doesn't resolve with DoH, we fall back to the system resolver. > This doesn't work properly when the same name is available on the public > DNS but pointing to a different location. As I alluded to in my email, > we're still working out how to deal with this split horizon scenario> > -Ekr IANAL, nevertheless I will say Beware of https://patents.google.com/patent/US20160197898A1 BTW This patent is very likely to soon become property of IBM as part of Red Hat acquisition. I'm not sure what is going to happen with Red Hat's patent promise. Petr Špaček @ CZ.NIC > > > Tony. > -- > f.anthony.n.finch  >  > http://dotat.at/ > each generation is responsible for the fate of our planet > > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Fri Mar 29 04:13:59 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73E6212026A for ; Fri, 29 Mar 2019 04:13:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.979 X-Spam-Level: X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XhZj0_wDRl7H for ; Fri, 29 Mar 2019 04:13:55 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74ECD12027D for ; Fri, 29 Mar 2019 04:13:54 -0700 (PDT) Received: from dhcp-9796.meeting.ietf.org (dhcp-9796.meeting.ietf.org [31.133.151.150]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2TBDpNq039123 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO) for ; Fri, 29 Mar 2019 06:13:53 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553858034; bh=oTRSkkbXBoWuQVgrvO7t1VYSfPx81UR/GupG81FoNK0=; h=Subject:To:References:From:Date:In-Reply-To; b=HD326uQGBh+0uAws4fXaOIwyNZutzVxLtPIUiaza875+Vtu5xh04Ns0aJRihv46GZ QDeD8pJ6eRgbAD0ECGL8gY58f7mR7fYVTbyxcT8oBv/lZYW6CAWEMZI2wBseN+XaPR uPlhgR0HeuqZpjphnk4QM9YlUSjajoxcPp+thdIY= To: doh@ietf.org References: From: Adam Roach Message-ID: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> Date: Fri, 29 Mar 2019 12:13:51 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 11:13:58 -0000 [as an area director in the associated area] On 3/29/19 12:05, Petr Špaček wrote: > IANAL, nevertheless I will say Beware of > [patent elided] With a reminder that mail to IETF mailing lists is covered under the definition of "IETF Contributions," I request that you read https://tools.ietf.org/html/bcp79#section-5.3 Please review the remainder of BCP 79 and take appropriate action. You may wish to consult with legal counsel in determining how to proceed. /a From nobody Fri Mar 29 04:55:11 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90D88120251 for ; Fri, 29 Mar 2019 04:55:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.03 X-Spam-Level: ** X-Spam-Status: No, score=2.03 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, FUZZY_XPILL=2.799, KHOP_DYNAMIC=0.85, RCVD_IN_DNSWL_LOW=-0.7, RDNS_DYNAMIC=0.982, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=rmplcnet.onmicrosoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HQ3VEou7mMjX for ; Fri, 29 Mar 2019 04:55:04 -0700 (PDT) Received: from mx07-002c0a01.pphosted.com (mx07-002c0a01.pphosted.com [185.132.180.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3AEBA12026D for ; Fri, 29 Mar 2019 04:55:04 -0700 (PDT) Received: from pps.filterd (m0127285.ppops.net [127.0.0.1]) by mx07-002c0a01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x2TBpph6016271; Fri, 29 Mar 2019 11:54:34 GMT Received: from eur01-he1-obe.outbound.protection.outlook.com (mail-he1eur01lp2055.outbound.protection.outlook.com [104.47.0.55]) by mx07-002c0a01.pphosted.com with ESMTP id 2rfvhabcej-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 29 Mar 2019 11:54:32 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rmplcnet.onmicrosoft.com; s=selector1-rm-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=oE3YqJPyzJeHcKenkNlze354mjJn12ZuWUUQo97Y63I=; b=P6V9MFpgd46tjy5POIo5ukRb8YvBDfNYLXsih/yfGn3HDtw5XQfwdSHaTPRJgthrqr5MzvEcWjsagAJ/giMfc0mBd1hXLF+VmRGyJZDiHxngMAUWVwcA9x+2bBBtgWy3eJzicW5BqsGdHB6nIefPdtPN/DVxnU9hxDuBiPMa+sA= Received: from AM6PR04MB4997.eurprd04.prod.outlook.com (20.177.33.216) by AM6PR04MB4406.eurprd04.prod.outlook.com (20.177.39.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1750.17; Fri, 29 Mar 2019 11:54:28 +0000 Received: from AM6PR04MB4997.eurprd04.prod.outlook.com ([fe80::5df9:95c7:55c0:c51e]) by AM6PR04MB4997.eurprd04.prod.outlook.com ([fe80::5df9:95c7:55c0:c51e%2]) with mapi id 15.20.1750.017; Fri, 29 Mar 2019 11:54:28 +0000 From: Paul Brears To: "andrew.campling@bt.com" , "Alister.Winfield@sky.uk" , "adam@nostrum.com" , "john@johncarr.eu" , "mcmanus@ducksong.com" CC: "paul.hoffman@icann.org" , "doh@ietf.org" Thread-Topic: [Doh] [EXTERNAL] Re: DoH Thread-Index: AQHU5a8WrcSJWAdgB0GdQglRRJjEqaYicS+AgAAO48A= Date: Fri, 29 Mar 2019 11:54:27 +0000 Message-ID: References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> <6bebaadff9b54dc1a906c237a756d476@tpw09926dag11h.domain1.systemhost.net> In-Reply-To: <6bebaadff9b54dc1a906c237a756d476@tpw09926dag11h.domain1.systemhost.net> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [194.238.49.17] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: ad142391-5e2d-4f50-0f18-08d6b43d4c1a x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(4618075)(2017052603328)(7153060)(7193020); SRVR:AM6PR04MB4406; x-ms-traffictypediagnostic: AM6PR04MB4406: x-ms-exchange-purlcount: 1 x-microsoft-antispam-prvs: x-forefront-prvs: 0991CAB7B3 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(376002)(366004)(39850400004)(396003)(346002)(189003)(199004)(13464003)(93886005)(52536014)(8936002)(3846002)(2906002)(486006)(68736007)(446003)(86362001)(11346002)(476003)(25786009)(33656002)(66066001)(4326008)(14454004)(105586002)(966005)(106356001)(66574012)(5024004)(14444005)(256004)(478600001)(97736004)(76176011)(6436002)(6116002)(26005)(55016002)(6246003)(8676002)(53546011)(6306002)(5660300002)(6506007)(2501003)(186003)(102836004)(71200400001)(54906003)(229853002)(71190400001)(81166006)(81156014)(316002)(110136005)(7736002)(99286004)(2201001)(305945005)(74316002)(7696005)(53936002)(9686003); DIR:OUT; SFP:1101; SCL:1; SRVR:AM6PR04MB4406; H:AM6PR04MB4997.eurprd04.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: rm.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: zrOMPqOBTiXnG4V3DzTJfTkfqEKtoq3Ix39tg6Ji4Hi8Ogsde8g4Rc9kMVyIkGJpLnHxWrXGeItxKondvktDYsafR5IJPq7d0XcEdSs1OFNzZ64hjREYnjizLhCPajt75DyyvD3ur9ZvJNh4g3IIYS/lfEtblsO7ZNVSniO7lGuFApK9djJfB26YyostKJnjls5RmOwKlE1XCfVElKoMDwcNWGGz4BTFhdD5TdwgcswjwpDV8QRryqeTsXGyYYrOIBDNFQBgTKxCk2PKXvrFHtCDB3sXrXx1gc5QVOT/DyZL03ur3fviHkR0MWjarRPPgzsKudxMaAX6PLhII1Ly4g8MG3wjk2fbL6/dXU8yIPbZVY+g1MCVsFGNtsllHaTw4oSbZIyKBxr0Lpk1Ml8ojbvxCozRKs8nOpGXmk/QaKU= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-OriginatorOrg: rm.com X-MS-Exchange-CrossTenant-Network-Message-Id: ad142391-5e2d-4f50-0f18-08d6b43d4c1a X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Mar 2019 11:54:28.0923 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 3a4af158-b8a5-4bc8-833c-d973205f2bc2 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM6PR04MB4406 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-29_06:, , signatures=0 X-Proofpoint-Spam-Details: rule=outboundspam_notspam policy=outboundspam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903290087 Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 11:55:10 -0000 RnVydGhlciBkb3duIHRoZSB0aHJlYWQgaXQgaGFkIGJlZW4gc2FpZCB0aGF0IGNob29zaW5nIHRv IHVzZSBEb0ggd2FzIHRoZSBzYW1lIGFzIGNob29zaW5nIHRvIHVzZSBHb29nbGUgRE5TIHJhdGhl ciB0aGFuIHlvdXIgSVNQ4oCZczoNCiA+IkZvciB0aGUgdHlwZXMgb2YgaG9tZSBuZXR3b3JrcyB5 b3UgbWVudGlvbiwgd2hpY2ggZ2VuZXJhbGx5IGxhY2sgcHJvZmVzc2lvbmFsIGFuZCBkZWRpY2F0 ZWQgbmV0d29yayBhZG1pbmlzdHJhdG9ycywgRG9IIGRvZXMgbm90IGluaGVyZW50bHkgcmVwcmVz ZW50IGFueSBzaWduaWZpY2FudCBjaGFuZ2UgdG8gdGhlIGRlY2FkZS1vbGQgc3RhdHVzIHF1byBy ZXN1bHRpbmcgZnJvbSBwdWJsaWNseS1hdmFpbGFibGUgRE5TLiINCg0KSSB0aGluayB0aGUga2V5 IGRpZmZlcmVuY2UgaXMgdGhhdCBvbiBhIG5vcm1hbCBXaWRvd3MgUEMgeW914oCZZCBuZWVkIGRl dmljZSBhZG1pbiBjcmVkZW50aWFscyB0byBjaGFuZ2UgRE5TIHByb3ZpZGVyLg0KU28gYSBjaGls ZCBjYW7igJl0IGNoYW5nZSBETlMgcHJvdmlkZXIsIHRvIGdldCByb3VuZCBwYXJlbnRhbCBjb250 cm9scywgb24gYSBmYW1pbHkgZGV2aWNlIHVubGVzcyB0aGV54oCZdmUgYmVlbiBnaXZlbiBhZG1p biByaWdodHMuDQoNCldoZXJlYXMgaW4gdGhlIGN1cnJlbnQgKGJldGEpIEZpcmVmb3ggVUksIERv SCBjYW4gYmUgdHVybmVkIG9uIHdpdGhvdXQgYW55IGFkZGl0aW9uYWwgY29udHJvbHMsIG9yIGFu eSB0ZWNobmljYWwga25vd2xlZGdlLg0KV2hhdOKAmXMgd29yc2UsIHRoZSBVSSB0b2RheSBkb2Vz buKAmXQgbWFrZSBpdCBjbGVhciB0aGF0IHRoaXMgc2V0dGluZyB3aWxsIHVuZGVybWluZSBwYXJl bnRhbCBjb250cm9scy4NClNvIGEgcGFyZW50LCBleHBlY3RpbmcgdGhlaXIgcGFyZW50YWwgY29u dHJvbHMgdG8gd29yaywgYW5kIGNoZWNraW5nIHRoZSBkZXZpY2Ugc2V0dGluZ3MsIHdvbuKAmXQg c2VlIERvSCBiZWluZyBlbmFibGVkIGFzIGEgcHJvYmxlbS4NCg0KSWYgRG9IIGJlY29tZXMgZGVm YXVsdCB0aGVuIG1vc3QgcGFyZW50cyB3b27igJl0IGV2ZW4gc2VlIHRoZSBjb250cm9sIGhpZGRl biBpbiB0aGUgYWR2YW5jZWQgc2V0dGluZ3MsIGFuZCB3b27igJl0IGtub3cgd2h5IHRoZWlyIHBh cmVudGFsIGNvbnRyb2xzIGFyZSBubyBsb25nZXIgd29ya2luZy4NCg0KUmVnYXJkcywNCg0KUGF1 bA0KDQotLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KRnJvbTogRG9oIDxkb2gtYm91bmNlc0Bp ZXRmLm9yZz4gT24gQmVoYWxmIE9mIGFuZHJldy5jYW1wbGluZ0BidC5jb20NClNlbnQ6IDI5IE1h cmNoIDIwMTkgMTA6NTgNClRvOiBBbGlzdGVyLldpbmZpZWxkQHNreS51azsgYWRhbUBub3N0cnVt LmNvbTsgam9obkBqb2huY2Fyci5ldTsgbWNtYW51c0BkdWNrc29uZy5jb20NCkNjOiBwYXVsLmhv ZmZtYW5AaWNhbm4ub3JnOyBkb2hAaWV0Zi5vcmcNClN1YmplY3Q6IFJlOiBbRG9oXSBbRVhURVJO QUxdIFJlOiBEb0gNCg0KDQpPbiBNYXIgMjgsIDIwMTksIGF0IDIyOjQwLCBXaW5maWVsZCwgQWxp c3RlciA8QWxpc3Rlci5XaW5maWVsZD00MHNreS51a0BkbWFyYy5pZXRmLm9yZz4gd3JvdGU6DQoN Cj4gVG9wIHBvc3Rpbmcgb24gcHVycG9zZSDigKYuDQoNCj4gSeKAmXZlIHRyaWVkIHRvIHJlc3Bv bmQgdHdpY2UgdG8gdGhpcyBhbmQgSSB0aGluayB0aGlyZCB0aW1lIEkgbWlnaHQgZ2V0DQo+IGNs b3NlciB0byBteSB0aGlua2luZ+KApg0KDQo+IFRoZSBEb0ggc29sdXRpb24gKG5vdGUgbm90IG5l Y2Vzc2FyaWx5IHByb3RvY29sKSBpcyBtaXNzaW5nIGF0IGxlYXN0DQo+IHR3byBrZXkgZWxlbWVu dHMgd2hpY2ggdG9nZXRoZXIgd291bGQgaGF2ZSByZWR1Y2VkIHRoZSBpbW1lZGlhdGUgcGFuaWMN Cj4gaW4gdGhlIGltcGxlbWVudGF0aW9uLiBOb3QgdG8gc2F5IHRoZXJlIGFyZW7igJl0IG90aGVy IHRoaW5ncyB0aGF0IG5lZWQgd29yayBqdXN0IHRoZSByZWFsbHkgcHJvYmxlbWF0aWMgaXNzdWVz IGNvdWxkIGJlIGNvbnRhaW5lZCBvciBkZWZlcnJlZC4NCg0KPiBUaGUgY3VycmVudCBhY3RpdmUg d29yayBvbiBkaXNjb3ZlcnkgYW5kIHNvbWVob3cgZGVmaW5pbmcgYSB0cnVzdCBhbmQgcHJpdmFj eSBtZWNoYW5pc20gc3Vycm91bmRpbmcgVFJS4oCZcy4NCg0KPiBXaXRoIHRydXN0ZWQgbGlzdHMg b2YgVFJS4oCZcyB5b3XigJlkIHRoZW4gYmUgYWJsZSB0byB1c2UgdGhlIG91dHB1dCBvZiBhDQo+ IGZ1bmRhbWVudGFsbHkgaW5zZWN1cmUgZGlzY292ZXJ5IG1ldGhvZC4gSWYgdGhhdCDigJh0cnVz dCBhbmQgcHJpdmFjeeKAmQ0KPiB3ZXJlIHRvIGJlIHNlbGVjdGFibGUgc2F5IGJ5IGNob2ljZSBv ZiBwcm92aWRlci4gWW91IGdldCB0aGUgb3B0aW9uIHRvDQo+IGFsbG93IHRoZSBsb2NhbCBuZXR3 b3JrIHBvbGljeSAvIG9yIG5vdC4gWW91IGNhbiBjaG9zZSB0byBhbGxvdw0KPiB0cnVzdGVkIGNv ZmZlZSBzaG9wcyBidXQgb3RoZXJzIG1heSBiZSBub3QgaW4geW91ciBsaXN0IGJlY2F1c2UgdGhl eQ0KPiBkbyB0aGluZ3MgdGhhdCDigJh5b3XigJkgZG9u4oCZdCBsaWtlLiBQYXJlbnRzIGNhbiBj aG9zZSB0byB0cnVzdCBvbmx5IHRob3NlIEROUyBwcm92aWRlcnMgdGhhdCBnaXZlIHN0cm9uZyBw YXJlbnRhbCBjb250cm9scy4gV2hhdGV2ZXIgZ3JvdXAgeW91IGFyZSBpbiBtYW55IHRoaW5ncyB3 b3VsZCBiZSBsZXNzIGNvbnRyb3ZlcnNpYWwuIE9oLCBpdOKAmXMgbm90IGVhc3kgYnV0IGF0IGxl YXN0IHdlIHdvdWxkbuKAmXQgYmUgaW4gdGhlIGN1cnJlbnQgcG9zaXRpb24gd2hlcmUgaXQgaXMg YWxtb3N0IGNlcnRhaW4gdGhhdCBhIHN1ZGRlbiBjaGFuZ2Ugd2lsbCBvY2N1ciB0byBhIGtleXN0 b25lIG9mIHRoZSBJbnRlcm5ldC4NCg0KPiBXb3JzdCBjYXNlIGV4YW1wbGUgaXMgdGhhdCBnaXZl biB0aGUgYmlsbGlvbnMgb2YgcXVlcmllcyBwZXIgc2Vjb25kIHdlDQo+IGFyZSB0YWxraW5nIGFi b3V0IGhlcmUgYW5kIHRoZSBsb2NhbGlzYXRpb24gb2YgY29udGVudCBkZWxpdmVyeSBpdA0KPiBp bXBhY3RzLCBtYW55IHRlcnJhYnl0ZXMgcGVyIHNlY29uZCBvZiB0cmFmZmljIGNvdWxkIC8gd291 bGQgcmFwaWRseQ0KPiBtaWdyYXRlIHRvIGxlc3Mtb3B0aW1hbCBDRE7igJlzLiBUaGUgZGlzdHJp YnV0aW9uIG9mIHRoaXMgbWlnaHQgd2VsbA0KPiBicmVhayBuZXR3b3Jrcywgc2FkbHkgdGhlcmUg aXMgbm8gcmVzZWFyY2ggdGhhdCBjYW4gcmVsaWFibHkgd29yayBvdXQNCj4gdGhlIGZ1bGwgaW1w YWN0LiBTbWFsbCB0cmlhbHMgcmVhbGx5IGRvbuKAmXQgaGVscCBiZWNhdXNlIHdlIGFscmVhZHkg aGFuZGxlIHNtYWxsIHBlcmNlbnRhZ2VzIG9mIG5vbi1sb2NhbCBETlMgdXNlLiBJdOKAmXMgdGhl IHVua25vd24gb2Ygd2hhdCBoYXBwZW5zIGlmIDgwJSBvZiB0aGUgdXNlcnMgaW4gYSBzaW5nbGUg c29mdHdhcmUgdXBkYXRlIGNoYW5nZSB0byBhIG5vbi1sb2NhbCBETlMgcHJvdmlkZXIgKGVzcGVj aWFsbHkgaWYgaXTigJlzIG9uZSB0aGF0IGRvZXNu4oCZdCBmb3J3YXJkIGdyYW51bGFyIGVub3Vn aCBFRE5TIGNsaWVudC1zdWJuZXQgZGF0YSBiZWNhdXNlIOKAmHByaXZhY3nigJkpLg0KDQo+IEkg YWRtaXQgdGhhdCBsYXN0IHBhcmFncmFwaCBtYXkgYmUgRlVELCBidXQgaW4gdGhpcyBjYXNlIHRo ZSByaXNrIHRvDQo+IHRoZSBzdGFiaWxpdHkgb2YgdGhlIEludGVybmV0IGlzIHBvdGVudGlhbGx5 IGF0IHN0YWtlIHNvIGxhcmdlc3QgcG9zc2libGUg4oCYd2XigJkgb3dlIGV2ZXJ5b25lIGEgbGl0 dGxlIHRpbWUgZXhwb3NpbmcgdGhlIHBvdGVudGlhbCBpc3N1ZXMgaW4gZGV0YWlsIHdpdGggYW55 IG1pdGlnYXRpb25zIGlmIHRoZXkgZXhpc3QuDQo+IFByZXBhcmluZyB0aG9zZSB3aG8gd2lsbCBi ZSBpbXBhY3RlZCBmb3IgY2hhbmdlIGFuZCB0aGVuIHNvbWVob3cNCj4gY29udGFpbmluZyB0aGUg aW5pdGlhbCAgY2hhbmdlIHNvIGlmIGl0IHJlYWxseSBkb2VzIGNhdXNlIGhhcmQgdG8NCj4gY29u dGFpbiBpc3N1ZXMgd2UgaGF2ZSBhIHNtYWxsIGVub3VnaCBwcm9ibGVtIGl0cyBzb2x2YWJsZSBp biByZWFzb25hYmxlIHRpbWVmcmFtZXMuIEFueW9uZSB3aG8gaGFzIGRvbmUgb3BlcmF0aW9ucyB3 aWxsIHRlbGwgeW91IHRoYXQgYmlnIGNoYW5nZXMgdGhhdCBoYXBwZW4gZmFzdCBhcmUgdGhlIG5p Z2h0bWFyZSB5b3UgZmlnaHQgaGFyZGVzdCB0byBhdm9pZC4NCg0KPiBPbmUgbW9yZSB0aGluZyBJ 4oCZbGwgcmVwZWF0IG90aGVycyB3YXJuaW5nLi4gYmV3YXJlIHVuaW50ZW5kZWQNCj4gY29uc2Vx dWVuY2VzIHRoaXMgbXVzdCBub3QgZW5kIGluIGEgZmlnaHQgYmV0d2VlbiBuZXR3b3Jrcywgb3IN Cj4gZ292ZXJubWVudHMgYW5kIERvSCBwcm92aWRlcnMuIElmIHRoaXMgZ29lcyB3cm9uZyBhbmQg Y29ycG9yYXRlcyBhbmQNCj4gb3RoZXIgcGxheWVycyBkZWNpZGUgdGhpcyBpcyBhIHN0ZXAgdG9v IGZhciBiZWNhdXNlIG9mIHRoZSBpbXBhY3RzIHdlIGFsbCBrbm93IHRoZSBvdXRjb21lIGNvdWxk IGJlIHZlcnkgbWVzc3kgYW5kIEkgZm9yIG9uZSB3b3VsZCByYXRoZXIgd29yayB0byBnZXQgYSBs ZXNzIHBhaW5mdWwgYW5kIG1vc3QgbGlrZWx5IGxlc3MgcHJpdmFjeSBpbXBhY3RmdWwgcmVzdWx0 Lg0KDQo+IE5COiBEb27igJl0IGJpdGUgSSBkbyBsaWtlIHRoZSBwcm90b2NvbCBhbmQgSSBhZ3Jl ZSB0aGF0IHRoZXJlIGFyZSBzb21lIHRoYXQgbmVlZCBpdCB0byBleGlzdC4NCg0KDQpJIGFncmVl IHdpdGggdGhlIHRocnVzdCBvZiB5b3VyIGFyZ3VtZW50LCB0aGluayB0aGF0IHRob3NlIHRoYXQg c2VlayB0byBkaXN0aW5ndWlzaCBiZXR3ZWVuIHRoZSBwcm90b2NvbCBhbmQgaXRzIGltcGFjdCBp biByZWFsLXdvcmxkIGltcGxlbWVudGF0aW9uIHNjZW5hcmlvcyBhcmUgbWlzdGFrZW4uICBUaGUg Y3VycmVudCBkZXNpZ24gaXMgaW5jb21wbGV0ZSBhbmQgbGFja2luZyBpbiBmdW5jdGlvbmFsaXR5 IGFuZCBuZWVkcyBtb3JlIGVuZ2luZWVyaW5nIGVmZm9ydCBpbiBvcmRlciB0byBhZGRyZXNzIHRo ZSBzaG9ydGNvbWluZ3MgaWRlbnRpZmllZCBoZXJlIGFuZCBlbHNld2hlcmUuICBXaXRob3V0IGZ1 cnRoZXIgd29yaywgRG9IIHdpbGwgc2ltcGx5IHNlcnZlIHRvIHVuZGVybWluZSBwcml2YWN5IGFu ZCBzZWN1cml0eSwgYXMgd2VsbCBhcyBsZWF2aW5nIGFwcGxpY2F0aW9uIGRldmVsb3BlcnMgYW5k IHJlc29sdmVycyB0aGF0IHVzZSBpdCBpbiBhIHBvc2l0aW9uIHdoZXJlIHRoZXkgbWF5IGJlIG5v bi1jb21wbGlhbnQgd2l0aCBsZWdpc2xhdGlvbiBpbiBudW1lcm91cyBjb3VudHJpZXMgIC0gYW5k IHNvIG9wZW4gdG8gbGVnYWwgcmVkcmVzcy4NCg0KSSBob3BlIHRoYXQgdGhlIElFVEYgcmVjb2du aXNlcyB0aGF0IHRoZXNlIGFyZSBsZWdpdGltYXRlIGNoYWxsZW5nZXMgdGhhdCBuZWVkIHRvIGJl IGRlYWx0IHdpdGggc28gdGhhdCBEb0ggY2FuIGRlbGl2ZXIgaXQncyBpbnRlbmRlZCBiZW5lZml0 cy4NCg0KDQpBbmRyZXcNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX18NCkRvaCBtYWlsaW5nIGxpc3QNCkRvaEBpZXRmLm9yZw0KaHR0cHM6Ly91cmxkZWZl bnNlLnByb29mcG9pbnQuY29tL3YyL3VybD91PWh0dHBzLTNBX193d3cuaWV0Zi5vcmdfbWFpbG1h bl9saXN0aW5mb19kb2gmZD1Ed0lHYVEmYz1RQlFuQkFEVGtIaTExZVAtY0VKY193JnI9ajExRVhB Nzl6dEVFeWZzZVd6MllPdyZtPUYzNnBrUWtqOU9idjlBeThEM0d5bEM3eXdoVHNPY0xueWNhWHZU a1I0dG8mcz1Zb01LVW5WNlBZUjJQYzN6bS02blBBTjBkcmJpcnc0REpVVG14Q0V2QkJ3JmU9DQpU aGlzIG1lc3NhZ2UgaXMgY29uZmlkZW50aWFsIGFuZCBzaG91bGQgbm90IGJlIGNvcGllZCBvciBk aXNjbG9zZWQgdG8gYW55b25lLiBJZiB0aGlzIGVtYWlsIGhhcyBjb21lIHRvIHlvdSBpbiBlcnJv ciwgcGxlYXNlIGRlbGV0ZSBpdCwgYWxvbmcgd2l0aCBhbnkgYXR0YWNobWVudHMuIEFueSB2aWV3 cyBvciBvcGluaW9ucyBwcmVzZW50ZWQgYXJlIG9ubHkgdGhvc2Ugb2YgdGhlIGF1dGhvciBhbmQg bm90IHRob3NlIG9mIFJNLiBSTSBhY2NlcHRzIG5vIGxpYWJpbGl0eSBmb3IgYW55IGxvc3Mgb3Ig ZGFtYWdlIHdoaWNoIG1heSBiZSBjYXVzZWQgYnkgc29mdHdhcmUgdmlydXNlcyBhbmQgaXQgaXMg eW91ciByZXNwb25zaWJpbGl0eSB0byBlbnN1cmUgdGhhdCB0aGlzIGVtYWlsIGFuZCBhbnkgYXR0 YWNobWVudHMgYXJlIGZyZWUgb2YgdmlydXNlcyB3aGVuIHlvdSByZWNlaXZlIGl0LiBZb3UgbWF5 IHVzZSBhbmQgYXBwbHkgdGhpcyBlbWFpbCBhbmQgdGhlIGluZm9ybWF0aW9uIGNvbnRhaW5lZCBp biBpdCBmb3IgdGhlIGludGVuZGVkIHB1cnBvc2Ugb25seSBhbmQgUk0gc2hhbGwgbm90IGJlIGxp YWJsZSBpbiBhbnkgd2F5IGluIHJlc3BlY3Qgb2YgdXNlIGZvciBhbnkgb3RoZXIgcHVycG9zZS4g SW4gcmVzcGVjdCBvZiBhbGwgb3RoZXIgbWF0dGVycywgdG8gdGhlIGZ1bGxlc3QgZXh0ZW50IHBl cm1pdHRlZCBieSBhcHBsaWNhYmxlIGxhdywgUk0gZGlzY2xhaW1zIGFsbCByZXNwb25zaWJpbGl0 eSBhbmQgbGlhYmlsaXR5IGZvciB0aGUgY29udGVudHMgb2YgdGhpcyBlbWFpbCAoaW5jbHVkaW5n IGFueSBhdHRhY2htZW50cykuIFBsZWFzZSBub3RlIHRoYXQgUk0gbWF5IGludGVyY2VwdCBpbmNv bWluZyBhbmQgb3V0Z29pbmcgZW1haWwgY29tbXVuaWNhdGlvbnMuDQoNClJNIEVkdWNhdGlvbiBM dGQgKFJlZy4gTm86IDAxMTQ4NTk0KSBpcyBhIGNvbXBhbnkgcmVnaXN0ZXJlZCBpbiBFbmdsYW5k IGFuZCBXYWxlcyB3aXRoIGl0cyByZWdpc3RlcmVkIG9mZmljZSBhdCAxNDAgRWFzdGVybiBBdmVu dWUsIE1pbHRvbiBQYXJrLCBBYmluZ2RvbiwgT3hvbiBPWDE0IDRTQjsgVkFUIE5vOiBHQiA2MzAg ODIzNiA1Ni4NCg== From nobody Fri Mar 29 06:06:56 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 493B8120252 for ; Fri, 29 Mar 2019 06:06:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.68 X-Spam-Level: X-Spam-Status: No, score=-1.68 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OxGtUf725Pea for ; Fri, 29 Mar 2019 06:06:54 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3A5C8120233 for ; Fri, 29 Mar 2019 06:06:54 -0700 (PDT) Received: from dhcp-8111.meeting.ietf.org (dhcp-8111.meeting.ietf.org [31.133.129.17]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2TD6mVZ057898 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 29 Mar 2019 08:06:50 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553864813; bh=VAVD9xu/J4s9YADimiLpET5WV20Xa7y9ZpTIP66r7qk=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=MJkEAUeygqBOX+M0HvhZPLRuMyIfNb10Trf2U5TO1uFAd1Idj90WdfIl8O/QRvqqj I2wGIpy+ccvzQUaAdA1SP+sA1OIme8x9HEkGuQTl0wSaa+6BHJR5PLtGs76k9HwSy8 uiYf6kgIIezin5giHL0Wc5P2cB7TN/7YYMWFsi98= To: Paul Brears , "andrew.campling@bt.com" , "Alister.Winfield@sky.uk" , "john@johncarr.eu" , "mcmanus@ducksong.com" Cc: "paul.hoffman@icann.org" , "doh@ietf.org" References: <73a0935d-f80b-0e8d-eb89-cb35a473122c@nostrum.com> <826904ddc23941d5be4d8872c4f2737a@tpw09926dag11h.domain1.systemhost.net> <2af82a6d-6887-ae36-4527-47e476829345@nostrum.com> <9E29A232-BA75-478D-96BF-5D6164142BDD@sky.uk> <6bebaadff9b54dc1a906c237a756d476@tpw09926dag11h.domain1.systemhost.net> From: Adam Roach Message-ID: <62c8932a-34f6-e0be-99fe-0976a8b4d5f7@nostrum.com> Date: Fri, 29 Mar 2019 14:06:48 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Doh] [EXTERNAL] Re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 13:06:56 -0000 On 3/29/19 12:54, Paul Brears wrote: > I think the key difference is that on a normal Widows PC you’d need device admin credentials to change DNS provider. This again conflates product concerns with protocol ones. Applications have always had the ability to incorporate their own resolver library and configure it to use servers other than those provided by the operating system (cf. c-ares, adns). The concern you describe is that some popular applications may choose to do so. /a From nobody Fri Mar 29 09:37:33 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C578B1200CC for ; Fri, 29 Mar 2019 09:37:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.001 X-Spam-Level: X-Spam-Status: No, score=-2.001 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n1_-jqawYuJ5 for ; Fri, 29 Mar 2019 09:37:29 -0700 (PDT) Received: from copdcmhout02.cable.comcast.com (copdcmhout02.cable.comcast.com [96.114.158.212]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B316C12004C for ; Fri, 29 Mar 2019 09:37:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1553877448; x=2417791048; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=VzJaU108OXO9fAh463kfnUxCHXziWAJ4qZsR1m7S+Co=; b=tjI0KM6E8SdKKkHOe/mvHND7KiLmAmckgv8cOk5/f1VUfBEkDhj1lU/ikpZUAUfH doLd8YQbF9PPoY5a6RS9UTrgc5DyjDn/oFMgLWBR9c+bzGwqVyqjNkuvSUFJH6JT +cIe5MxVVtVUuOkAtCH0tG4RWav6IPZIRQiXqyuW3FpWABpGx77eJWSc/U7zxvx3 YvBypZ9BpaIj/BoUspumonWCaVBhi0wGa9PMY0va7LbeyptlrAfLa3w6HitSHyTZ UklHz42KvVbtRLKzqpkw4U7kXNVaBgpqUEi65blRVp4ColL4LbtHg5XegSvcAtGb ft4Uhopw2WAqRgNLCmaEEaC9st3fz6f4ks+c0aYkar4LJP/EuzUwTE/6S2DhCCB6 WiOu9cNRWceev4zQFT87GpVhNRzXwkivaKn36m/GF5AA1t1GCQgGbYczg0f29r19 9HsalmlMYpglwkNABEwNIw2ca5Jf/skqZipkzWJtnHLTJD+YLawVkZNiDKdNCzmz IPflxDR2lCovKFyxUIOQWyUxyh3IKDVeA873ODSA1FDElc+x7BUOA3iHWYNYqGBZ WNT+ztpF8ww6oxxIKRyAc+PPch0chcimfrJ8ABMu/6AW+MBdoogTHe9vVgxlB49e kuGmdK21AgXMswyiMcU0+bjkKZTu9ugtA8I6UIT4R3M=; X-AuditID: 60729ed4-ef9ff7000000403c-01-5c9e49c87240 Received: from COPDCEXC38.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout02.cable.comcast.com (SMTP Gateway) with SMTP id 2E.A4.16444.8C94E9C5; Fri, 29 Mar 2019 10:37:28 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC38.cable.comcast.com (147.191.125.137) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 29 Mar 2019 12:37:27 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Fri, 29 Mar 2019 12:37:27 -0400 From: "Livingood, Jason" To: Adam Roach , "doh@ietf.org" Thread-Topic: [Doh] Mozilla's plans re: DoH Thread-Index: AQHU5H3+TKCHj3Ms1kiNknptws9ehaYfd9IAgAB3kACAAAanAIACwrQAgAACT4CAAGstgA== Date: Fri, 29 Mar 2019 16:37:27 +0000 Message-ID: <80D7A331-5D86-4467-931A-957F09D3CF7B@cable.comcast.com> References: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> In-Reply-To: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [96.115.73.254] Content-Type: text/plain; charset="utf-8" Content-ID: <2B5EBE526F2D8948942D90B7DF864FD0@comcast.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprNKsWRmVeSWpSXmKPExsWSUDRnsu4Jz3kxBuvXmFvs+buI3eLa3Yts DkweS5b8ZPKYtfMJSwBTVAOjTUlGUWpiiUtqWmpecaodlwIGsElKTcsvSnVNLMqpDErNSU3E rgykMiU1J7MstUgfqzH6WM1J6GLK2PMpu+ACZ8XPw+1sDYwbOLsYOTkkBEwk1m24yNbFyMUh JLCLSaLn+TtWkISQQAuTxOrvthCJ04wSizf3giXYBMwk7i68wgxiiwg4SLyf+AosLiygJfHj yVM2iLi2xJtjx9i7GDmA7DCJx3P9QcIsAqoS71e/YAexeQVcJPpunmGCmP+PSWLm2i8sIAlO AXuJ7Y8Og81kFBCT+H5qDROIzSwgLnHryXwmiKsFJJbsOc8MYYtKvHz8D6xeVEBfYuOmo2wQ cUWJX/OusIHcwCygKbF+lz7EGCuJba1XGCFsRYkp3Q+h7hGUODnzCQtEq7jE4SM7WCcwSsxC snkWwqRZSCbNQjJpFpJJCxhZVzHyWZrpGRqa6BmaWugZGRptYgQnmXlXdjBenu5xiFGAg1GJ h/eq9bwYIdbEsuLK3EOMEhzMSiK8MZ/nxgjxpiRWVqUW5ccXleakFh9ilOZgURLnTXg/J0ZI ID2xJDU7NbUgtQgmy8TBKQVMZytuR/fcexVet+PsytVfOXjXzWzUuqU0l2XWSb4F9dbPzr0z WfDnJv+7Mw2rVv4JWhPR+D5th03/+i+OO+TORxtzapxf/elGiePL0uTjbuuzt95jU/B1PvbM m8n9yRF17+wDFq2WtQc17s45MHvOzXnpj7JvnZpvtsz2wclczejN12yOi84TfavEUpyRaKjF XFScCAAiJLlYLgMAAA== Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 16:37:32 -0000 KzEgdG8gd2hhdCBBZGFtIHNhaWQgLSB0aGlzIGNhbiBhdmVydCBzZXJpb3VzIGxlZ2FsIC8gSVBS IGlzc3VlcyBsYXRlciBvbi4gDQoNCg0K77u/T24gMy8yOS8xOSwgNzoxNCBBTSwgIkRvaCBvbiBi ZWhhbGYgb2YgQWRhbSBSb2FjaCIgPGRvaC1ib3VuY2VzQGlldGYub3JnIG9uIGJlaGFsZiBvZiBh ZGFtQG5vc3RydW0uY29tPiB3cm90ZToNCg0KICAgIFthcyBhbiBhcmVhIGRpcmVjdG9yIGluIHRo ZSBhc3NvY2lhdGVkIGFyZWFdDQogICAgDQogICAgT24gMy8yOS8xOSAxMjowNSwgUGV0ciDFoHBh xI1layB3cm90ZToNCiAgICA+IElBTkFMLCBuZXZlcnRoZWxlc3MgSSB3aWxsIHNheSBCZXdhcmUg b2YNCiAgICA+IFtwYXRlbnQgZWxpZGVkXQ0KICAgIA0KICAgIA0KICAgIFdpdGggYSByZW1pbmRl ciB0aGF0IG1haWwgdG8gSUVURiBtYWlsaW5nIGxpc3RzIGlzIGNvdmVyZWQgdW5kZXIgdGhlIA0K ICAgIGRlZmluaXRpb24gb2YgIklFVEYgQ29udHJpYnV0aW9ucywiIEkgcmVxdWVzdCB0aGF0IHlv dSByZWFkIA0KICAgIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9iY3A3OSNzZWN0aW9uLTUu Mw0KICAgIA0KICAgIFBsZWFzZSByZXZpZXcgdGhlIHJlbWFpbmRlciBvZiBCQ1AgNzkgYW5kIHRh a2UgYXBwcm9wcmlhdGUgYWN0aW9uLiBZb3UgDQogICAgbWF5IHdpc2ggdG8gY29uc3VsdCB3aXRo IGxlZ2FsIGNvdW5zZWwgaW4gZGV0ZXJtaW5pbmcgaG93IHRvIHByb2NlZWQuDQogICAgDQogICAg L2ENCiAgICANCiAgICBfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fXw0KICAgIERvaCBtYWlsaW5nIGxpc3QNCiAgICBEb2hAaWV0Zi5vcmcNCiAgICBodHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RvaA0KICAgIA0KDQo= From nobody Fri Mar 29 09:50:05 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 889EB1200EF for ; Fri, 29 Mar 2019 09:50:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ey0rNZQmBLfT for ; Fri, 29 Mar 2019 09:50:00 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9BA8120003 for ; Fri, 29 Mar 2019 09:49:59 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id w30so3075805qta.8 for ; Fri, 29 Mar 2019 09:49:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=pVYBfndN+SG+pPT7Y7fH981eMMLhDz+EQGMTzEfa+Bw=; b=SkyOWlP/nT5qXOM4qVZ6jE44PfzcQaijrcBU+jhDULPkEo/KNmOwk+xLisvyarSHl8 /HHEQ5Q7sCQhbXj0K9tEwQlil+umTlafI0Cu+SUx7K+tVIFX0wslEnOje3ak9zMLe7o4 hVq2WPlu7o1boPu/3uCYPMcojoZOe/0mwaVH7AI6+kVGgSFCm310TwZQ8M13mhm5x1dU sS6YivRStmneW5aPOLvVLOtLENHK4Tkhs1A7zsh7Nnev1Op/iQN1jR+2c6xZJGiPmsYd ywAD4SPXYMG88crv4eYqeETprxXLNAIoqPYv02UUMoaatrF+I6IOE2eQs3pL8OYg5lK4 bQgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=pVYBfndN+SG+pPT7Y7fH981eMMLhDz+EQGMTzEfa+Bw=; b=aBwn2HCj2EOvWhQhRZ+hy7HjT1M2BNgwyNP9Sx0ENVVtRSAE2uaDgz9cVErRghef5c ATRI5yop8WcPU6MdJCxrjskbpO9G3kn3vhmIA9/vSVzPFdtiDqjqNkXykzn76RvEclc9 aZMdaONNkFcTsyoFmyc2LsKaVtSpCxII8o/zBPpwi6Scwv5jkD7I40jOf5tgTmpAjj3I VncRSi/FsUQK5b7NLeqY3SQNNCQ4z83CxWhHQTQUdXKSvDAA2jzb6JjsuXwr+JJxfTA9 K3+LP8O029pNQNMINn9r0WG3891jl2oFvaKhRJL6DvNq+zTSk0nC0Fh5HhZOxWAwu5ah R0zw== X-Gm-Message-State: APjAAAUCjt/YmX6wN0bIDGpidWLfB8o7TydMsMBP7zVUznlglveTq8qj fvhkP/AlSKMNp2VsfzzwA2k4WZCpBGkMC7jgQ3bNFgRY X-Google-Smtp-Source: APXvYqw3pXWo5c/irhri+gfd4tNnr75HPEp6imCTfPEv5jmQ5CUxihrS/e2HgreTtZvFkKQWlBcvO4YNNaH1WWsNsIY= X-Received: by 2002:a0c:814d:: with SMTP id 71mr31561237qvc.47.1553878198957; Fri, 29 Mar 2019 09:49:58 -0700 (PDT) MIME-Version: 1.0 References: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> In-Reply-To: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> From: Brian Dickson Date: Fri, 29 Mar 2019 17:49:47 +0100 Message-ID: To: Adam Roach Cc: DoH WG Content-Type: multipart/alternative; boundary="00000000000012b97705853e7645" Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 16:50:03 -0000 --00000000000012b97705853e7645 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Fri, Mar 29, 2019 at 12:14 PM Adam Roach wrote: > [as an area director in the associated area] > > On 3/29/19 12:05, Petr =C5=A0pa=C4=8Dek wrote: > > IANAL, nevertheless I will say Beware of > > [patent elided] > > > With a reminder that mail to IETF mailing lists is covered under the > definition of "IETF Contributions," I request that you read > Hi, Adam, Unfortunately, English (my native language BTW) is ambiguous in the meaning of "you"; it could be second person singular OR second person plural. Additionally, the "To:" line of your email was the DoH WG mailing list. Could you clarify, to whom were you addressing the message re: BCP 79? (The possibilities seem to be, Petr, or the whole list, or maybe implicitly any WG participants who are employed/sponsored by whoever owns that patent?= ) Thanks, Brian > https://tools.ietf.org/html/bcp79#section-5.3 > > Please review the remainder of BCP 79 and take appropriate action. You > may wish to consult with legal counsel in determining how to proceed. > > /a > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh > --00000000000012b97705853e7645 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable


=
On Fri, Mar 29, 2019 at 12:14 PM Adam= Roach <adam@nostrum.com> wro= te:
[as an area = director in the associated area]

On 3/29/19 12:05, Petr =C5=A0pa=C4=8Dek wrote:
> IANAL, nevertheless I will say Beware of
> [patent elided]


With a reminder that mail to IETF mailing lists is covered under the
definition of "IETF Contributions," I request that you read
<= /blockquote>

Hi, Adam,

Unfortun= ately, English (my native language BTW) is ambiguous in the meaning of &quo= t;you"; it could be second person singular OR second person plural.
Additionally, the "To:" line of your email was the DoH WG= mailing list.

Could you clarify, to whom were you= addressing the message re: BCP 79?
(The possibilities seem to be= , Petr, or the whole list, or maybe implicitly any WG participants who are = employed/sponsored by whoever owns that patent?)

T= hanks,
Brian

=C2=A0
https://tools.ietf.org/html/bcp79#section-5.3

Please review the remainder of BCP 79 and take appropriate action. You
may wish to consult with legal counsel in determining how to proceed.

/a

_______________________________________________
Doh mailing list
Doh@ietf.org
https://www.ietf.org/mailman/listinfo/doh
--00000000000012b97705853e7645-- From nobody Fri Mar 29 11:16:09 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FB811202D6 for ; Fri, 29 Mar 2019 11:16:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.021 X-Spam-Level: X-Spam-Status: No, score=-6.021 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_HI=-5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nic.cz Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AGYnpLyxNFx7 for ; Fri, 29 Mar 2019 11:16:04 -0700 (PDT) Received: from mail.nic.cz (mail.nic.cz [217.31.204.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0EB2E12008A for ; Fri, 29 Mar 2019 11:16:03 -0700 (PDT) Received: from [IPv6:2001:1488:fffe:6:8c02:b089:e778:64c3] (unknown [IPv6:2001:1488:fffe:6:8c02:b089:e778:64c3]) by mail.nic.cz (Postfix) with ESMTPSA id 8C32D6359E; Fri, 29 Mar 2019 19:16:00 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nic.cz; s=default; t=1553883360; bh=oJpymJOEpFWSxSFVdx+SdNLgC10PmIWUHNT773wMYkk=; h=To:From:Date; b=ORkKbNPRcxZGlWZiJ12zAgcsL6QU/jquW5hpJiHJ3IlOBR9UptaLcC8HkF4X3HCRE dNX2PG0V3aKfS/3IG6u6e9VkgkT6DC29z1aYPPy3knG/wZSCbVl1qoJrokOrLjZyWH XenCdn/NC+YhNgdXOKROyfP5nC/q/eOJh0hDcP0M= To: doh@ietf.org References: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> Cc: Adam Roach From: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= Openpgp: preference=signencrypt Autocrypt: addr=vladimir.cunat+ietf@nic.cz; prefer-encrypt=mutual; keydata= mQINBFgDknYBEADHEQwLBlfqbVCzq7qYcBFFTc1WCAFtqiKehOrsITnKusZw4nhYwlKQxcum gj01xJOhbfHBCBeGlDydYqemKg4IfY2nwSyPwZZYMJn7L7AGrCeytr4VMvDJ7o7qDZjjim4i fv+GUwdk3plXx6oMF4nctesI8aAOuLUHAn0PfrGfNhWoaglOKgdOI6DGjhI/aGkvy+jrI/+X sdMV+3f1RuEOfI+Yu4SXFjJyhAmqEOBRxxdHqKreIIpz3Lg38yWwiVGfwgQT+nFIz9BpHH3l Wg1uS8xM3ezceBmRYV8zT9PvbeZ57BlaTR6rLae5RYwV397PSLBqqLkB5H0TDRUFBnwBsUob LebYHmJCOydvyNv5AFkLmLZ7O4j2jFo1WPSMt3ThM6wRwqrnB4Gi+6onyrZfE1DnVZMqbxZ3 VXa+E4S5YwrfCLUErGEn+d40OtoRZmQXhRPVAsdjimMj9oFM9RoxSgUrDg6Ia3n0IrKFb++z HAFbqkR5g4qzXiOMEG621GYEex2sDEKz/PD4CVKlNI9eld4ToH592kAwzJmd+sAi+Rfos0NE zxuFd0ekAOeWoURo0zoYTSWPlMOmFMvcpH6LP3leJmY7x4z/b1ng/+7UnKonVALVPFbRbElO kIfAtLKcUEofwV1jr7DyYGPalJtiDJPomB041ZHCj2RxyXY/oQARAQABtDBWbGFkaW3DrXIg xIx1bsOhdCAod29yaykgPHZsYWRpbWlyLmN1bmF0QG5pYy5jej6JAlQEEwEIAD4CGyMFCQlm AYAFCwkIBwIGFQgJCgsCBBYCAwECHgECF4AWIQS2AGRgtgqA54IGJEnnR98flXWjqgUCWg3w 3gAKCRDnR98flXWjqmD6D/96U4cDZBrHQ5LhqybocZr/N2IS5Wr2SLLB4k2F5/W/wbL05gq6 Ha9/2TMqXoxRkhug+EAHFHxylPR43yN9rz0pjBXHrra87FAPHMqq/qqrOEUdhkytEqa6WIho aoEkdhaMhUyctjVjL2WZ0+MWeRjqedLQX+VCrOVPcVbLreRRhA9N3KPgNwbp9zCg6hEPi4l2 zZKedHkTNjKIAwJ0xZoMwFa1Y+vL8Em8Or+IBZuGBMP/ZMtasPOIQaT/Gvsyx1DDorwsoCdX 6zaTZy5DOWP3FIrMzus/YDbzwAYxSpWk/jF44ySbnJzdjU67EfG3UrsK+RRGw8aJqs3/4qHK ZMZZnNL+4wJpEdnZyFic/MXcw6FBszQEwrIOaM1WEfwzn2ExUYk2pM5zaBwq76OgrmGMzMEi cfMDyqLodwEQqR70PvRbkrh+R02LphwQ9c5AFXcrLjKMmeQlbQVarTUsrELcTK6rElC1ojS7 M37j0XzFE+kgNWn2fyBRgtnGDWEa7r+oDaueXJnEf0/4Ww28IwxakNc7r0N41GIBekwSxKdk epKFZgtVGGSDlFei5hb5LLWFljA1OS7CRVJKpbHafQjdPdb1vNqZAj4y2SJXvVVpI1KO5kq+ dFdYipORv0N2Iho6MNYbQUT1EBeU46G5N0viCoLS15/PxLhIAo+PzKpW97kCDQRYA5J2ARAA yHww3huLEtsdyqgjiGMhtEKOLmp7yFl450HY9oPcHS02U5BC1370ssNShrdOCi2ACDbe41Zx x85WcuaO1OVqung2umX047mj2xQsiTAFRDLZsQu8cQFoEy/DBL2bk7ThfK1Lh+NyZAs0UaPp DkGodS0De9osA+4T6Nf4POYaeavbYVFSdDKS4lUboBqApKnD/TzKFxFcpuFx6FN92lteTbOo jGMiLoZvELY86Kn9KuFZ8FM2ZSNHx1Z75KouufGrdkeCoZYVYiuzT+fnt2it4dIpIlnF+yxM t5LB/MSrmECB5CAFJtxzuMccm6yDUZQSWWi9vUgxIJwvt5w0CIBT353DGeP4WnH0r5YoBKoR bh7i4fT0lWvMXTG/V2lqyzBdClMebyHffMgba26Kj6oeDygDfC5aGsVaqw1Ue/qQ5QRqTJcJ V7xVLTtS1EamVqkfKwPS0zTfnrF1jQtnO/P4qkfgBRRG9BXGGrykHpXOyqmX6Z0wbV2P4j+p 02oSecDl5yVXplJfsXfbS/xXnaSkaN/7mCU29ul26cAVNxDkDPunztSFi9K9LM2T/XWYJQGX M71OpmONQJGF24lx7Wp/kobnHtbjGDzjDPC4eSL7MA56qtrWaLM+4ePKANct2q0q6c0uSLs0 Q2zochS64Mcg0YzL1sinWPN1rXLDk3lwpIsAEQEAAYkCJQQYAQgADwUCWAOSdgIbDAUJCWYB gAAKCRDnR98flXWjqn4yEACA0f1XBAg+WMaNPtIt0k15yFPfhdbOg9GhDcYGgvFIOxRuaFWw 9SLUt7OGuUnIpKxKRXtQJss98fHkijo70ONYWPuLhfRGK/wg9Ao6MuFw5G8m431CBS/awrie b6iPjvAARXJCPTTBZk/NC988jiKdCh8PbTCHDsl+gSDytP15QUrdqSfS2Wf4653ej7+jtuTj xZzmGgvNSi6JDlb9KNtmBQKQAgpnOQM46ItESmzHDnmdcvhPLUDsjwkpIJ6clasOzaObwxJi ba7iFPcGwcClCSwYjMNXFtneCGUnEAa5RBIx+i+LV1iqB3VRvTC6tMIUueoQ7cdTy6afNkhw QYXm4/pDmNT8UMdnzwnlTpFQ0CegDQRDWc+dIDDBHGEEEYBh2vTOE04KrmYUp1bQsNegPfvL woHib0jEvohPMJ2fJtZAd1SJElgwPbM8H7emKBiTsHwF8gL7G2jo7AoGpqYjqXkCRS0tSLTN r+qHh+7Ltrkbu/ZVTTfh4Q/qw3VaLYQh4C0tBma/YevQy1O2c3TZXXFz1QF8b9/Hj/3sq2Kg T1AcZ51E+xG+cb6cUqgkihmgm39xx24GPlNAdCRuq01+iILol+Wox6OwF6hmqx1EMSmxcmGo UREr0rkMnFVsWeAYeVoE4q689qxCPu9iCMJMJnkRe1o9oQYSN7my+S98gA== Message-ID: Date: Fri, 29 Mar 2019 19:15:59 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.1 MIME-Version: 1.0 In-Reply-To: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Content-Language: en-US X-Virus-Scanned: clamav-milter 0.99.2 at mail X-Virus-Status: Clean Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 18:16:08 -0000 On 3/29/19 12:13 PM, Adam Roach wrote: > Please review the remainder of BCP 79 and take appropriate action. You > may wish to consult with legal counsel in determining how to proceed. The mentioned patent belongs to Red Hat (according to the link), but I can't see any (current) employee of Red Hat in this WG's discussion, on a quick look, so there seems to be no obligation.  What perhaps applies is 5.1.3 (a): third-party IPR, so the information is accessible in the usual way. Well, correct me if I'm wrong, as I'm rather avoiding patents whenever I can (and I'm no lawyer). --Vladimir From nobody Fri Mar 29 11:31:04 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CAFE2120408 for ; Fri, 29 Mar 2019 11:31:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.002 X-Spam-Level: X-Spam-Status: No, score=-2.002 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=comcast.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7YAsFfK26dy1 for ; Fri, 29 Mar 2019 11:31:00 -0700 (PDT) Received: from copdcmhout01.cable.comcast.com (copdcmhout01.cable.comcast.com [162.150.44.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 28E7A120340 for ; Fri, 29 Mar 2019 11:31:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=comcast.com; s=20190220p; c=relaxed/simple; q=dns/txt; i=@comcast.com; t=1553884256; x=2417797856; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=EsobbngSzuFxFNwbFIGNMPpGvHKDZ5pCAJ1EwdO0qww=; b=wp/8yiN2j3j9UUjCEUEO5wEK812o8ohGf2uM1Gp393QkbTdmQcfWns1CAO6TlYCG FHIuBw5Hr9aZ+poUFtuAa/4yX86mQTT7PbZAhcLkuBgD6UV290f9c/2TicUl4lri ItrAg0FW09I95k4F5vFLHUAIMpdU3xeJ5uxN0kjOq0O+fR3TeVXRBs3Q0V6RwTTI ih+YDoCGlWZXwXyOkEg7TepeXH/sOeOOuUg0e2+pLjgmNddYd7QdA3A30Wmprqzq KQeD+Wc4XuPnub7qHwP7axlmDCFKfH3nfjcNYjHxOIoFEq/qNpdLmL95p9RBPCxg lOgPYPDYbNPBQ82Ehyu4/pos1zzCuKUWatE0d0l10g5Zzq4PKkkPbOWUwnziDEiI IINHLAWOsZe0M7O0IJgY/2bETvOXqp1BV+bIVRlTzw2uKrAmlJaixgxBztxc5P2l FjaU8Fd74RZYaBAX4u1rEsrmb6f17P9/I77jRSQiTOu8NeElvCFuPwkMVtT8x7AJ 9mbGKW7mCwDGtyJAbeP12H5JSyJH9s9Zv2aPQHagA05031T+pgHr5UtUu4ZlDb6c EGvL/JNnHendCyYWnWsxlKQ5SfXIhIbQvS7pSDGP/QJWgerxUxNkukz0395TfTl/ NFnkOsrve4ObXfbVdT9J5vT+wdXQZSte8wK3AwKGWD4=; X-AuditID: a2962c47-3475d9e000001275-9f-5c9e645f55e2 Received: from COPDCEXC37.cable.comcast.com (copdcmhoutvip.cable.comcast.com [96.114.156.147]) (using TLS with cipher AES256-SHA256 (256/256 bits)) (Client did not present a certificate) by copdcmhout01.cable.comcast.com (SMTP Gateway) with SMTP id 2A.1F.04725.F546E9C5; Fri, 29 Mar 2019 12:30:55 -0600 (MDT) Received: from COPDCEXC37.cable.comcast.com (147.191.125.136) by COPDCEXC37.cable.comcast.com (147.191.125.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 29 Mar 2019 14:30:56 -0400 Received: from COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94]) by COPDCEXC37.cable.comcast.com ([fe80::3aea:a7ff:fe36:8a94%15]) with mapi id 15.01.1713.004; Fri, 29 Mar 2019 14:30:56 -0400 From: "Livingood, Jason" To: Eric Rescorla , DoH WG Thread-Topic: [Doh] Mozilla's plans re: DoH Thread-Index: AQHU5H3+TKCHj3Ms1kiNknptws9ehaYjRe2A Date: Fri, 29 Mar 2019 18:30:56 +0000 Message-ID: <9E5DEDE1-14C1-48AA-B2EC-85A8CC20CBE7@cable.comcast.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.17.0.190309 x-originating-ip: [96.115.73.253] Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-CFilter-Loop: Forward X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprNKsWRmVeSWpSXmKPExsWSUDRnsm5CyrwYg+fyFtfuXmSzWPH6HLsD k8eSJT+ZPCY/bmMOYIpqYLQpyShKTSxxSU1LzStOteNSwAA2Salp+UWprolFOZVBqTmpidiV gVSmpOZklqUW6WM1Rh+rOQldTBkdz9+xFcxhr7iwpo+5gbGFvYuRk0NCwETi4t/5zF2MXBxC AruYJHpevWGEcFqYJP50zoPKnGaU+DX9LVgLm4CZxN2FV5hBbBEBc4lPU6czgtjCAloSP548 ZYOIa0u8OXaMHcI2kli7rh8sziKgKnFg2zEmEJtXwEXifuMnMFtIIEBi6YQ1YDM5BQIlbl08 AxZnFBCT+H5qDZjNLCAucevJfCaIswUkluw5zwxhi0q8fPyPFcQWFdCX2LjpKBtEXFFi34cV QDUcQL2aEut36UOMsZI4vPQ0I4StKDGl+yE7xDmCEidnPmGBaBWXOHxkB+sERolZSDbPQpg0 C8mkWUgmzUIyaQEj6ypGXkMzIz1DUwM9ExM9c8NNjMAks2iajvsOxg/nYw8xCnAwKvHw3g2Z FyPEmlhWXJl7iFGCg1lJhDfm89wYId6UxMqq1KL8+KLSnNTiQ4zSHCxK4rxe7+fECAmkJ5ak ZqemFqQWwWSZODilGhgta0JaPi627OZa93v9BIakiMubF1+rf39fIMfS99+5AKFpigmn9nwL W7NXgEdpm26Dz2pzlrRnzAXJ/3RP2BYE/z9aIrQ1rmCjssv2F59CYgvlHdLF/SO0j+n8O+hU aXmt5t7R31mnu4WuLnoVxJko9ON70iK7m3/nJ075cvC/cWXLYYnL894osRRnJBpqMRcVJwIA dWnwsC4DAAA= Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 18:31:02 -0000 PiBbMl0gTWFueSBuZXR3b3JrcyByZWRpcmVjdCBOWERPTUFJTiB0byBhIHNlYXJjaC9hZHZlcnRp c2luZyBwYWdlLg0KDQpbSkxdIFRoaXMgaXMgYSByZXBseSBvbiB0aGlzIHNvbWV3aGF0IG1pbm9y IHBvaW50IGJlY2F1c2UgTlhET01BSU4gd2FzIGFsc28gcmFpc2VkIGF0IHRoZSBzaWRlIG1lZXRp bmcuIEkgd29uZGVyIGlmIGZvbGtzIGhhdmUgbW9yZSBzcGVjaWZpYyByZWZlcmVuY2VzIHRvIG5l dHdvcmtzIHRoYXQgYXJlICpjdXJyZW50bHkqIGVuZ2FnZWQgaW4gTlhET01BSU4gcmVkaXJlY3Rp b24uIE15IHNlbnNlIGlzIHRoYXQgdGhpcyBwcmFjdGljZSB3YXMgbGFyZ2VseSBmYWxsZW4gYnkg dGhlIHdheXNpZGUgYXMgYSByZXN1bHQgb2YgYmVpbmcgb3ZlcnRha2VuIGJ5IHRoZSBicm93c2Vy LWJhc2VkIG9tbmlib3ggZnVuY3Rpb24gdGhhdCBsYXVuY2hlZCBzZXZlcmFsIHllYXJzIGFnbyBh bmQgdGhlIHJlc3VsdGluZyBjaGFuZ2UgaW4gdXNlciBiZWhhdmlvciB0byBqdXN0IHR5cGUgc2Vh cmNoIHRlcm1zIGludG8gdGhlIGFkZHJlc3MgYmFyIGFuZCB0aGVuIGNsaWNrIG9uIHNlYXJjaCBy ZXN1bHRzLiBJbiBhbnkgY2FzZSwgY3VyaW91cyB0byBrbm93IGlmIHRoZXJlJ3MgYSBsaXN0IG9m IElTUHMgY3VycmVudGx5IGRvaW5nIHRoaXMuDQoNCg0KDQoNCg0KDQoNCg0KDQo= From nobody Fri Mar 29 12:30:22 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6FB0120285 for ; Fri, 29 Mar 2019 12:30:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.979 X-Spam-Level: X-Spam-Status: No, score=-1.979 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j30Uftwwb0Hz for ; Fri, 29 Mar 2019 12:30:16 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 415E1120297 for ; Fri, 29 Mar 2019 12:30:16 -0700 (PDT) Received: from Orochi.local ([62.168.35.69]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2TJUAKQ022054 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 29 Mar 2019 14:30:13 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553887813; bh=vjRCVlifNR0QNczsG1ePr4Cjr3kSf7xLunRbTheY0MA=; h=Subject:To:Cc:References:From:Date:In-Reply-To; b=rgmKC3FwdrpzsHsqUANhukcP/neybGfucBzGDqJm72Mc+eGkU6DPw5bzhURseO0Be U8t+6g/GgaJkXbeOxEfDfsDIiQ4SUx5ehB1YLMVYn381MdGx/+DtxdTnzra5tlsOeD X4wXFMSoMP17iYlEg4jYWgpyD+dHAFLZgmvRsQZk= X-Authentication-Warning: raven.nostrum.com: Host [62.168.35.69] claimed to be Orochi.local To: Brian Dickson Cc: DoH WG References: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> From: Adam Roach Message-ID: Date: Fri, 29 Mar 2019 20:30:10 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------8290B242BABADDC47A1A159E" Content-Language: en-US Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 19:30:20 -0000 This is a multi-part message in MIME format. --------------8290B242BABADDC47A1A159E Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit On 3/29/19 17:49, Brian Dickson wrote: > Could you clarify, to whom were you addressing the message re: BCP 79? > (The possibilities seem to be, Petr, or the whole list, or maybe > implicitly any WG participants who are employed/sponsored by whoever > owns that patent?) The specific request was for Petr, although it's never a bad time for anyone to go refresh their memory about the contents of BCP 79. /a --------------8290B242BABADDC47A1A159E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit
On 3/29/19 17:49, Brian Dickson wrote:
Could you clarify, to whom were you addressing the message re: BCP 79?
(The possibilities seem to be, Petr, or the whole list, or maybe implicitly any WG participants who are employed/sponsored by whoever owns that patent?)


The specific request was for Petr, although it's never a bad time for anyone to go refresh their memory about the contents of BCP 79.

/a

--------------8290B242BABADDC47A1A159E-- From nobody Fri Mar 29 12:47:32 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8C6D4120391 for ; Fri, 29 Mar 2019 12:47:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wujoG3ercjKx for ; Fri, 29 Mar 2019 12:47:29 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 888FA12037B for ; Fri, 29 Mar 2019 12:47:29 -0700 (PDT) Received: from Orochi.local ([62.168.35.69]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2TJlPqk024936 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 29 Mar 2019 14:47:27 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553888849; bh=0fA/mzQvP0LVYIDcOPvhds2+U7V1G9zc3Q1DX9SHXVo=; h=Subject:To:References:From:Date:In-Reply-To; b=H0bYVR3z5EjOwnzJI6kaGhVVXeWlspHWRaOKY3KsUNfvNz4gi8Uma5ilvhbkKJHy8 LcCFy28+fWTFr28jTO6RKT8tXRz5xut/lYrNAicLm24Bz+LcbgWosyn3wYRjOBSG5P jeG2oMeXN/sBXg9aiXQuvxB/HFjrLwbTFnFTNX6o= X-Authentication-Warning: raven.nostrum.com: Host [62.168.35.69] claimed to be Orochi.local To: =?UTF-8?B?VmxhZGltw61yIMSMdW7DoXQ=?= , doh@ietf.org References: <92eb504b-42ff-fd35-b8d7-848d740736b9@nostrum.com> From: Adam Roach Message-ID: <33d597a4-f587-5c02-5464-77065cd7060e@nostrum.com> Date: Fri, 29 Mar 2019 20:47:24 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 19:47:31 -0000 I'm not in a position to know what specific obligations may apply, as I don't know anything about peoples' current or past employers, previous potential involvement, or a host of other subtle issues that might be relevant. This is why I directed Petr to BCP 79 rather than trying to parse out the details of his situation. The important issue is that any mention of specific patents must be done through the formal patent disclosure process rather than sending patent-related information to a mailing list or bringing it up as part of any other IETF contribution (such as during an IETF in-person session). /a On 3/29/19 19:15, Vladimír Čunát wrote: > On 3/29/19 12:13 PM, Adam Roach wrote: >> Please review the remainder of BCP 79 and take appropriate action. You >> may wish to consult with legal counsel in determining how to proceed. > The mentioned patent belongs to Red Hat (according to the link), but I > can't see any (current) employee of Red Hat in this WG's discussion, on > a quick look, so there seems to be no obligation.  What perhaps applies > is 5.1.3 (a): third-party IPR, so the information is accessible in the > usual way. > > Well, correct me if I'm wrong, as I'm rather avoiding patents whenever I > can (and I'm no lawyer). > > --Vladimir > > _______________________________________________ > Doh mailing list > Doh@ietf.org > https://www.ietf.org/mailman/listinfo/doh From nobody Fri Mar 29 13:02:31 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 183B812032A for ; Fri, 29 Mar 2019 13:02:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.679 X-Spam-Level: X-Spam-Status: No, score=-1.679 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_INVALID=0.1, DKIM_SIGNED=0.1, T_SPF_HELO_PERMERROR=0.01, T_SPF_PERMERROR=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=fail (1024-bit key) reason="fail (message has been altered)" header.d=nostrum.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4O3qojXM_vQJ for ; Fri, 29 Mar 2019 13:02:28 -0700 (PDT) Received: from nostrum.com (raven-v6.nostrum.com [IPv6:2001:470:d:1130::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2153A120327 for ; Fri, 29 Mar 2019 13:02:27 -0700 (PDT) Received: from Orochi.local ([62.168.35.69]) (authenticated bits=0) by nostrum.com (8.15.2/8.15.2) with ESMTPSA id x2TK2JeL027394 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128 verify=NO); Fri, 29 Mar 2019 15:02:22 -0500 (CDT) (envelope-from adam@nostrum.com) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nostrum.com; s=default; t=1553889743; bh=FhYWDktojLbf52iYE/Jxbp0/xbOue3xgpOtercRqx58=; h=Subject:To:References:From:Date:In-Reply-To; b=Car98IluFmSL506gpBkyW0/Ssg/VO/GhOP9rxmIqnVcbFYQlNxhWJgM3FIg1HLXgH UAiWWLt1delAaj3XWYNNZ+BwHcHAODqG6iw2+spkKBswP+kHt2iBoyRtm8VUraQ3j3 HwIVUmIyEps4lH0KiaBk8q0gsWH84a1qIjEKPBdo= X-Authentication-Warning: raven.nostrum.com: Host [62.168.35.69] claimed to be Orochi.local To: "Livingood, Jason" , Eric Rescorla , DoH WG References: <9E5DEDE1-14C1-48AA-B2EC-85A8CC20CBE7@cable.comcast.com> From: Adam Roach Message-ID: <9ce6777e-5957-c5a9-78d2-977c446dd67f@nostrum.com> Date: Fri, 29 Mar 2019 21:02:19 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <9E5DEDE1-14C1-48AA-B2EC-85A8CC20CBE7@cable.comcast.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US Archived-At: Subject: Re: [Doh] Mozilla's plans re: DoH X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Mar 2019 20:02:30 -0000 On 3/29/19 19:30, Livingood, Jason wrote: >> [2] Many networks redirect NXDOMAIN to a search/advertising page. > [JL] This is a reply on this somewhat minor point because NXDOMAIN was also raised at the side meeting. I wonder if folks have more specific references to networks that are *currently* engaged in NXDOMAIN redirection. I can get you the specific IP addresses returned once I'm back home, but I know with absolute certainty that AT&T (Uverse) and T-Mobile both perform such interception. I'm *pretty* certain that Spectrum does as well, although I'll have to double-check this to be 100% sure. I see evidence that Verizon does so as well, at least based on https://www.verizon.com/support/residential/internet/home-network/settings/opt-out-of-dns-assist I see that Comcast turned its DNS hijacking off back in 2012. I fear this makes Comcast fairly unique within the US. /a From nobody Sat Mar 30 05:48:36 2019 Return-Path: X-Original-To: doh@ietfa.amsl.com Delivered-To: doh@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D26B1201A4 for ; Sat, 30 Mar 2019 05:48:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=lowentropy.net header.b=UxTBQ1aV; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=7Og57Fnm Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lKIh9Sx1u_uB for ; Sat, 30 Mar 2019 05:48:32 -0700 (PDT) Received: from out4-smtp.messagingengine.com (out4-smtp.messagingengine.com [66.111.4.28]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5B69D1201A3 for ; Sat, 30 Mar 2019 05:48:32 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 7814921ADD for ; Sat, 30 Mar 2019 08:48:31 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute1.internal (MEProxy); Sat, 30 Mar 2019 08:48:31 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=lowentropy.net; h=mime-version:message-id:in-reply-to:references:date:from:to :subject:content-type; s=fm1; bh=HFyP7GOsN0Dptm0CCNy0bHTm5It+9FB oM0zPDNS+Mqg=; b=UxTBQ1aVwOGmzrzQpwlpmlxyT8KWoJRzGd391466dVgzkJ0 gwkJd6UeM1r0u4EdSejgWLXoc01fn4ZAGE35xtd3s3C868mOwq35760u8hrHcxah EaHEvjJZLovax6syiVNd06+55FdijNywjLg504QA6yHjGkkysGiilknUBaFaw919 4DmC6SdqSWmKnVmPjoizMDic4+ZcPzBMg3hJz5fS/JrswX04d50i79ZhZgtAmkzv QUbaVdUqoL9hOQcQ4Mm/exHGrEPiGKF8byvgujBym+zmtcW4jVzWlovP/ChRcKp1 nihYcz0nZ8eScmtFwDR1WMTaNAZiNJlNbk2MiHQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=HFyP7G OsN0Dptm0CCNy0bHTm5It+9FBoM0zPDNS+Mqg=; b=7Og57FnmVigMld9yygJ0J5 PyQFuSeiyWa02V362VFuMOz91uogTmmj4B77biM3AEQuyErjyK+S8lweXAouDUDv Hx4Q2GcAGfT3nKMb7Tn/3CwYPPHWzB2TTaYbtjrpTV8+7EYP4NFC3ueYqsFIv1v1 MpFsSI/UayuwpTf1NAKV437380cTrRv0yRLcr2Fk6s3PhKcmATbPeNAP5E2i0O33 SgP/i74qkC+ilTs+bNtw3KBgs/jH3zUitvz7vDtU9rVpQiJXtrCB2Jp6qK8ooEO7 ad97RYzc8qXWdFFLdzyGvNuQ/dzizNCMgjGRNDbyE6eH/rZ1IsmFQTVU3zD1NamA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrkeelgdegiecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfghnecu uegrihhlohhuthemuceftddtnecunecujfgurhepofgfggfkjghffffhvffutgesthdtre dtreerjeenucfhrhhomhepfdforghrthhinhcuvfhhohhmshhonhdfuceomhhtsehlohif vghnthhrohhphidrnhgvtheqnecurfgrrhgrmhepmhgrihhlfhhrohhmpehmtheslhhofi gvnhhtrhhophihrdhnvghtnecuvehluhhsthgvrhfuihiivgeptd X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id 0A64B7C1B7; Sat, 30 Mar 2019 08:48:31 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.1.6-329-gf4aae99-fmstable-20190329v1 Mime-Version: 1.0 X-Me-Personality: 92534000 Message-Id: <6121981d-9827-483d-92db-14bd8e39c05e@www.fastmail.com> In-Reply-To: <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> References: <155341529409.18062.10657099011172813446@ietfa.amsl.com> <20190325110136.GA23793@laperouse.bortzmeyer.org> <08BD5718-CD1F-47B3-A4FB-4040F8E9FC4B@icann.org> Date: Sat, 30 Mar 2019 08:48:32 -0400 From: "Martin Thomson" To: doh@ietf.org Content-Type: text/plain Archived-At: Subject: Re: [Doh] =?utf-8?q?Authentication_in_draft-ietf-doh-resolver-associ?= =?utf-8?q?ated-doh-03=2Etxt?= X-BeenThere: doh@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DNS Over HTTPS List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Mar 2019 12:48:34 -0000 On Mon, Mar 25, 2019, at 12:37, Paul Hoffman wrote: > The reason I didn't drop down to http: is that doing so evokes the > response, even though you are quite correct that the other two > methods given in this document do not offer any authentication. There is a different reason that I think is stronger. We tolerate an exposure on DHCP and other network-layer configuration options (like the v6 RA). The security implications of those mechanisms are well understood and it is common for networks to deploy systems that limit the opportunity for attacks. Things like filtering broadcast and RA from end hosts are common. But the connection to a resolver might be harder to secure in this fashion. Though it might be possible to narrow the use of unicast port 53 (or 853), such filtering is different. It is not always the case that the resolver is local in the same way that a DHCP server/relay or gateway is. For DoH, which might use a service that is completely external to the network, this is more difficult. Therefore, it is easier to look at this step of the configuration process as being subject to "untrusted" activity and insist on authentication. It's certainly true that the only basis for authentication is the assertion by the network discovery phase, for which you have no prior expectations. However, the property we are looking for is that we are talking to the same server that the network intended for us to talk to. Thus, if the name of the server comes from the same mechanism that gave us an IP address (DHCP), or the system that provides connectivity (RA), then we at least have that much. If your goal is to talk to the resolver provided by the network, then I believe that to be sufficient. Hence I would propose a different design for this, bringing DoT into the design. 1. The first step requires no new protocol mechanisms. To discover DoT, connect to the resolver IP at port 853. If the server produces a certificate that is valid for the IP address of the resolver, then you are good to proceed. No new mechanism is required. (Clients may decide to accept any certificate here if they require opportunistic security, but I would suggest that this is unwise for the aforementioned reasons. That said, it's better than using Do53, so I'd say it's still worth doing except for the fact that this establishes an expectation on the part of DoT resolvers that having a valid certificate is not required, which is dangerous.) 2. We add a field to DHCP and RA that carries the "DoT resolver". When this is present, the client resolves this name using the resolver. This resolution is unsecured. The client then connects to the resulting IP address and validates the certificate it presents using this name. This enables easier deployment of DoT because a certificate for a name is easier to get than an IP certificate (it also enables use of 1918 address and the like). 3. We add another field to DHCP and RA that carries the "DoH resolver". When this is present, the client resolves the associated name using the unsecured resolver. The client then connects to this endpoint, validates the certificate and proceeds to use DoH. We could decide not to do the DoT step, but I wanted to include it to illustrate the symmetry of the design. You will observe that this is significantly simpler than the proposed design. There are several drawbacks, that I will address: A. A client in a residential network will not receive this option unless their gateway/relay is configured to relay these values from external network. The design proposed in the current draft has this property in that the SUDN is forwarded by resolvers that don't understand its purpose. In this case, endpoints will talk to the DNS proxy in their gateway and not be able to discover a DoH service provided by an ISP. RFC 5625 points out that it is not generally possible to talk to the external resolver. B. This doesn't provide any option for web clients to find the local resolver. I will separately argue that this is not a valid use case, and moreover that it is one that presents some privacy challenges for clients and networks. It should not be possible for a web site to be able to use a client's position in the network to access information that it would not otherwise be able to access itself. Allowing requests to a local resolver might allow access to that sort of information. Sites are better suited to making requests of configured resolvers. With DoH, they can make those requests from the client, meaning that the answers will be more suitable for the client's position in the network than their own. Though this requires that the configured resolver has nodes that are deployed near the client, I believe this to be sufficient. I think that problem A is pretty significant. The SUDN option does help there, but it eliminates the weak "authentication" we have. For anything in this area to work, I think that we would need some other basis for deciding that the DoH server that is identified in this way is OK. The only idea that I have, which is a poor one, is to configure clients with a list of "trusted" resolvers. I don't like maintaining these sorts of lists, but it might be the only way to manage it. No matter what option we choose here, I would prefer that we look at the DHCP/RA steps first.