From nobody Tue Aug 11 08:44:10 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E105F3A1110 for ; Tue, 11 Aug 2020 08:44:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.99 X-Spam-Level: X-Spam-Status: No, score=-1.99 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_MSPIKE_H2=-0.001, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=microsoft.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YOkjSk9rfY1X for ; Tue, 11 Aug 2020 08:44:06 -0700 (PDT) Received: from NAM06-BL2-obe.outbound.protection.outlook.com (mail-eopbgr650123.outbound.protection.outlook.com [40.107.65.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9654B3A110D for ; Tue, 11 Aug 2020 08:44:06 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=WKFVXYC4M2KqzfLkuF5D3zAr1LYhRaXvHsKnWtHEDeyrorEkr5ZdMGTiF5dtIw8+bdrHJiym2pzyr5HRgBxWpWRPl8JpYkEnQ+Cto3Ku+eNNZdybK0+kB7bJEY3IRvSCN5WPl7HXCUuf6CvAmAmQSG3vZLk8xIFFVs3EvRToX4MpvXhcQbcy/GG4J/E+J+OgeIP5icV7MwWfZY2OUC2M/E/VmoxEFc+t1fSGSp7dD+Tynl84/eta4X9A5xWbTFoKMjARLkz4rymzMlv4VSoMvQINRDye3baUsfFr0z+d+XsjXA4c+bLP+N7aTSb2THR2ocYHAaHhsyRdtVn4i2N9Fw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fbPeXZLVT7ZYTQvG0NhIgtJj9hNRLTy2MhJ28PxGN6Q=; b=cjW2IQQmOcMB6eUbZSg2iLhJ5iU3gWHeZhpUUZNqCqxnvh4Z4omux5M08wnbtVCgfaofjX0DBMrP7wSAchIgWFlSX0jKcdfXAbV3cDshmOmSWWpUt6REx9fai6yvW2JuUuLpIZejnoIUrHhMeLej/D3nGkGOvgDECtCtbKDEvhxgT7FjdsKPB+e4HYu7x1FUxteeTg3hTVfDGc8OHJewPogF1jIEjq91QCcU1wsWoa7lssiiqIosIhpKKyDzMP/3aqldqlOumf4oYFoN719N0gHrwSSgcJckJOSQzi4XHy6L4L0Tbw4TQ/8aNbhBMTlKdDKKFLzMjKwZakvgTgM1fQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=fbPeXZLVT7ZYTQvG0NhIgtJj9hNRLTy2MhJ28PxGN6Q=; b=ZSXXLC91AzS+p/0Id0Su9lRzMub2cwLT1uYYE16EJ+oYMG5mH2NSuu+MtGNufz9zC1S/UyoGL4Zsbp26kT4rLtTdU0Oip0i4NsSLyZMRthqetOmvMIxSL1bw1ZLb47JI8q4psnxbuqi6YBo+Ig86YgwZaCJKNvHpZYVPag/nt9M= Received: from MN2PR00MB0893.namprd00.prod.outlook.com (2603:10b6:208:fd::15) by BL0PR00MB0769.namprd00.prod.outlook.com (2603:10b6:208:1c4::22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3321.0; Tue, 11 Aug 2020 15:44:04 +0000 Received: from MN2PR00MB0893.namprd00.prod.outlook.com ([fe80::d51b:b73f:f1be:eba3]) by MN2PR00MB0893.namprd00.prod.outlook.com ([fe80::d51b:b73f:f1be:eba3%4]) with mapi id 15.20.3321.000; Tue, 11 Aug 2020 15:44:04 +0000 From: Tim Cappalli To: Phil Hunt , Atul Tulshibagwale CC: ID Events Mailing List , Dick Hardt Thread-Topic: [Id-event] Subject Categories in Subject Identifiers Thread-Index: AQHWWTAqoif/LYUQT0uaDTnz4y2rg6kF01WAgAAn+YCAABLXgIAtKrkB Date: Tue, 11 Aug 2020 15:44:04 +0000 Message-ID: References: , <5C854271-BC02-47EE-814C-D8270681BF33@independentid.com> In-Reply-To: <5C854271-BC02-47EE-814C-D8270681BF33@independentid.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-08-11T15:44:02.865Z; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Name=General; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0; MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Standard; authentication-results: independentid.com; dkim=none (message not signed) header.d=none;independentid.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [100.0.202.188] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: 03d6c543-da1b-4742-0c0a-08d83e0d604e x-ms-traffictypediagnostic: BL0PR00MB0769: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: px0/8Qsv28mMp70bEmYWTCCLXwiRyTlk/MgLGbgtVvknKYFyB9m1lwjwX/vd7bHE3hw2o4yw+EhvxF5E3clf2ifGFy4u6o1RNYcjD1DaXrRkwHJACdRUUiC9PhmYWNg4OutAfoMrOlEgi2HqshmUTz5y8YIsQKkfY+XBlUfMCtCX5CgTKDpWmK+MYLKbIQ+MUE/v0SfLI4pMkRgb5Ml46u+EVLmBNp8TD0E8PjhYXAcmPDo1Li4hL8AGZozZhNfZ14wGktvmOFF6X412lyhEfaQKDSNlfB9fQtEa2nO/3/7jOBkNVTd+7tlC0+y7GOiTjK4/dCelzHGDCvsKJpZRPSzgY+GNV8zJr6bfZk9Pz6yRJfjBeUfmvDADV11R0kU790dnd7FnDngA8czKPcNX5fX3hNj5j0FqMsCyklLAcKsLHGBj3cBbZ3NOhoYi9pQBqbAKSDBpk44k8dNTuM3jFg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MN2PR00MB0893.namprd00.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(39860400002)(136003)(366004)(376002)(346002)(396003)(8936002)(82950400001)(82960400001)(8676002)(71200400001)(6506007)(186003)(52536014)(26005)(478600001)(7696005)(10290500003)(86362001)(966005)(83380400001)(8990500004)(5660300002)(55016002)(9686003)(33656002)(54906003)(2906002)(316002)(110136005)(19627405001)(66446008)(64756008)(66556008)(66476007)(4326008)(76116006)(166002)(53546011)(66946007)(99710200001); DIR:OUT; SFP:1102; x-ms-exchange-antispam-messagedata: lUzXDui+/f4QHmTYGN0y3TyR7mcTCbB0yyR4iOg2Cs+rcHhO2Hg0hDBpyMbeJPz6AbNllbjIZ/qfgeetDIc4i7wgAZas4zh4Ydu+u+fcSSuXoH8EOIIQZrk1SFOBH5LBxV7Y7wyBqc8Y/n8hRo7B27SCjXBBBSMy6Ll70lqr6FulPCbjhTFTdF1KYT6UeoXDdC3lTfdYQrLv96IUHSY82UCf5c3+YrWfvOJZlrLAu/Vra8HnzbPNh4oW1NOim2ITBHGqPuVPfl7KhaFjfXH/mYX/GS2BJTMLdPrCl1fDELH2yiDxz6ts8uSICDdUola02EHX7XzMkdtABlOXBRXG8hSylt+CPoKLMb2Iv1aNW08c+Oy8vyBYVGJzHc9Ing4CQX6EZxpravYkU5Yyyhz8UZ6F/0oPQFOtFPCb89hIdP1CV/KOU+nFf+BTD+HQqmoRBnCGARkuf7Ld0tVfsttAqkuel/r62RG04wnkh+L/RFM6zfkrj603P9+E7u1ftxyiUHppp93OceK+ItNF5btI5odpGjmWuatT03+qMYgxul3svzXTD23qCu/lISFklESDOUG2d0TIiybyOpETVH/b5g== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MN2PR00MB0893B4D1347E71A7B18AFD8095451MN2PR00MB0893namp_" MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN2PR00MB0893.namprd00.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 03d6c543-da1b-4742-0c0a-08d83e0d604e X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Aug 2020 15:44:04.3210 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: 9u69jNePD3tOX4zIRsxTkDRrr0qZ1LBW7hwhYz0gT8zQ/Ed85yYa77HZKG+xKxl6uzl7JQEZcMidJoiD8DHl1Q== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL0PR00MB0769 Archived-At: Subject: Re: [Id-event] Subject Categories in Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 15:44:09 -0000 --_000_MN2PR00MB0893B4D1347E71A7B18AFD8095451MN2PR00MB0893namp_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGV5IFBoaWwsIHNvcnJ5IGZvciB0aGUgZGVsYXkgb24gdGhpcy4gV2UndmUgYmVlbiBkaXNjdXNz aW5nIHRoaXMgaW4gdGhlIE9wZW5JRCBTU0UgZ3JvdXAgYXMgd2VsbC4NCg0KV2UgaGF2ZSBjb25j ZXJucyBhYm91dCByZWNlaXZlcnMvUlBzIGluIENBRVAvUklTQyBuZWVkaW5nIHRvIHVuZGVyc3Rh bmQgd2hhdCBhcmUgZXNzZW50aWFsbHkgaWRlbnRpY2FsIGV2ZW50IHR5cGVzIGp1c3QgdG8gZGVs aW5lYXRlIGEgdXNlciB2cyBhIGRldmljZSBzdWJqZWN0IChhcyBhbiBleGFtcGxlKS4gVGhlcmUg YXJlIGFsc28gc2NhbGFiaWxpdHkgY29uY2VybnMgd2l0aCBoYXZpbmcgdG8gc2VuZCBtdWx0aXBs ZSBldmVudHMgdG8gY29udmVyeSB0aGlzIGluZm9ybWF0aW9uLiBUaGUgc2NhbGUgd2UncmUgdGFs a2luZyBhYm91dCBoZXJlIGlzIGh1bmRyZWRzIG9mIG1pbGxpb25zIG9mICJzdWJqZWN0cyIgKHVz ZXJzLCBkZXZpY2VzLCBzZXNzaW9ucywgYXBwbGljYXRpb25zLCB3b3JrbG9hZHMpLg0KDQpGb3Ig YSBiYXNpYyByZXZvY2F0aW9uIHVzZSBjYXNlLCBpZiB3ZSBkb24ndCBoYXZlIHRoZSBhYmlsaXR5 IHRvIGluY2x1ZGUgbXVsdGlwbGUgc3ViamVjdHMgYW5kIGluY2x1ZGUgYSBzdWJqZWN0IGNhdGVn b3J5LCBpbnN0ZWFkIG9mIGFuIFJQL3JlY2VpdmVyIG5lZWRpbmcgdG8ga25vdyBhYm91dCBhIHNp bmdsZSBldmVudCB0eXBlIG9mICJhbGwtc2Vzc2lvbnMtcmV2b2tlZCIsIHdlIG5vdyBuZWVkIGEg bWluaW11bSBvZiA0IGV2ZW50IHR5cGVzIChkZXZpY2Utc2Vzc2lvbi1yZXZva2VkLCB1c2VyLXNl c3Npb24tcmV2b2tlZCwgc2Vzc2lvbi1yZXZva2VkLCBhbGwtc2Vzc2lvbnMtcmV2b2tlZCkuIFRo aXMgZ3Jvd3MgZXhwb25lbnRpYWxseSB3aXRoIG5ldyBldmVudCB0eXBlcyBhbmQgbWFrZXMgaXQg ZGlmZmljdWx0IHRvIG1haW50YWluIGluIGxhcmdlIHNjYWxlIGVudmlyb25tZW50cyB3aXRoIHRo b3VzYW5kcyBvZiBSUHMvcmVjZWl2ZXJzLg0KDQoNCldlIGhhZCBkaXNjdXNzZWQgcG90ZW50aWFs bHkgdXNpbmcgdGhlIHN1YmplY3RfYWxpYXMgb3B0aW9uLCBidXQgd2UgY2FuJ3QgZHVlIHRvIHRo ZSB1c2VyIGFuZCBkZXZpY2Ugbm90IGJlaW5nIHRoZSBzYW1lICJlbnRpdHkiLg0KMy41ID4gIkVh Y2ggU3ViamVjdCBJZGVudGlmaWVyIGluIHRoZSBhcnJheSBNVVNUIGlkZW50aWZ5IHRoZSBzYW1l IGVudGl0eS4iDQoNCkhlcmUncyBhbiBleGFtcGxlIG9mIHdoYXQgd2UncmUgdHJ5aW5nIHRvIHNp Z25hbDoNCg0Kew0KICAiaXNzIjogImh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzJkMWFlMTg5LTNk ODUtNDRjZi04NDM3LTI2ZmJhNDI0ZmVhZi8iLA0KICAianRpIjogIjc1NkU2OTcxNzU2NTIwNjk2 NDY1NkU3NDY5NjY2OTY1NzIiLA0KICAiaWF0IjogMTU5NzE1ODIzOSwNCiAgImF1ZCI6ICJodHRw czovL291dGxvb2sub2ZmaWNlMzY1LmNvbS8iLA0KICAiZXZlbnRzIjogew0KICAgICJodHRwczov L3NjaGVtYXMub3BlbmlkLm5ldC9zZWNldmVudC9jYWVwL2V2ZW50LXR5cGUvYWxsLXNlc3Npb25z LXJldm9rZWQiOiB7DQogICAgICAic3ViamVjdCI6IFsNCiAgICAgICAgew0KICAgICAgICAgICJz dWJqZWN0X3R5cGUiOiAiZW1haWwiLA0KICAgICAgICAgICJlbWFpbCI6ICJ0aW1AbWljcm9zb2Z0 LmNvbSIsDQogICAgICAgICAgInN1YmplY3RfY2F0ZWdvcnkiOiAidXNlciINCiAgICAgICAgfSwN CiAgICAgICAgew0KICAgICAgICAgICJzdWJqZWN0X3R5cGUiOiAiaXNzLXN1YiIsDQogICAgICAg ICAgImlzcyI6ICJodHRwczovL3N0cy53aW5kb3dzLm5ldC8yZDFhZTE4OS0zZDg1LTQ0Y2YtODQz Ny0yNmZiYTQyNGZlYWYvIiwNCiAgICAgICAgICAic3ViIjogIjQwNGVhNjhiLThiODItNGU4Yy04 NzZlLWU5MzY5OTUyMzhhMyIsDQogICAgICAgICAgInN1YmplY3RfY2F0ZWdvcnkiOiAiZGV2aWNl Ig0KICAgICAgICB9LA0KICAgICAgICB7DQogICAgICAgICAgInN1YmplY3RfdHlwZSI6ICJpc3Mt c3ViIiwNCiAgICAgICAgICAiaXNzIjogImh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzJkMWFlMTg5 LTNkODUtNDRjZi04NDM3LTI2ZmJhNDI0ZmVhZi8iLA0KICAgICAgICAgICJzdWIiOiAiMDdiZGQ4 ZGYtM2JjZC00NTYyLTlmZmMtNWUzNTVmN2U4YmExIiwNCiAgICAgICAgICAic3ViamVjdF9jYXRl Z29yeSI6ICJkZXZpY2UiDQogICAgICAgIH0sDQogICAgICAgIHsNCiAgICAgICAgICAic3ViamVj dF90eXBlIjogImlzcy1zdWIiLA0KICAgICAgICAgICJpc3MiOiAiaHR0cHM6Ly9zdHMud2luZG93 cy5uZXQvMmQxYWUxODktM2Q4NS00NGNmLTg0MzctMjZmYmE0MjRmZWFmLyIsDQogICAgICAgICAg InN1YiI6ICI1NzNkOWMxYy1iNGUwLTRjYWMtODkyNy02ZDQzNjkxZmE4OTgiLA0KICAgICAgICAg ICJzdWJqZWN0X2NhdGVnb3J5IjogInVzZXIiDQogICAgICAgIH0NCiAgICAgIF0NCiAgICB9DQog IH0NCn0NCg0KDQoNClByb3Bvc2FsOg0KDQpBZGQgYSBzdWJqZWN0IGNhdGVnb3J5IHdpdGggdGhl IGZvbGxvd2luZyBkZWZpbmVkIG9wdGlvbnM6DQoNCiAgKiAgIHVzZXINCiAgKiAgIGRldmljZQ0K ICAqICAgc2Vzc2lvbg0KICAqICAgYXBwbGljYXRpb24NCiAgKiAgIHdvcmtsb2FkDQoNCklmIG11 bHRpcGxlIHN1YmplY3RzIGFyZSBwcmVzZW50LCBpdCBpcyBleHBlY3RlZCB0aGF0IHRoZSBldmVu dCBhcHBsaWVzIHRvIGFsbCBvZiB0aGUgc3ViamVjdHMgdG8gdGhlIGV4dGVudCB0aGF0IGl0IG1h a2VzIHNlbnNlIHRvIHRoZSBldmVudCB0eXBlLg0KDQoNCk9wZW4gcXVlc3Rpb24gYW5kIGRpc2N1 c3Npb24gaXRlbXM6DQoNCjEpIENhbiAic3ViamVjdCIgYmUgYW4gYXJyYXkgb2YgbXVsdGlwbGUg c3ViamVjdHMgdGhhdCBhcmUgbm90IHRoZSBzYW1lIGVudGl0eT8NCg0KMWEpIElmIHNvLCBob3cg c2hvdWxkIGFsaWFzIGJlIGNvbWJpbmVkIHdpdGggbXVsdGlwbGUgc3ViamVjdHM/IEluIHRoZSBl eGFtcGxlIGFib3ZlLCBib3RoIHVzZXIgc3ViamVjdHMgd291bGQgYmUgYWxpYXNlcyBvZiBlYWNo IG90aGVyLg0KDQoyKSBJZiBubyBjYXRlZ29yeSBpcyBwcm92aWRlZCwgd2hhdCBzaG91bGQgYmUg dGhlIGRlZmF1bHQ/DQoNCnRpbQ0KDQoNCg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X18NCkZyb206IElkLWV2ZW50IDxpZC1ldmVudC1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYg b2YgUGhpbCBIdW50IDxwaGlsLmh1bnRAaW5kZXBlbmRlbnRpZC5jb20+DQpTZW50OiBNb25kYXks IEp1bHkgMTMsIDIwMjAgMTc6NTUNClRvOiBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGk9 NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPg0KQ2M6IElEIEV2ZW50cyBNYWlsaW5nIExpc3Qg PGlkLWV2ZW50QGlldGYub3JnPjsgRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFpbC5jb20+DQpT dWJqZWN0OiBSZTogW0lkLWV2ZW50XSBTdWJqZWN0IENhdGVnb3JpZXMgaW4gU3ViamVjdCBJZGVu dGlmaWVycw0KDQpXaHkgaXMgdGhlIGNhdGVnb3J5IG5vdCBwYXJ0IG9mIHRoZSBldmVudHVyaSAv IGV2ZW50IGRlZmluaXRpb24/ICBXaHkgaGF2ZSBvbmUgZXZlbnQgdGhhdCBhcHBsaWVzIHRvIGEg c2Vzc2lvbiwgYSBkZXZpY2UsIGEgcGVyc29uLCBhbmQgYW4gYWNjb3VudCBhdCB0aGUgc2FtZSB0 aW1lIGFzIG9wcG9zZWQgdG8gNCBkaWZmZXJlbnQgZXZlbnQgdXJpcz8NCg0KSXQgZmVlbHMgbGlr ZSB5b3UgbWF5IGJlIHRyeWluZyBkZWZpbmUgYSAgY29tYmluZWQsIG11bHRpLXB1cnBvc2UgZXZl bnQgdG8gY292ZXIgbWFueSBhY3R1YWwgZXZlbnRzLiBJcyB0aGF0IHRoZSBnb2FsPw0KDQpNeSBl eHBlY3RhdGlvbiBmb3IgZGVmaW5pbmcgU0VUcyBhbmQgZXZlbnR1cmlzIHdhcyB0aGF0IHRoZSBl dmVudHVyaSBjb252ZXlzIDkwJSBvZiB0aGUgaW5mb3JtYXRpb24gY29udGVudCBvZiBhIFNFVC4g VGhlIHN1YmplY3QgaWRlbnRpZmllciBpbmRpY2F0ZXMgd2hvIG9yIHdoYXQgdGhlIGV2ZW50IGlz IGFib3V0IGFuZCB0aGUgb2NjYXNpb25hbCB1c2Ugb2YgcGF5bG9hZCBjbGFpbXMgdG8gcHJvdmlk ZSDigJx1c2VmdWzigJ0gYWRkaXRpb25hbCBpbmZvcm1hdGlvbiAobGlrZSBhIGNvdW50ZXIpLiAg RS5nLiBpZiB5b3Ugd2FudCB0byBjb252ZXkgaG93IG1hbnkgYWNjb3VudCByZXNldHMgYW5kIG5v dCBqdXN0IHRoZSBmYWN0IHRoZSBhY2NvdW50IHdhcyByZXNldC4gSXQgbWFrZXMgc2Vuc2UgdG8g cmUtdXNlIHRoZSBzYW1lIFVSSSBldmVuIHRob3VnaCB0aGUgYWN0aW9ucyB0YWtlbiBvbiB0aGUg M3JkIHJlc2V0IG1pZ2h0IGJlIGRpZmZlcmVudCB0aGVuIG9uIHRoZSBmaXJzdC4NCg0KSU1PLCBh IHdpZGUgbnVtYmVyIG9mIGV2ZW50IHVyaXMgcGFpcmVkIHdpdGggbGlnaHR3ZWlnaHQgU0VUcyBt ZWFucyBwb2xpY3kgc3lzdGVtcyBhbmQgU0VUIHJvdXRlcnMgY2FuIG1ha2UgcXVpY2sgZGVjaXNp b25zIG9uIHdoZXJlIGFuZCBob3cgdG8gYWN0IHVwb24gYW4gZXZlbnQgZm9yIGEgcGFydGljdWxh ciBzdWJqZWN0Lg0KDQpQaGlsbGlwIEh1bnQNCnBoaWwuaHVudEBpbmRlcGVuZGVudGlkLmNvbTxt YWlsdG86cGhpbC5odW50QGluZGVwZW5kZW50aWQuY29tPg0KDQoNCg0KT24gSnVsIDEzLCAyMDIw LCBhdCAxOjQ3IFBNLCBBdHVsIFR1bHNoaWJhZ3dhbGUgPGF0dWx0dWxzaGk9NDBnb29nbGUuY29t QGRtYXJjLmlldGYub3JnPG1haWx0bzphdHVsdHVsc2hpPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRm Lm9yZz4+IHdyb3RlOg0KDQpUbyBhZGRyZXNzIE1pa2UncyBwb2ludCBJJ20gY2xhcmlmeWluZyB0 aGUgcHJvcG9zYWwgc3ludGF4IGhlcmUuDQoNCkknbSBwcm9wb3NpbmcgdGhhdCB3ZSBhZGQgYSAi Y2F0ZWdvcmllcyIgY2xhaW0gdG8gc3ViamVjdCBpZGVudGlmaWVycywgcmVnYXJkbGVzcyBvZiB0 aGUgc3ViamVjdC1pZGVudGlmaWVyIHR5cGUgKGkuZS4gYSBjb21tb24gY2xhaW0pLCB3aXRoIHRo ZSBmb2xsb3dpbmcgdGV4dDoNClN1YmplY3QgQ2F0ZWdvcmllcw0KDQogICBTdWJqZWN0cyBtYXkg YmUgY2F0ZWdvcml6ZWQgYXMgdXNlcnMsIGRldmljZXMgb3Igc2Vzc2lvbnMuICBUbw0KICAgc3Bl Y2lmeSB0aGUgY2F0ZWdvcnkgb2YgYSBzdWJqZWN0LCBhICJjYXRlZ29yeSIgY2xhaW0gTUFZIGJl DQogICBpbmNsdWRlZC4gIElmIHByZXNlbnQsIHRoZSBjbGFpbSBNVVNUIGhhdmUgYSB2YWx1ZSB0 aGF0IGlzIG9uZSBvZjoNCg0KICAgdXNlciAgU3BlY2lmaWVzIHRoYXQgdGhlIHN1YmplY3QgY2F0 ZWdvcnkgaXMgYSB1c2VyLg0KDQogICBkZXZpY2UgIFNwZWNpZmllcyB0aGF0IHRoZSBzdWJqZWN0 IGNhdGVnb3J5IGlzIGEgZGV2aWNlLg0KDQogICBzZXNzaW9uICBTcGVjaWZpZXMgdGhhdCB0aGUg c3ViamVjdCBjYXRlZ29yeSBpcyBhIHNlc3Npb24uDQoNClRvIGFkZHJlc3MgRGljaydzIHF1ZXN0 aW9uOg0KSSBzdXBwb3NlIG9uZSBjb3VsZCB0aGluayBvZiBpdCBlaXRoZXIgd2F5LiBJIGFtIG5l dXRyYWwgdG8gYWRkaW5nIGl0IHdpdGhpbiBzdWJqZWN0IGlkZW50aWZpZXJzIG9yIGF0IGEgaGln aGVyLWxldmVsIGluIHRoZSBldmVudCB0aGF0IGluY2x1ZGVzIHRoZSBzdWJqZWN0IGlkZW50aWZp ZXIgY2xhaW0uIFRoaXMgd2FzIGFsc28gYSBwb2ludCBvZiBkaXNjdXNzaW9uIGluIHRoZSBTU0Ug d29ya2luZyBncm91cCwgc28gSSdsbCBsZXQgb3RoZXJzIGNvbW1lbnQgb24gdGhpcy4gVGhpcyBt YXkgYmUgZHJvcHBlZCBpZiBubyBvbmUgaGFzIHN0cm9uZyByZWFzb25zIHRvIGluY2x1ZGUgaXQg aW4gdGhlIHN1YmplY3QgaWRlbnRpZmllcnMgY2xhaW0uDQoNClRoYW5rcywNCkF0dWwNCg0KT24g TW9uLCBKdWwgMTMsIDIwMjAgYXQgMTE6MjUgQU0gRGljayBIYXJkdCA8ZGljay5oYXJkdEBnbWFp bC5jb208bWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tPj4gd3JvdGU6DQpIaSBBdHVsDQoNCkkg ZG9uJ3QgZm9sbG93IHdoeSB0aGlzIHN0YXRlbWVudCBpcyB0cnVlOg0KDQoiU2luY2UgdGhpcyBp cyBhIHByb3BlcnR5IG9mIHRoZSBzdWJqZWN0IHJhdGhlciB0aGFuIHRoZSBldmVudCINCg0KSSB3 b3VsZCBjb21lIHRvIHRoZSBvcHBvc2l0ZSBjb25jbHVzaW9uLg0KDQpbaHR0cHM6Ly9tYWlsZm9v Z2FlLmFwcHNwb3QuY29tL3Q/c2VuZGVyPWFaR2xqYXk1b1lYSmtkRUJuYldGcGJDNWpiMjAlM0Qm dHlwZT16ZXJvY29udGVudCZndWlkPWEwYzM0N2M4LWExYmEtNGU3OS05MDUzLTM3NzdlYTQzMmE1 MV3hkKcNCg0KT24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgOToxMCBBTSBBdHVsIFR1bHNoaWJhZ3dh bGUgPGF0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3JnPG1haWx0bzo0MGdvb2ds ZS5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNCkhpIGFsbCwNClN1YmplY3QgSWRlbnRpZmll cnMgd2lsbCBiZSB1c2VkIGluIHZhcmlvdXMgc3BlY2lmaWNhdGlvbnMgYWJvdXQgZXZlbnRzIHBl cnRhaW5pbmcgdG8gdGhvc2Ugc3ViamVjdCBpZGVudGlmaWVycy4gSW4gb3JkZXIgdG8gZGV0ZXJt aW5lIHRoZSBzY29wZSBvZiB0aGUgZXZlbnQsIGl0IGlzIGltcG9ydGFudCB0byBrbm93IHdoYXQg dGhlIHRyYW5zbWl0dGVyIG9mIHRoZSBldmVudCB0aGF0IGluY2x1ZGVzIHRoZSBzdWJqZWN0IGlk ZW50aWZpZXIgcmVmZXJzIHRvLg0KDQpGb3IgZXhhbXBsZSwgd2hlbiBhIHN1YmplY3QgaWRlbnRp ZmllciBzcGVjaWZpZXMgYSBwaG9uZSBudW1iZXIgYXMgdGhlIGlkZW50aWZpZXIsIGlzIHRoZSB0 cmFuc21pdHRlciBvZiB0aGUgZXZlbnQgdGhhdCBpbmNsdWRlcyBzdWNoIGEgc3ViamVjdCBpZGVu dGlmaWVyIHNwZWNpZnlpbmcgdGhlIHVzZXIgb3IgdGhlIGRldmljZSByZXByZXNlbnRlZCBieSB0 aGUgc3ViamVjdCBpZGVudGlmaWVyLg0KDQpTaW5jZSB0aGlzIGlzIGEgcHJvcGVydHkgb2YgdGhl IHN1YmplY3QgcmF0aGVyIHRoYW4gdGhlIGV2ZW50LCBpdCBzaG91bGQgYmUgbG9naWNhbGx5IGlu Y2x1ZGVkIGluIHRoZSBzdWJqZWN0IGlkZW50aWZpZXIgc3BlYy4gVGhlcmVmb3JlLCBJJ20gcHJv cG9zaW5nIHRoYXQgd2UgaW5jbHVkZSBhICJzdWJqZWN0IGNhdGVnb3J5IiBjbGFpbSB3aXRoaW4g dGhlIHN1YmplY3QgaWRlbnRpZmllci4gVGhlIHN1YmplY3QgY2F0ZWdvcnkgY291bGQgaGF2ZSBv bmUgb2YgdGhlIGZvbGxvd2luZyB2YWx1ZXM6DQoNCiAgKiAgIFVzZXINCiAgKiAgIERldmljZQ0K ICAqICAgU2Vzc2lvbg0KDQpUaGUgYWJvdmUgdmFsdWVzIGFyZSBzdWZmaWNpZW50IGZvciB0aGUg U1NFIHByb2ZpbGUsIGJ1dCBvdGhlciB2YWx1ZXMgbWF5IGJlIHBvc3NpYmxlIChhbHRob3VnaCBz dWNoIGEgcG9zc2liaWxpdHkgaXMgbm90IGEgcGFydCBvZiBteSBwcm9wb3NhbDxodHRwczovL25h bTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMlM0ElMkYlMkZn aXRodWIuY29tJTJGcmljaGFubmElMkZzZWNldmVudCUyRnB1bGwlMkYxJmRhdGE9MDIlN0MwMSU3 Q3RpbS5jYXBwYWxsaSU0MG1pY3Jvc29mdC5jb20lN0M3YmNmY2EwNGNkYWE0ZDRlNWE4NzA4ZDgy Nzc3OTRkYyU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2Mzcz MDI3NDE4NDc1MjI1NjYmc2RhdGE9WTZsWW8zR0I2T1oyTmw2NjFEUGRBcWNkS2slMkJTVk94WE9q YkdMJTJGV1NYODQlM0QmcmVzZXJ2ZWQ9MD4pLi4NCg0KVGhhbmtzLA0KQXR1bA0KDQpfX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KSWQtZXZlbnQgbWFpbGlu ZyBsaXN0DQpJZC1ldmVudEBpZXRmLm9yZzxtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmc+DQpodHRw czovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PGh0dHBzOi8vbmFtMDYu c2FmZWxpbmtzLnByb3RlY3Rpb24ub3V0bG9vay5jb20vP3VybD1odHRwcyUzQSUyRiUyRnd3dy5p ZXRmLm9yZyUyRm1haWxtYW4lMkZsaXN0aW5mbyUyRmlkLWV2ZW50JmRhdGE9MDIlN0MwMSU3Q3Rp bS5jYXBwYWxsaSU0MG1pY3Jvc29mdC5jb20lN0M3YmNmY2EwNGNkYWE0ZDRlNWE4NzA4ZDgyNzc3 OTRkYyU3QzcyZjk4OGJmODZmMTQxYWY5MWFiMmQ3Y2QwMTFkYjQ3JTdDMSU3QzAlN0M2MzczMDI3 NDE4NDc1MzI1MTYmc2RhdGE9VHNLRXRpRjdMcUVEOENxcXg5VDBaRklSdEJaYUJ6MWRTdDAyZ3RN V0FBNCUzRCZyZXNlcnZlZD0wPg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18NCklkLWV2ZW50IG1haWxpbmcgbGlzdA0KSWQtZXZlbnRAaWV0Zi5vcmc8bWFp bHRvOklkLWV2ZW50QGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0 aW5mby9pZC1ldmVudDxodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2su Y29tLz91cmw9aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8l MkZpZC1ldmVudCZkYXRhPTAyJTdDMDElN0N0aW0uY2FwcGFsbGklNDBtaWNyb3NvZnQuY29tJTdD N2JjZmNhMDRjZGFhNGQ0ZTVhODcwOGQ4Mjc3Nzk0ZGMlN0M3MmY5ODhiZjg2ZjE0MWFmOTFhYjJk N2NkMDExZGI0NyU3QzElN0MwJTdDNjM3MzAyNzQxODQ3NTMyNTE2JnNkYXRhPVRzS0V0aUY3THFF RDhDcXF4OVQwWkZJUnRCWmFCejFkU3QwMmd0TVdBQTQlM0QmcmVzZXJ2ZWQ9MD4NCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQpJZC1ldmVudCBtYWlsaW5n IGxpc3QNCklkLWV2ZW50QGlldGYub3JnPG1haWx0bzpJZC1ldmVudEBpZXRmLm9yZz4NCmh0dHBz Oi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQNCg0K --_000_MN2PR00MB0893B4D1347E71A7B18AFD8095451MN2PR00MB0893namp_ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyIgc3R5bGU9 ImRpc3BsYXk6bm9uZTsiPiBQIHttYXJnaW4tdG9wOjA7bWFyZ2luLWJvdHRvbTowO30gPC9zdHls ZT4NCjwvaGVhZD4NCjxib2R5IGRpcj0ibHRyIj4NCjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OiBB cmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2Io MCwgMCwgMCk7Ij4NCkhleSBQaGlsLCBzb3JyeSBmb3IgdGhlIGRlbGF5IG9uIHRoaXMuIFdlJ3Zl IGJlZW4gZGlzY3Vzc2luZyB0aGlzIGluIHRoZSBPcGVuSUQgU1NFIGdyb3VwIGFzIHdlbGwuPGJy Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+V2UgaGF2ZSBjb25jZXJucyBhYm91dCByZWNlaXZl cnMvUlBzIGluIENBRVAvUklTQyBuZWVkaW5nIHRvIHVuZGVyc3RhbmQgd2hhdCBhcmUgZXNzZW50 aWFsbHkgaWRlbnRpY2FsIGV2ZW50IHR5cGVzIGp1c3QgdG8gZGVsaW5lYXRlIGEgdXNlciB2cyBh IGRldmljZSBzdWJqZWN0IChhcyBhbiBleGFtcGxlKS4gVGhlcmUgYXJlIGFsc28gc2NhbGFiaWxp dHkgY29uY2VybnMgd2l0aCBoYXZpbmcgdG8gc2VuZCBtdWx0aXBsZSBldmVudHMgdG8NCiBjb252 ZXJ5IHRoaXMgaW5mb3JtYXRpb24uIFRoZSBzY2FsZSB3ZSdyZSB0YWxraW5nIGFib3V0IGhlcmUg aXMgaHVuZHJlZHMgb2YgbWlsbGlvbnMgb2YgJnF1b3Q7c3ViamVjdHMmcXVvdDsgKHVzZXJzLCBk ZXZpY2VzLCBzZXNzaW9ucywgYXBwbGljYXRpb25zLCB3b3JrbG9hZHMpLjwvZGl2Pg0KPGRpdj48 YnI+DQo8L2Rpdj4NCjxkaXY+Rm9yIGEgYmFzaWMgcmV2b2NhdGlvbiB1c2UgY2FzZSwgaWYgd2Ug ZG9uJ3QgaGF2ZSB0aGUgYWJpbGl0eSB0byBpbmNsdWRlIG11bHRpcGxlIHN1YmplY3RzIGFuZCBp bmNsdWRlIGEgc3ViamVjdCBjYXRlZ29yeSwgaW5zdGVhZCBvZiBhbiBSUC9yZWNlaXZlciBuZWVk aW5nIHRvIGtub3cgYWJvdXQgYSBzaW5nbGUgZXZlbnQgdHlwZSBvZiAmcXVvdDthbGwtc2Vzc2lv bnMtcmV2b2tlZCZxdW90Oywgd2Ugbm93IG5lZWQgYSBtaW5pbXVtIG9mIDQgZXZlbnQgdHlwZXMN CiAoZGV2aWNlLXNlc3Npb24tcmV2b2tlZCwgdXNlci1zZXNzaW9uLXJldm9rZWQsIHNlc3Npb24t cmV2b2tlZCwgYWxsLXNlc3Npb25zLXJldm9rZWQpLiBUaGlzIGdyb3dzIGV4cG9uZW50aWFsbHkg d2l0aCBuZXcgZXZlbnQgdHlwZXMgYW5kIG1ha2VzIGl0IGRpZmZpY3VsdCB0byBtYWludGFpbiBp biBsYXJnZSBzY2FsZSBlbnZpcm9ubWVudHMgd2l0aCB0aG91c2FuZHMgb2YgUlBzL3JlY2VpdmVy cy4NCjwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2Pldl IGhhZCBkaXNjdXNzZWQgcG90ZW50aWFsbHkgdXNpbmcgdGhlIHN1YmplY3RfYWxpYXMgb3B0aW9u LCBidXQgd2UgY2FuJ3QgZHVlIHRvIHRoZSB1c2VyIGFuZCBkZXZpY2Ugbm90IGJlaW5nIHRoZSBz YW1lICZxdW90O2VudGl0eSZxdW90Oy48L2Rpdj4NCjwvZGl2Pg0KPGJsb2NrcXVvdGUgc3R5bGU9 Im1hcmdpbjogMCAwIDAgNDBweDsgYm9yZGVyOiBub25lOyBwYWRkaW5nOiAwcHg7Ij4NCjxkaXYg c3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbCwgSGVsdmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNp emU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7Ij4NCjxkaXY+PHNwYW4gc3R5bGU9ImZvbnQt ZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwgbW9ub3NwYWNlOyI+My41ICZndDsgJnF1b3Q7RWFj aCBTdWJqZWN0IElkZW50aWZpZXIgaW4gdGhlIGFycmF5IE1VU1QgaWRlbnRpZnkgdGhlIHNhbWUg ZW50aXR5LiZxdW90Ozwvc3Bhbj48L2Rpdj4NCjwvZGl2Pg0KPC9ibG9ja3F1b3RlPg0KPGRpdiBz dHlsZT0iZm9udC1mYW1pbHk6IEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6 ZTogMTJwdDsgY29sb3I6IHJnYigwLCAwLCAwKTsiPg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+ SGVyZSdzIGFuIGV4YW1wbGUgb2Ygd2hhdCB3ZSdyZSB0cnlpbmcgdG8gc2lnbmFsOjwvZGl2Pg0K PGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xh cywgQ291cmllciwgbW9ub3NwYWNlOyI+ezwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwgbW9ub3NwYWNlOyI+Jm5ic3A7ICZxdW90 O2lzcyZxdW90OzogJnF1b3Q7aHR0cHM6Ly9zdHMud2luZG93cy5uZXQvMmQxYWUxODktM2Q4NS00 NGNmLTg0MzctMjZmYmE0MjRmZWFmLyZxdW90Oyw8L3NwYW4+PC9kaXY+DQo8ZGl2PjxzcGFuIHN0 eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMsIENvdXJpZXIsIG1vbm9zcGFjZTsiPiZuYnNwOyAm cXVvdDtqdGkmcXVvdDs6ICZxdW90Ozc1NkU2OTcxNzU2NTIwNjk2NDY1NkU3NDY5NjY2OTY1NzIm cXVvdDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNv bGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJnF1b3Q7aWF0JnF1b3Q7OiAxNTk3MTU4 MjM5LDwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xh cywgQ291cmllciwgbW9ub3NwYWNlOyI+Jm5ic3A7ICZxdW90O2F1ZCZxdW90OzogJnF1b3Q7aHR0 cHM6Ly9vdXRsb29rLm9mZmljZTM2NS5jb20vJnF1b3Q7LDwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwgbW9ub3NwYWNlOyI+Jm5i c3A7ICZxdW90O2V2ZW50cyZxdW90Ozogezwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNwYW4gc3R5bGU9 ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwgbW9ub3NwYWNlOyI+Jm5ic3A7ICZuYnNw OyAmcXVvdDtodHRwczovL3NjaGVtYXMub3BlbmlkLm5ldC9zZWNldmVudC9jYWVwL2V2ZW50LXR5 cGUvYWxsLXNlc3Npb25zLXJldm9rZWQmcXVvdDs6IHs8L3NwYW4+PC9kaXY+DQo8ZGl2PjxzcGFu IHN0eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMsIENvdXJpZXIsIG1vbm9zcGFjZTsiPiZuYnNw OyAmbmJzcDsgJm5ic3A7ICZxdW90O3N1YmplY3QmcXVvdDs6IFs8L3NwYW4+PC9kaXY+DQo8ZGl2 PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMsIENvdXJpZXIsIG1vbm9zcGFjZTsi PiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB7PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsg Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O3N1YmplY3RfdHlwZSZxdW90OzogJnF1 b3Q7ZW1haWwmcXVvdDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1p bHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAm bmJzcDsgJm5ic3A7ICZxdW90O2VtYWlsJnF1b3Q7OiAmcXVvdDt0aW1AbWljcm9zb2Z0LmNvbSZx dW90Oyw8L3NwYW4+PC9kaXY+DQo8ZGl2PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ29uc29s YXMsIENvdXJpZXIsIG1vbm9zcGFjZTsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJz cDsgJnF1b3Q7c3ViamVjdF9jYXRlZ29yeSZxdW90OzogJnF1b3Q7dXNlciZxdW90Ozwvc3Bhbj48 L2Rpdj4NCjxkaXY+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwg bW9ub3NwYWNlOyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IH0sPC9zcGFuPjwvZGl2Pg0K PGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3Bh Y2U7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgezwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwgbW9ub3NwYWNlOyI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmcXVvdDtzdWJqZWN0X3R5cGUmcXVvdDs6 ICZxdW90O2lzcy1zdWImcXVvdDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7aHR0cHM6Ly9zdHMud2lu ZG93cy5uZXQvMmQxYWUxODktM2Q4NS00NGNmLTg0MzctMjZmYmE0MjRmZWFmLyZxdW90Oyw8L3Nw YW4+PC9kaXY+DQo8ZGl2PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMsIENvdXJp ZXIsIG1vbm9zcGFjZTsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7 c3ViJnF1b3Q7OiAmcXVvdDs0MDRlYTY4Yi04YjgyLTRlOGMtODc2ZS1lOTM2OTk1MjM4YTMmcXVv dDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFz LCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZxdW90O3N1YmplY3RfY2F0ZWdvcnkmcXVvdDs6ICZxdW90O2RldmljZSZxdW90Ozwvc3Bhbj48 L2Rpdj4NCjxkaXY+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwg bW9ub3NwYWNlOyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IH0sPC9zcGFuPjwvZGl2Pg0K PGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3Bh Y2U7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgezwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwgbW9ub3NwYWNlOyI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmcXVvdDtzdWJqZWN0X3R5cGUmcXVvdDs6 ICZxdW90O2lzcy1zdWImcXVvdDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7aHR0cHM6Ly9zdHMud2lu ZG93cy5uZXQvMmQxYWUxODktM2Q4NS00NGNmLTg0MzctMjZmYmE0MjRmZWFmLyZxdW90Oyw8L3Nw YW4+PC9kaXY+DQo8ZGl2PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMsIENvdXJp ZXIsIG1vbm9zcGFjZTsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7 c3ViJnF1b3Q7OiAmcXVvdDswN2JkZDhkZi0zYmNkLTQ1NjItOWZmYy01ZTM1NWY3ZThiYTEmcXVv dDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFz LCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZxdW90O3N1YmplY3RfY2F0ZWdvcnkmcXVvdDs6ICZxdW90O2RldmljZSZxdW90Ozwvc3Bhbj48 L2Rpdj4NCjxkaXY+PHNwYW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwg bW9ub3NwYWNlOyI+Jm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7IH0sPC9zcGFuPjwvZGl2Pg0K PGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3Bh Y2U7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgezwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNw YW4gc3R5bGU9ImZvbnQtZmFtaWx5OiBDb25zb2xhcywgQ291cmllciwgbW9ub3NwYWNlOyI+Jm5i c3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmcXVvdDtzdWJqZWN0X3R5cGUmcXVvdDs6 ICZxdW90O2lzcy1zdWImcXVvdDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9u dC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7ICZu YnNwOyAmbmJzcDsgJm5ic3A7ICZxdW90O2lzcyZxdW90OzogJnF1b3Q7aHR0cHM6Ly9zdHMud2lu ZG93cy5uZXQvMmQxYWUxODktM2Q4NS00NGNmLTg0MzctMjZmYmE0MjRmZWFmLyZxdW90Oyw8L3Nw YW4+PC9kaXY+DQo8ZGl2PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMsIENvdXJp ZXIsIG1vbm9zcGFjZTsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJnF1b3Q7 c3ViJnF1b3Q7OiAmcXVvdDs1NzNkOWMxYy1iNGUwLTRjYWMtODkyNy02ZDQzNjkxZmE4OTgmcXVv dDssPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFz LCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyAmbmJzcDsgJm5ic3A7 ICZxdW90O3N1YmplY3RfY2F0ZWdvcnkmcXVvdDs6ICZxdW90O3VzZXImcXVvdDs8L3NwYW4+PC9k aXY+DQo8ZGl2PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMsIENvdXJpZXIsIG1v bm9zcGFjZTsiPiZuYnNwOyAmbmJzcDsgJm5ic3A7ICZuYnNwOyB9PC9zcGFuPjwvZGl2Pg0KPGRp dj48c3BhbiBzdHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7 Ij4mbmJzcDsgJm5ic3A7ICZuYnNwOyBdPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBzdHlsZT0i Zm9udC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij4mbmJzcDsgJm5ic3A7 IH08L3NwYW4+PC9kaXY+DQo8ZGl2PjxzcGFuIHN0eWxlPSJmb250LWZhbWlseTogQ29uc29sYXMs IENvdXJpZXIsIG1vbm9zcGFjZTsiPiZuYnNwOyB9PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBz dHlsZT0iZm9udC1mYW1pbHk6IENvbnNvbGFzLCBDb3VyaWVyLCBtb25vc3BhY2U7Ij59PC9zcGFu PjwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2Pjxicj4N CjwvZGl2Pg0KPGRpdj48Yj5Qcm9wb3NhbDo8L2I+PC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0K PGRpdj5BZGQgYSBzdWJqZWN0IGNhdGVnb3J5IHdpdGggdGhlIGZvbGxvd2luZyBkZWZpbmVkIG9w dGlvbnM6PC9kaXY+DQo8L2Rpdj4NCjxkaXYgc3R5bGU9ImZvbnQtZmFtaWx5OiBBcmlhbCwgSGVs dmV0aWNhLCBzYW5zLXNlcmlmOyBmb250LXNpemU6IDEycHQ7IGNvbG9yOiByZ2IoMCwgMCwgMCk7 Ij4NCjxkaXY+DQo8dWw+DQo8bGk+dXNlcjwvbGk+PGxpPmRldmljZTwvbGk+PGxpPnNlc3Npb248 L2xpPjxsaT5hcHBsaWNhdGlvbjwvbGk+PGxpPndvcmtsb2FkPC9saT48L3VsPg0KPC9kaXY+DQo8 ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj5JZiBtdWx0aXBsZSBzdWJqZWN0cyBhcmUgcHJlc2VudCwg aXQgaXMgZXhwZWN0ZWQgdGhhdCB0aGUgZXZlbnQgYXBwbGllcyB0byBhbGwgb2YgdGhlIHN1Ympl Y3RzIHRvIHRoZSBleHRlbnQgdGhhdCBpdCBtYWtlcyBzZW5zZSB0byB0aGUgZXZlbnQgdHlwZS48 L2Rpdj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2Pjxicj4NCjwvZGl2Pg0KPGRpdj48Yj5PcGVu IHF1ZXN0aW9uIGFuZCBkaXNjdXNzaW9uIGl0ZW1zOjwvYj48L2Rpdj4NCjxkaXY+PGJyPg0KPC9k aXY+DQo8ZGl2PjEpIENhbiAmcXVvdDtzdWJqZWN0JnF1b3Q7IGJlIGFuIGFycmF5IG9mIG11bHRp cGxlIHN1YmplY3RzIHRoYXQgYXJlIG5vdCB0aGUgc2FtZSBlbnRpdHk/PC9kaXY+DQo8ZGl2Pjxi cj4NCjwvZGl2Pg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0ibWFyZ2luOiAwIDAgMCA0MHB4 OyBib3JkZXI6IG5vbmU7IHBhZGRpbmc6IDBweDsiPg0KPGRpdiBzdHlsZT0iZm9udC1mYW1pbHk6 IEFyaWFsLCBIZWx2ZXRpY2EsIHNhbnMtc2VyaWY7IGZvbnQtc2l6ZTogMTJwdDsgY29sb3I6IHJn YigwLCAwLCAwKTsiPg0KPGRpdj4xYSkgSWYgc28sIGhvdyBzaG91bGQgYWxpYXMgYmUgY29tYmlu ZWQgd2l0aCBtdWx0aXBsZSBzdWJqZWN0cz8gSW4gdGhlIGV4YW1wbGUgYWJvdmUsIGJvdGggdXNl ciBzdWJqZWN0cyB3b3VsZCBiZSBhbGlhc2VzIG9mIGVhY2ggb3RoZXIuPC9kaXY+DQo8ZGl2Pjxi cj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2IHN0eWxlPSJmb250LWZhbWls eTogQXJpYWwsIEhlbHZldGljYSwgc2Fucy1zZXJpZjsgZm9udC1zaXplOiAxMnB0OyBjb2xvcjog cmdiKDAsIDAsIDApOyI+DQo8ZGl2PjIpIElmIG5vIGNhdGVnb3J5IGlzIHByb3ZpZGVkLCB3aGF0 IHNob3VsZCBiZSB0aGUgZGVmYXVsdD88L2Rpdj4NCjxkaXY+PGJyPg0KPC9kaXY+DQo8ZGl2PnRp bTwvZGl2Pg0KPGRpdj48YnI+DQo8L2Rpdj4NCjxicj4NCjxicj4NCjwvZGl2Pg0KPGRpdiBpZD0i YXBwZW5kb25zZW5kIj48L2Rpdj4NCjxociBzdHlsZT0iZGlzcGxheTppbmxpbmUtYmxvY2s7d2lk dGg6OTglIiB0YWJpbmRleD0iLTEiPg0KPGRpdiBpZD0iZGl2UnBseUZ3ZE1zZyIgZGlyPSJsdHIi Pjxmb250IGZhY2U9IkNhbGlicmksIHNhbnMtc2VyaWYiIHN0eWxlPSJmb250LXNpemU6MTFwdCIg Y29sb3I9IiMwMDAwMDAiPjxiPkZyb206PC9iPiBJZC1ldmVudCAmbHQ7aWQtZXZlbnQtYm91bmNl c0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIFBoaWwgSHVudCAmbHQ7cGhpbC5odW50QGluZGVw ZW5kZW50aWQuY29tJmd0Ozxicj4NCjxiPlNlbnQ6PC9iPiBNb25kYXksIEp1bHkgMTMsIDIwMjAg MTc6NTU8YnI+DQo8Yj5Ubzo8L2I+IEF0dWwgVHVsc2hpYmFnd2FsZSAmbHQ7YXR1bHR1bHNoaT00 MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+Q2M6PC9iPiBJRCBFdmVudHMg TWFpbGluZyBMaXN0ICZsdDtpZC1ldmVudEBpZXRmLm9yZyZndDs7IERpY2sgSGFyZHQgJmx0O2Rp Y2suaGFyZHRAZ21haWwuY29tJmd0Ozxicj4NCjxiPlN1YmplY3Q6PC9iPiBSZTogW0lkLWV2ZW50 XSBTdWJqZWN0IENhdGVnb3JpZXMgaW4gU3ViamVjdCBJZGVudGlmaWVyczwvZm9udD4NCjxkaXY+ Jm5ic3A7PC9kaXY+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiIgc3R5bGU9IndvcmQtd3JhcDpicmVh ay13b3JkOyBsaW5lLWJyZWFrOmFmdGVyLXdoaXRlLXNwYWNlIj5XaHkgaXMgdGhlIGNhdGVnb3J5 IG5vdCBwYXJ0IG9mIHRoZSBldmVudHVyaSAvIGV2ZW50IGRlZmluaXRpb24/ICZuYnNwO1doeSBo YXZlIG9uZSBldmVudCB0aGF0IGFwcGxpZXMgdG8gYSBzZXNzaW9uLCBhIGRldmljZSwgYSBwZXJz b24sIGFuZCBhbiBhY2NvdW50IGF0IHRoZSBzYW1lIHRpbWUgYXMgb3Bwb3NlZCB0byA0IGRpZmZl cmVudA0KIGV2ZW50IHVyaXM/DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0K PGRpdiBjbGFzcz0iIj5JdCBmZWVscyBsaWtlIHlvdSBtYXkgYmUgdHJ5aW5nIGRlZmluZSBhICZu YnNwO2NvbWJpbmVkLCBtdWx0aS1wdXJwb3NlIGV2ZW50IHRvIGNvdmVyIG1hbnkgYWN0dWFsIGV2 ZW50cy4gSXMgdGhhdCB0aGUgZ29hbD88YnIgY2xhc3M9IiI+DQo8ZGl2IGNsYXNzPSIiPjxiciBj bGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5NeSBleHBlY3RhdGlvbiBmb3IgZGVmaW5p bmcgU0VUcyBhbmQgZXZlbnR1cmlzIHdhcyB0aGF0IHRoZSBldmVudHVyaSBjb252ZXlzIDkwJSBv ZiB0aGUgaW5mb3JtYXRpb24gY29udGVudCBvZiBhIFNFVC4gVGhlIHN1YmplY3QgaWRlbnRpZmll ciBpbmRpY2F0ZXMgd2hvIG9yIHdoYXQgdGhlIGV2ZW50IGlzIGFib3V0IGFuZCB0aGUgb2NjYXNp b25hbCB1c2Ugb2YgcGF5bG9hZCBjbGFpbXMgdG8gcHJvdmlkZSDigJx1c2VmdWzigJ0NCiBhZGRp dGlvbmFsIGluZm9ybWF0aW9uIChsaWtlIGEgY291bnRlcikuICZuYnNwO0UuZy4gaWYgeW91IHdh bnQgdG8gY29udmV5IGhvdyBtYW55IGFjY291bnQgcmVzZXRzIGFuZCBub3QganVzdCB0aGUgZmFj dCB0aGUgYWNjb3VudCB3YXMgcmVzZXQuIEl0IG1ha2VzIHNlbnNlIHRvIHJlLXVzZSB0aGUgc2Ft ZSBVUkkgZXZlbiB0aG91Z2ggdGhlIGFjdGlvbnMgdGFrZW4gb24gdGhlIDNyZCByZXNldCBtaWdo dCBiZSBkaWZmZXJlbnQgdGhlbiBvbiB0aGUgZmlyc3QuPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPjxi ciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5JTU8sIGEgd2lkZSBudW1iZXIgb2Yg ZXZlbnQgdXJpcyBwYWlyZWQgd2l0aCBsaWdodHdlaWdodCBTRVRzIG1lYW5zIHBvbGljeSBzeXN0 ZW1zIGFuZCBTRVQgcm91dGVycyBjYW4gbWFrZSBxdWljayBkZWNpc2lvbnMgb24gd2hlcmUgYW5k IGhvdyB0byBhY3QgdXBvbiBhbiBldmVudCBmb3IgYSBwYXJ0aWN1bGFyIHN1YmplY3QuPC9kaXY+ DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj4NCjxk aXYgY2xhc3M9IiI+DQo8ZGl2PlBoaWxsaXAgSHVudDwvZGl2Pg0KPGRpdj48YSBocmVmPSJtYWls dG86cGhpbC5odW50QGluZGVwZW5kZW50aWQuY29tIiBjbGFzcz0iIj5waGlsLmh1bnRAaW5kZXBl bmRlbnRpZC5jb208L2E+PC9kaXY+DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2 Pg0KPGJyIGNsYXNzPSJ4X0FwcGxlLWludGVyY2hhbmdlLW5ld2xpbmUiPg0KPC9kaXY+DQo8ZGl2 PjxiciBjbGFzcz0iIj4NCjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiIGNsYXNzPSIiPg0KPGRpdiBj bGFzcz0iIj5PbiBKdWwgMTMsIDIwMjAsIGF0IDE6NDcgUE0sIEF0dWwgVHVsc2hpYmFnd2FsZSAm bHQ7PGEgaHJlZj0ibWFpbHRvOmF0dWx0dWxzaGk9NDBnb29nbGUuY29tQGRtYXJjLmlldGYub3Jn IiBjbGFzcz0iIj5hdHVsdHVsc2hpPTQwZ29vZ2xlLmNvbUBkbWFyYy5pZXRmLm9yZzwvYT4mZ3Q7 IHdyb3RlOjwvZGl2Pg0KPGJyIGNsYXNzPSJ4X0FwcGxlLWludGVyY2hhbmdlLW5ld2xpbmUiPg0K PGRpdiBjbGFzcz0iIj4NCjxkaXYgZGlyPSJsdHIiIGNsYXNzPSIiPlRvIGFkZHJlc3MgTWlrZSdz IHBvaW50IEknbSBjbGFyaWZ5aW5nIHRoZSBwcm9wb3NhbCBzeW50YXgmbmJzcDtoZXJlLg0KPGRp diBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+SSdtIHByb3Bv c2luZyB0aGF0IHdlIGFkZCBhICZxdW90O2NhdGVnb3JpZXMmcXVvdDsgY2xhaW0gdG8gc3ViamVj dCBpZGVudGlmaWVycywgcmVnYXJkbGVzcyBvZiB0aGUgc3ViamVjdC1pZGVudGlmaWVyIHR5cGUg KGkuZS4gYSBjb21tb24gY2xhaW0pLCB3aXRoIHRoZSBmb2xsb3dpbmcgdGV4dDo8L2Rpdj4NCjxk aXYgY2xhc3M9IiI+PHNwYW4gaWQ9InhfZ21haWwtZG9jcy1pbnRlcm5hbC1ndWlkLWJkMGY0ZmRm LTdmZmYtYWE1Mi05ZDEzLTE5OTNjYzIzNWZjZiIgY2xhc3M9IiI+DQo8ZGl2IGNsYXNzPSIiIHN0 eWxlPSJsaW5lLWhlaWdodDoxLjM4OyBtYXJnaW4tdG9wOjBwdDsgbWFyZ2luLWJvdHRvbTowcHQi PjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJmb250LXNpemU6OHB0OyBmb250LWZhbWlseTomcXVvdDtS b2JvdG8gTW9ubyZxdW90Oyxtb25vc3BhY2U7IGJhY2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7 IGZvbnQtdmFyaWFudC1udW1lcmljOm5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46bm9y bWFsOyB2ZXJ0aWNhbC1hbGlnbjpiYXNlbGluZTsgd2hpdGUtc3BhY2U6cHJlLXdyYXAiPlN1Ympl Y3QNCiBDYXRlZ29yaWVzPC9zcGFuPjwvZGl2Pg0KPGJyIGNsYXNzPSIiPg0KPGRpdiBjbGFzcz0i IiBzdHlsZT0ibGluZS1oZWlnaHQ6MS4zODsgbWFyZ2luLXRvcDowcHQ7IG1hcmdpbi1ib3R0b206 MHB0Ij48c3BhbiBjbGFzcz0iIiBzdHlsZT0iZm9udC1zaXplOjhwdDsgZm9udC1mYW1pbHk6JnF1 b3Q7Um9ib3RvIE1vbm8mcXVvdDssbW9ub3NwYWNlOyBiYWNrZ3JvdW5kLWNvbG9yOnRyYW5zcGFy ZW50OyBmb250LXZhcmlhbnQtbnVtZXJpYzpub3JtYWw7IGZvbnQtdmFyaWFudC1lYXN0LWFzaWFu Om5vcm1hbDsgdmVydGljYWwtYWxpZ246YmFzZWxpbmU7IHdoaXRlLXNwYWNlOnByZS13cmFwIj4m bmJzcDsmbmJzcDsmbmJzcDtTdWJqZWN0cw0KIG1heSBiZSBjYXRlZ29yaXplZCBhcyB1c2Vycywg ZGV2aWNlcyBvciBzZXNzaW9ucy4mbmJzcDsgVG88L3NwYW4+PC9kaXY+DQo8ZGl2IGNsYXNzPSIi IHN0eWxlPSJsaW5lLWhlaWdodDoxLjM4OyBtYXJnaW4tdG9wOjBwdDsgbWFyZ2luLWJvdHRvbTow cHQiPjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJmb250LXNpemU6OHB0OyBmb250LWZhbWlseTomcXVv dDtSb2JvdG8gTW9ubyZxdW90Oyxtb25vc3BhY2U7IGJhY2tncm91bmQtY29sb3I6dHJhbnNwYXJl bnQ7IGZvbnQtdmFyaWFudC1udW1lcmljOm5vcm1hbDsgZm9udC12YXJpYW50LWVhc3QtYXNpYW46 bm9ybWFsOyB2ZXJ0aWNhbC1hbGlnbjpiYXNlbGluZTsgd2hpdGUtc3BhY2U6cHJlLXdyYXAiPiZu YnNwOyZuYnNwOyZuYnNwO3NwZWNpZnkNCiB0aGUgY2F0ZWdvcnkgb2YgYSBzdWJqZWN0LCBhICZx dW90O2NhdGVnb3J5JnF1b3Q7IGNsYWltIE1BWSBiZTwvc3Bhbj48L2Rpdj4NCjxkaXYgY2xhc3M9 IiIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEuMzg7IG1hcmdpbi10b3A6MHB0OyBtYXJnaW4tYm90dG9t OjBwdCI+PHNwYW4gY2xhc3M9IiIgc3R5bGU9ImZvbnQtc2l6ZTo4cHQ7IGZvbnQtZmFtaWx5OiZx dW90O1JvYm90byBNb25vJnF1b3Q7LG1vbm9zcGFjZTsgYmFja2dyb3VuZC1jb2xvcjp0cmFuc3Bh cmVudDsgZm9udC12YXJpYW50LW51bWVyaWM6bm9ybWFsOyBmb250LXZhcmlhbnQtZWFzdC1hc2lh bjpub3JtYWw7IHZlcnRpY2FsLWFsaWduOmJhc2VsaW5lOyB3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+ Jm5ic3A7Jm5ic3A7Jm5ic3A7aW5jbHVkZWQuJm5ic3A7DQogSWYgcHJlc2VudCwgdGhlIGNsYWlt IE1VU1QgaGF2ZSBhIHZhbHVlIHRoYXQgaXMgb25lIG9mOjwvc3Bhbj48L2Rpdj4NCjxiciBjbGFz cz0iIj4NCjxkaXYgY2xhc3M9IiIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEuMzg7IG1hcmdpbi10b3A6 MHB0OyBtYXJnaW4tYm90dG9tOjBwdCI+PHNwYW4gY2xhc3M9IiIgc3R5bGU9ImZvbnQtc2l6ZTo4 cHQ7IGZvbnQtZmFtaWx5OiZxdW90O1JvYm90byBNb25vJnF1b3Q7LG1vbm9zcGFjZTsgYmFja2dy b3VuZC1jb2xvcjp0cmFuc3BhcmVudDsgZm9udC12YXJpYW50LW51bWVyaWM6bm9ybWFsOyBmb250 LXZhcmlhbnQtZWFzdC1hc2lhbjpub3JtYWw7IHZlcnRpY2FsLWFsaWduOmJhc2VsaW5lOyB3aGl0 ZS1zcGFjZTpwcmUtd3JhcCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7dXNlciZuYnNwOw0KIFNwZWNpZmll cyB0aGF0IHRoZSBzdWJqZWN0IGNhdGVnb3J5IGlzIGEgdXNlci48L3NwYW4+PC9kaXY+DQo8YnIg Y2xhc3M9IiI+DQo8ZGl2IGNsYXNzPSIiIHN0eWxlPSJsaW5lLWhlaWdodDoxLjM4OyBtYXJnaW4t dG9wOjBwdDsgbWFyZ2luLWJvdHRvbTowcHQiPjxzcGFuIGNsYXNzPSIiIHN0eWxlPSJmb250LXNp emU6OHB0OyBmb250LWZhbWlseTomcXVvdDtSb2JvdG8gTW9ubyZxdW90Oyxtb25vc3BhY2U7IGJh Y2tncm91bmQtY29sb3I6dHJhbnNwYXJlbnQ7IGZvbnQtdmFyaWFudC1udW1lcmljOm5vcm1hbDsg Zm9udC12YXJpYW50LWVhc3QtYXNpYW46bm9ybWFsOyB2ZXJ0aWNhbC1hbGlnbjpiYXNlbGluZTsg d2hpdGUtc3BhY2U6cHJlLXdyYXAiPiZuYnNwOyZuYnNwOyZuYnNwO2RldmljZSZuYnNwOw0KIFNw ZWNpZmllcyB0aGF0IHRoZSBzdWJqZWN0IGNhdGVnb3J5IGlzIGEgZGV2aWNlLjwvc3Bhbj48L2Rp dj4NCjxiciBjbGFzcz0iIj4NCjxkaXYgY2xhc3M9IiIgc3R5bGU9ImxpbmUtaGVpZ2h0OjEuMzg7 IG1hcmdpbi10b3A6MHB0OyBtYXJnaW4tYm90dG9tOjBwdCI+PHNwYW4gY2xhc3M9IiIgc3R5bGU9 ImZvbnQtc2l6ZTo4cHQ7IGZvbnQtZmFtaWx5OiZxdW90O1JvYm90byBNb25vJnF1b3Q7LG1vbm9z cGFjZTsgYmFja2dyb3VuZC1jb2xvcjp0cmFuc3BhcmVudDsgZm9udC12YXJpYW50LW51bWVyaWM6 bm9ybWFsOyBmb250LXZhcmlhbnQtZWFzdC1hc2lhbjpub3JtYWw7IHZlcnRpY2FsLWFsaWduOmJh c2VsaW5lOyB3aGl0ZS1zcGFjZTpwcmUtd3JhcCI+Jm5ic3A7Jm5ic3A7Jm5ic3A7c2Vzc2lvbiZu YnNwOw0KIFNwZWNpZmllcyB0aGF0IHRoZSBzdWJqZWN0IGNhdGVnb3J5IGlzIGEgc2Vzc2lvbi48 L3NwYW4+PC9kaXY+DQo8L3NwYW4+PGJyIGNsYXNzPSJ4X2dtYWlsLUFwcGxlLWludGVyY2hhbmdl LW5ld2xpbmUiPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPlRvIGFkZHJlc3MgRGljaydzIHF1ZXN0 aW9uOjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5JIHN1cHBvc2Ugb25lIGNvdWxkIHRoaW5rIG9mIGl0 IGVpdGhlciB3YXkuIEkgYW0gbmV1dHJhbCB0byBhZGRpbmcgaXQgd2l0aGluIHN1YmplY3QgaWRl bnRpZmllcnMgb3IgYXQgYSBoaWdoZXItbGV2ZWwgaW4gdGhlIGV2ZW50IHRoYXQgaW5jbHVkZXMg dGhlIHN1YmplY3QgaWRlbnRpZmllciBjbGFpbS4gVGhpcyB3YXMgYWxzbyBhIHBvaW50IG9mIGRp c2N1c3Npb24gaW4gdGhlIFNTRSB3b3JraW5nIGdyb3VwLCBzbyBJJ2xsDQogbGV0IG90aGVycyBj b21tZW50IG9uIHRoaXMuIFRoaXMgbWF5IGJlIGRyb3BwZWQgaWYgbm8gb25lIGhhcyBzdHJvbmcg cmVhc29ucyB0byBpbmNsdWRlIGl0IGluIHRoZSBzdWJqZWN0IGlkZW50aWZpZXJzIGNsYWltLjwv ZGl2Pg0KPGRpdiBjbGFzcz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+ VGhhbmtzLDwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5BdHVsPC9kaXY+DQo8L2Rpdj4NCjxiciBjbGFz cz0iIj4NCjxkaXYgY2xhc3M9InhfZ21haWxfcXVvdGUiPg0KPGRpdiBkaXI9Imx0ciIgY2xhc3M9 InhfZ21haWxfYXR0ciI+T24gTW9uLCBKdWwgMTMsIDIwMjAgYXQgMTE6MjUgQU0gRGljayBIYXJk dCAmbHQ7PGEgaHJlZj0ibWFpbHRvOmRpY2suaGFyZHRAZ21haWwuY29tIiBjbGFzcz0iIj5kaWNr LmhhcmR0QGdtYWlsLmNvbTwvYT4mZ3Q7IHdyb3RlOjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGJs b2NrcXVvdGUgY2xhc3M9InhfZ21haWxfcXVvdGUiIHN0eWxlPSJtYXJnaW46MHB4IDBweCAwcHgg MC44ZXg7IGJvcmRlci1sZWZ0OjFweCBzb2xpZCByZ2IoMjA0LDIwNCwyMDQpOyBwYWRkaW5nLWxl ZnQ6MWV4Ij4NCjxkaXYgZGlyPSJsdHIiIGNsYXNzPSIiPkhpJm5ic3A7QXR1bA0KPGRpdiBjbGFz cz0iIj48YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+SSBkb24ndCBmb2xsb3cg d2h5IHRoaXMgc3RhdGVtZW50IGlzIHRydWU6PC9kaXY+DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFz cz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj4mcXVvdDtTaW5jZSB0aGlzIGlzIGEgcHJvcGVy dHkgb2YgdGhlIHN1YmplY3QgcmF0aGVyIHRoYW4gdGhlIGV2ZW50JnF1b3Q7PC9kaXY+DQo8ZGl2 IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBjbGFzcz0iIj5JIHdvdWxkIGNv bWUgdG8gdGhlIG9wcG9zaXRlIGNvbmNsdXNpb24uPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPjxiciBj bGFzcz0iIj4NCjwvZGl2Pg0KPC9kaXY+DQo8ZGl2IGhzcGFjZT0ic3RyZWFrLXB0LW1hcmsiIGNs YXNzPSIiIHN0eWxlPSJtYXgtaGVpZ2h0OjFweCI+PGltZyBhbHQ9IiIgY2xhc3M9IiIgc3R5bGU9 IndpZHRoOjBweDsgbWF4LWhlaWdodDowcHg7IG92ZXJmbG93OmhpZGRlbiIgc3JjPSJodHRwczov L21haWxmb29nYWUuYXBwc3BvdC5jb20vdD9zZW5kZXI9YVpHbGpheTVvWVhKa2RFQm5iV0ZwYkM1 amIyMCUzRCZhbXA7dHlwZT16ZXJvY29udGVudCZhbXA7Z3VpZD1hMGMzNDdjOC1hMWJhLTRlNzkt OTA1My0zNzc3ZWE0MzJhNTEiPjxmb250IGNvbG9yPSIjZmZmZmZmIiBzaXplPSIxIiBjbGFzcz0i Ij7hkKc8L2ZvbnQ+PC9kaXY+DQo8YnIgY2xhc3M9IiI+DQo8ZGl2IGNsYXNzPSJ4X2dtYWlsX3F1 b3RlIj4NCjxkaXYgZGlyPSJsdHIiIGNsYXNzPSJ4X2dtYWlsX2F0dHIiPk9uIE1vbiwgSnVsIDEz LCAyMDIwIGF0IDk6MTAgQU0gQXR1bCBUdWxzaGliYWd3YWxlICZsdDthdHVsdHVsc2hpPTxhIGhy ZWY9Im1haWx0bzo0MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5rIiBj bGFzcz0iIj40MGdvb2dsZS5jb21AZG1hcmMuaWV0Zi5vcmc8L2E+Jmd0OyB3cm90ZTo8YnIgY2xh c3M9IiI+DQo8L2Rpdj4NCjxibG9ja3F1b3RlIGNsYXNzPSJ4X2dtYWlsX3F1b3RlIiBzdHlsZT0i bWFyZ2luOjBweCAwcHggMHB4IDAuOGV4OyBib3JkZXItbGVmdDoxcHggc29saWQgcmdiKDIwNCwy MDQsMjA0KTsgcGFkZGluZy1sZWZ0OjFleCI+DQo8ZGl2IGRpcj0ibHRyIiBjbGFzcz0iIj5IaSBh bGwsDQo8ZGl2IGNsYXNzPSIiPlN1YmplY3QgSWRlbnRpZmllcnMgd2lsbCBiZSB1c2VkIGluIHZh cmlvdXMgc3BlY2lmaWNhdGlvbnMgYWJvdXQgZXZlbnRzIHBlcnRhaW5pbmcgdG8gdGhvc2Ugc3Vi amVjdCBpZGVudGlmaWVycy4gSW4gb3JkZXIgdG8gZGV0ZXJtaW5lIHRoZSBzY29wZSBvZiB0aGUg ZXZlbnQsIGl0IGlzIGltcG9ydGFudCZuYnNwO3RvIGtub3cgd2hhdCB0aGUgdHJhbnNtaXR0ZXIg b2YgdGhlIGV2ZW50IHRoYXQgaW5jbHVkZXMgdGhlIHN1YmplY3QNCiBpZGVudGlmaWVyIHJlZmVy cyB0by48L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNs YXNzPSIiPkZvciBleGFtcGxlLCB3aGVuIGEgc3ViamVjdCBpZGVudGlmaWVyIHNwZWNpZmllcyBh IHBob25lIG51bWJlciBhcyB0aGUgaWRlbnRpZmllciwgaXMgdGhlIHRyYW5zbWl0dGVyIG9mIHRo ZSBldmVudCB0aGF0IGluY2x1ZGVzIHN1Y2ggYSBzdWJqZWN0IGlkZW50aWZpZXIgc3BlY2lmeWlu ZyB0aGUgdXNlciBvciB0aGUgZGV2aWNlIHJlcHJlc2VudGVkIGJ5IHRoZSBzdWJqZWN0IGlkZW50 aWZpZXIuPC9kaXY+DQo8ZGl2IGNsYXNzPSIiPjxiciBjbGFzcz0iIj4NCjwvZGl2Pg0KPGRpdiBj bGFzcz0iIj5TaW5jZSB0aGlzIGlzIGEgcHJvcGVydHkgb2YgdGhlIHN1YmplY3QgcmF0aGVyIHRo YW4gdGhlIGV2ZW50LCBpdCBzaG91bGQgYmUgbG9naWNhbGx5IGluY2x1ZGVkIGluIHRoZSBzdWJq ZWN0IGlkZW50aWZpZXIgc3BlYy4gVGhlcmVmb3JlLCBJJ20gcHJvcG9zaW5nIHRoYXQgd2UgaW5j bHVkZSBhICZxdW90O3N1YmplY3QgY2F0ZWdvcnkmcXVvdDsgY2xhaW0gd2l0aGluIHRoZSBzdWJq ZWN0IGlkZW50aWZpZXIuIFRoZSBzdWJqZWN0IGNhdGVnb3J5DQogY291bGQgaGF2ZSBvbmUgb2Yg dGhlIGZvbGxvd2luZyB2YWx1ZXM6PC9kaXY+DQo8ZGl2IGNsYXNzPSIiPg0KPHVsIGNsYXNzPSIi Pg0KPGxpIGNsYXNzPSIiPjxiIGNsYXNzPSIiPlVzZXI8L2I+PC9saT48bGkgY2xhc3M9IiI+PGIg Y2xhc3M9IiI+RGV2aWNlPC9iPjwvbGk+PGxpIGNsYXNzPSIiPjxiIGNsYXNzPSIiPlNlc3Npb248 L2I+PC9saT48L3VsPg0KPGRpdiBjbGFzcz0iIj5UaGUgYWJvdmUgdmFsdWVzIGFyZSBzdWZmaWNp ZW50IGZvciB0aGUgU1NFIHByb2ZpbGUsIGJ1dCBvdGhlciB2YWx1ZXMgbWF5IGJlIHBvc3NpYmxl IChhbHRob3VnaCBzdWNoIGEgcG9zc2liaWxpdHkgaXMgbm90IGEgcGFydCBvZiBteQ0KPGEgaHJl Zj0iaHR0cHM6Ly9uYW0wNi5zYWZlbGlua3MucHJvdGVjdGlvbi5vdXRsb29rLmNvbS8/dXJsPWh0 dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRnJpY2hhbm5hJTJGc2VjZXZlbnQlMkZwdWxsJTJGMSZh bXA7ZGF0YT0wMiU3QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzdiY2ZjYTA0 Y2RhYTRkNGU1YTg3MDhkODI3Nzc5NGRjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRi NDclN0MxJTdDMCU3QzYzNzMwMjc0MTg0NzUyMjU2NiZhbXA7c2RhdGE9WTZsWW8zR0I2T1oyTmw2 NjFEUGRBcWNkS2slMkJTVk94WE9qYkdMJTJGV1NYODQlM0QmYW1wO3Jlc2VydmVkPTAiIG9yaWdp bmFsc3JjPSJodHRwczovL2dpdGh1Yi5jb20vcmljaGFubmEvc2VjZXZlbnQvcHVsbC8xIiBzaGFz aD0icUF3TVowdFFIZUsxbzBOaWRmRzdpdGtUV0xwU0padzZFSTIwQ1pUbkVCMXE0dFc2Y0RtU01Y bm4rdWZxWlRGZHo4NXBxRkJCSkIwNitFL25CamprWVF1NjIxNm5rU1dXSnM0TS9sbEFrUmJLWisr YXVpbFJqYkZhU1ZpSHhQUWVwVllGOFo4T1NpRG5SMlZOaUdVaUlrUmRIRkRMOXJ3TEhuNkpxMXJZ dno4PSIgdGFyZ2V0PSJfYmxhbmsiIGNsYXNzPSIiPg0KcHJvcG9zYWw8L2E+KS4uPC9kaXY+DQo8 L2Rpdj4NCjxkaXYgY2xhc3M9IiI+PGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8ZGl2IGNsYXNzPSIi PlRoYW5rcyw8L2Rpdj4NCjxkaXYgY2xhc3M9IiI+QXR1bDwvZGl2Pg0KPGRpdiBjbGFzcz0iIj48 YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjwvZGl2Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX188YnIgY2xhc3M9IiI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8 YnIgY2xhc3M9IiI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0i X2JsYW5rIiBjbGFzcz0iIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnIgY2xhc3M9IiI+DQo8YSBo cmVmPSJodHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9 aHR0cHMlM0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZpZC1ldmVu dCZhbXA7ZGF0YT0wMiU3QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzdiY2Zj YTA0Y2RhYTRkNGU1YTg3MDhkODI3Nzc5NGRjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAx MWRiNDclN0MxJTdDMCU3QzYzNzMwMjc0MTg0NzUzMjUxNiZhbXA7c2RhdGE9VHNLRXRpRjdMcUVE OENxcXg5VDBaRklSdEJaYUJ6MWRTdDAyZ3RNV0FBNCUzRCZhbXA7cmVzZXJ2ZWQ9MCIgb3JpZ2lu YWxzcmM9Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHNo YXNoPSJMc0tvYTNMaDhGN3BFNUk3NEpuSGZ0MWJxSElOdndHRng4bVJuZ08zQ3pHUmhIY1ZJQ2oy U0d5QlgwT3puUHhjZld0YXB5MGtYb3ZzSlZjU2V6VTZZVWpCZ1BnQzlYWFJ0d2lsUW5CN0liOWNX UVJ4TG9DMkV4aFlXM3U3dUFqZXZ4VzFjM1oyTk5reXNCUzk0eTRSSWpRZTdjbGxlZEx4OVdaeHRJ YWlydzQ9IiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIiBjbGFzcz0iIj5odHRwczov L3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxiciBjbGFzcz0iIj4N CjwvYmxvY2txdW90ZT4NCjwvZGl2Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX188YnIgY2xhc3M9IiI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnIgY2xh c3M9IiI+DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIHRhcmdldD0iX2JsYW5r IiBjbGFzcz0iIj5JZC1ldmVudEBpZXRmLm9yZzwvYT48YnIgY2xhc3M9IiI+DQo8YSBocmVmPSJo dHRwczovL25hbTA2LnNhZmVsaW5rcy5wcm90ZWN0aW9uLm91dGxvb2suY29tLz91cmw9aHR0cHMl M0ElMkYlMkZ3d3cuaWV0Zi5vcmclMkZtYWlsbWFuJTJGbGlzdGluZm8lMkZpZC1ldmVudCZhbXA7 ZGF0YT0wMiU3QzAxJTdDdGltLmNhcHBhbGxpJTQwbWljcm9zb2Z0LmNvbSU3QzdiY2ZjYTA0Y2Rh YTRkNGU1YTg3MDhkODI3Nzc5NGRjJTdDNzJmOTg4YmY4NmYxNDFhZjkxYWIyZDdjZDAxMWRiNDcl N0MxJTdDMCU3QzYzNzMwMjc0MTg0NzUzMjUxNiZhbXA7c2RhdGE9VHNLRXRpRjdMcUVEOENxcXg5 VDBaRklSdEJaYUJ6MWRTdDAyZ3RNV0FBNCUzRCZhbXA7cmVzZXJ2ZWQ9MCIgb3JpZ2luYWxzcmM9 Imh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vaWQtZXZlbnQiIHNoYXNoPSJM c0tvYTNMaDhGN3BFNUk3NEpuSGZ0MWJxSElOdndHRng4bVJuZ08zQ3pHUmhIY1ZJQ2oyU0d5Qlgw T3puUHhjZld0YXB5MGtYb3ZzSlZjU2V6VTZZVWpCZ1BnQzlYWFJ0d2lsUW5CN0liOWNXUVJ4TG9D MkV4aFlXM3U3dUFqZXZ4VzFjM1oyTk5reXNCUzk0eTRSSWpRZTdjbGxlZEx4OVdaeHRJYWlydzQ9 IiByZWw9Im5vcmVmZXJyZXIiIHRhcmdldD0iX2JsYW5rIiBjbGFzcz0iIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2lkLWV2ZW50PC9hPjxiciBjbGFzcz0iIj4NCjwvYmxv Y2txdW90ZT4NCjwvZGl2Pg0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX188YnIgY2xhc3M9IiI+DQpJZC1ldmVudCBtYWlsaW5nIGxpc3Q8YnIgY2xhc3M9IiI+ DQo8YSBocmVmPSJtYWlsdG86SWQtZXZlbnRAaWV0Zi5vcmciIGNsYXNzPSIiPklkLWV2ZW50QGll dGYub3JnPC9hPjxiciBjbGFzcz0iIj4NCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlz dGluZm8vaWQtZXZlbnQ8YnIgY2xhc3M9IiI+DQo8L2Rpdj4NCjwvYmxvY2txdW90ZT4NCjwvZGl2 Pg0KPGJyIGNsYXNzPSIiPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9ib2R5Pg0KPC9odG1s Pg0K --_000_MN2PR00MB0893B4D1347E71A7B18AFD8095451MN2PR00MB0893namp_-- From nobody Tue Aug 11 16:34:29 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 505783A0DD0 for ; Tue, 11 Aug 2020 16:34:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.785 X-Spam-Level: X-Spam-Status: No, score=-1.785 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_FONT_LOW_CONTRAST=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=independentid-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WVhSfv3oXk27 for ; Tue, 11 Aug 2020 16:34:25 -0700 (PDT) Received: from mail-pf1-x434.google.com (mail-pf1-x434.google.com [IPv6:2607:f8b0:4864:20::434]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 874F43A0D77 for ; Tue, 11 Aug 2020 16:34:25 -0700 (PDT) Received: by mail-pf1-x434.google.com with SMTP id 17so59392pfw.9 for ; Tue, 11 Aug 2020 16:34:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=independentid-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=em6ojSJs8M7rUDoZM5mg53gMxD59xfAbnhwSuoEAWmU=; b=CQ5M9UxrbhG2QBghUO2v5xolvzmNY1gBOJzFzf7oc0HVaS1CARenwrySpwaGubUu4Z AzbYKyfYHBJJxJ3izpwKfmfxbb8fL21wSqw24H7WzdLFDYtm8UyxD+p1UknCGiirmOj2 HMR1yKW6y8a/nTIsQdvEfWjk8Ua9rzq8pXVceDTOVeRfLCUN0Zcsnta1AGRnjfqNNwBW 12I4WjE15HISDpLcOXZ53f5OkaIM7YEAdXwnYS6XeXFMAitg1xhkel48lF0nVwyV5gob ysDlvbJk75e3y4vi+pOYljt954COVNMpHgaFGtODpmKJowOflYX/P7Z1312IhtdBax+F NCeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=em6ojSJs8M7rUDoZM5mg53gMxD59xfAbnhwSuoEAWmU=; b=naVgBvzgWF84UCNsEty01e/TMw2u2AYsc8Zzh7ICeA89Y0e1XrSOf8S1bfEEuTCDwC OA9Kbjx0fFKRWJ+uTv91eZntg6lF5GYrSSdu1VTQ//6KvamJsg3bMMN4Ga+tYLROVNmB P8NzGQHLeBOixK0HOyFK3lRrFO9GTSLU8znJGBXvkxgTu9NG4p1RPptlRg0a9Shu+NMe njcpuL/3nQBovxB8g5TwWTFJe7bjH9sQ8gCksiKuU51TBuDCIHfCyLB6Ohtx1CwXiwtQ xhY104hYxeRv3RL5egjYF5DNWETLw/7eEiTigBCGB1ik088QxlduepX6BBM+6yLBjGap 6ohA== X-Gm-Message-State: AOAM533yZqiVbDRZVQbN2Z6rAy7nQ97zFHsYCScpwUOtP8FGzpzjLhWo ZEGe5iSGc6E2HdODGwHnimtwKw== X-Google-Smtp-Source: ABdhPJwEYtNje9kpxrPePZRtgWrIbZNhtfwsYmOiqiU9RFipmIHKaur47FNTElKDp6Eq+9Fl2oi39g== X-Received: by 2002:aa7:9813:: with SMTP id e19mr8544202pfl.285.1597188864558; Tue, 11 Aug 2020 16:34:24 -0700 (PDT) Received: from node-1w7jr9qqo6k568f59thk6ol0s.ipv6.telus.net (node-1w7jr9qqo6k568f59thk6ol0s.ipv6.telus.net. [2001:569:79bc:100:3d8b:f0d9:348a:666c]) by smtp.gmail.com with ESMTPSA id y1sm177082pfr.207.2020.08.11.16.34.23 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 11 Aug 2020 16:34:23 -0700 (PDT) From: Phil Hunt Message-Id: <09677E12-D17E-47DA-8FC3-A434B90B3148@independentid.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_7088B8B7-ED93-4C6C-9380-FC6890171A2E" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Tue, 11 Aug 2020 16:34:23 -0700 In-Reply-To: Cc: ID Events Mailing List To: Tim Cappalli References: <5C854271-BC02-47EE-814C-D8270681BF33@independentid.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [Id-event] Subject Categories in Subject Identifiers X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 23:34:28 -0000 --Apple-Mail=_7088B8B7-ED93-4C6C-9380-FC6890171A2E Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Tim, Thanks for getting back to me. I worry bringing multi-subject dimensionality to SET could have a lot of = negative consequences. This is similar to the discussion we had in the = WG about bundling multiple event URIs in the same SET and the complexity = that might cause. I think there is a PII concern that the RP can correlate multiple = identifiers it might not know about. Having only 1 subject identifier = implies sender and receiver have a mutual understanding about the = subject that was likely previously authorized by the subject. Introducing multiple subjects may introduce binding artifacts that = undermine the idea that shared signals enables cross-domain decoupling. = Multiplicity may introduce permutation and combination effects upon the = receiver that may not be workable.=20 If you think it is important to express the idea that a series of SETs = are in fact related (e.g. all items related to a user are revoked = including sessions, tokens, authorization, are to be revoked), the = =E2=80=9Ctxn=E2=80=9D claim can be used for this purpose. =E2=80=9Ctxn=E2=80= =9D lets an issuer indicate that a set of Events stem from the same = transaction (aka event). Phillip Hunt phil.hunt@independentid.com > On Aug 11, 2020, at 8:44 AM, Tim Cappalli = wrote: >=20 > Hey Phil, sorry for the delay on this. We've been discussing this in = the OpenID SSE group as well. >=20 > We have concerns about receivers/RPs in CAEP/RISC needing to = understand what are essentially identical event types just to delineate = a user vs a device subject (as an example). There are also scalability = concerns with having to send multiple events to convery this = information. The scale we're talking about here is hundreds of millions = of "subjects" (users, devices, sessions, applications, workloads). >=20 > For a basic revocation use case, if we don't have the ability to = include multiple subjects and include a subject category, instead of an = RP/receiver needing to know about a single event type of = "all-sessions-revoked", we now need a minimum of 4 event types = (device-session-revoked, user-session-revoked, session-revoked, = all-sessions-revoked). This grows exponentially with new event types and = makes it difficult to maintain in large scale environments with = thousands of RPs/receivers. >=20 >=20 > We had discussed potentially using the subject_alias option, but we = can't due to the user and device not being the same "entity". > 3.5 > "Each Subject Identifier in the array MUST identify the same = entity." >=20 > Here's an example of what we're trying to signal: >=20 > { > "iss": = "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/ = ", > "jti": "756E69717565206964656E746966696572", > "iat": 1597158239, > "aud": "https://outlook.office365.com/ = ", > "events": { > = "https://schemas.openid.net/secevent/caep/event-type/all-sessions-revoked = = ": { > "subject": [ > { > "subject_type": "email", > "email": "tim@microsoft.com ", > "subject_category": "user" > }, > { > "subject_type": "iss-sub", > "iss": = "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/ = ", > "sub": "404ea68b-8b82-4e8c-876e-e936995238a3", > "subject_category": "device" > }, > { > "subject_type": "iss-sub", > "iss": = "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/ = ", > "sub": "07bdd8df-3bcd-4562-9ffc-5e355f7e8ba1", > "subject_category": "device" > }, > { > "subject_type": "iss-sub", > "iss": = "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/ = ", > "sub": "573d9c1c-b4e0-4cac-8927-6d43691fa898", > "subject_category": "user" > } > ] > } > } > } >=20 >=20 >=20 > Proposal: >=20 > Add a subject category with the following defined options: > user > device > session > application > workload >=20 > If multiple subjects are present, it is expected that the event = applies to all of the subjects to the extent that it makes sense to the = event type. >=20 >=20 > Open question and discussion items: >=20 > 1) Can "subject" be an array of multiple subjects that are not the = same entity? >=20 > 1a) If so, how should alias be combined with multiple subjects? In the = example above, both user subjects would be aliases of each other. >=20 > 2) If no category is provided, what should be the default? >=20 > tim >=20 >=20 >=20 > From: Id-event > on behalf of Phil Hunt = > > Sent: Monday, July 13, 2020 17:55 > To: Atul Tulshibagwale > > Cc: ID Events Mailing List >; Dick Hardt > > Subject: Re: [Id-event] Subject Categories in Subject Identifiers > =20 > Why is the category not part of the eventuri / event definition? Why = have one event that applies to a session, a device, a person, and an = account at the same time as opposed to 4 different event uris? >=20 > It feels like you may be trying define a combined, multi-purpose = event to cover many actual events. Is that the goal? >=20 > My expectation for defining SETs and eventuris was that the eventuri = conveys 90% of the information content of a SET. The subject identifier = indicates who or what the event is about and the occasional use of = payload claims to provide =E2=80=9Cuseful=E2=80=9D additional = information (like a counter). E.g. if you want to convey how many = account resets and not just the fact the account was reset. It makes = sense to re-use the same URI even though the actions taken on the 3rd = reset might be different then on the first. >=20 > IMO, a wide number of event uris paired with lightweight SETs means = policy systems and SET routers can make quick decisions on where and how = to act upon an event for a particular subject. >=20 > Phillip Hunt > phil.hunt@independentid.com >=20 >=20 >=20 >> On Jul 13, 2020, at 1:47 PM, Atul Tulshibagwale = > wrote: >>=20 >> To address Mike's point I'm clarifying the proposal syntax here. >>=20 >> I'm proposing that we add a "categories" claim to subject = identifiers, regardless of the subject-identifier type (i.e. a common = claim), with the following text: >> Subject >> Categories >>=20 >> Subjects >> may be categorized as users, devices or sessions. To >> specify >> the category of a subject, a "category" claim MAY be >> included.=20 >> If present, the claim MUST have a value that is one of: >>=20 >> user=20 >> Specifies that the subject category is a user. >>=20 >> device=20 >> Specifies that the subject category is a device. >>=20 >> session=20 >> Specifies that the subject category is a session. >>=20 >> To address Dick's question: >> I suppose one could think of it either way. I am neutral to adding it = within subject identifiers or at a higher-level in the event that = includes the subject identifier claim. This was also a point of = discussion in the SSE working group, so I'll let others comment on this. = This may be dropped if no one has strong reasons to include it in the = subject identifiers claim. >>=20 >> Thanks, >> Atul >>=20 >> On Mon, Jul 13, 2020 at 11:25 AM Dick Hardt > wrote: >> Hi Atul >>=20 >> I don't follow why this statement is true: >>=20 >> "Since this is a property of the subject rather than the event" >>=20 >> I would come to the opposite conclusion. >>=20 >> =E1=90=A7 >>=20 >> On Mon, Jul 13, 2020 at 9:10 AM Atul Tulshibagwale = > wrote: >> Hi all, >> Subject Identifiers will be used in various specifications about = events pertaining to those subject identifiers. In order to determine = the scope of the event, it is important to know what the transmitter of = the event that includes the subject identifier refers to. >>=20 >> For example, when a subject identifier specifies a phone number as = the identifier, is the transmitter of the event that includes such a = subject identifier specifying the user or the device represented by the = subject identifier. >>=20 >> Since this is a property of the subject rather than the event, it = should be logically included in the subject identifier spec. Therefore, = I'm proposing that we include a "subject category" claim within the = subject identifier. The subject category could have one of the following = values: >> User >> Device >> Session >> The above values are sufficient for the SSE profile, but other values = may be possible (although such a possibility is not a part of my = proposal = ).. >>=20 >> Thanks, >> Atul >>=20 >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event = >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event = >> _______________________________________________ >> Id-event mailing list >> Id-event@ietf.org >> https://www.ietf.org/mailman/listinfo/id-event = --Apple-Mail=_7088B8B7-ED93-4C6C-9380-FC6890171A2E Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Tim,

Thanks= for getting back to me.

I worry bringing multi-subject dimensionality to SET could = have a lot of negative consequences.  This is similar to the = discussion we had in the WG about bundling multiple event URIs in the = same SET and the complexity that might cause.

I think there is a PII concern that the = RP can correlate multiple identifiers it might not know about. Having = only 1 subject identifier implies sender and receiver have a mutual = understanding about the subject that was likely previously authorized by = the subject.

Introducing multiple subjects may introduce binding artifacts = that undermine the idea that shared signals enables cross-domain = decoupling.  Multiplicity may introduce permutation and combination = effects upon the receiver that may not be workable. 

If you think it is = important to express the idea that a series of SETs are in fact related = (e.g. all items related to a user are revoked including sessions, = tokens, authorization, are to be revoked), the =E2=80=9Ctxn=E2=80=9D = claim can be used for this purpose. =E2=80=9Ctxn=E2=80=9D lets an issuer = indicate that a set of Events stem from the same transaction (aka = event).

Phillip Hunt



On Aug 11, 2020, at 8:44 AM, Tim Cappalli <Tim.Cappalli@microsoft.com> wrote:

Hey Phil, = sorry for the delay on this. We've been discussing this in the OpenID = SSE group as well.

We have concerns about receivers/RPs in CAEP/RISC needing to = understand what are essentially identical event types just to delineate = a user vs a device subject (as an example). There are also scalability = concerns with having to send multiple events to convery this = information. The scale we're talking about here is hundreds of millions = of "subjects" (users, devices, sessions, applications, = workloads).

For = a basic revocation use case, if we don't have the ability to include = multiple subjects and include a subject category, instead of an = RP/receiver needing to know about a single event type of = "all-sessions-revoked", we now need a minimum of 4 event types = (device-session-revoked, user-session-revoked, session-revoked, = all-sessions-revoked). This grows exponentially with new event types and = makes it difficult to maintain in large scale environments with = thousands of RPs/receivers.


We had discussed = potentially using the subject_alias option, but we can't due to the user = and device not being the same "entity".
3.5 > "Each Subject Identifier in the = array MUST identify the same = entity."

Here's an example of what we're trying to signal:

{
  "iss": "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/",
  "jti": = "756E69717565206964656E746966696572",
  = "iat": 1597158239,
  "aud": "https://outlook.office365.com/",
  "events": {
  =   "https://schemas.openid.net/secevent/caep/event-type/all-session= s-revoked": {
      = "subject": [
        = {
          = "subject_type": "email",
  =         "email": "tim@microsoft.com",
  =         "subject_category": "user"
        },
        {
  =         "subject_type": "iss-sub",
          "iss": "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/",
          = "sub": "404ea68b-8b82-4e8c-876e-e936995238a3",
          "subject_category": = "device"
        = },
        = {
          = "subject_type": "iss-sub",
  =         "iss": "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/",
          = "sub": "07bdd8df-3bcd-4562-9ffc-5e355f7e8ba1",
          "subject_category": = "device"
        = },
        = {
          = "subject_type": "iss-sub",
  =         "iss": "https://sts.windows.net/2d1ae189-3d85-44cf-8437-26fba424feaf/",
          = "sub": "573d9c1c-b4e0-4cac-8927-6d43691fa898",
          "subject_category": = "user"
        = }
      ]
    }
  = }
}



Proposal:

Add a subject category = with the following defined options:

If multiple subjects are present, it is = expected that the event applies to all of the subjects to the extent = that it makes sense to the event type.


Open question and discussion items:

1) Can "subject" be an = array of multiple subjects that are not the same entity?

1a) If so, how = should alias be combined with multiple subjects? In the example above, = both user subjects would be aliases of each other.

2) If no category is provided, what should be the = default?

tim



From: Id-event <id-event-bounces@ietf.org> on behalf of Phil Hunt = <phil.hunt@independentid.com>
Sent: Monday, July 13, 2020 = 17:55
To: Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org>
Cc: ID Events Mailing List = <id-event@ietf.org>; Dick Hardt <dick.hardt@gmail.com>
Subject: Re: [Id-event] Subject = Categories in Subject Identifiers
 
Why is the category not part of the eventuri / event = definition?  Why have one event that applies to a session, a = device, a person, and an account at the same time as opposed to 4 = different event uris?

It feels like you may be trying define a  combined, = multi-purpose event to cover many actual events. Is that the goal?

My = expectation for defining SETs and eventuris was that the eventuri = conveys 90% of the information content of a SET. The subject identifier = indicates who or what the event is about and the occasional use of = payload claims to provide =E2=80=9Cuseful=E2=80=9D additional = information (like a counter).  E.g. if you want to convey how many = account resets and not just the fact the account was reset. It makes = sense to re-use the same URI even though the actions taken on the 3rd = reset might be different then on the first.

IMO, a wide number of event uris paired = with lightweight SETs means policy systems and SET routers can make = quick decisions on where and how to act upon an event for a particular = subject.

Phillip Hunt
phil.hunt@independentid.com



On Jul 13, 2020, at 1:47 PM, Atul Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> = wrote:

To address Mike's point I'm clarifying the = proposal syntax here.

I'm proposing that we add a "categories" claim to subject = identifiers, regardless of the subject-identifier type (i.e. a common = claim), with the following text:
Subject Categories

   Subjects may be categorized as users, devices or sessions.  = To
   specify the category of a subject, a "category" claim MAY be
   included.  If present, the claim MUST have a value that is one of:

   user  Specifies that the subject category is a user.

   device  Specifies that the subject category is a device.

   session  Specifies that the subject category is a = session.

To = address Dick's question:
I suppose one could think = of it either way. I am neutral to adding it within subject identifiers = or at a higher-level in the event that includes the subject identifier = claim. This was also a point of discussion in the SSE working group, so = I'll let others comment on this. This may be dropped if no one has = strong reasons to include it in the subject identifiers claim.

Thanks,
Atul

On Mon, = Jul 13, 2020 at 11:25 AM Dick Hardt <dick.hardt@gmail.com> wrote:
Hi Atul

I don't follow why this statement is = true:

"Since = this is a property of the subject rather than the event"

I would come to the = opposite conclusion.

3D""=E1=90=A7

On Mon, Jul 13, 2020 at 9:10 AM Atul = Tulshibagwale <atultulshi=3D40google.com@dmarc.ietf.org> wrote:
Hi all,
Subject Identifiers will = be used in various specifications about events pertaining to those = subject identifiers. In order to determine the scope of the event, it is = important to know what the transmitter of the event that includes = the subject identifier refers to.

For example, when a subject identifier = specifies a phone number as the identifier, is the transmitter of the = event that includes such a subject identifier specifying the user or the = device represented by the subject identifier.

Since this is a property of the subject = rather than the event, it should be logically included in the subject = identifier spec. Therefore, I'm proposing that we include a "subject = category" claim within the subject identifier. The subject category = could have one of the following values:
  • User
  • Device
  • Session
The above values are = sufficient for the SSE profile, but other values may be possible = (although such a possibility is not a part of my proposal)..

Thanks,
Atul

_______________________________________________
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
____________________________________________= ___
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event
____________________________________________= ___
Id-event mailing list
Id-event@ietf.org
https://www.ietf.org/mailman/listinfo/id-event

= --Apple-Mail=_7088B8B7-ED93-4C6C-9380-FC6890171A2E-- From nobody Wed Aug 19 11:05:17 2020 Return-Path: X-Original-To: id-event@ietfa.amsl.com Delivered-To: id-event@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 42F073A0807 for ; Wed, 19 Aug 2020 11:05:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -17.6 X-Spam-Level: X-Spam-Status: No, score=-17.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VFJGqVKPyFDy for ; Wed, 19 Aug 2020 11:05:14 -0700 (PDT) Received: from mail-yb1-xb2a.google.com (mail-yb1-xb2a.google.com [IPv6:2607:f8b0:4864:20::b2a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D5BA23A07CE for ; Wed, 19 Aug 2020 11:05:13 -0700 (PDT) Received: by mail-yb1-xb2a.google.com with SMTP id m200so13806923ybf.10 for ; Wed, 19 Aug 2020 11:05:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=I2xBBCoIL+c9OpX6POsHuG/9eM4lfoPCBK7vDouiKIE=; b=Ak5WODyOfrUIeZuOElUE/AnPgT2A2U5pNtSyCAUalIE5h6u5XSJnIR69A+OomD1GDi qikMK5h/MjpbVjRtOHloJM2M+Rwa7awTMarcNsx2OK2sZ2WxBfihNJfKhWZCV7qmoUOZ mHjk96TimkmGd2taGtxOh2b7KeuVLaEvwRCmMJJSvugG3WkY9jPRBXCcFvsv7OTkRiE8 kLB7TnBg/CgIAeqDDEiZ9qw8QqAxKAbtUxS3a+R3BZPf3rTpurJRb5CoLZo6wWstvGKS LYbTX/fLdCVpL6oLpQs457JyelELUKKm2m7g+Wb9fpin6eigDvsVZWL+I8as0KFfb3wT pOkw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=I2xBBCoIL+c9OpX6POsHuG/9eM4lfoPCBK7vDouiKIE=; b=WOJAF+gFs/7Id73bFbLlSSjvFAOG7b+zJpP7sO22quR/SJDjcVwXrCStFopiY6HgHo n7o1Ule5Q7f4d2dV2A4Ai2bwirM4DrSrIbmaCw44BaRfZk9Hmj5v0moDiiZvakZuIfyR qdyuBhow5tyUWzDqzIoe6nvkcUSYFGohBa9Ey7QMyzP7d0C3aUxAZl1LSs+7NZU0RbjA 1BhLtNKLnsnDFZi7AdjymQvvXcF3Hw2iWPc+95l+LF04owTU7XsxtS84wXADPHkPKhxg Bz8XpKsLD+U9unHN7xC/YfiAuk9gik6An/Wy54SMKJgHwGV72nVq3RvEtEGvuyBoSDFH Rcpw== X-Gm-Message-State: AOAM533z1cmIbkA/vGrsPx8cifi9T2y4vRBwLgrzkN9C7HU1GyuI3guD YtLv9LXOgO+YWOtcryQ9LVcfR0F05i/3qzG0+G2q5A== X-Google-Smtp-Source: ABdhPJyPzs9OZZD2YNmFa2jjnMhtKDFaOfG6VvonZtCeZtppB2DZtk8bi4h1/71rEX3je8Sfvxve4TMVgCr2u3DyDPA= X-Received: by 2002:a25:3483:: with SMTP id b125mr38050385yba.8.1597860312706; Wed, 19 Aug 2020 11:05:12 -0700 (PDT) MIME-Version: 1.0 From: Atul Tulshibagwale Date: Wed, 19 Aug 2020 11:05:01 -0700 Message-ID: To: Openid-specs-risc Cc: SecEvent Content-Type: multipart/alternative; boundary="0000000000005771a805ad3ed88c" Archived-At: Subject: [Id-event] Subject categories X-BeenThere: id-event@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: "A mailing list to discuss the potential solution for a common identity event messaging format and distribution system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Aug 2020 18:05:15 -0000 --0000000000005771a805ad3ed88c Content-Type: text/plain; charset="UTF-8" Hi all, As agreed on the SSE call yesterday, I'd like to present a use-case where I believe subject categories within a subject identifier are useful. I encourage others to also send such emails in advance of the call next Tuesday, so that there's more clarity on the viewpoints and use-cases. My use case: Say a SSE Transmitter wants to signal that the authentication for a certain user on a certain device has weakened (due to some change initiated, observed or inferred by the transmitter). The user may have authenticated to many devices, and one device may have sessions for multiple users. In this case, the possibilities for conveying such information through an event are: 1. Include two subject identifiers in a single event. The SSE spec can define that when multiple subjects are present within the same event, the subject is identified as an "AND" of all such subject identifiers. This was a point of confusion in yesterday's call, but I believe this can be clarified in the specification and will not be a point of confusion once clarified. Each subject identifier specifies the category that it applies to. (i.e, one subject identifier is for the user category and another for the device category) 2. Define the "authentication status change" event such that it can take multiple optional fields. A field can be "user", another can be "device" Sending multiple events, one with a user subject and another with a device subject is not really a choice because it will mean the first event applies to everywhere the user is logged in to, and the second event applies to all users logged into the device. Having the subject category will help if the user is identified by the subject identifier type "phone number", to clarify that the subject refers to the user and not the device. Option 1 is better because it is independent of the event type. Processing multiple subject identifiers with a well defined combination semantics will help identify subjects that the event applies to in advance of processing the specific event. Option 2 intertwines the logic of event processing with subject identification and can cause an implementer to have more code that differs slightly in handling each event that has multiple subject possibilities. Atul --0000000000005771a805ad3ed88c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi all,
As agreed on the SSE call yesterday, I'= ;d like to present a use-case where I believe subject categories within a s= ubject identifier are useful. I encourage others to also send such emails i= n advance of the call next Tuesday, so that there's more clarity on the= viewpoints and use-cases.

My use case:
= Say a SSE Transmitter wants to signal that the authentication for a certain= user on a certain device has weakened (due to some change initiated, obser= ved or inferred by the transmitter). The user may have authenticated to man= y devices, and one device may have sessions for multiple users.
<= br>
In this case, the possibilities for conveying such informatio= n through an event are:
  1. Include two subject identifiers i= n a single event. The SSE spec can define that when multiple subjects are p= resent within the same event, the subject is identified as an "AND&quo= t; of all such subject identifiers. This was a point of confusion in yester= day's call, but I believe this can be clarified in the specification an= d will not be a point of confusion once clarified. Each subject identifier = specifies the category that it applies to. (i.e, one subject identifier is = for the user category and another for the device category)
  2. Define t= he "authentication status change" event such that it can take mul= tiple optional fields. A field can be "user", another can be &quo= t;device"
Sending multiple events, one with a user subje= ct and another with a device subject is not really a choice because it will= mean the first event applies to everywhere the user is logged in to, and t= he second event applies to all users logged into the device.

Having the subject category will help if the user is ident= ified by the subject identifier type "phone number", to clarify t= hat the subject refers to the user and not the device.

=
Option 1 is better because it is independent of the event t= ype. Processing multiple subject identifiers with a well defined combinatio= n semantics will help identify subjects that the event applies to in advanc= e of processing the specific event.

Option 2 inter= twines the logic of event processing with subject identification and can ca= use an implementer to have more code that differs slightly in handling each= event that has multiple subject possibilities.

At= ul

--0000000000005771a805ad3ed88c--