From nobody Fri Oct 2 14:33:27 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 67A001B2EFE for ; Fri, 2 Oct 2015 14:33:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.5 X-Spam-Level: X-Spam-Status: No, score=-0.5 tagged_above=-999 required=5 tests=[BAYES_05=-0.5] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZYBbafuYcQlm for ; Fri, 2 Oct 2015 14:33:24 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [IPv6:2600:3c03::f03c:91ff:fedf:cfab]) by ietfa.amsl.com (Postfix) with ESMTP id 159D11B2F02 for ; Fri, 2 Oct 2015 14:33:24 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id 9F6381072E for ; Fri, 2 Oct 2015 21:33:23 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Dr46yzmOMNzj for ; Fri, 2 Oct 2015 21:33:22 +0000 (UTC) Received: from anvilwalrusden.com (unknown [IPv6:2601:18d:8600:1da9:611b:b371:ffeb:72e7]) by mx2.yitter.info (Postfix) with ESMTPSA id 9092C10662 for ; Fri, 2 Oct 2015 21:33:22 +0000 (UTC) Date: Fri, 2 Oct 2015 17:33:21 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151002213320.GN91013@anvilwalrusden.com> References: <2015092917052161861514@cnnic.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2015092917052161861514@cnnic.cn> User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Oct 2015 21:33:26 -0000 Hi, On Tue, Sep 29, 2015 at 05:06:23PM +0800, Jiankang Yao wrote: > Dear all, > > I submit a draft about dbound solution. > any comments are welcome. Thanks for this contribution. I've read it, and I have some comments. It seems to me that this approach is not too dissimilar to a couple of the earlier approaches I took to the problem. In https://tools.ietf.org/html/draft-sullivan-domain-origin-assert-02 I had two different ways to assert the policy boundaries: either with names alone, or else with ports and schemes as well. In https://tools.ietf.org/html/draft-sullivan-zone-policy-assertions, I had a target document that included various policies for the zone. In draft-yao-dbound-dns-solution, there is a combination of these approaches, AFAICT, such that either the mechanism can do what the current SOPA draft offers (the one Jeff and I are working on), or else you can get a policy document from elsewhere. The features of the get-document-from-elsewhere part seem to me to be somewhat underdefined in the draft, so it's hard to know what is intended for it, but I suspect it shares the same problem that the zone-policy-assertions draft I wrote did: you could put more or less anything in the target policy, so it's nearly impossible to understand what the effects of this mechanism would be, and the ways to express the policies need to be well worked out in advance. RRTYPEs are not that expensive, so we probably don't need a general-purpose mechanism here. So I think the flag field is probably not a good idea in its own right. I'm also extremely uncomfortable with an RRTYPE that includes its own subtyping mechanism, because it isn't clear to me what an application ought to do in case both types are at the same owner name (which is certainly legal under the DNS). The relation field seems unnecessary. The "ancestry" relationship in draft-deccio-dbound-name-relationships can be read directly off the domain name itself, so explicitly including data for it in the DNS seems wasteful. The service type field got me into trouble when I tried to do this with draft-sullivan-domain-origin-assert-02. There are two reasons. First, this effectively ties DNS RDATA directly to other services, whereas we've traditionally used the DNS as a lookup device to find more stuff. (SRV and related data types already strain this boundary, and arguably DANE does too, so maybe it's no big deal.) The bigger problem, however, is that it involves a new specification of how to construct (e.g.) the same-origin rules that is totally incompatible with existing policy-enforcement deployed code. As a result, it seems fantastically unlikely to get deployed. It also isn't clear whether how the proposal can be used in the absence of the data: it seems to require a lookup at the time resources are being used. Anything that involves additional lookups in real time will simply not fly: the browsers (and mobile device people) are terribly sensitive to additional latency, lookups, and so on. So it needs to offer a way that existing code that uses a built-in PSL can work. I can see how one could construct such a list with this mechanism, but the addition of the service field means that it won't be a drop-in replacement. (Without that service field, as John Levine already noted, this proposal is no different from the SOPA type Jeff and I suggested.) Finally, I _really_ dislike the Expiration and Inception fields. I get what they're for, and they're attractive in themselves, but experience with DNSSEC has shown how hard it is to get such values right in the presence of caches, propagation times in the DNS, and so on. I don't even want to think about the timing considerations of TTL && propagation && RRSIG validity && policy validity. I think they should be shed. Best regards, A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Sat Oct 3 04:01:00 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B24121AD087 for ; Sat, 3 Oct 2015 04:00:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.16 X-Spam-Level: X-Spam-Status: No, score=-0.16 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gKECUWQiTBCm for ; Sat, 3 Oct 2015 04:00:55 -0700 (PDT) Received: from SNT004-OMC4S13.hotmail.com (snt004-omc4s13.hotmail.com [65.55.90.216]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 555051AD084 for ; Sat, 3 Oct 2015 04:00:55 -0700 (PDT) Received: from SNT407-EAS425 ([65.55.90.200]) by SNT004-OMC4S13.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Sat, 3 Oct 2015 04:00:54 -0700 X-TMN: [xGAfZDHW0onWMZ1/vgZrRMwz/d98uT3U] X-Originating-Email: [jiankangyao@hotmail.com] Message-ID: Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> From: yaojk In-Reply-To: <20151002213320.GN91013@anvilwalrusden.com> Date: Sat, 3 Oct 2015 19:10:09 +0800 To: "dbound@ietf.org" MIME-Version: 1.0 (1.0) X-OriginalArrivalTime: 03 Oct 2015 11:00:54.0979 (UTC) FILETIME=[C6885930:01D0FDCA] Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2015 11:00:58 -0000 DQoNCg0KDQo+INTaIDIwMTXE6jEw1MIzyNWjrDA1OjMzo6xBbmRyZXcgU3VsbGl2YW4gPGFqc0Bh bnZpbHdhbHJ1c2Rlbi5jb20+INC0tcCjug0KPiANCj4gSGksDQo+IA0KPj4gT24gVHVlLCBTZXAg MjksIDIwMTUgYXQgMDU6MDY6MjNQTSArMDgwMCwgSmlhbmthbmcgWWFvIHdyb3RlOg0KPj4gRGVh ciBhbGwsDQo+PiANCj4+ICAgICAgIEkgc3VibWl0IGEgZHJhZnQgYWJvdXQgZGJvdW5kIHNvbHV0 aW9uLg0KPj4gICAgICAgYW55IGNvbW1lbnRzIGFyZSB3ZWxjb21lLg0KPiANCj4gVGhhbmtzIGZv ciB0aGlzIGNvbnRyaWJ1dGlvbi4gIEkndmUgcmVhZCBpdCwgYW5kIEkgaGF2ZSBzb21lIGNvbW1l bnRzLg0KDQpUaGFua3MgZm9yIHlvdXIga2luZCByZWFkaW5nLg0KDQo+IEl0IHNlZW1zIHRvIG1l IHRoYXQgdGhpcyBhcHByb2FjaCBpcyBub3QgdG9vIGRpc3NpbWlsYXIgdG8gYSBjb3VwbGUgb2YN Cj4gdGhlIGVhcmxpZXIgYXBwcm9hY2hlcyBJIHRvb2sgdG8gdGhlIHByb2JsZW0uICBJbg0KPiBo dHRwczovL3Rvb2xzLmlldGYub3JnL2h0bWwvZHJhZnQtc3VsbGl2YW4tZG9tYWluLW9yaWdpbi1h c3NlcnQtMDIgSQ0KPiBoYWQgdHdvIGRpZmZlcmVudCB3YXlzIHRvIGFzc2VydCB0aGUgcG9saWN5 IGJvdW5kYXJpZXM6IGVpdGhlciB3aXRoDQo+IG5hbWVzIGFsb25lLCBvciBlbHNlIHdpdGggcG9y dHMgYW5kIHNjaGVtZXMgYXMgd2VsbC4gIEluDQo+IGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9kcmFmdC1zdWxsaXZhbi16b25lLXBvbGljeS1hc3NlcnRpb25zLCBJDQo+IGhhZCBhIHRhcmdl dCBkb2N1bWVudCB0aGF0IGluY2x1ZGVkIHZhcmlvdXMgcG9saWNpZXMgZm9yIHRoZSB6b25lLg0K PiANCj4gSW4gZHJhZnQteWFvLWRib3VuZC1kbnMtc29sdXRpb24sIHRoZXJlIGlzIGEgY29tYmlu YXRpb24gb2YgdGhlc2UNCj4gYXBwcm9hY2hlcywgQUZBSUNULCBzdWNoIHRoYXQgZWl0aGVyIHRo ZSBtZWNoYW5pc20gY2FuIGRvIHdoYXQgdGhlDQo+IGN1cnJlbnQgU09QQSBkcmFmdCBvZmZlcnMg KHRoZSBvbmUgSmVmZiBhbmQgSSBhcmUgd29ya2luZyBvbiksIG9yIGVsc2UNCj4geW91IGNhbiBn ZXQgYSBwb2xpY3kgZG9jdW1lbnQgZnJvbSBlbHNld2hlcmUuICBUaGUgZmVhdHVyZXMgb2YgdGhl DQo+IGdldC1kb2N1bWVudC1mcm9tLWVsc2V3aGVyZSBwYXJ0IHNlZW0gdG8gbWUgdG8gYmUgc29t ZXdoYXQNCj4gdW5kZXJkZWZpbmVkIGluIHRoZSBkcmFmdCwgc28gaXQncyBoYXJkIHRvIGtub3cg d2hhdCBpcyBpbnRlbmRlZCBmb3INCj4gaXQsIGJ1dCBJIHN1c3BlY3QgaXQgc2hhcmVzIHRoZSBz YW1lIHByb2JsZW0gdGhhdCB0aGUNCj4gem9uZS1wb2xpY3ktYXNzZXJ0aW9ucyBkcmFmdCBJIHdy b3RlIGRpZDogeW91IGNvdWxkIHB1dCBtb3JlIG9yIGxlc3MNCj4gYW55dGhpbmcgaW4gdGhlIHRh cmdldCBwb2xpY3ksIHNvIGl0J3MgbmVhcmx5IGltcG9zc2libGUgdG8gdW5kZXJzdGFuZA0KPiB3 aGF0IHRoZSBlZmZlY3RzIG9mIHRoaXMgbWVjaGFuaXNtIHdvdWxkIGJlLCBhbmQgdGhlIHdheXMg dG8gZXhwcmVzcw0KPiB0aGUgcG9saWNpZXMgbmVlZCB0byBiZSB3ZWxsIHdvcmtlZCBvdXQgaW4g YWR2YW5jZS4gIFJSVFlQRXMgYXJlIG5vdA0KPiB0aGF0IGV4cGVuc2l2ZSwgc28gd2UgcHJvYmFi bHkgZG9uJ3QgbmVlZCBhIGdlbmVyYWwtcHVycG9zZSBtZWNoYW5pc20NCj4gaGVyZS4gIA0KDQpB bnkgbmV3IHJydHlwZSBiYXNlZCBETlMgc29sdXRpb25zIHdpbGwgc2hhcmUgc29tZXRoaW5nIHNp bWlsYXIgYmVjYXVzZSANClRoZXkgYWxsIHVzZSB0aGUgYmFzaWMgRE5TIGZlYXR1cmUuDQpJZiB0 aGVyZSBpcyBhIGdlbmVyYWwgbWVjaGFuaXNtIHdoaWNoIGNhbiB3b3JrcyB3ZWxsLCB3aHkgZG8g d2UgcmVmdXNlIGl0o78NCk9mIGNvdXJzZSwgdGhlIHdnIGZpbmFsbHkgZGVjaWRlIGl0Lg0KSSBh bHNvIHRob3VnaHQgb2YgREREUyBiYXNlZCBzb2x1dGlvbiwgYnV0IGl0IHNlZW1zIHRvIGJlIG1v cmUgY29tcGxleGl0eSwgbm90IGVhc2lseSBkZXBsb3libGUuDQoNCj4gU28gSSB0aGluayB0aGUg ZmxhZyBmaWVsZCBpcyBwcm9iYWJseSBub3QgYSBnb29kIGlkZWEgaW4gaXRzDQo+IG93biByaWdo dC4NCg0KQmVjYXVzZSB0aGVyZSBhcmUgdHdvIGtpbmRzIG9mIHNlcnZpY2UgcmVsYXRpb25zaGlw cywgb25lIGRlY2lkZWQgYnkgdGhlIGNlbnRyYWxpemVkIGF1dGhvcml0eSBzdWNoIGFzIFBTTCwg dGhlIG90aGVyIGRlY2lkZWQgYnkgdGhlbXNlbHZlcyAsIHRoaXMgZmxhZyB3aWxsIGluZGljYXRl IHRoYXQgaW5mb3JtYXRpb24uDQoNCg0KPiAgSSdtIGFsc28gZXh0cmVtZWx5IHVuY29tZm9ydGFi bGUgd2l0aCBhbiBSUlRZUEUgdGhhdA0KPiBpbmNsdWRlcyBpdHMgb3duIHN1YnR5cGluZyBtZWNo YW5pc20sIGJlY2F1c2UgaXQgaXNuJ3QgY2xlYXIgdG8gbWUNCj4gd2hhdCBhbiBhcHBsaWNhdGlv biBvdWdodCB0byBkbyBpbiBjYXNlIGJvdGggdHlwZXMgYXJlIGF0IHRoZSBzYW1lDQo+IG93bmVy IG5hbWUgKHdoaWNoIGlzIGNlcnRhaW5seSBsZWdhbCB1bmRlciB0aGUgRE5TKS4NCj4gDQpTb21l IGRvbWFpbiBuYW1lcyBtYXkgb25seSBzaGFyZSB0aGUgRE5TIGJvdW5kYXJpZXMgZm9yIHNvbWUg c3BlY2lmaWMgc2VydmljZSB0eXBlcyBzdWNoIGFzIGh0dHBzIHNlcnZpY2UgdHlwZS4gU28gdGhl IGRib3VuZCBETlMgdHlwZSBpcyBmb3IgRE5TIGxvb2t1cCB3aGlsZSB0aGUgImh0dHBzICIgaXMg dG8gY29uZmlybSB0aGF0IHRoZXNlIG5hbWUgd2lsbCBvbmx5IHNoYXJlIHRoZSBETlMgYm91bmRh cmllcyB1bmRlciB0aGUgImh0dHBzIiBzZXJ2aWNlIGFmdGVyIHRoZSBETlMgbG9va3VwIGZvciBk Ym91bmQuDQoNCg0KSXQgaXMgdGhlIHByb2dyYW0gd2hpY2ggZGVhbCB3aXRoIGl0LiBJIGRvIG5v dCB0aGluayB0aGF0IHRoZXJlIGhhcyBzb21ldGhpbmcgdW5jbGVhci4NCg0KDQo+IFRoZSByZWxh dGlvbiBmaWVsZCBzZWVtcyB1bm5lY2Vzc2FyeS4gIFRoZSAiYW5jZXN0cnkiIHJlbGF0aW9uc2hp cCBpbg0KPiBkcmFmdC1kZWNjaW8tZGJvdW5kLW5hbWUtcmVsYXRpb25zaGlwcyBjYW4gYmUgcmVh ZCBkaXJlY3RseSBvZmYgdGhlDQo+IGRvbWFpbiBuYW1lIGl0c2VsZiwgc28gZXhwbGljaXRseSBp bmNsdWRpbmcgZGF0YSBmb3IgaXQgaW4gdGhlIEROUw0KPiBzZWVtcyB3YXN0ZWZ1bC4NCg0KDQpU aGUgd2cgY2FuIGRpc2N1c3MgaXQgYW5kIGRlY2lkZSBpdC4NCg0KDQo+IA0KPiBUaGUgc2Vydmlj ZSB0eXBlIGZpZWxkIGdvdCBtZSBpbnRvIHRyb3VibGUgd2hlbiBJIHRyaWVkIHRvIGRvIHRoaXMN Cj4gd2l0aCBkcmFmdC1zdWxsaXZhbi1kb21haW4tb3JpZ2luLWFzc2VydC0wMi4gIFRoZXJlIGFy ZSB0d28gcmVhc29ucy4NCj4gRmlyc3QsIHRoaXMgZWZmZWN0aXZlbHkgdGllcyBETlMgUkRBVEEg ZGlyZWN0bHkgdG8gb3RoZXIgc2VydmljZXMsDQo+IHdoZXJlYXMgd2UndmUgdHJhZGl0aW9uYWxs eSB1c2VkIHRoZSBETlMgYXMgYSBsb29rdXAgZGV2aWNlIHRvIGZpbmQNCj4gbW9yZSBzdHVmZi4g IChTUlYgYW5kIHJlbGF0ZWQgZGF0YSB0eXBlcyBhbHJlYWR5IHN0cmFpbiB0aGlzIGJvdW5kYXJ5 LA0KPiBhbmQgYXJndWFibHkgREFORSBkb2VzIHRvbywgc28gbWF5YmUgaXQncyBubyBiaWcgZGVh bC4pICBUaGUgYmlnZ2VyDQo+IHByb2JsZW0sIGhvd2V2ZXIsIGlzIHRoYXQgaXQgaW52b2x2ZXMg YSBuZXcgc3BlY2lmaWNhdGlvbiBvZiBob3cgdG8NCj4gY29uc3RydWN0IChlLmcuKSB0aGUgc2Ft ZS1vcmlnaW4gcnVsZXMgdGhhdCBpcyB0b3RhbGx5IGluY29tcGF0aWJsZQ0KPiB3aXRoIGV4aXN0 aW5nIHBvbGljeS1lbmZvcmNlbWVudCBkZXBsb3llZCBjb2RlLiAgQXMgYSByZXN1bHQsIGl0IHNl ZW1zDQo+IGZhbnRhc3RpY2FsbHkgdW5saWtlbHkgdG8gZ2V0IGRlcGxveWVkLg0KPiANCg0KDQpE TlMgYm91bmRhcmllcyBpc3N1ZXMgbWF5IGJlIG1vcmUgY29tcGxpY2F0ZWQgdGhhbiB3aGF0IFdl IGNhbiBpbWFnaW5lLiBXZSdkIGJldHRlciBjb3ZlciBtb3N0IGlzc3VlcyBhcHBlYXJlZCBvciB0 aGF0IHdpbGwgYXBwZWFyLg0KDQoNCj4gSXQgYWxzbyBpc24ndCBjbGVhciB3aGV0aGVyIGhvdyB0 aGUgcHJvcG9zYWwgY2FuIGJlIHVzZWQgaW4gdGhlDQo+IGFic2VuY2Ugb2YgdGhlIGRhdGE6IGl0 IHNlZW1zIHRvIHJlcXVpcmUgYSBsb29rdXAgYXQgdGhlIHRpbWUNCj4gcmVzb3VyY2VzIGFyZSBi ZWluZyB1c2VkLiAgQW55dGhpbmcgdGhhdCBpbnZvbHZlcyBhZGRpdGlvbmFsIGxvb2t1cHMNCj4g aW4gcmVhbCB0aW1lIHdpbGwgc2ltcGx5IG5vdCBmbHk6IHRoZSBicm93c2VycyAoYW5kIG1vYmls ZSBkZXZpY2UNCj4gcGVvcGxlKSBhcmUgdGVycmlibHkgc2Vuc2l0aXZlIHRvIGFkZGl0aW9uYWwg bGF0ZW5jeSwgbG9va3VwcywgYW5kIHNvDQo+IG9uLiAgU28gaXQgbmVlZHMgdG8gb2ZmZXIgYSB3 YXkgdGhhdCBleGlzdGluZyBjb2RlIHRoYXQgdXNlcyBhDQo+IGJ1aWx0LWluIFBTTCBjYW4gd29y ay4gIEkgY2FuIHNlZSBob3cgb25lIGNvdWxkIGNvbnN0cnVjdCBzdWNoIGEgbGlzdA0KPiB3aXRo IHRoaXMgbWVjaGFuaXNtLCBidXQgdGhlIGFkZGl0aW9uIG9mIHRoZSBzZXJ2aWNlIGZpZWxkIG1l YW5zIHRoYXQNCj4gaXQgd29uJ3QgYmUgYSBkcm9wLWluIHJlcGxhY2VtZW50LiAgKFdpdGhvdXQg dGhhdCBzZXJ2aWNlIGZpZWxkLCBhcw0KPiBKb2huIExldmluZSBhbHJlYWR5IG5vdGVkLCB0aGlz IHByb3Bvc2FsIGlzIG5vIGRpZmZlcmVudCBmcm9tIHRoZSBTT1BBDQo+IHR5cGUgSmVmZiBhbmQg SSBzdWdnZXN0ZWQuKQ0KPiANCj4gRmluYWxseSwgSSBfcmVhbGx5XyBkaXNsaWtlIHRoZSBFeHBp cmF0aW9uIGFuZCBJbmNlcHRpb24gZmllbGRzLiAgSQ0KPiBnZXQgd2hhdCB0aGV5J3JlIGZvciwg YW5kIHRoZXkncmUgYXR0cmFjdGl2ZSBpbiB0aGVtc2VsdmVzLCBidXQNCj4gZXhwZXJpZW5jZSB3 aXRoIEROU1NFQyBoYXMgc2hvd24gaG93IGhhcmQgaXQgaXMgdG8gZ2V0IHN1Y2ggdmFsdWVzDQo+ IHJpZ2h0IGluIHRoZSBwcmVzZW5jZSBvZiBjYWNoZXMsIHByb3BhZ2F0aW9uIHRpbWVzIGluIHRo ZSBETlMsIGFuZCBzbw0KPiBvbi4gIEkgZG9uJ3QgZXZlbiB3YW50IHRvIHRoaW5rIGFib3V0IHRo ZSB0aW1pbmcgY29uc2lkZXJhdGlvbnMgb2YgVFRMDQo+ICYmIHByb3BhZ2F0aW9uICYmIFJSU0lH IHZhbGlkaXR5ICYmIHBvbGljeSB2YWxpZGl0eS4gIEkgdGhpbmsgdGhleQ0KPiBzaG91bGQgYmUg c2hlZC4NCg0KSWYgdGhlIHNpbXBsZSBzb2x1dGlvbiBjYW4gc29sdmUgZXZlcnl0aGluZywgdGhh dCBpcyBvay4gIElmIEROUyBib3VuZGFyaWVzIGlzc3VlIGlzIHRvbyBjb21wbGV4LCB3ZSBtaWdo dCBoYXZlIHRvIG5lZWQgYSBjb21wbGV4IG9uZS4NCg0KPiANCj4gQmVzdCByZWdhcmRzLA0KDQpU aGUgRE5TIGJvdW5kYXJpZXMgaXNzdWUgaXMgdmVyeSBpbXBvcnRhbnQuIFRoaXMgZHJhZnQgaXMg Zm9yIGRpc2N1c3Npb24sIHdoaWNoIG1heSBoZWxwIHRvIHRyaWdnZXIgYSBiZXR0ZXIgcHJvcG9z YWwuIEkgaG9wZSB0aGF0IHRoZSB3ZyBjYW4gcHJvcG9zZSBhIGJldHRlciBzb2x1dGlvbiBiYXNl ZCBvbiBpdCBvciBub3QuDQoNClRoYW5rcy4NCg0KSmlhbmthbmcgDQo+IA0KPiBBDQo+IA0KPiAt LSANCj4gQW5kcmV3IFN1bGxpdmFuDQo+IGFqc0BhbnZpbHdhbHJ1c2Rlbi5jb20NCj4gDQo+IF9f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+IGRib3VuZCBt YWlsaW5nIGxpc3QNCj4gZGJvdW5kQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21h aWxtYW4vbGlzdGluZm8vZGJvdW5kDQo+IA0K From nobody Sat Oct 3 04:33:18 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 19C5C1B3618 for ; Sat, 3 Oct 2015 04:33:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.359 X-Spam-Level: X-Spam-Status: No, score=-0.359 tagged_above=-999 required=5 tests=[BAYES_05=-0.5, MIME_CHARSET_FARAWAY=2.45, NO_DNS_FOR_FROM=0.001, RCVD_IN_DNSWL_MED=-2.3, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kacnzFXaIW4r for ; Sat, 3 Oct 2015 04:32:43 -0700 (PDT) Received: from vacation.karoshi.com (vacation.karoshi.com [198.32.6.68]) by ietfa.amsl.com (Postfix) with ESMTP id 74AEA1B361F for ; Sat, 3 Oct 2015 04:32:27 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by vacation.karoshi.com (Postfix) with ESMTP id C009BC3D4C4; Sat, 3 Oct 2015 04:32:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at karoshi.com Received: from vacation.karoshi.com ([127.0.0.1]) by localhost (vacation.karoshi.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m5F_tynz17RS; Sat, 3 Oct 2015 04:32:01 -0700 (PDT) Received: from [192.168.0.4] (cpe-172-90-219-168.socal.res.rr.com [172.90.219.168]) by vacation.karoshi.com (Postfix) with ESMTPSA id E41B1C3D4BA; Sat, 3 Oct 2015 04:31:57 -0700 (PDT) Mime-Version: 1.0 (Mac OS X Mail 7.3 \(1878.6\)) Content-Type: text/plain; charset=GB2312 From: manning In-Reply-To: Date: Sat, 3 Oct 2015 04:31:49 -0700 Content-Transfer-Encoding: quoted-printable Message-Id: References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> To: yaojk X-Mailer: Apple Mail (2.1878.6) Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2015 11:33:18 -0000 Just one comment for now. On 3October2015Saturday, at 4:10, yaojk wrote: >=20 >> =D4=DA 2015=C4=EA10=D4=C23=C8=D5=A3=AC05:33=A3=ACAndrew Sullivan = =D0=B4=B5=C0=A3=BA >>=20 >> Hi, >>=20 >>> On Tue, Sep 29, 2015 at 05:06:23PM +0800, Jiankang Yao wrote: >>> Dear all, >>>=20 >>> I submit a draft about dbound solution. >>> any comments are welcome. >>=20 >=20 >> So I think the flag field is probably not a good idea in its >> own right. >=20 > Because there are two kinds of service relationships, one decided by = the centralized authority such as PSL, the other decided by themselves , = this flag will indicate that information. The only two types are me and everyone else. There is no centralized = authority per se. I can serve data authoritatively or I can serve data = received from others. The DNSSEC validation model tracks the = authoritative source of the data. Given these, I can see no value to = flags. /bill= From nobody Sat Oct 3 07:22:38 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9E6441B29A3 for ; Sat, 3 Oct 2015 07:22:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.16 X-Spam-Level: X-Spam-Status: No, score=-0.16 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UwV5QJ0cvADb for ; Sat, 3 Oct 2015 07:22:34 -0700 (PDT) Received: from SNT004-OMC4S33.hotmail.com (snt004-omc4s33.hotmail.com [65.55.90.236]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 020511B29A2 for ; Sat, 3 Oct 2015 07:22:33 -0700 (PDT) Received: from SNT407-EAS192 ([65.55.90.201]) by SNT004-OMC4S33.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Sat, 3 Oct 2015 07:22:33 -0700 X-TMN: [GyuY5F+/jDXAzuyUy5WEHw/LZgd5HHjP] X-Originating-Email: [jiankangyao@hotmail.com] Message-ID: Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 References: <20150929195514.14378.qmail@ary.lan> From: yaojk MIME-Version: 1.0 (1.0) In-Reply-To: <20150929195514.14378.qmail@ary.lan> Date: Sat, 3 Oct 2015 22:31:48 +0800 To: John Levine X-OriginalArrivalTime: 03 Oct 2015 14:22:33.0737 (UTC) FILETIME=[F1F44F90:01D0FDE6] Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2015 14:22:37 -0000 DQoNCg0K1NogMjAxNcTqOdTCMzDI1aOsMDM6NTWjrEpvaG4gTGV2aW5lIDxqb2hubEB0YXVnaC5j b20+INC0tcCjug0KDQo+PiAgICAgIEkgc3VibWl0IGEgZHJhZnQgYWJvdXQgZGJvdW5kIHNvbHV0 aW9uLg0KPiANCj4gVGhpcyBsb29rcyBzaW1pbGFyIHRvIHRoZSBTT1BBIHJlY29yZCB0aGF0IEFu ZHJldyBTdWxsaXZhbiBwcm9wb3NlZA0KPiBhYm91dCBhIHllYXIgYWdvLg0KPiANCj4gSWYgSSB3 YW50IHRvIHNheSwgImFsbCBuYW1lcyB1bmRlciBleGFtcGxlLmNvbSBhcmUgdW5kZXIgdGhlIHNh bWUNCj4gYXV0aG9yaXR5IiwgaG93IGRvIEkgZG8gdGhhdD8gIERvIEkgaGF2ZSB0byBwdXQgYSBE Qk9VTkQgcmVjb3JkIGF0DQo+IGV2ZXJ5IG5hbWUgdGhhdCBleGlzdHMgYXQgYW5kIGJlbG93IGV4 YW1wbGUuY29tPw0KPiANCg0KSXQgaXMgd2lsZGNhcmQgaXNzdWUuIEl0IGlzIGFuIGluaXRpYWwg ZHJhZnQsIHdoaWNoIHN0aWxsIGRvZXMgbm90IGNvdmVyIGl0LiANCg0KDQpUaGFua3MNCg0KSmlh bmthbmcgDQoNCj4gUidzLA0KPiBKb2huDQo+IA0KPiBfX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fXw0KPiBkYm91bmQgbWFpbGluZyBsaXN0DQo+IGRib3VuZEBp ZXRmLm9yZw0KPiBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Rib3VuZA0K PiANCg== From nobody Sat Oct 3 07:49:32 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A6B671B29EE for ; Sat, 3 Oct 2015 07:49:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.137 X-Spam-Level: X-Spam-Status: No, score=-1.137 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8LEY4fK4k5Nz for ; Sat, 3 Oct 2015 07:49:29 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 878111B29ED for ; Sat, 3 Oct 2015 07:49:29 -0700 (PDT) Received: (qmail 42585 invoked from network); 3 Oct 2015 14:49:29 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=a658.560feaf9.k1510; bh=S03YbTmZwcsNcL8I3N3EtL4OnT+od3vO44lyz32Rh5U=; b=wEcF5L1ztlyS55K9Brhqdmnnun4VRy6rxg/oMcU9MMLYzTfeFlGRaH6yjOJJl4MlnavTZosVQMrRC7RcRbYXnLIzmMWoLsrwQtt2mcXrYUI8fMC44PXZO751kQRWUGgomy9H/nkPPTvtdItNsfXGe+h2mVpHb3eANOrHmBXJD8XF+E03hCe1FPr+PxtQ4KOphpY+H4ByK3vc9nOJu+4eiDPY40r7PKywxziw6HPDXzT4rDjqM6GjTkRf1OdlDopH DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=a658.560feaf9.k1510; bh=S03YbTmZwcsNcL8I3N3EtL4OnT+od3vO44lyz32Rh5U=; b=WPuW4mhT472/cZxiig8DNCkxV0hUfbXtufJViMK9RjYclT30rcu9MyF4REk6wRj6wVCKW8UJjw62NZ6E/U9CDhWdWDDa+Vn6Ai5kHthEIe3n+yFubRAQoD1GM0c5v+R5piH5sdMqyrpRTJ/1QvWxyzKHrnVq5aBd8K/BRTLM9KQnQ2ZR+YPwXkTlmzzGH49QCFD+Bj4OBYa9oS4cTBQ7H2zD+gKC7HKhyzngCCeM0uT73QovGf0S+X+KHmUoqh/5 Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 03 Oct 2015 14:49:29 -0000 Date: 3 Oct 2015 10:49:27 -0400 Message-ID: From: "John R Levine" To: "yaojk" In-Reply-To: References: <20150929195514.14378.qmail@ary.lan> User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2015 14:49:31 -0000 >> If I want to say, "all names under example.com are under the same >> authority", how do I do that? Do I have to put a DBOUND record at >> every name that exists at and below example.com? > > It is wildcard issue. It is an initial draft, which still does not cover it. I think you will find that DNS wildcards don't do what you want. In particular, wildcards don't match anywhere that a name exists, even if there are no records at that name. So if you have a wildcard at *.example.com with your proposed record, and an A record at a.b.example.com, the wildcard will not match a.b.example.com or b.example.com. Andrew's SOPA record has the same problem, you'd need to put a SOPA record at every name that exists in the DNS subtree, which would be a very difficult provisioning problem. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Sat Oct 3 08:31:26 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C54291B2A9A for ; Sat, 3 Oct 2015 08:31:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.441 X-Spam-Level: X-Spam-Status: No, score=0.441 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, J_CHICKENPOX_37=0.6, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HNauzBUaQQRW for ; Sat, 3 Oct 2015 08:31:19 -0700 (PDT) Received: from SNT004-OMC4S31.hotmail.com (snt004-omc4s31.hotmail.com [65.55.90.234]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 702281B2A96 for ; Sat, 3 Oct 2015 08:31:19 -0700 (PDT) Received: from SNT407-EAS311 ([65.55.90.201]) by SNT004-OMC4S31.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Sat, 3 Oct 2015 08:31:18 -0700 X-TMN: [JnfSCaVxTRo0Si/o+KPOFTkteNQznKj1] X-Originating-Email: [jiankangyao@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="Apple-Mail-E8E4E0AB-850F-4689-AABD-9069E0B2A2D4" Content-Transfer-Encoding: 7bit References: <2015092917052161861514@cnnic.cn> <877fn9xc30.fsf@alice.fifthhorseman.net> From: yaojk MIME-Version: 1.0 (1.0) In-Reply-To: <877fn9xc30.fsf@alice.fifthhorseman.net> Date: Sat, 3 Oct 2015 23:40:29 +0800 To: Daniel Kahn Gillmor X-OriginalArrivalTime: 03 Oct 2015 15:31:18.0445 (UTC) FILETIME=[8C78CDD0:01D0FDF0] Archived-At: Cc: dbound Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Oct 2015 15:31:26 -0000 --Apple-Mail-E8E4E0AB-850F-4689-AABD-9069E0B2A2D4 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 DQoNCg0KDQo+INTaIDIwMTXE6jnUwjMwyNWjrDAzOjI1o6xEYW5pZWwgS2FobiBHaWxsbW9yIDxk a2dAZmlmdGhob3JzZW1hbi5uZXQ+INC0tcCjug0KPiANCj4+IE9uIFR1ZSAyMDE1LTA5LTI5IDA1 OjA2OjIzIC0wNDAwLCBKaWFua2FuZyBZYW8gPHlhb2prQGNubmljLmNuPiB3cm90ZToNCj4+IA0K Pj4gICAgICAgSSBzdWJtaXQgYSBkcmFmdCBhYm91dCBkYm91bmQgc29sdXRpb24uDQo+PiAgICAg ICBhbnkgY29tbWVudHMgYXJlIHdlbGNvbWUuDQo+IFsuLi5dDQo+PiBOYW1lOiBkcmFmdC15YW8t ZGJvdW5kLWRucy1zb2x1dGlvbg0KPj4gUmV2aXNpb246IDAwDQo+PiBUaXRsZTogUmVzb3VyY2Ug UmVjb3JkIGZvciBETlMgQWRtaW5pc3RyYXRpdmUgQm91bmRhcmllcw0KPj4gRG9jdW1lbnQgZGF0 ZTogMjAxNS0wOS0yOA0KPj4gR3JvdXA6IEluZGl2aWR1YWwgU3VibWlzc2lvbg0KPj4gUGFnZXM6 IDExDQo+PiBVUkw6ICAgICAgICAgICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvaW50ZXJuZXQtZHJh ZnRzL2RyYWZ0LXlhby1kYm91bmQtZG5zLXNvbHV0aW9uLTAwLnR4dA0KPj4gU3RhdHVzOiAgICAg ICAgIGh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5vcmcvZG9jL2RyYWZ0LXlhby1kYm91bmQtZG5z LXNvbHV0aW9uLw0KPj4gSHRtbGl6ZWQ6ICAgICAgIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRt bC9kcmFmdC15YW8tZGJvdW5kLWRucy1zb2x1dGlvbi0wMA0KPiANCj4gVGhhbmtzIGZvciB3b3Jr aW5nIG9uIHRoaXMhDQo+IA0KPiBJIGRpZCBhIHF1aWNrIHJlYWQgb2YgdGhpcyBkcmFmdCwgYW5k IGkgdGhpbmsgaSBhbSBjb25mdXNlZCBieSBpdC4gOigNCg0KDQpUaGFua3MgYSBsb3QgZm9yIHlv dXIga2luZCByZWFkaW5nIGFuZCBjb21tZW50cy4gDQoNClRoZSBkYm91bmQgaXNzdWUgaXMgY29t cGxpY2F0ZWQuIFNvIHRoZSBzb2x1dGlvbiBwcm9wb3NlZCBpcyBhbHNvIGEgbGl0dGxlIGNvbXBs ZXguICBJdCBjYW4gZWFzaWx5IGNhdXNlIGNvbmZ1c2lvbiBieSBGaXJzdCByZWFkaW5nLiA6KQ0K DQo+IA0KPiBJIGhhdmUgdGhyZWUgbWFpbiBjb25mdXNpb25zIHRoYXQgaSB3b3VsZCB0cnkgdG8g Y2xlYXIgdXAgYmVmb3JlDQo+IHRoaW5raW5nIG1vcmUgZGVlcGx5IGFib3V0IHRoZSBkcmFmdDoN Cj4gDQo+IEFuY2VzdHJ5IHZzLiBQb2xpY3kNCj4gLS0tLS0tLS0tLS0tLS0tLS0tLQ0KPiANCj4g VGhpcyBkcmFmdCBwcm9wb3NlcyBhIHNpbmdsZSBtZWNoYW5pc20gdGhhdCBjYW4gd29yayBmb3Ig em9uZXMgc2NvcGVkIGJ5DQo+IGJvdGggYW5jZXN0cnkgYW5kIHBvbGljeS4gIEl0J3Mgbm90IGNs ZWFyIHRoYXQgdGhlIHNhbWUgbWVjaGFuaXNtIHNob3VsZA0KPiBiZSB1c2VkIGZvciBib3RoIG9m IHRoZXNlIGRpc3RpbmN0aW9ucy4gIGZ1cnRoZXJtb3JlLCB5b3VyIGFuY2VzdHJ5DQo+IG1lY2hh bmlzbSBhcHBlYXIgdG8gb25seSBzdXBwb3J0IGJpbGF0ZXJhbCBwb2xpY3kgYWdyZWVtZW50cyAt LSBBIG11c3QNCj4gcG9pbnQgdG8gQiBhbmQgQiBtdXN0IHBvaW50IHRvIEEuICBUaGUgdXN1YWwg YW5jZXN0cmFsIHJlbGF0aW9uc2hpcHMgYXJlDQo+IHRoYXQgZm9vLmJhci5leGFtcGxlIGFuZCBx dXguYmFyLmV4YW1wbGUgYm90aCB1c2UgYmFyLmV4YW1wbGUgYXMgdGhlaXINCj4gYWRtaW5pc3Ry YXRpdmUgYm91bmRhcnkuICBUaGUgcHJvcG9zYWwgaGVyZSwgZXZlbiBpZiBpJ20NCj4gbWlzdW5k ZXJzdGFuZGluZyB0aGUgcGFydCB0aGF0IGFwcGVhcnMgdG8gcmVxdWlyZSBiaWxhdGVyYWwgcG9s aWN5LCBhdA0KPiBsZWFzdCByZXF1aXJlcyBhbiBhIERCT1VORCBSUiBmb3IgZWFjaCBETlMgcmVj b3JkIGxvb2tlZCB1cC4gIFRoaXMgd291bGQNCj4gbWFzc2l2ZWx5IGluZmxhdGUgdGhlIHNpemUg b2YgbW9zdCB6b25lcy4gIEEgZGVjaXNpb24gYmFzZWQgb24gYW5jZXN0cnkNCj4gbWlnaHQgYmUg bXVjaCBlYXNpZXIgdG8gZmluZCB3aXRoIHNpbXBsZSB1cC13YWxraW5nIGFwcHJvYWNoOiBmb3IN Cj4gZm9vLmJhci5leGFtcGxlLCBsb29rIGZvciBhIERCT1VORCByZWNvcmQgZm9yIGZvby5iYXIu ZXhhbXBsZSwgdGhlbiBpZg0KPiB0aGF0J3MgTlhET01BSU4sIGxvb2sgZm9yIGJhci5leGFtcGxl Lg0KPiANCj4gVGhlIGNvbnNlbnN1cyBpIGhlYXJkIGluIHRoZSByb29tIGluIFByYWd1ZSB3YXMg dGhhdCB0cnlpbmcgdG8gc29sdmUNCj4gYm90aCBhbmNlc3RyeSBhbmQgcG9saWN5IHJlbGF0aW9u c2hpcHMgd2l0aCB0aGUgc2FtZSBtZWNoYW5pc20gc21lbGxzDQo+IG92ZXJseSBjb21wbGV4LiAg TWF5YmUgaXQgd291bGQgYmUgYmV0dGVyIHRvIHN0YXJ0IHdpdGggYSBwcm9wb3NhbCB0aGF0DQo+ IGhhbmRsZXMgb25seSBvbmUgb2YgdGhlbT8NCj4gDQo+IA0KDQo+IEFuY2VzdHJ5IHZzLiBQb2xp Y3kNCg0KQW5jZXN0cnkgYW5kIHBvbGljeSBjYW4gYWRkIG1vcmUgY29tcGxleCBpc3N1ZXMgdG8g ZGJvdW5kIHNvbHV0aW9uLiBJIHRoaW5rIHRoYXQgdGhpcyB0b3BpYyBtaWdodCBuZWVkIG1vcmUg ZGlzY3Vzc2lvbiBiZWZvcmUgZmluZGluZyBvdXQgYSBnb29kIHNvbHV0aW9uLg0KDQo+IFRhcmdl dCBOYW1lczogVVJMIHZzIG90aGVyIEROUyBsYWJlbD8NCj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLQ0KPiANCj4gVGhlIFVSTCBhcHByb2FjaCBzZWVtcyB2ZXJ5IHVuZGVy c3BlY2lmaWVkLiAgV2hhdCBzb3J0IG9mIFVSTHMgc2hvdWxkIGJlDQo+IHJldHJpZXZhYmxlIGJ5 IGFuIGltcGxlbWVudGF0aW9uPyAgd2hhdCBzaG91bGQgYW4gaW1wbGVtZW50YXRpb24gZG8gd2l0 aA0KPiB0aGUgcmV0cmlldmVkIGRhdGE/DQoNClRoZSB1cmwgaXMgdGhlIG9uZSB3aGljaCBpcyB0 byBiZSBhZ3JlZWQgYnkgYm90aCBuYW1lcy4gVGhlIHVybCBtYXkgYmUgYSBmYW1vdXMgb25lIHN1 Y2ggYXMgUFNMIG9yIGFueSBwcml2YXRlIG9uZSB3aGljaCBpcyBqdXN0IGFncmVlZCBieSBzb21l IG5hbWVzLg0KDQo+IA0KPiBJIHRoaW5rIGl0IHdvdWxkIGJlIGJldHRlciB0byBqdXN0IHRoaW5r IGFib3V0IHN0YXRpbmcgdGhlIGV4aXN0ZW5jZSBvZg0KPiBzb21lIHR5cGUgb2YgcG9saWN5IGJv dW5kYXJ5IGluIHRoZSBETlMsIHdpdGhvdXQgdHJ5aW5nIHRvIHNwZWMgb3V0IHRoZQ0KPiBzdHJ1 Y3R1cmUgb2YgYWxsIHBvc3NpYmxlIHBvbGljaWVzIHRoYXQgY291bGQgaGF2ZSBib3VuZGFyaWVz IGluIHRoZQ0KPiBETlMNCg0KWW91ciBwcm9wb3NhbCBpcyBvbmUga2luZCBvZiBjaG9pY2VzLiBT cGVjaWFsIG9uZSBWUyBHZW5lcmFsIG9uZQ0KDQo+IA0KPiANCj4gRXhwaXJhdGlvbnMgdnMuIERO UyBUVEwgKGFuZCBSUlNJRykNCj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0K PiANCj4gRE5TIHJlY29yZHMgYWxyZWFkeSBoYXZlIGEgVFRMIChhbmQgRE5TU0VDIHJlY29yZHMg aGF2ZSB0aGUNCj4gaW5jZXB0aW9uL2V4cGlyYXRpb24gb2YgdGhlIFJSU0lHKS4gIFRoaXMgZHJh ZnQgaW50cm9kdWNlcyBuZXcNCj4gYWRkaXRpb25hbCBpbmNlcHRpb24vZXhwaXJhdGlvbiB0aW1l c3RhbXBzLiAgaG93IGRvIGFsbCB0aGVzZSB0aW1lc3RhbXBzDQo+IGludGVyYWN0IHdpdGggb25l IGFub3RoZXI/DQoNCkkgdGhpbmsgdGhhdCB0aGUgZGJvdW5kLWF3YXJlIGFwcGxpY2F0aW9uIHNo b3VsZCBzdG9yZSB0aGUgcmRhdGEgcGFydCBvZiBkYm91bmQgcmVjb3JkIGFzIHRoZSBwcm9wcmll dHkgb2YgdGhlIG5hbWVzIG9yIHRoZSBzdGFibGUgaW5mb3JtYXRpb24uIFNvIHRoZSBkbnNzZWMn cyB0aW1lc3RhbXAgaGFzIG5vdGhpbmcgcmVsYXRpb25zaGlwIHdpdGggZGJvdW5kJ3MgdGltZXN0 YW1wLiANCg0KVGhhdCBtZWFucyB0aGF0IHRoZSBpbmZvcm1hdGlvbiBleHRyYWN0ZWQgZnJvbSB0 aGUgcmRhdGEgb2YgZGJvdW5kIHdpbGwgc3RpbGwga2VlcCBhdmFpbGFibGUgZXZlbiBpZiBkbnNz ZWMgcnJzaWcgZXhwaXJlcy4NCj4gDQo+IA0KPiANCj4gDQo+IE90aGVyIHNtYWxsZXIgbm90ZXMg ZnJvbSBteSByZWFkLXRocm91Z2gNCj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLQ0KPiANCj4gKiB0aGUgY29ycmVjdCBVUkwgZm9yIHRoZSBjYW5vbmljYWwgd2ViIHZp ZXcgb2YgdGhlIFBTTCB0aGVzZSBkYXlzIGlzDQo+ICAgIHByb2JhYmx5Og0KPiAgICBodHRwczov L2dpdGh1Yi5jb20vcHVibGljc3VmZml4L2xpc3QvYmxvYi9tYXN0ZXIvcHVibGljX3N1ZmZpeF9s aXN0LmRhdA0KPiANCj4gKiBJQU5BIGNvbnNpZGVyYXRpb25zIGluY2x1ZGUgIkRib3VuZCBQdWJs aWMgU2VydmljZSIgLS0gaXQncyBub3QgY2xlYXINCj4gICBob3cgdGhpcyByZWxhdGVzIHRvIHRo ZSByZXN0IG9mIHRoZSBkcmFmdA0KPiANCj4gKiBJQU5BIGNvbnNpZGVyYXRpb25zIHdvdWxkIHBy b2JhYmx5IG5lZWQgYSByZWdpc3RyeSBvZiBhY2NlcHRhYmxlDQo+ICAgdmFsdWVzIGZvciB0aGUg RmxhZyBhbmQgUmVsYXRpb24gZmllbGRzLCBvciB5b3Ugc2hvdWxkIHJlcGxhY2UgdGhvc2UNCj4g ICBmaWVsZHMgd2l0aCBiaXRzIGRyYXduIGZyb20gYSBiaXRtYXNrLg0KPiANCj4gKiBzZWN0aW9u IDQgZGVzY3JpYmVzICJSZWxhdGlvbiIgYXMgInJlc2VydmVkIGZvciBmdXR1cmUgdXNlIiwgYnV0 IGFsc28NCj4gICBkZXNjcmliZXMgbW9yZSB0aGFuIG9uZSB2YWx1ZS4gIFRoZXNlIHNlZW0gaW5j b21wYXRpYmxlLg0KPiANCj4gKiBJdCdzIHVuY2xlYXIgaG93IHRoZSB2YXJpYWJsZS1sZW5ndGgg c2VydmljZSB0eXBlIGZpZWxkIGlzIGRlbGltaXRlZA0KPiAgIGZyb20gdGhlIGxhdGVyIGZpZWxk cyBvZiB0aGUgcmVjb3JkLg0KPiANCj4gKiBSRkMgMjExOSBsYW5ndWFnZSBpbiBzZWN0aW9uIDUg c2VlbXMgd3JvbmcgLS0gdGhlc2UgU0hPVUxEcyBkbyBub3QNCj4gICBhcHBseSB0byBhY3Rpb25z IHRha2VuIGJ5IGltcGxlbWVudGF0aW9ucy4NCj4gDQpUaGFua3MgZm9yIHlvdXIgY2FyZWZ1bCBy ZWFkaW5nIGFuZCBzdWdnZXN0aW9ucy4gDQoNCg0KSmlhbmthbmcgDQoNCj4gQWxsIHRoZSBiZXN0 LA0KPiANCj4gICAtLWRrZw0KPiANCj4gX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCj4gZGJvdW5kIG1haWxpbmcgbGlzdA0KPiBkYm91bmRAaWV0Zi5vcmcN Cj4gaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kYm91bmQNCj4gDQo= --Apple-Mail-E8E4E0AB-850F-4689-AABD-9069E0B2A2D4 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+PGJyPjxi cj48YnI+PC9kaXY+PGRpdj48YnI+5ZyoIDIwMTXlubQ55pyIMzDml6XvvIwwMzoyNe+8jERhbmll bCBLYWhuIEdpbGxtb3IgJmx0OzxhIGhyZWY9Im1haWx0bzpka2dAZmlmdGhob3JzZW1hbi5uZXQi PmRrZ0BmaWZ0aGhvcnNlbWFuLm5ldDwvYT4mZ3Q7IOWGmemBk++8mjxicj48YnI+PC9kaXY+PGJs b2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48c3Bhbj5PbiBUdWUgMjAxNS0wOS0yOSAwNTowNjoy MyAtMDQwMCwgSmlhbmthbmcgWWFvICZsdDs8YSBocmVmPSJtYWlsdG86eWFvamtAY25uaWMuY24i Pnlhb2prQGNubmljLmNuPC9hPiZndDsgd3JvdGU6PC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJy PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPiAmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDsmbmJzcDtJIHN1Ym1pdCBhIGRyYWZ0IGFib3V0IGRib3VuZCBzb2x1dGlvbi48L3NwYW4+ PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj4gJm5ic3A7Jm5i c3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7YW55IGNvbW1lbnRzIGFyZSB3ZWxjb21lLjwvc3Bh bj48YnI+PC9ibG9ja3F1b3RlPjxzcGFuPiBbLi4uXTwvc3Bhbj48YnI+PGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+PHNwYW4+TmFtZTogZHJhZnQteWFvLWRib3VuZC1kbnMtc29sdXRpb248L3NwYW4+ PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5SZXZpc2lvbjog MDA8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48c3Bhbj5U aXRsZTogUmVzb3VyY2UgUmVjb3JkIGZvciBETlMgQWRtaW5pc3RyYXRpdmUgQm91bmRhcmllczwv c3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPkRvY3Vt ZW50IGRhdGU6IDIwMTUtMDktMjg8L3NwYW4+PGJyPjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0 eXBlPSJjaXRlIj48c3Bhbj5Hcm91cDogSW5kaXZpZHVhbCBTdWJtaXNzaW9uPC9zcGFuPjxicj48 L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+UGFnZXM6IDExPC9zcGFu Pjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PHNwYW4+VVJMOiAmbmJz cDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDsm bmJzcDs8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9pbnRlcm5ldC1kcmFmdHMvZHJhZnQt eWFvLWRib3VuZC1kbnMtc29sdXRpb24tMDAudHh0Ij5odHRwczovL3d3dy5pZXRmLm9yZy9pbnRl cm5ldC1kcmFmdHMvZHJhZnQteWFvLWRib3VuZC1kbnMtc29sdXRpb24tMDAudHh0PC9hPjwvc3Bh bj48YnI+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3RlIHR5cGU9ImNpdGUiPjxzcGFuPlN0YXR1czog Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7Jm5ic3A7PGEgaHJlZj0i aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvZHJhZnQteWFvLWRib3VuZC1kbnMtc29s dXRpb24vIj5odHRwczovL2RhdGF0cmFja2VyLmlldGYub3JnL2RvYy9kcmFmdC15YW8tZGJvdW5k LWRucy1zb2x1dGlvbi88L2E+PC9zcGFuPjxicj48L2Jsb2NrcXVvdGU+PGJsb2NrcXVvdGUgdHlw ZT0iY2l0ZSI+PHNwYW4+SHRtbGl6ZWQ6ICZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZuYnNwOyZu YnNwOzxhIGhyZWY9Imh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFmdC15YW8tZGJvdW5k LWRucy1zb2x1dGlvbi0wMCI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXlhby1k Ym91bmQtZG5zLXNvbHV0aW9uLTAwPC9hPjwvc3Bhbj48YnI+PC9ibG9ja3F1b3RlPjxzcGFuPjwv c3Bhbj48YnI+PHNwYW4+VGhhbmtzIGZvciB3b3JraW5nIG9uIHRoaXMhPC9zcGFuPjxicj48c3Bh bj48L3NwYW4+PGJyPjxzcGFuPkkgZGlkIGEgcXVpY2sgcmVhZCBvZiB0aGlzIGRyYWZ0LCBhbmQg aSB0aGluayBpIGFtIGNvbmZ1c2VkIGJ5IGl0LiA6KDwvc3Bhbj48YnI+PC9kaXY+PC9ibG9ja3F1 b3RlPjxkaXY+PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PlRoYW5rcyBhIGxvdCBmb3IgeW91ciBr aW5kIHJlYWRpbmcgYW5kIGNvbW1lbnRzLiZuYnNwOzxkaXY+PGJyPjwvZGl2PjxkaXY+VGhlIGRi b3VuZCBpc3N1ZSBpcyBjb21wbGljYXRlZC4gU28gdGhlIHNvbHV0aW9uIHByb3Bvc2VkIGlzIGFs c28gYSBsaXR0bGUgY29tcGxleC4gJm5ic3A7SXQgY2FuIGVhc2lseSBjYXVzZSBjb25mdXNpb24g YnkgRmlyc3QgcmVhZGluZy4gOik8L2Rpdj48ZGl2Pjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRl Ij48ZGl2PjxzcGFuPjwvc3Bhbj48YnI+PHNwYW4+SSBoYXZlIHRocmVlIG1haW4gY29uZnVzaW9u cyB0aGF0IGkgd291bGQgdHJ5IHRvIGNsZWFyIHVwIGJlZm9yZTwvc3Bhbj48YnI+PHNwYW4+dGhp bmtpbmcgbW9yZSBkZWVwbHkgYWJvdXQgdGhlIGRyYWZ0Ojwvc3Bhbj48YnI+PGZvbnQgY29sb3I9 IiMwMDAwMDAiPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiByZ2JhKDI1NSwgMjU1LCAy NTUsIDApOyI+PGJyPjwvc3Bhbj48L2ZvbnQ+PC9kaXY+PC9ibG9ja3F1b3RlPjxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPjxmb250IGNvbG9yPSIjMDAwMDAwIj48c3BhbiBzdHlsZT0iYmFja2dyb3Vu ZC1jb2xvcjogcmdiYSgyNTUsIDI1NSwgMjU1LCAwKTsiPkFuY2VzdHJ5IHZzLiBQb2xpY3k8L3Nw YW4+PC9mb250PjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxzcGFu PiAtLS0tLS0tLS0tLS0tLS0tLS0tPC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPlRo aXMgZHJhZnQgcHJvcG9zZXMgYSBzaW5nbGUgbWVjaGFuaXNtIHRoYXQgY2FuIHdvcmsgZm9yIHpv bmVzIHNjb3BlZCBieTwvc3Bhbj48YnI+PHNwYW4+Ym90aCBhbmNlc3RyeSBhbmQgcG9saWN5LiAm bmJzcDtJdCdzIG5vdCBjbGVhciB0aGF0IHRoZSBzYW1lIG1lY2hhbmlzbSBzaG91bGQ8L3NwYW4+ PGJyPjxzcGFuPmJlIHVzZWQgZm9yIGJvdGggb2YgdGhlc2UgZGlzdGluY3Rpb25zLiAmbmJzcDtm dXJ0aGVybW9yZSwgeW91ciBhbmNlc3RyeTwvc3Bhbj48YnI+PHNwYW4+bWVjaGFuaXNtIGFwcGVh ciB0byBvbmx5IHN1cHBvcnQgYmlsYXRlcmFsIHBvbGljeSBhZ3JlZW1lbnRzIC0tIEEgbXVzdDwv c3Bhbj48YnI+PHNwYW4+cG9pbnQgdG8gQiBhbmQgQiBtdXN0IHBvaW50IHRvIEEuICZuYnNwO1Ro ZSB1c3VhbCBhbmNlc3RyYWwgcmVsYXRpb25zaGlwcyBhcmU8L3NwYW4+PGJyPjxzcGFuPnRoYXQg Zm9vLmJhci5leGFtcGxlIGFuZCBxdXguYmFyLmV4YW1wbGUgYm90aCB1c2UgYmFyLmV4YW1wbGUg YXMgdGhlaXI8L3NwYW4+PGJyPjxzcGFuPmFkbWluaXN0cmF0aXZlIGJvdW5kYXJ5LiAmbmJzcDtU aGUgcHJvcG9zYWwgaGVyZSwgZXZlbiBpZiBpJ208L3NwYW4+PGJyPjxzcGFuPm1pc3VuZGVyc3Rh bmRpbmcgdGhlIHBhcnQgdGhhdCBhcHBlYXJzIHRvIHJlcXVpcmUgYmlsYXRlcmFsIHBvbGljeSwg YXQ8L3NwYW4+PGJyPjxzcGFuPmxlYXN0IHJlcXVpcmVzIGFuIGEgREJPVU5EIFJSIGZvciBlYWNo IEROUyByZWNvcmQgbG9va2VkIHVwLiAmbmJzcDtUaGlzIHdvdWxkPC9zcGFuPjxicj48c3Bhbj5t YXNzaXZlbHkgaW5mbGF0ZSB0aGUgc2l6ZSBvZiBtb3N0IHpvbmVzLiAmbmJzcDtBIGRlY2lzaW9u IGJhc2VkIG9uIGFuY2VzdHJ5PC9zcGFuPjxicj48c3Bhbj5taWdodCBiZSBtdWNoIGVhc2llciB0 byBmaW5kIHdpdGggc2ltcGxlIHVwLXdhbGtpbmcgYXBwcm9hY2g6IGZvcjwvc3Bhbj48YnI+PHNw YW4+Zm9vLmJhci5leGFtcGxlLCBsb29rIGZvciBhIERCT1VORCByZWNvcmQgZm9yIGZvby5iYXIu ZXhhbXBsZSwgdGhlbiBpZjwvc3Bhbj48YnI+PHNwYW4+dGhhdCdzIE5YRE9NQUlOLCBsb29rIGZv ciBiYXIuZXhhbXBsZS48L3NwYW4+PGJyPjxzcGFuPjwvc3Bhbj48YnI+PHNwYW4+VGhlIGNvbnNl bnN1cyBpIGhlYXJkIGluIHRoZSByb29tIGluIFByYWd1ZSB3YXMgdGhhdCB0cnlpbmcgdG8gc29s dmU8L3NwYW4+PGJyPjxzcGFuPmJvdGggYW5jZXN0cnkgYW5kIHBvbGljeSByZWxhdGlvbnNoaXBz IHdpdGggdGhlIHNhbWUgbWVjaGFuaXNtIHNtZWxsczwvc3Bhbj48YnI+PHNwYW4+b3Zlcmx5IGNv bXBsZXguICZuYnNwO01heWJlIGl0IHdvdWxkIGJlIGJldHRlciB0byBzdGFydCB3aXRoIGEgcHJv cG9zYWwgdGhhdDwvc3Bhbj48YnI+PHNwYW4+aGFuZGxlcyBvbmx5IG9uZSBvZiB0aGVtPzwvc3Bh bj48YnI+PHNwYW4+PC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjwvZGl2PjwvYmxvY2txdW90 ZT48ZGl2Pjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48Zm9udCBjb2xvcj0iIzAwMDAwMCI+ PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6IHJnYmEoMjU1LCAyNTUsIDI1NSwgMCk7Ij5B bmNlc3RyeSB2cy4gUG9saWN5PC9zcGFuPjwvZm9udD48L2Jsb2NrcXVvdGU+PGJyPjwvZGl2Pjxk aXY+QW5jZXN0cnkgYW5kIHBvbGljeSBjYW4gYWRkIG1vcmUgY29tcGxleCBpc3N1ZXMgdG8gZGJv dW5kIHNvbHV0aW9uLiBJIHRoaW5rIHRoYXQgdGhpcyB0b3BpYyBtaWdodCBuZWVkIG1vcmUgZGlz Y3Vzc2lvbiBiZWZvcmUgZmluZGluZyBvdXQgYSBnb29kIHNvbHV0aW9uLjwvZGl2Pjxicj48Ymxv Y2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxzcGFuPiBUYXJnZXQgTmFtZXM6IFVSTCB2cyBvdGhl ciBETlMgbGFiZWw/PC9zcGFuPjxicj48c3Bhbj4gLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLTwvc3Bhbj48YnI+PHNwYW4+PC9zcGFuPjxicj48c3Bhbj5UaGUgVVJMIGFwcHJv YWNoIHNlZW1zIHZlcnkgdW5kZXJzcGVjaWZpZWQuICZuYnNwO1doYXQgc29ydCBvZiBVUkxzIHNo b3VsZCBiZTwvc3Bhbj48YnI+PHNwYW4+cmV0cmlldmFibGUgYnkgYW4gaW1wbGVtZW50YXRpb24/ ICZuYnNwO3doYXQgc2hvdWxkIGFuIGltcGxlbWVudGF0aW9uIGRvIHdpdGg8L3NwYW4+PGJyPjxz cGFuPnRoZSByZXRyaWV2ZWQgZGF0YT88L3NwYW4+PGJyPjwvZGl2PjwvYmxvY2txdW90ZT48ZGl2 Pjxicj48L2Rpdj48ZGl2PlRoZSB1cmwgaXMgdGhlIG9uZSB3aGljaCBpcyB0byBiZSBhZ3JlZWQg YnkgYm90aCBuYW1lcy4gVGhlIHVybCBtYXkgYmUgYSBmYW1vdXMgb25lIHN1Y2ggYXMgUFNMIG9y IGFueSBwcml2YXRlIG9uZSB3aGljaCBpcyBqdXN0IGFncmVlZCBieSBzb21lIG5hbWVzLjwvZGl2 Pjxicj48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxzcGFuPjwvc3Bhbj48YnI+PHNwYW4+ SSB0aGluayBpdCB3b3VsZCBiZSBiZXR0ZXIgdG8ganVzdCB0aGluayBhYm91dCBzdGF0aW5nIHRo ZSBleGlzdGVuY2Ugb2Y8L3NwYW4+PGJyPjxzcGFuPnNvbWUgdHlwZSBvZiBwb2xpY3kgYm91bmRh cnkgaW4gdGhlIEROUywgd2l0aG91dCB0cnlpbmcgdG8gc3BlYyBvdXQgdGhlPC9zcGFuPjxicj48 c3Bhbj5zdHJ1Y3R1cmUgb2YgYWxsIHBvc3NpYmxlIHBvbGljaWVzIHRoYXQgY291bGQgaGF2ZSBi b3VuZGFyaWVzIGluIHRoZTwvc3Bhbj48YnI+PHNwYW4+RE5TPC9zcGFuPjxicj48L2Rpdj48L2Js b2NrcXVvdGU+PGRpdj48YnI+PC9kaXY+PGRpdj5Zb3VyIHByb3Bvc2FsIGlzIG9uZSBraW5kIG9m IGNob2ljZXMuIFNwZWNpYWwgb25lIFZTIEdlbmVyYWwgb25lPC9kaXY+PGJyPjxibG9ja3F1b3Rl IHR5cGU9ImNpdGUiPjxkaXY+PHNwYW4+PC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFu PiBFeHBpcmF0aW9ucyB2cy4gRE5TIFRUTCAoYW5kIFJSU0lHKTwvc3Bhbj48YnI+PHNwYW4+IC0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS08L3NwYW4+PGJyPjxzcGFuPjwvc3Bhbj48 YnI+PHNwYW4+RE5TIHJlY29yZHMgYWxyZWFkeSBoYXZlIGEgVFRMIChhbmQgRE5TU0VDIHJlY29y ZHMgaGF2ZSB0aGU8L3NwYW4+PGJyPjxzcGFuPmluY2VwdGlvbi9leHBpcmF0aW9uIG9mIHRoZSBS UlNJRykuICZuYnNwO1RoaXMgZHJhZnQgaW50cm9kdWNlcyBuZXc8L3NwYW4+PGJyPjxzcGFuPmFk ZGl0aW9uYWwgaW5jZXB0aW9uL2V4cGlyYXRpb24gdGltZXN0YW1wcy4gJm5ic3A7aG93IGRvIGFs bCB0aGVzZSB0aW1lc3RhbXBzPC9zcGFuPjxicj48c3Bhbj5pbnRlcmFjdCB3aXRoIG9uZSBhbm90 aGVyPzwvc3Bhbj48YnI+PC9kaXY+PC9ibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2PkkgdGhpbmsg dGhhdCB0aGUgZGJvdW5kLWF3YXJlIGFwcGxpY2F0aW9uIHNob3VsZCBzdG9yZSB0aGUgcmRhdGEg cGFydCBvZiBkYm91bmQgcmVjb3JkIGFzIHRoZSBwcm9wcmlldHkgb2YgdGhlIG5hbWVzIG9yIHRo ZSBzdGFibGUgaW5mb3JtYXRpb24uIFNvIHRoZSBkbnNzZWMncyB0aW1lc3RhbXAgaGFzIG5vdGhp bmcgcmVsYXRpb25zaGlwIHdpdGggZGJvdW5kJ3MgdGltZXN0YW1wLiZuYnNwOzwvZGl2PjxkaXY+ PGJyPjwvZGl2PjxkaXY+VGhhdCBtZWFucyB0aGF0IHRoZSBpbmZvcm1hdGlvbiBleHRyYWN0ZWQg ZnJvbSB0aGUgcmRhdGEgb2YgZGJvdW5kIHdpbGwgc3RpbGwga2VlcCBhdmFpbGFibGUgZXZlbiBp ZiBkbnNzZWMgcnJzaWcgZXhwaXJlcy48L2Rpdj48ZGl2PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PjxkaXY+PHNwYW4+PC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPjwvc3Bhbj48YnI+ PHNwYW4+PC9zcGFuPjxicj48c3Bhbj5PdGhlciBzbWFsbGVyIG5vdGVzIGZyb20gbXkgcmVhZC10 aHJvdWdoPC9zcGFuPjxicj48c3Bhbj4tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tPC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPiAqIHRoZSBjb3JyZWN0IFVS TCBmb3IgdGhlIGNhbm9uaWNhbCB3ZWIgdmlldyBvZiB0aGUgUFNMIHRoZXNlIGRheXMgaXM8L3Nw YW4+PGJyPjxzcGFuPiAmbmJzcDsmbmJzcDsmbmJzcDtwcm9iYWJseTo8L3NwYW4+PGJyPjxzcGFu PiAmbmJzcDsmbmJzcDsmbmJzcDs8YSBocmVmPSJodHRwczovL2dpdGh1Yi5jb20vcHVibGljc3Vm Zml4L2xpc3QvYmxvYi9tYXN0ZXIvcHVibGljX3N1ZmZpeF9saXN0LmRhdCI+aHR0cHM6Ly9naXRo dWIuY29tL3B1YmxpY3N1ZmZpeC9saXN0L2Jsb2IvbWFzdGVyL3B1YmxpY19zdWZmaXhfbGlzdC5k YXQ8L2E+PC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPiAqIElBTkEgY29uc2lkZXJh dGlvbnMgaW5jbHVkZSAiRGJvdW5kIFB1YmxpYyBTZXJ2aWNlIiAtLSBpdCdzIG5vdCBjbGVhcjwv c3Bhbj48YnI+PHNwYW4+ICZuYnNwOyZuYnNwO2hvdyB0aGlzIHJlbGF0ZXMgdG8gdGhlIHJlc3Qg b2YgdGhlIGRyYWZ0PC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPiAqIElBTkEgY29u c2lkZXJhdGlvbnMgd291bGQgcHJvYmFibHkgbmVlZCBhIHJlZ2lzdHJ5IG9mIGFjY2VwdGFibGU8 L3NwYW4+PGJyPjxzcGFuPiAmbmJzcDsmbmJzcDt2YWx1ZXMgZm9yIHRoZSBGbGFnIGFuZCBSZWxh dGlvbiBmaWVsZHMsIG9yIHlvdSBzaG91bGQgcmVwbGFjZSB0aG9zZTwvc3Bhbj48YnI+PHNwYW4+ ICZuYnNwOyZuYnNwO2ZpZWxkcyB3aXRoIGJpdHMgZHJhd24gZnJvbSBhIGJpdG1hc2suPC9zcGFu Pjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPiAqIHNlY3Rpb24gNCBkZXNjcmliZXMgIlJlbGF0 aW9uIiBhcyAicmVzZXJ2ZWQgZm9yIGZ1dHVyZSB1c2UiLCBidXQgYWxzbzwvc3Bhbj48YnI+PHNw YW4+ICZuYnNwOyZuYnNwO2Rlc2NyaWJlcyBtb3JlIHRoYW4gb25lIHZhbHVlLiAmbmJzcDtUaGVz ZSBzZWVtIGluY29tcGF0aWJsZS48L3NwYW4+PGJyPjxzcGFuPjwvc3Bhbj48YnI+PHNwYW4+ICog SXQncyB1bmNsZWFyIGhvdyB0aGUgdmFyaWFibGUtbGVuZ3RoIHNlcnZpY2UgdHlwZSBmaWVsZCBp cyBkZWxpbWl0ZWQ8L3NwYW4+PGJyPjxzcGFuPiAmbmJzcDsmbmJzcDtmcm9tIHRoZSBsYXRlciBm aWVsZHMgb2YgdGhlIHJlY29yZC48L3NwYW4+PGJyPjxzcGFuPjwvc3Bhbj48YnI+PHNwYW4+ICog UkZDIDIxMTkgbGFuZ3VhZ2UgaW4gc2VjdGlvbiA1IHNlZW1zIHdyb25nIC0tIHRoZXNlIFNIT1VM RHMgZG8gbm90PC9zcGFuPjxicj48c3Bhbj4gJm5ic3A7Jm5ic3A7YXBwbHkgdG8gYWN0aW9ucyB0 YWtlbiBieSBpbXBsZW1lbnRhdGlvbnMuPC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjwvZGl2 PjwvYmxvY2txdW90ZT48ZGl2PlRoYW5rcyBmb3IgeW91ciBjYXJlZnVsIHJlYWRpbmcgYW5kIHN1 Z2dlc3Rpb25zLiZuYnNwOzwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+PGJyPjwvZGl2PjxkaXY+ SmlhbmthbmcmbmJzcDs8L2Rpdj48YnI+PGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSI+PGRpdj48c3Bh bj5BbGwgdGhlIGJlc3QsPC9zcGFuPjxicj48c3Bhbj48L3NwYW4+PGJyPjxzcGFuPiAmbmJzcDsm bmJzcDstLWRrZzwvc3Bhbj48YnI+PHNwYW4+PC9zcGFuPjxicj48c3Bhbj5fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXzwvc3Bhbj48YnI+PHNwYW4+ZGJvdW5k IG1haWxpbmcgbGlzdDwvc3Bhbj48YnI+PHNwYW4+PGEgaHJlZj0ibWFpbHRvOmRib3VuZEBpZXRm Lm9yZyI+ZGJvdW5kQGlldGYub3JnPC9hPjwvc3Bhbj48YnI+PHNwYW4+PGEgaHJlZj0iaHR0cHM6 Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kYm91bmQiPmh0dHBzOi8vd3d3LmlldGYu b3JnL21haWxtYW4vbGlzdGluZm8vZGJvdW5kPC9hPjwvc3Bhbj48YnI+PHNwYW4+PC9zcGFuPjxi cj48L2Rpdj48L2Jsb2NrcXVvdGU+PC9kaXY+PC9ib2R5PjwvaHRtbD4= --Apple-Mail-E8E4E0AB-850F-4689-AABD-9069E0B2A2D4-- From nobody Sun Oct 4 00:41:31 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 406FF1A19EC for ; Sun, 4 Oct 2015 00:41:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.16 X-Spam-Level: X-Spam-Status: No, score=-0.16 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ChB4Bkxco42a for ; Sun, 4 Oct 2015 00:41:27 -0700 (PDT) Received: from SNT004-OMC4S28.hotmail.com (snt004-omc4s28.hotmail.com [65.55.90.231]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A16E1A19F7 for ; Sun, 4 Oct 2015 00:41:27 -0700 (PDT) Received: from SNT407-EAS238 ([65.55.90.200]) by SNT004-OMC4S28.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Sun, 4 Oct 2015 00:41:27 -0700 X-TMN: [aHv1zVsUWBSy5HCW84aJu3V4QowxMslc] X-Originating-Email: [jiankangyao@hotmail.com] Message-ID: Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 References: <20150929195514.14378.qmail@ary.lan> From: yaojk MIME-Version: 1.0 (1.0) In-Reply-To: Date: Sun, 4 Oct 2015 15:50:38 +0800 To: John R Levine X-OriginalArrivalTime: 04 Oct 2015 07:41:27.0336 (UTC) FILETIME=[13ACB280:01D0FE78] Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Oct 2015 07:41:30 -0000 DQoNCtTaIDIwMTXE6jEw1MIzyNWjrDIyOjQ5o6xKb2huIFIgTGV2aW5lIDxqb2hubEB0YXVnaC5j b20+INC0tcCjug0KDQo+Pj4gSWYgSSB3YW50IHRvIHNheSwgImFsbCBuYW1lcyB1bmRlciBleGFt cGxlLmNvbSBhcmUgdW5kZXIgdGhlIHNhbWUNCj4+PiBhdXRob3JpdHkiLCBob3cgZG8gSSBkbyB0 aGF0PyAgRG8gSSBoYXZlIHRvIHB1dCBhIERCT1VORCByZWNvcmQgYXQNCj4+PiBldmVyeSBuYW1l IHRoYXQgZXhpc3RzIGF0IGFuZCBiZWxvdyBleGFtcGxlLmNvbT8NCj4+IA0KPj4gSXQgaXMgd2ls ZGNhcmQgaXNzdWUuIEl0IGlzIGFuIGluaXRpYWwgZHJhZnQsIHdoaWNoIHN0aWxsIGRvZXMgbm90 IGNvdmVyIGl0Lg0KPiANCj4gSSB0aGluayB5b3Ugd2lsbCBmaW5kIHRoYXQgRE5TIHdpbGRjYXJk cyBkb24ndCBkbyB3aGF0IHlvdSB3YW50LiAgSW4gcGFydGljdWxhciwgd2lsZGNhcmRzIGRvbid0 IG1hdGNoIGFueXdoZXJlIHRoYXQgYSBuYW1lIGV4aXN0cywgZXZlbiBpZiB0aGVyZSBhcmUgbm8g cmVjb3JkcyBhdCB0aGF0IG5hbWUuICBTbyBpZiB5b3UgaGF2ZSBhIHdpbGRjYXJkIGF0ICouZXhh bXBsZS5jb20gd2l0aCB5b3VyIHByb3Bvc2VkIHJlY29yZCwgYW5kIGFuIEEgcmVjb3JkIGF0IGEu Yi5leGFtcGxlLmNvbSwgdGhlIHdpbGRjYXJkIHdpbGwgbm90IG1hdGNoIGEuYi5leGFtcGxlLmNv bSBvciBiLmV4YW1wbGUuY29tLg0KPiANCllvdSBkbyBub3QgbmVlZCBwdXQgZGJvdW5kIHJlY29y ZCBmb3IgZXZlcnkgbmFtZSB0aGF0IGV4aXN0cyBhdCBvciBiZWxvdyBleGFtcGxlLmNvbS4NCg0K WW91IGp1c3QgbmVlZCB0byBwdXQgMiByZWNvcmRzOg0KKi5leGFtcGxlLmNvbSBkYm91bmQgZXhh bXBsZS5jb20NCkV4YW1wbGUuY29tIGRib3VuZCAqLmV4YW1wbGUuY29tDQpXaGVuIGRvIHRoZSBE TlMgcmVzb2x1dGlvbiBmb3IgYS5iLmV4YW1wbGUuY29tLCBpdCB3aWxsIGdldCB0aGUgcmVjb3Jk ICIqLmV4YW1wbGUuY29tIGRib3VuZCBleGFtcGxlLmNvbSIuIFRoZW4gZm9sbG93aW5nIHRoZSBy ZXNvbHV0aW9uIHN0ZXBzIGluIHRoZSBkYm91bmQgZHJhZnQsIGl0IGNhbiBhcHByb3ZlIHRoYXQg Ki5leGFtcGxlLmNvbSBhbmQgZXhhbXBsZS5jb20gc2hhcmUgdGhlIHNhbWUgRE5TIGJvdW5kYXJp ZXMuIFNvIGl0IG1lYW5zIHRoYXQgYS5iLmV4YW1wbGUuY29tIGFuZCBiLmV4YW1wbGUuY29tDQpT aGFyZSB0aGUgc2FtZSBETlMgYm91bmRhcmllcy4NCg0KQmVzdCByZWdhcmRzIA0KSmlhbmthbmcg DQoNCj4gQW5kcmV3J3MgU09QQSByZWNvcmQgaGFzIHRoZSBzYW1lIHByb2JsZW0sIHlvdSdkIG5l ZWQgdG8gcHV0IGEgU09QQSByZWNvcmQgYXQgZXZlcnkgbmFtZSB0aGF0IGV4aXN0cyBpbiB0aGUg RE5TIHN1YnRyZWUsIHdoaWNoIHdvdWxkIGJlIGEgdmVyeSBkaWZmaWN1bHQgcHJvdmlzaW9uaW5n IHByb2JsZW0uDQo+IA0KPiBSZWdhcmRzLA0KPiBKb2huIExldmluZSwgam9obmxAdGF1Z2guY29t LCBUYXVnaGFubm9jayBOZXR3b3JrcywgVHJ1bWFuc2J1cmcgTlkNCj4gUGxlYXNlIGNvbnNpZGVy IHRoZSBlbnZpcm9ubWVudCBiZWZvcmUgcmVhZGluZyB0aGlzIGUtbWFpbC4NCj4gDQo+IF9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQo+IGRib3VuZCBtYWls aW5nIGxpc3QNCj4gZGJvdW5kQGlldGYub3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxt YW4vbGlzdGluZm8vZGJvdW5kDQo= From nobody Sun Oct 4 08:44:50 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 80FDF1B2A23 for ; Sun, 4 Oct 2015 08:44:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.137 X-Spam-Level: X-Spam-Status: No, score=-1.137 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Skvx2aBjknDT for ; Sun, 4 Oct 2015 08:44:47 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5236C1B2A1A for ; Sun, 4 Oct 2015 08:44:12 -0700 (PDT) Received: (qmail 28941 invoked from network); 4 Oct 2015 15:44:12 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=710c.5611494c.k1510; bh=BYUs4LkpmnokykTM6zFlKSYFha0SqCvxhCrQkC668k8=; b=ZQV62jnKXMjQeuT2QtBBjwro7RZWU2877Z0aEO2IAw4wszQs5JlVVncew2q8GrN4s+jc9F8F93em716Q4fa8jprN0gvuuWbLS/lDjgYg3VXPpzjAVlOziGPYMmIyys8JLaq9MXCVS3sjANThbB7jfCF/2l4AMQnr5oKHM1BoSuIdgl6yvbGMHjMNAqKEc14emaq8jbXF0npDd0TEk77lbGHkwLnx1EDGoDvrGf3gNhZNImvmkSECLXcK2e4M7yCm DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=710c.5611494c.k1510; bh=BYUs4LkpmnokykTM6zFlKSYFha0SqCvxhCrQkC668k8=; b=jU7P2TFzPhFY3nFg8cR3qB3T1JDi0r38eIDG2b65s3/ZHc6C/Plelbm8Dp6ywOWhof8ylGkC83LQZ7ILAr8hNzyjIi9VKPX6E/wsGkTKWt/lu9CktKHB8TY0YumUTmR0VqvzIKNPuGD8QOV6UBE6dy57VHJtCkktaZPIofMoMYR0FySQwNG8zYIQ790yjKOAYymKOdoPo4IJ1+3Ea7dV+FI/M2l//DXcQPelhV6dbhLiCQTuBHF/QyBOqyGY9IwJ Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 04 Oct 2015 15:44:12 -0000 Date: 4 Oct 2015 11:44:10 -0400 Message-ID: From: "John R Levine" To: "yaojk" In-Reply-To: References: <20150929195514.14378.qmail@ary.lan> User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Oct 2015 15:44:48 -0000 > You do not need put dbound record for every name that exists at or below example.com. > > You just need to put 2 records: > *.example.com dbound example.com > Example.com dbound *.example.com > When do the DNS resolution for a.b.example.com, it will get the record > "*.example.com dbound example.com". Then following the resolution steps > in the dbound draft, it can approve that *.example.com and example.com > share the same DNS boundaries. So it means that a.b.example.com and > b.example.com DNS wildcards don't work that way. If there's an A record at a.b.example.com, queries for a dbound record at a.b.example.com or at b.example.com will return an empty (NOERROR) answer. See RFC 4592 which explains this in more detail. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Wed Oct 7 18:00:47 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C75F11B2C3F for ; Wed, 7 Oct 2015 18:00:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i7kN2MPUcqZR for ; Wed, 7 Oct 2015 18:00:39 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [IPv6:2600:3c03::f03c:91ff:fedf:cfab]) by ietfa.amsl.com (Postfix) with ESMTP id 8E1491B2C91 for ; Wed, 7 Oct 2015 18:00:39 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id 316071073B for ; Thu, 8 Oct 2015 01:00:39 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uBU0t6xdaK0F for ; Thu, 8 Oct 2015 01:00:38 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id 7B6C310662 for ; Thu, 8 Oct 2015 01:00:38 +0000 (UTC) Date: Wed, 7 Oct 2015 21:00:37 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151008010037.GI1389@mx2.yitter.info> References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2015 01:00:44 -0000 On Sat, Oct 03, 2015 at 07:10:09PM +0800, yaojk wrote: > If there is a general mechanism which can works well, why do we refuse it？ I think the point I was trying to make was that I don't think we have any evidence yet that there _is_ a general mechanism that works well. In this particular case, I don't think it's specified well enough for me to evaluate. But in the case I worked out before, I concluded pretty quickly that it was too general to be deployable. That's why I abandoned that approach. > Because there are two kinds of service relationships, one decided by the centralized authority such as PSL, the other decided by themselves , this flag will indicate that information. > No, I claim these are not two kinds of service relationships. I think what Bill said is right. > Some domain names may only share the DNS boundaries for some specific service types such as https service type. So the dbound DNS type is for DNS lookup while the "https " is to confirm that these name will only share the DNS boundaries under the "https" service after the DNS lookup for dbound. > But my point is that this approach is _totally incompatible_ with everything that people already do in this space. That was the feedback I got when I tried the same thing. It was nearly two years ago, if I recall correctly, but it was discussed at length both in the APPSAWG meeting and also on the W3C websec list. > It is the program which deal with it. I do not think that there has something unclear. > Yes, it's perfectly clear. But I claim it's not going to work. > > DNS boundaries issues may be more complicated than what We can imagine. We'd better cover most issues appeared or that will appear. > If you can show a use case, I'll be interested. I'm not partial to solutions to problems we can't describe because we haven't imagined them yet. We have problems we can describe: let's solve those. > > If the simple solution can solve everything, that is ok. If DNS boundaries issue is too complex, we might have to need a complex one. > But the inception and expiration fields are terribly dangerous, as already demonstrated by DNSSEC. You need to show why they're needed. A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Thu Oct 8 12:20:09 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 304891A1B00 for ; Thu, 8 Oct 2015 12:20:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8Z7mSsSH1vYJ for ; Thu, 8 Oct 2015 12:20:06 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [IPv6:2600:3c03::f03c:91ff:fedf:cfab]) by ietfa.amsl.com (Postfix) with ESMTP id E81041A1AFB for ; Thu, 8 Oct 2015 12:20:05 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id 5FC891072E for ; Thu, 8 Oct 2015 19:20:05 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IVJRMxiVmxd2 for ; Thu, 8 Oct 2015 19:20:03 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id 26B4E10739 for ; Thu, 8 Oct 2015 19:20:03 +0000 (UTC) Date: Thu, 8 Oct 2015 15:20:01 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151008192001.GR17602@mx2.yitter.info> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2015 19:20:08 -0000 Hi, The glossary at http://trac.tools.ietf.org/wg/dbound/trac/wiki/Glossary has this: Control:: (as in "Is domain X under the same control as domain Y") There are really two different kinds of control here, though, and I think it's important to make the distinction. By making this distinction, I think we reveal something about use cases. That might lead us to a solution. It seems to me that one kind of relationship we want is very close to what's said above: for any two domain names n1 and n2, in policy terms is effective control of the domain such that Cn1 == Cn2? This needs to be a two-way relationship: n1 should assert that it is in the same policy realm as n2, and conversely. If not, then they do not really share the policy realm. (I can think of relationships that are trickier, but they seem to me to be at least problematic.) This approach is waht the SOPA record was supposed to do: it asserts the Start Of Policy Authority, thereby giving us a place to found our policy-based assertions about how things are grouped together. As a happy side effect, we also get a way to disclaim _any_ such bilateral relationship because you can publish a SOPA record that names the null set. This is what "public suffix" domains should do. Note that this style of policy is permissive. It assumes that descendent domains may have all manner of important relationships between them, and that they do not implicate the ancestor. But this does not solve the problem where an ancestor name asserts a policy by fiat: any delegation I make is required to behave by my policy, so I can assert that policy and thereby impose it on the delegated names. Now, it seems to me that the use cases here come from the _consumers_ of the data. Mail administrative domains, for instance, want to be able to assert their mail policies, and consumers of the data want to be able to find that assertion point in the tree because it's the point beyond which they don't have to search. It's not necessary for the operator of the domain to use the mechanism to enforce anything, because the policy is impermissive: it says that anyone outside the policy is not conforming to the rules for creation of that descendent domain. If it were important for the ancestor to enforce this, it would be simple: delete the domain or delegation. Instead, this is a way for the ancestor to tell _others_ about the ancestor policies, so that those others can simply impose the policy on communications from the descendent. I think therefore that it would be ok to have two different mechanisms for these two styles of thing, because the party relying on the mechanism knows which style of thing it needs. So it will use the appropriate mechanism to get the information it needs. Therefore, it seems to me that we could cover the two different use cases by refining the SOPA record Jeff and I have already proposed, and then adding a different mechanism for the second style of problem. We could call this second case "Parent-Imposed Policy Assertion" (or PIPA for a nmemonic. Yes, this tickles me slightly). The PIPA RR would in effect assert that it has policy rules that bind descendents. I am sensitive here to the point that Jiankang Yao made, in that this is quite a blunt instrument. In particular, it's not too hard to imagine cases where one would want a PIPA RR to cover one case and not another. One solution for this would be to use a policy document target along the lines of draft-yao-dbound-dns-solution, but I tend to feel that's a little complicated. Moreover, it doesn't follow the approach already being used by code already deployed. As I understand it, that code finds the last point in the public suffix graph that is an ancestor to the domain name under consideration, moves one label deeper in the DNS graph, and then uses that as the effective point for policy. The same result could be achieved by looking for the last null-target SOPA record and then searching down the tree for a PIPA RR, only it would provide greater accuracy. So I think that the blunt instrument is sharp enough for what we need. I'd be interested in people's thoughts about this. If it seems worth doing, Jeff and I can update the sopa draft to include this approach. Best regards, A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Thu Oct 8 12:59:33 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 451F81ACC88 for ; Thu, 8 Oct 2015 12:59:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.862 X-Spam-Level: X-Spam-Status: No, score=0.862 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0sfLyAP5k7RT for ; Thu, 8 Oct 2015 12:59:31 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E91F1ACC86 for ; Thu, 8 Oct 2015 12:59:31 -0700 (PDT) Received: (qmail 21755 invoked from network); 8 Oct 2015 19:59:31 -0000 Received: from unknown (64.57.183.18) by mail1.iecc.com with QMQP; 8 Oct 2015 19:59:31 -0000 Date: 8 Oct 2015 19:59:08 -0000 Message-ID: <20151008195908.35761.qmail@ary.lan> From: "John Levine" To: dbound@ietf.org In-Reply-To: <20151008192001.GR17602@mx2.yitter.info> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Cc: ajs@anvilwalrusden.com Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2015 19:59:32 -0000 >But this does not solve the problem where an ancestor name asserts a >policy by fiat: any delegation I make is required to behave by my >policy, so I can assert that policy and thereby impose it on the >delegated names. For DMARC, at least, it's not imposed, it's a default. If foo.bar.example.com doesn't have its own _dmarc record, it falls back to the one for example.com. This is to avoid the SOPA problem of having to put a record at every point in the subtree. I can't offhand think of a scenario in which a domain imposes a policy on an unwilling descendant other than the implicit "not the same as me" policy of a public suffix cut point. R's, John From nobody Thu Oct 8 13:04:12 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5AFA51ACCD9 for ; Thu, 8 Oct 2015 13:04:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id m6Gk71ijICSM for ; Thu, 8 Oct 2015 13:04:09 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [50.116.54.116]) by ietfa.amsl.com (Postfix) with ESMTP id F341B1ACC8D for ; Thu, 8 Oct 2015 13:04:08 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id ACD001073C for ; Thu, 8 Oct 2015 20:04:07 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ry3oieyJrM60 for ; Thu, 8 Oct 2015 20:04:05 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id D6DE010733 for ; Thu, 8 Oct 2015 20:04:05 +0000 (UTC) Date: Thu, 8 Oct 2015 16:04:04 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151008200404.GU17602@mx2.yitter.info> References: <20151008192001.GR17602@mx2.yitter.info> <20151008195908.35761.qmail@ary.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151008195908.35761.qmail@ary.lan> User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2015 20:04:10 -0000 On Thu, Oct 08, 2015 at 07:59:08PM -0000, John Levine wrote: > For DMARC, at least, it's not imposed, it's a default. If > foo.bar.example.com doesn't have its own _dmarc record, it falls back > to the one for example.com. This is to avoid the SOPA problem of > having to put a record at every point in the subtree. Yes, I skipped over the part where you looked at the name itself, for simplicity's sake. That part is irrelevant to this discussion because in that case _no_ policy-finding mechanism is going to be invoked. > I can't offhand think of a scenario in which a domain imposes a policy > on an unwilling descendant other than the implicit "not the same as > me" policy of a public suffix cut point. In every DMARC case where the descendant doesn't have a _dmarc record, it gets such a policy. (It's not "unwilling" but "indeterminate willingness". The thing is that you don't care what the willingness is, because in the absence of data some other policy gets used.) A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Thu Oct 8 13:27:53 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8788E1ACD52 for ; Thu, 8 Oct 2015 13:27:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1B6FWqv7ktah for ; Thu, 8 Oct 2015 13:27:51 -0700 (PDT) Received: from mail-io0-x22e.google.com (mail-io0-x22e.google.com [IPv6:2607:f8b0:4001:c06::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4F5871ACD50 for ; Thu, 8 Oct 2015 13:27:51 -0700 (PDT) Received: by iofh134 with SMTP id h134so71391606iof.0 for ; Thu, 08 Oct 2015 13:27:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=deccio.net; s=google; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=maKaxhjv08COTMKpGF1iAa7VdPFgAIe4VZUpRAKjpKU=; b=GE2dGdLnDN6y3zUaFWz3PqooSN5r6u7TFxAgfmG2Qejnr2PE3NYVfyCI+ueXYZe8hJ MaCVwRVPfmEVOxOaVONiMVqsDeHxgBlsb+iww3U3h2DWU7BLHm/It2fSZXnRT6axDgdb jerbEeVFFlGEmmwS+0RFr8mlMy7uRnHvISpkY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=maKaxhjv08COTMKpGF1iAa7VdPFgAIe4VZUpRAKjpKU=; b=B2+5lxMYe6Teq4x1llyh8zQAGDOGzIvqCeZZLiU6Y8BlmbfgDN3T0lWUfReC6u1xqk DbBs8unxy2xSNVS0yT5fh4cV9kn3/OO5uyQB3NTCoAb7PpOKuEHx9EFbYJqNx4nn77t0 K5TDzOIsMzJAkGtYrST65MykwWMvqQ39IdOIdswYJowbjTCLRFurDxErRHkZzo+uRKzC vJhPo8UlX3XQZuUpRcYfoH51LV66W4/nXjUQr2uewPhHPZO2Fq2x8kr8ymUzzN84rYKp erfNWVGLV+P5AfXXGF0mOICNmcSFY9LbWhc549KgR4UhtnrExGxkIvLFAWOJfqvp7Ke+ usNQ== X-Gm-Message-State: ALoCoQkIbheVm4M+BWtXaeGhozP5fAPmUAEcV5lnjywlOWpw00hNo1ys32cSBXXU3lmN7LAyF+XA MIME-Version: 1.0 X-Received: by 10.107.19.234 with SMTP id 103mr12538878iot.41.1444336070207; Thu, 08 Oct 2015 13:27:50 -0700 (PDT) Received: by 10.50.159.230 with HTTP; Thu, 8 Oct 2015 13:27:50 -0700 (PDT) In-Reply-To: <20151008192001.GR17602@mx2.yitter.info> References: <20151008192001.GR17602@mx2.yitter.info> Date: Thu, 8 Oct 2015 16:27:50 -0400 Message-ID: From: Casey Deccio To: Andrew Sullivan Content-Type: multipart/alternative; boundary=001a113f7a9266c9e905219db20e Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Oct 2015 20:27:52 -0000 --001a113f7a9266c9e905219db20e Content-Type: text/plain; charset=UTF-8 Hi Andrew, On Thu, Oct 8, 2015 at 3:20 PM, Andrew Sullivan wrote: > Control:: (as in "Is domain X under the same control as domain Y") > > While this was one of the "questions" that were posed for discussion prior to the DBOUND WG meeting in Prague, it seems to me to be fairly high level and the least grounded in an actual application problem. I'm not saying that it's not worth consideration, but if I had to prioritize the questions, this one comes after others that stem from current application needs (e.g., HTTP cookies, DMARC, etc.). > Therefore, it seems to me that we could cover the two different use > cases by refining the SOPA record Jeff and I have already proposed, > and then adding a different mechanism for the second style of problem. > We could call this second case "Parent-Imposed Policy Assertion" (or > PIPA for a nmemonic. Yes, this tickles me slightly). The PIPA RR > would in effect assert that it has policy rules that bind descendents. > In general, think you're right - that there are two broad categories of the problem: identifying policy relationships between a domain name and its ancestor or descendant; and identifying policy relationships between two domain names that are not ancestrally related. This sentiment was expressed at the DBOUND WG meeting in Prague. I also had with the impression from the WG discussion that the two should be considered separately and that the former was the more pressing than the latter. My focus as of late has been the former, and I have a draft that will be submitted soon on that topic--probably Monday. Casey --001a113f7a9266c9e905219db20e Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi Andrew,

On Thu, Oct 8, 2015 at 3:20 PM, And= rew Sullivan <ajs@anvilwalrusden.com> wrote:
Control:: (as in "Is domain X under the same control as domain Y&qu= ot;)


While this was one of the "questi= ons" that were posed for discussion prior to the DBOUND WG meeting in = Prague, it seems to me to be fairly high level and the least grounded in an= actual application problem.=C2=A0 I'm not saying that it's not wor= th consideration, but if I had to prioritize the questions, this one comes = after others that stem from current application needs (e.g., HTTP cookies, = DMARC, etc.).
=C2=A0
Therefore, it seems to me that we could cover the two different use
cases by refining the SOPA record Jeff and I have already proposed,
and then adding a different mechanism for the second style of problem.
We could call this second case "Parent-Imposed Policy Assertion" = (or
PIPA for a nmemonic.=C2=A0 Yes, this tickles me slightly).=C2=A0 The PIPA R= R
would in effect assert that it has policy rules that bind descendents.
<= /blockquote>

In general, think you're right - that t= here are two broad categories of the problem: identifying policy relationsh= ips between a domain name and its ancestor or descendant; and identifying p= olicy relationships between two domain names that are not ancestrally relat= ed.=C2=A0 This sentiment was expressed at the DBOUND WG meeting in Prague.= =C2=A0 I also had with the impression from the WG discussion that the two s= hould be considered separately and that the former was the more pressing th= an the latter.

My focus as of late has been the former, a= nd I have a draft that will be submitted soon on that topic--probably Monda= y.

Casey
--001a113f7a9266c9e905219db20e-- From nobody Thu Oct 8 22:14:28 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F039D1B347B for ; Thu, 8 Oct 2015 22:14:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.308 X-Spam-Level: X-Spam-Status: No, score=-0.308 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DATE_IN_PAST_03_06=1.592] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CbzslpA9oREl for ; Thu, 8 Oct 2015 22:14:26 -0700 (PDT) Received: from che.mayfirst.org (che.mayfirst.org [209.234.253.108]) by ietfa.amsl.com (Postfix) with ESMTP id EAC891B3478 for ; Thu, 8 Oct 2015 22:14:25 -0700 (PDT) Received: from fifthhorseman.net (h-67-101-29-156.nycm.ny.dynamic.megapath.net [67.101.29.156]) by che.mayfirst.org (Postfix) with ESMTPSA id 378E8F984; Fri, 9 Oct 2015 01:14:23 -0400 (EDT) Received: by fifthhorseman.net (Postfix, from userid 1000) id 127E02078F; Thu, 8 Oct 2015 22:00:52 -0400 (EDT) From: Daniel Kahn Gillmor To: John Levine , dbound@ietf.org In-Reply-To: <20151008195908.35761.qmail@ary.lan> References: <20151008195908.35761.qmail@ary.lan> User-Agent: Notmuch/0.20.2 (http://notmuchmail.org) Emacs/24.5.1 (x86_64-pc-linux-gnu) Date: Thu, 08 Oct 2015 22:00:52 -0400 Message-ID: <87k2qwyf57.fsf@alice.fifthhorseman.net> MIME-Version: 1.0 Content-Type: text/plain Archived-At: Cc: ajs@anvilwalrusden.com Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Oct 2015 05:14:27 -0000 On Thu 2015-10-08 15:59:08 -0400, John Levine wrote: > I can't offhand think of a scenario in which a domain imposes a policy > on an unwilling descendant other than the implicit "not the same as > me" policy of a public suffix cut point. It's not currently in the DNS, but HSTS's includeSubdomains flag seems to impose a policy on the entire subtree that a descendent should not be allowed to override. --dkg From nobody Fri Oct 9 07:50:24 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C9E21B4231 for ; Fri, 9 Oct 2015 07:50:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.137 X-Spam-Level: X-Spam-Status: No, score=-1.137 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hRsFVrzV6QJL for ; Fri, 9 Oct 2015 07:50:20 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9D2C31B4230 for ; Fri, 9 Oct 2015 07:50:20 -0700 (PDT) Received: (qmail 83348 invoked from network); 9 Oct 2015 14:50:20 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=14593.5617d42c.k1510; bh=e5WT5m5p17g1evm6knxZ0IkhLXY/nIt1KpFhtEYEBVk=; b=dZ1+cE6TUy1j2bW4NaoaAvfSwAigwExQgNNzWnyK+ehkf47VVWDNxf4qhm4VXGx38LX/35p7e8WcGJiC4p+jvam7Tb2MoiYHGTOqhUICPabJxfZ3oQSjj+fXuNsByR4Hx+EdoU4SgzGeljvihxRUP2e671z2jrqcAapCYDS/VXPann1Pow465vfxid2x6kvH4/RyXbfTONl0z08hs4x6FsHD4WtDZJRp2o0uLeJXYlcm489B1MsS+NKMUboYvRts DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:references:mime-version:content-type:user-agent; s=14593.5617d42c.k1510; bh=e5WT5m5p17g1evm6knxZ0IkhLXY/nIt1KpFhtEYEBVk=; b=jj/1RGz5H2YEPX0Dy5zyLT0ZVbik4u5W6xnPRLcgguaPKUpCE61S8YX0PWf1JPWe/a9ejw5rTlDm1R+PHG2SiTH5o5oXGfoUCrnffPUaN0XIuV+GtX1wI0hSTERXbwOBpFSHEqIzfAhqw3U9Qehyn/yW879fO2s+kM1YVbZdVW9kdWesvEz9wALmDAPlgc5W1nudlsvZNvZFjJp+vtfjyMwDNR1WHyDS66twN00FPDHAJ1c/MbMSmWRERMBTzBD3 Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by imap.iecc.com ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.0/X.509/SHA1) via TCP6; 09 Oct 2015 14:50:20 -0000 Date: 9 Oct 2015 10:50:18 -0400 Message-ID: From: "John R Levine" To: "Daniel Kahn Gillmor" In-Reply-To: <87k2qwyf57.fsf@alice.fifthhorseman.net> References: <20151008195908.35761.qmail@ary.lan> <87k2qwyf57.fsf@alice.fifthhorseman.net> User-Agent: Alpine 2.11 (OSX 23 2013-08-11) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Archived-At: Cc: dbound@ietf.org Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Oct 2015 14:50:23 -0000 > It's not currently in the DNS, but HSTS's includeSubdomains flag seems > to impose a policy on the entire subtree that a descendent should not be > allowed to override. Good catch. I missed that. But when I look at the spec, that bit seems sort of half hearted. They note that if a client fetches www.example.com, and there's an includeSubdomains flag at example.com, the client will only apply the policy it's previously cached example.com, which as likely as not it hasn't. I don't see this as a strong argument either way for overridable or non-overridable assertions about subdomains. Regards, John Levine, johnl@taugh.com, Taughannock Networks, Trumansburg NY Please consider the environment before reading this e-mail. From nobody Fri Oct 9 08:59:40 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 374201B455C for ; Fri, 9 Oct 2015 08:59:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WSJo6623iJwA for ; Fri, 9 Oct 2015 08:59:37 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [50.116.54.116]) by ietfa.amsl.com (Postfix) with ESMTP id C41A91B455A for ; Fri, 9 Oct 2015 08:59:37 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id 79BDA10733 for ; Fri, 9 Oct 2015 15:59:36 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ImbCm6-HkI15 for ; Fri, 9 Oct 2015 15:59:35 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id C83B010662 for ; Fri, 9 Oct 2015 15:59:35 +0000 (UTC) Date: Fri, 9 Oct 2015 11:59:33 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151009155933.GF20427@mx2.yitter.info> References: <20151008195908.35761.qmail@ary.lan> <87k2qwyf57.fsf@alice.fifthhorseman.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Oct 2015 15:59:39 -0000 On Fri, Oct 09, 2015 at 10:50:18AM -0400, John R Levine wrote: > I don't see this as a strong argument either way for overridable or > non-overridable assertions about subdomains. Since we appear to have a small number of cases where ancestor policies are in some ways inherited down the tree, I think we need some more clarity here. It seems to me the case that was important to John and which argued against the SOPA approach was the DMARC one. In that case, as I understand it, the idea is to find the last point of public/private split in the path from the root to the target domain, and use that. This only kicks in where the target domain itself has not published a record. If the domain _has_ published a record, then the search doesn't happen. But if it has not, then you need a way to find a policy to inherit. In a case where the ancestor were imposing policy _regardless_ of what the descendent did, the search effort would I think have to be the same. It's just that there would not be the first step of determining policy at the target name in the first place. Therefore, I claim, the two cases collapse to one, because once you're in the mode of looking for some overriding ancestor policy (however you got into that mode), you're looking for the same thing. Does that make sense? A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Fri Oct 9 10:16:30 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 988711B48D3 for ; Fri, 9 Oct 2015 10:16:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.663 X-Spam-Level: * X-Spam-Status: No, score=1.663 tagged_above=-999 required=5 tests=[BAYES_50=0.8, HELO_MISMATCH_COM=0.553, HOST_MISMATCH_NET=0.311, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 43MfEViJ2PeN for ; Fri, 9 Oct 2015 10:16:28 -0700 (PDT) Received: from miucha.iecc.com (abusenet-1-pt.tunnel.tserv4.nyc4.ipv6.he.net [IPv6:2001:470:1f06:1126::2]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C981D1B47F8 for ; Fri, 9 Oct 2015 10:16:27 -0700 (PDT) Received: (qmail 8114 invoked from network); 9 Oct 2015 17:16:27 -0000 Received: from unknown (64.57.183.18) by mail1.iecc.com with QMQP; 9 Oct 2015 17:16:27 -0000 Date: 9 Oct 2015 17:16:04 -0000 Message-ID: <20151009171604.41254.qmail@ary.lan> From: "John Levine" To: dbound@ietf.org In-Reply-To: <20151009155933.GF20427@mx2.yitter.info> Organization: X-Headerized: yes Mime-Version: 1.0 Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 8bit Archived-At: Cc: ajs@anvilwalrusden.com Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Oct 2015 17:16:29 -0000 >Therefore, I claim, the two cases collapse to one, because once you're >in the mode of looking for some overriding ancestor policy (however >you got into that mode), you're looking for the same thing. > >Does that make sense? Pretty much. The code is nearly the same, only difference is whether you always look for an ancestor or only if you didn't find something locally. R's, John From nobody Mon Oct 12 08:28:03 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4604E1A7004 for ; Mon, 12 Oct 2015 08:28:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.61 X-Spam-Level: X-Spam-Status: No, score=-2.61 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xJOXRw8tX9eL for ; Mon, 12 Oct 2015 08:28:00 -0700 (PDT) Received: from SNT004-OMC4S30.hotmail.com (snt004-omc4s30.hotmail.com [65.55.90.233]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1FD051A7003 for ; Mon, 12 Oct 2015 08:28:00 -0700 (PDT) Received: from SNT407-EAS291 ([65.55.90.200]) by SNT004-OMC4S30.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Mon, 12 Oct 2015 08:27:59 -0700 X-TMN: [UvAjTMu2XVPfHJocMPYwkht8mbDmgZK2] X-Originating-Email: [jiankangyao@hotmail.com] Message-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> From: yaojk MIME-Version: 1.0 (1.0) In-Reply-To: <20151008010037.GI1389@mx2.yitter.info> Date: Mon, 12 Oct 2015 23:37:36 +0800 To: Andrew Sullivan X-OriginalArrivalTime: 12 Oct 2015 15:27:59.0482 (UTC) FILETIME=[939935A0:01D10502] Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Oct 2015 15:28:02 -0000 =20 >=20 > If you can show a use case, I'll be interested. I'm not partial to > solutions to problems we can't describe because we haven't imagined > them yet. We have problems we can describe: let's solve those. >=20 >>=20 >> If the simple solution can solve everything, that is ok. If DNS boundari= es issue is too complex, we might have to need a complex one. >=20 > But the inception and expiration fields are terribly dangerous, as > already demonstrated by DNSSEC. You need to show why they're needed. For example, a user has 2 domain names, a.com and a.net which have applied C= A certificates with some expired date. The user would like to configure the s= ame DNS boundaries for these domain names under the https service during the= validity period of CA certificates. The valid period is from the maximum (inception of both domain name certific= ates) to minimum (expiration of both domain name certificates) >=20 > A > --=20 > Andrew Sullivan > ajs@anvilwalrusden.com >=20 > _______________________________________________ > dbound mailing list > dbound@ietf.org > https://www.ietf.org/mailman/listinfo/dbound From nobody Mon Oct 12 20:48:20 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA5881A88E3 for ; Mon, 12 Oct 2015 20:48:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.712 X-Spam-Level: X-Spam-Status: No, score=-0.712 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1htdLlF0BVmu for ; Mon, 12 Oct 2015 20:48:17 -0700 (PDT) Received: from cnnic.cn (smtp13.cnnic.cn [218.241.118.13]) by ietfa.amsl.com (Postfix) with ESMTP id D96EC1A88DA for ; Mon, 12 Oct 2015 20:48:15 -0700 (PDT) Received: from yaojiankang (unknown [218.241.103.29]) by ocmail02.zx.nicx.cn (Coremail) with SMTP id AQAAf0DZ4DjqfhxWKLibBA--.5947S2; Tue, 13 Oct 2015 11:47:56 +0800 (CST) Date: Tue, 13 Oct 2015 11:47:56 +0800 From: "Jiankang Yao" To: "Andrew Sullivan" , dbound References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> , <20151008010037.GI1389@mx2.yitter.info> X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7.0.1.92[cn] Mime-Version: 1.0 Message-ID: <2015101311474918524028@cnnic.cn> Content-Type: multipart/alternative; boundary="----=_001_NextPart687773287142_=----" X-CM-TRANSID: AQAAf0DZ4DjqfhxWKLibBA--.5947S2 X-Coremail-Antispam: 1UD129KBjvJXoWxJr4kAFy3WFWxJF4UWr17Jrb_yoW8Ar18pF W3Wwn7KF4kGr47Aa4jqw13WF13ZrW8JrWaq3WrCr1ktwnI9Fy8t348tF4rCF4rZF97Jryq qF42yrZrur98ZFJanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUQ2b7Iv0xC_Cr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Gr0_Xr1l84ACjcxK6xII jxv20xvEc7CjxVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I 8E87Iv6xkF7I0E14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVAYj202 j2C_Jr0_Gr1l5I8CrVAKz4kIr2xC04v26r4j6ryUMc02F40E42I26xC2a48xMc02F40Ex7 xS67I2xxkvbII20VAazxkCjI0Eb7x7McIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv 67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lFcxC0VAYjx AxZF0Ew4CEw7xC0wCY02Avz4vE14v_Gr4l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Y z7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUGVWUWwC20s026x8GjcxK67AKxVWUGVWUWwC2zV AF1VAY17CE14v26r1Y6r17MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4l IxAIcVC0I7IYx2IY6xkF7I0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWrZr1j6s 0DMIIF0xvEx4A2jsIE14v26r1j6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Jr0_Gr1l6VAC Y4xI67k04243AbIYCTnIWIevJa73UjIFyTuYvjxU4qgxUUUUU X-CM-SenderInfo: x1dryyw6fq0xffof0/ Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: yaojk List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 03:48:20 -0000 This is a multi-part message in MIME format. ------=_001_NextPart687773287142_=---- Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 DQoNCg0KRnJvbTogQW5kcmV3IFN1bGxpdmFuDQpEYXRlOiAyMDE1LTEwLTA4IDA5OjAwDQpUbzog ZGJvdW5kDQpTdWJqZWN0OiBSZTogW2Rib3VuZF0gRnc6IE5ldyBWZXJzaW9uIE5vdGlmaWNhdGlv biBmb3IgZHJhZnQteWFvLWRib3VuZC1kbnMtc29sdXRpb24tMDAudHh0DQoNCg0KPj4gQmVjYXVz ZSB0aGVyZSBhcmUgdHdvIGtpbmRzIG9mIHNlcnZpY2UgcmVsYXRpb25zaGlwcywgb25lIGRlY2lk ZWQgYnkgdGhlIGNlbnRyYWxpemVkIGF1dGhvcml0eSBzdWNoIGFzIFBTTCwgdGhlIG90aGVyIGRl Y2lkZWQgYnkgdGhlbXNlbHZlcyAsIHRoaXMgZmxhZyB3aWxsIGluZGljYXRlIHRoYXQgaW5mb3Jt YXRpb24uDQo+PiANCj4NCj5ObywgSSBjbGFpbSB0aGVzZSBhcmUgbm90IHR3byBraW5kcyBvZiBz ZXJ2aWNlIHJlbGF0aW9uc2hpcHMuICBJIHRoaW5rDQo+d2hhdCBCaWxsIHNhaWQgaXMgcmlnaHQu DQo+DQoNCk5vdywgd2l0aCB0aGUgbmV3IGdUTEQgcHJvZ3JhbSwgaXQgaXMgdmVyeSBsaWtlbHkg dGhhdCBhIGNvbXBhbnkgYXBwbGllcyBzb21lIG5hbWVzIGZyb20gZGlmZmVyZW50IGdUTEQgZm9y IHRoZSBzYW1lIHB1cnBvc2VzLg0KaWYgb25lIGNvbXBhbnkgaGFzIGRvemVucyBvZiBkb21haW4g bmFtZXMgd2hpY2ggYXJlIHN1cHBvc2VkIHRvIHNoYXJlIHRoZSBzYW1lIGRucyBib3VuZGFyaWVz LCBmb3IgZXhhbXBsZSwgZG9tYWluIGFubWVzLCBuMSwgbjIsIG4zLCBuNCwgbjUsIC4uLi4uLiwN CmlmIHRoZXJlIGFyZSBjZW50cmFsaXplZCBtZWNoYW5pc20sIHRoZSBkbnMgYWRtaW5pc3RyYXRv cnMgbWlnaHQgbmVlZCBodW5kcmVkcyBvZiBETlMgU09QQSByZWNvcmRzIGZvciBjb25zdHJ1Y3Rp bmcgcGFpcndpc2UgcmVsYXRpb25zaGlwIGJldHdlZW4gYW55IDIgb2YgdGhlc2UgIGRvemVucyBv ZiBkb21haW4gbmFtZXMuDQpjb25maWd1cmF0aW9uIGV4YW1wbGVzOg0KbjEtLT5uMg0KbjEtLT5u Mw0KbjEtLT5uNA0KbjEtLT5uNQ0KLi4uLi4uDQpuMi0tPm4xDQpuMi0tPm4zDQpuMi0tPm40DQpu Mi0tPm41DQouLi4uLi4uLg0KbjMtLT5uMQ0KbjMtLT5uMg0KbjMtLT5uNA0KbjMtLT5uNQ0KLi4u Li4uLg0KDQoNCmlmIHRoZXJlIGlzIGEgY2VudHJhbGl6ZWQgbWVjaGFuaXNtLCBhbGwgdGhlc2Ug ZG9tYWluIG5hbWVzIG4xLCBuMiwgbjMsIG40LG41IG1heSBhZ3JlZSB0byBnZXQgdGhlIHNhbWUg cG9saWN5IGZyb20gUFNMIG9yIHNvbWUgc29tZSBwcml2YXRlIFVSTCAoY29udHJvbGxlZCBieSB0 aGUgY29tYW55IGl0c2VsZikuDQpuMSwgbjIsIG4zLCBuNCxuNSBtYXkgdXNlIG9uZSBkbnMgcmVj b3JkIHRvIHBvaW50IHRvIFBTTCBvciBwcml2YXRlIFVSTCB3aGVyZSBzb21lIHBvbGljeSBpbmZv cm1hdGlvbiBpcyBhdmFpbGFibGUuDQoNCm4xLS0+VVJMDQpuMi0tPlVSTA0KbjMtLT5VUkwNCm40 LS0+VVJMDQpuNS0tPlVSTA0KLi4uLi4NCg0KDQpzbyBpZiB0aGVyZSBpcyBhIGNlbnRyYWxpemVk IG1lY2hhbmlzbShwdWJsaWMgb3IgcHJpdmF0ZSBjb250cm9sKSwgaXQgaXMgZWFzeSBmb3IgZG5z IGFkbWluaXN0cmF0b3JzIHRvIG1hbmFnZSB0aGVzZSBkbnMgYm91bmRhcmllcy4gIEJ1aWxkaW5n IGNyb3NzIHJlbGF0aW9uc2hpcCBiZXR3ZWUgYW55IDIgb2YgdGhlIGRvbWFpbiBuYW1lcyBpcyBm b3Igc21hbGwgbnVtYmVyIG9mIGRvbWFpbiBuYW1lcywgZm9yIGV4YW1wbGUgMiBvciAzIGRvbWFp biBuYW1lcy4NCg0KDQpKaWFua2FuZyBZYW8NCiA= ------=_001_NextPart687773287142_=---- Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable =EF=BB=BF
 
 
 
Date: 2015-10-08 09:00
To: dbound
Subject: Re: [dbound] Fw: New Version Notification for=20 draft-yao-dbound-dns-solution-00.txt
 
 
>> Because there are two kinds of=  service relationships, one decided by the&n= bsp;centralized authority such as PSL, the o= ther decided by themselves , this flag = will indicate that information.
>> 
>
>No, I claim these are not two = kinds of service relationships.  I think
>what Bill said is right.
>
 
Now, with the new gTLD program, it is very likely that a company appl= ies=20 some names from different gTLD for the same purposes.
if one company has dozens of domain names which are supposed to = share=20 the same dns boundaries, for example, domain anmes, n1, n2, n3, n4, n5,=20 ......,
if there are centralized mechanism, the dns administrators might= =20 need hundreds of DNS SOPA records for constructing pairwise relationship betwe= en any 2=20 of these  dozens of domain names.
configuration=20 examples:
n1-->n2
n1-->n3
n1-->n4
n1-->n5
......=
n2-->n1
n2-->n3
n2-->n4
n2-->n5
........
n3-->n1
n3-->n2
n3-->n4
n3-->n5
.......
 
 
if there is a centralized=20 mechanism, all these domain names n1, n2, n3, n4,n5 may agree to get the s= ame=20 policy from PSL or some some private URL (controlled by the comany=20 itself).
n1, n2, n3, n4,n5 may use o= ne dns=20 record to point to PSL or private URL where some policy information is=20 available.
 
n1-->URL
n2-->URL
n3-->URL
n4-->URL=
n5-->URL=
.....<= /SPAN>
=  
=  
so if there is a centralized=20 mechanism(public or private control), it is easy for dns administrators to= =20 manage these dns boundaries.  Building cross relationship betwee= any 2=20 of the domain names is for small number of domain names, for example 2 or = 3=20 domain=20 names.=
= <= /SPAN> 
= <= /SPAN> 
Jiankang=20 Yao<= /SPAN>
 = <= /SPAN>
=  
=  
 
 
 
 
------=_001_NextPart687773287142_=------ From nobody Tue Oct 13 06:28:45 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 448701B3894 for ; Tue, 13 Oct 2015 06:28:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P9fxqZPGIok0 for ; Tue, 13 Oct 2015 06:28:39 -0700 (PDT) Received: from mail-ig0-x234.google.com (mail-ig0-x234.google.com [IPv6:2607:f8b0:4001:c05::234]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8D58E1B311F for ; Tue, 13 Oct 2015 06:28:38 -0700 (PDT) Received: by igcpe7 with SMTP id pe7so15633188igc.0 for ; Tue, 13 Oct 2015 06:28:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=deccio.net; s=google; h=mime-version:date:message-id:subject:from:to:content-type; bh=kKtndBBJO8OFZKF4f9bNq1/SibMmlU5YHXfopU8RnVg=; b=ZQxhdJGqg7mdwkdJsM5PVH9JC5FfILmXwHgCcPUWCd/l2oljSwhiLE1OXnmaDrrdH/ PAWi3Xw7LNi6tBT9EqYQkMIqjMbdbAU8xw4cwcjuPLAQ21djJvnfujhSi25uVPfJnRmj ItHV1eNFMwFIX2a88un50SzIUMr0RjabqVa2Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=kKtndBBJO8OFZKF4f9bNq1/SibMmlU5YHXfopU8RnVg=; b=Y0MJw7JUhq03Woo3Ky6Hl3zXds7Tfezc/Ur3Psr426O53/htuTMrIsPFs1MElbb4FB UHnnXuANKhIMJTlwVjBITmihiF4WfkqeKuG9nKmOzXvQK+il6w7hXLK+gFCKL8Tmaa9f 2DNZU5p/Os2e2PNvFob7fMjXT2SHJJZI0+iuOgCbhIqsblfQUsS38l7OQoSBt/uGTkFo oGSML04AiF+OAorxbtinJRIekOSAVNmdoVbTqU0EBEjARVuZVvRpPyigPetqTPDLbR9Y GNefwmveAou05uzs+5vcF8h/Pq7A8zI5eYICrjTj/M7Ub76f9IxsQGD9+mAmEFlVrDUY vQBA== X-Gm-Message-State: ALoCoQktfbJuhTV8qt+/ib0yakkjOxYqPKM08r1u4Rh/rJZ7My6VNGR+Q1cxUarybGfKrEguHTWb MIME-Version: 1.0 X-Received: by 10.50.50.139 with SMTP id c11mr20072188igo.10.1444742917820; Tue, 13 Oct 2015 06:28:37 -0700 (PDT) Received: by 10.50.159.230 with HTTP; Tue, 13 Oct 2015 06:28:37 -0700 (PDT) Date: Tue, 13 Oct 2015 09:28:37 -0400 Message-ID: From: Casey Deccio To: "dbound@ietf.org" Content-Type: multipart/alternative; boundary=047d7bdca04068b0e10521fc6c4a Archived-At: Subject: [dbound] draft-deccio-dbound-organizational-domain-policy-00 X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 13:28:41 -0000 --047d7bdca04068b0e10521fc6c4a Content-Type: text/plain; charset=UTF-8 For your review, I've submitted the following I-D. Regards, Casey Name: draft-deccio-dbound-organizational-domain-policy Revision: 00 Title: Organizational Domains and Use Policies for Domain Names Document date: 2015-10-13 Group: Individual Submission Pages: 18 URL: https://www.ietf.org/internet-drafts/draft-deccio-dbound-organizational-domain-policy-00.txt Status: https://datatracker.ietf.org/doc/draft-deccio-dbound-organizational-domain-policy/ Htmlized: https://tools.ietf.org/html/draft-deccio-dbound-organizational-domain-policy-00 Abstract: Various Internet protocols and applications require some mechanism for identifying policy surrounding the use Domain Name System (DNS) names. In this document we describe an extensible system in which domain name policies can be discovered at various levels in the DNS tree. --047d7bdca04068b0e10521fc6c4a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
For your review, I've submitted the followin= g I-D.

Regards,
Casey


= Name:=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 draft-deccio-dbound-organization= al-domain-policy
Revision:=C2=A0=C2=A0=C2=A0 00
Title:=C2=A0=C2=A0=C2= =A0 =C2=A0=C2=A0=C2=A0 Organizational Domains and Use Policies for Domain N= ames
Document date:=C2=A0=C2=A0=C2=A0 2015-10-13
Group:=C2=A0=C2=A0= =C2=A0 =C2=A0=C2=A0=C2=A0 Individual Submission
Pages:=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0 18
URL:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 https://www.ietf.org/in= ternet-drafts/draft-deccio-dbound-organizational-domain-policy-00.txtStatus:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 https://datatracker.ietf.org/doc/draft-deccio-dbound-organizational-doma= in-policy/
Htmlized:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 https://tools.ietf.org/html/draft-deccio-dbound-organizational-domain= -policy-00


Abstract:
=C2=A0 Various Internet protocols an= d applications require some mechanism
=C2=A0 for identifying policy surr= ounding the use Domain Name System (DNS)
=C2=A0 names.=C2=A0 In this doc= ument we describe an extensible system in which
=C2=A0 domain name polic= ies can be discovered at various levels in the DNS
=C2=A0 tree.

<= /div>
--047d7bdca04068b0e10521fc6c4a-- From nobody Tue Oct 13 07:06:06 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BDCF51B31CB for ; Tue, 13 Oct 2015 07:06:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.969 X-Spam-Level: ** X-Spam-Status: No, score=2.969 tagged_above=-999 required=5 tests=[BAYES_50=0.8, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, MIME_CHARSET_FARAWAY=2.45, MIME_HTML_MOSTLY=0.428, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 72cWFRw-vLYj for ; Tue, 13 Oct 2015 07:06:01 -0700 (PDT) Received: from SNT004-OMC4S47.hotmail.com (snt004-omc4s47.hotmail.com [65.54.51.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 56CBB1B31CA for ; Tue, 13 Oct 2015 07:06:01 -0700 (PDT) Received: from SNT407-EAS188 ([65.55.90.201]) by SNT004-OMC4S47.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Tue, 13 Oct 2015 07:06:00 -0700 X-TMN: [v8KE6Khnzc9Od05R93anOBgFqpF2mVbi] X-Originating-Email: [jiankangyao@hotmail.com] Message-ID: Content-Type: multipart/related; boundary="_9660c38f-c06a-4584-a044-62a42ac01f4a_" References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> <2015101311474918524028@cnnic.cn> From: yaojk MIME-Version: 1.0 (1.0) In-Reply-To: <2015101311474918524028@cnnic.cn> Date: Tue, 13 Oct 2015 22:15:39 +0800 To: yaojk X-OriginalArrivalTime: 13 Oct 2015 14:06:00.0821 (UTC) FILETIME=[4A42DA50:01D105C0] Archived-At: Cc: Andrew Sullivan , dbound Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 14:06:05 -0000 --_9660c38f-c06a-4584-a044-62a42ac01f4a_ Content-Type: multipart/alternative; boundary="Apple-Mail-0993ADE4-AB6E-44FE-BB3E-D5C219856D75" Content-Transfer-Encoding: 7bit --Apple-Mail-0993ADE4-AB6E-44FE-BB3E-D5C219856D75 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 DQoNCg0KDQo+INTaIDIwMTXE6jEw1MIxM8jVo6wxMTo0OKOsSmlhbmthbmcgWWFvIDx5YW9qa0Bj bm5pYy5jbj4g0LS1wKO6DQo+IA0KPiAgDQo+ICANCj4gIA0KPiBGcm9tOiBBbmRyZXcgU3VsbGl2 YW4NCj4gRGF0ZTogMjAxNS0xMC0wOCAwOTowMA0KPiBUbzogZGJvdW5kDQo+IFN1YmplY3Q6IFJl OiBbZGJvdW5kXSBGdzogTmV3IFZlcnNpb24gTm90aWZpY2F0aW9uIGZvciBkcmFmdC15YW8tZGJv dW5kLWRucy1zb2x1dGlvbi0wMC50eHQNCj4gIA0KPiAgDQo+ID4+IEJlY2F1c2UgdGhlcmUgYXJl IHR3byBraW5kcyBvZiBzZXJ2aWNlIHJlbGF0aW9uc2hpcHMsIG9uZSBkZWNpZGVkIGJ5IHRoZSBj ZW50cmFsaXplZCBhdXRob3JpdHkgc3VjaCBhcyBQU0wsIHRoZSBvdGhlciBkZWNpZGVkIGJ5IHRo ZW1zZWx2ZXMgLCB0aGlzIGZsYWcgd2lsbCBpbmRpY2F0ZSB0aGF0IGluZm9ybWF0aW9uLg0KPiA+ PiANCj4gPg0KPiA+Tm8sIEkgY2xhaW0gdGhlc2UgYXJlIG5vdCB0d28ga2luZHMgb2Ygc2Vydmlj ZSByZWxhdGlvbnNoaXBzLiAgSSB0aGluaw0KPiA+d2hhdCBCaWxsIHNhaWQgaXMgcmlnaHQuDQo+ ID4NCj4gIA0KPiBOb3csIHdpdGggdGhlIG5ldyBnVExEIHByb2dyYW0sIGl0IGlzIHZlcnkgbGlr ZWx5IHRoYXQgYSBjb21wYW55IGFwcGxpZXMgc29tZSBuYW1lcyBmcm9tIGRpZmZlcmVudCBnVExE IGZvciB0aGUgc2FtZSBwdXJwb3Nlcy4NCj4gaWYgb25lIGNvbXBhbnkgaGFzIGRvemVucyBvZiBk b21haW4gbmFtZXMgd2hpY2ggYXJlIHN1cHBvc2VkIHRvIHNoYXJlIHRoZSBzYW1lIGRucyBib3Vu ZGFyaWVzLCBmb3IgZXhhbXBsZSwgZG9tYWluIGFubWVzLCBuMSwgbjIsIG4zLCBuNCwgbjUsIC4u Li4uLiwNCj4gaWYgdGhlcmUgYXJlIGNlbnRyYWxpemVkIG1lY2hhbmlzbQ0KDQpPb3BzLCAiaWYg dGhlcmUgYXJlIGNlbnRyYWxpemVkIG1lY2hhbmlzbSINClNob3VsZCBiZToNCg0KImlmIHRoZXJl IGFyZSBubyBjZW50cmFsaXplZCBtZWNoYW5pc21zIg0KDQoNCj4gLCB0aGUgZG5zIGFkbWluaXN0 cmF0b3JzIG1pZ2h0IG5lZWQgaHVuZHJlZHMgb2YgRE5TIFNPUEEgcmVjb3JkcyBmb3IgY29uc3Ry dWN0aW5nIHBhaXJ3aXNlIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIGFueSAyIG9mIHRoZXNlICBkb3pl bnMgb2YgZG9tYWluIG5hbWVzLg0KPiBjb25maWd1cmF0aW9uIGV4YW1wbGVzOg0KPiBuMS0tPm4y DQo+IG4xLS0+bjMNCj4gbjEtLT5uNA0KPiBuMS0tPm41DQo+IC4uLi4uLg0KPiBuMi0tPm4xDQo+ IG4yLS0+bjMNCj4gbjItLT5uNA0KPiBuMi0tPm41DQo+IC4uLi4uLi4uDQo+IG4zLS0+bjENCj4g bjMtLT5uMg0KPiBuMy0tPm40DQo+IG4zLS0+bjUNCj4gLi4uLi4uLg0KPiAgDQo+ICANCj4gaWYg dGhlcmUgaXMgYSBjZW50cmFsaXplZCBtZWNoYW5pc20sIGFsbCB0aGVzZSBkb21haW4gbmFtZXMg bjEsIG4yLCBuMywgbjQsbjUgbWF5IGFncmVlIHRvIGdldCB0aGUgc2FtZSBwb2xpY3kgZnJvbSBQ U0wgb3Igc29tZSBzb21lIHByaXZhdGUgVVJMIChjb250cm9sbGVkIGJ5IHRoZSBjb21hbnkgaXRz ZWxmKS4NCj4gbjEsIG4yLCBuMywgbjQsbjUgbWF5IHVzZSBvbmUgZG5zIHJlY29yZCB0byBwb2lu dCB0byBQU0wgb3IgcHJpdmF0ZSBVUkwgd2hlcmUgc29tZSBwb2xpY3kgaW5mb3JtYXRpb24gaXMg YXZhaWxhYmxlLg0KPiAgDQo+IG4xLS0+VVJMDQo+IG4yLS0+VVJMDQo+IG4zLS0+VVJMDQo+IG40 LS0+VVJMDQo+IG41LS0+VVJMDQo+IC4uLi4uDQo+ICANCj4gIA0KPiBzbyBpZiB0aGVyZSBpcyBh IGNlbnRyYWxpemVkIG1lY2hhbmlzbShwdWJsaWMgb3IgcHJpdmF0ZSBjb250cm9sKSwgaXQgaXMg ZWFzeSBmb3IgZG5zIGFkbWluaXN0cmF0b3JzIHRvIG1hbmFnZSB0aGVzZSBkbnMgYm91bmRhcmll cy4gIEJ1aWxkaW5nIGNyb3NzIHJlbGF0aW9uc2hpcCBiZXR3ZWUgYW55IDIgb2YgdGhlIGRvbWFp biBuYW1lcyBpcyBmb3Igc21hbGwgbnVtYmVyIG9mIGRvbWFpbiBuYW1lcywgZm9yIGV4YW1wbGUg MiBvciAzIGRvbWFpbiBuYW1lcy4NCj4gIA0KPiAgDQo+IEppYW5rYW5nIFlhbw0KPiAgDQo+ICAN Cj4gIA0KPiAgDQo+ICANCj4gIA0KPiAgDQo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fDQo+IGRib3VuZCBtYWlsaW5nIGxpc3QNCj4gZGJvdW5kQGlldGYu b3JnDQo+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vZGJvdW5kDQo= --Apple-Mail-0993ADE4-AB6E-44FE-BB3E-D5C219856D75 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+PGhlYWQ+PG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250ZW50PSJ0ZXh0 L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPjwvaGVhZD48Ym9keSBkaXI9ImF1dG8iPjxkaXY+PGJyPjxi cj48YnI+PC9kaXY+PGRpdj48YnI+5ZyoIDIwMTXlubQxMOaciDEz5pel77yMMTE6NDjvvIxKaWFu a2FuZyBZYW8gJmx0OzxhIGhyZWY9Im1haWx0bzp5YW9qa0Bjbm5pYy5jbiI+eWFvamtAY25uaWMu Y248L2E+Jmd0OyDlhpnpgZPvvJo8YnI+PGJyPjwvZGl2PjxibG9ja3F1b3RlIHR5cGU9ImNpdGUi PjxkaXY+DQoNCjxtZXRhIGNvbnRlbnQ9InRleHQvaHRtbDsgY2hhcnNldD11dGYtOCIgaHR0cC1l cXVpdj0iQ29udGVudC1UeXBlIj4NCjxzdHlsZT4NCkJMT0NLUVVPVEUgew0KCU1BUkdJTi1CT1RU T006IDBweDsgTUFSR0lOLUxFRlQ6IDJlbTsgTUFSR0lOLVRPUDogMHB4DQp9DQpPTCB7DQoJTUFS R0lOLUJPVFRPTTogMHB4OyBNQVJHSU4tVE9QOiAwcHgNCn0NClVMIHsNCglNQVJHSU4tQk9UVE9N OiAwcHg7IE1BUkdJTi1UT1A6IDBweA0KfQ0KQk9EWSB7DQoJRk9OVC1TSVpFOiAxMC41cHQ7IEZP TlQtRkFNSUxZOiAmIzIzNDM1OyBDT0xPUjogIzAwMDAwMDsgTElORS1IRUlHSFQ6IDEuNTsgMjAz MDc6IA0KfQ0KUCB7DQoJTUFSR0lOLUJPVFRPTTogMHB4OyBNQVJHSU4tVE9QOiAwcHgNCn0NCjwv c3R5bGU+DQoNCjxtZXRhIG5hbWU9IkdFTkVSQVRPUiIgY29udGVudD0iTVNIVE1MIDExLjAwLjk2 MDAuMTgwMTUiPg0KDQo8ZGl2PiZuYnNwOzwvZGl2Pg0KPGRpdj4mbmJzcDs8L2Rpdj4NCjxkaXY+ Jm5ic3A7PC9kaXY+DQo8ZGl2IHN0eWxlPSJCT1JERVItVE9QOiAjYjVjNGRmIDFwdCBzb2xpZDsg Qk9SREVSLVJJR0hUOiBtZWRpdW0gbm9uZTsgQk9SREVSLUJPVFRPTTogbWVkaXVtIG5vbmU7IFBB RERJTkctQk9UVE9NOiAwY207IFBBRERJTkctVE9QOiAzcHQ7IFBBRERJTkctTEVGVDogMGNtOyBC T1JERVItTEVGVDogbWVkaXVtIG5vbmU7IFBBRERJTkctUklHSFQ6IDBjbSI+DQo8ZGl2IHN0eWxl PSJGT05ULVNJWkU6IDEycHg7IEJBQ0tHUk9VTkQ6ICNlZmVmZWY7IENPTE9SOiAjMDAwMDAwOyBQ QURESU5HLUJPVFRPTTogOHB4OyBQQURESU5HLVRPUDogOHB4OyBQQURESU5HLUxFRlQ6IDhweDsg UEFERElORy1SSUdIVDogOHB4Ij4NCjxkaXY+PGI+RnJvbTo8L2I+Jm5ic3A7PGEgaHJlZj0ibWFp bHRvOmFqc0BhbnZpbHdhbHJ1c2Rlbi5jb20iPkFuZHJldyANClN1bGxpdmFuPC9hPjwvZGl2Pg0K PGRpdj48Yj5EYXRlOjwvYj4mbmJzcDsyMDE1LTEwLTA4Jm5ic3A7MDk6MDA8L2Rpdj4NCjxkaXY+ PGI+VG86PC9iPiZuYnNwOzxhIGhyZWY9Im1haWx0bzpkYm91bmRAaWV0Zi5vcmciPmRib3VuZDwv YT48L2Rpdj4NCjxkaXY+PGI+U3ViamVjdDo8L2I+Jm5ic3A7UmU6IFtkYm91bmRdIEZ3OiBOZXcg VmVyc2lvbiBOb3RpZmljYXRpb24gZm9yIA0KZHJhZnQteWFvLWRib3VuZC1kbnMtc29sdXRpb24t MDAudHh0PC9kaXY+PC9kaXY+PC9kaXY+DQo8ZGl2Pg0KPGRpdj4mbmJzcDs8L2Rpdj4NCjxkaXY+ Jm5ic3A7PC9kaXY+DQo8ZGl2PiZndDsmZ3Q7Jm5ic3A7QmVjYXVzZSZuYnNwO3RoZXJlJm5ic3A7 YXJlJm5ic3A7dHdvJm5ic3A7a2luZHMmbmJzcDtvZiZuYnNwO3NlcnZpY2UmbmJzcDtyZWxhdGlv bnNoaXBzLCZuYnNwO29uZSZuYnNwO2RlY2lkZWQmbmJzcDtieSZuYnNwO3RoZSZuYnNwO2NlbnRy YWxpemVkJm5ic3A7YXV0aG9yaXR5Jm5ic3A7c3VjaCZuYnNwO2FzJm5ic3A7UFNMLCZuYnNwO3Ro ZSZuYnNwO290aGVyJm5ic3A7ZGVjaWRlZCZuYnNwO2J5Jm5ic3A7dGhlbXNlbHZlcyZuYnNwOywm bmJzcDt0aGlzJm5ic3A7ZmxhZyZuYnNwO3dpbGwmbmJzcDtpbmRpY2F0ZSZuYnNwO3RoYXQmbmJz cDtpbmZvcm1hdGlvbi48L2Rpdj4NCjxkaXY+Jmd0OyZndDsmbmJzcDs8L2Rpdj4NCjxkaXY+Jmd0 OzwvZGl2Pg0KPGRpdj4mZ3Q7Tm8sJm5ic3A7SSZuYnNwO2NsYWltJm5ic3A7dGhlc2UmbmJzcDth cmUmbmJzcDtub3QmbmJzcDt0d28mbmJzcDtraW5kcyZuYnNwO29mJm5ic3A7c2VydmljZSZuYnNw O3JlbGF0aW9uc2hpcHMuJm5ic3A7Jm5ic3A7SSZuYnNwO3RoaW5rPC9kaXY+DQo8ZGl2PiZndDt3 aGF0Jm5ic3A7QmlsbCZuYnNwO3NhaWQmbmJzcDtpcyZuYnNwO3JpZ2h0LjwvZGl2Pg0KPGRpdj4m Z3Q7PC9kaXY+DQo8ZGl2PiZuYnNwOzwvZGl2Pg0KPGRpdj5Ob3csIHdpdGggdGhlIG5ldyBnVExE IHByb2dyYW0sIGl0IGlzIHZlcnkgbGlrZWx5IHRoYXQgYSBjb21wYW55IGFwcGxpZXMgDQpzb21l IG5hbWVzIGZyb20gZGlmZmVyZW50IGdUTEQgZm9yIHRoZSBzYW1lIHB1cnBvc2VzLjwvZGl2Pg0K PGRpdj5pZiBvbmUgY29tcGFueSBoYXMgZG96ZW5zJm5ic3A7b2YgZG9tYWluIG5hbWVzIHdoaWNo IGFyZSBzdXBwb3NlZCB0byBzaGFyZSANCnRoZSBzYW1lIGRucyBib3VuZGFyaWVzLCBmb3IgZXhh bXBsZSwgZG9tYWluIGFubWVzLCBuMSwgbjIsIG4zLCBuNCwgbjUsIA0KLi4uLi4uLDwvZGl2Pg0K PGRpdj5pZiB0aGVyZSBhcmUgY2VudHJhbGl6ZWQgbWVjaGFuaXNtPC9kaXY+PC9kaXY+PC9kaXY+ PC9ibG9ja3F1b3RlPjxkaXY+PGJyPjwvZGl2PjxkaXY+T29wcywgImlmJm5ic3A7PHNwYW4gc3R5 bGU9ImJhY2tncm91bmQtY29sb3I6IHJnYmEoMjU1LCAyNTUsIDI1NSwgMCk7Ij50aGVyZSBhcmUg Y2VudHJhbGl6ZWQgbWVjaGFuaXNtIjwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuIHN0eWxlPSJiYWNr Z3JvdW5kLWNvbG9yOiByZ2JhKDI1NSwgMjU1LCAyNTUsIDApOyI+U2hvdWxkIGJlOjwvc3Bhbj48 L2Rpdj48ZGl2PjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiByZ2JhKDI1NSwgMjU1LCAy NTUsIDApOyI+PGJyPjwvc3Bhbj48L2Rpdj48ZGl2PjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNv bG9yOiByZ2JhKDI1NSwgMjU1LCAyNTUsIDApOyI+ImlmIHRoZXJlIGFyZSBubyBjZW50cmFsaXpl ZCBtZWNoYW5pc21zIjwvc3Bhbj48L2Rpdj48ZGl2Pjxicj48L2Rpdj48YnI+PGJsb2NrcXVvdGUg dHlwZT0iY2l0ZSI+PGRpdj48ZGl2PjxkaXY+LCB0aGUgZG5zIGFkbWluaXN0cmF0b3JzJm5ic3A7 bWlnaHQgDQpuZWVkJm5ic3A7aHVuZHJlZHMgb2YgRE5TIFNPUEEmbmJzcDtyZWNvcmRzIGZvciBj b25zdHJ1Y3RpbmcgPHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+cGFpcndpc2UgcmVsYXRpb25zaGlwIGJldHdlZW4gYW55IDIgDQpvZiB0aGVzZSZuYnNw OyBkb3plbnMmbmJzcDtvZiBkb21haW4gbmFtZXMuPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij5jb25maWd1cmF0aW9u IA0KZXhhbXBsZXM6PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij5uMS0tJmd0O24yPC9zcGFuPjwvZGl2Pg0KPGRpdj48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij5uMS0tJmd0 O24zPC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij5uMS0tJmd0O240PC9zcGFuPjwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+bjEtLSZndDtuNTwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij4u Li4uLi48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+bjItLSZndDtuMTwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2Rp dj4NCjxkaXY+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+bjItLSZndDtuMzwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij5uMi0t Jmd0O240PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv ZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij5uMi0tJmd0O241PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+Li4uLi4u Li48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu PjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij4NCjxkaXY+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+bjMtLSZndDtuMTwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2Rpdj4NCjxkaXY+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+bjMtLSZndDtuMjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9kaXY+DQo8ZGl2PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQg b3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmln aHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNs YXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPm4zLS0mZ3Q7bjQ8L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9kaXY+DQo8ZGl2 PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFu IGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNz PSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9k aWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19m b250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQg b3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPm4zLS0mZ3Q7bjU8L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij4uLi4uLi4uPC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2Rpdj4NCjxk aXY+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj4mbmJzcDs8L2Rpdj4NCjxkaXY+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj4mbmJzcDs8L2Rpdj4NCjxkaXY+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+aWYgdGhlcmUgaXMgYSBjZW50cmFsaXplZCANCm1lY2hhbmlzbSwgYWxsIHRoZXNl IGRvbWFpbiBuYW1lcyBuMSwgbjIsIG4zLCBuNCxuNSBtYXkgYWdyZWUgdG8gZ2V0IHRoZSBzYW1l IA0KcG9saWN5IGZyb20gUFNMIG9yIHNvbWUgc29tZSBwcml2YXRlIFVSTCAoY29udHJvbGxlZCBi eSB0aGUgY29tYW55IA0KaXRzZWxmKS48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij5uMSwgbjIsIG4zLCBu NCxuNSBtYXkgdXNlIG9uZSBkbnMgDQpyZWNvcmQgdG8gcG9pbnQgdG8gUFNMIG9yIHByaXZhdGUg VVJMIHdoZXJlIHNvbWUgcG9saWN5IGluZm9ybWF0aW9uIGlzIA0KYXZhaWxhYmxlLjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9kaXY+DQo8 ZGl2PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNs YXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJv cF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0 M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250 MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3Bf ZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNf bWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2lu UmlnaHQiPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPiZuYnNwOzwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij5uMS0tJmd0O1VSTDwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2 Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij5uMi0tJmd0O1VSTDwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij5uMy0tJmd0O1VSTDwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij5u NC0tJmd0O1VSTDwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij5uNS0tJmd0O1VSTDwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRp dj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij4uLi4uLjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2 Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj4mbmJz cDs8L2Rpdj4NCjxkaXY+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+Jm5ic3A7PC9kaXY+DQo8ZGl2PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmln aHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNs YXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJv cF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0 M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250 MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3Bf ZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNf bWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2lu UmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQi PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFu IGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNz PSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9k aWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19m b250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQg b3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmln aHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNs YXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJv cF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0 M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250 MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3Bf ZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNf bWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2lu UmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQi PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFu IGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNz PSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9k aWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19m b250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQg b3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmln aHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNs YXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJv cF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPnNvIDxzcGFuIGNsYXNzPSJvcF9k aWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19m b250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQg b3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmln aHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPmlmIHRoZXJl IGlzIGEgY2VudHJhbGl6ZWQgDQptZWNoYW5pc20ocHVibGljIG9yIHByaXZhdGUgY29udHJvbCks IGl0IGlzIGVhc3kgZm9yIGRucyBhZG1pbmlzdHJhdG9ycyB0byANCm1hbmFnZSB0aGVzZSBkbnMg Ym91bmRhcmllcy4mbmJzcDsgQnVpbGRpbmcmbmJzcDtjcm9zcyByZWxhdGlvbnNoaXAgYmV0d2Vl IGFueSAyIA0Kb2YgdGhlIGRvbWFpbiBuYW1lcyBpcyBmb3Igc21hbGwgbnVtYmVyIG9mIGRvbWFp biBuYW1lcywgZm9yIGV4YW1wbGUgMiBvciAzIA0KZG9tYWluIA0KbmFtZXMuPC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L2Rpdj4NCjxkaXY+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj4mbmJzcDs8L2Rpdj4NCjxkaXY+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj4mbmJzcDs8L2Rpdj4NCjxk aXY+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+SmlhbmthbmcgDQpZYW88L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij4mbmJzcDs8 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+ PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvZGl2Pg0KPGRpdj48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBj bGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0i b3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGlj dDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9u dDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9w X2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3Qz X21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdp blJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0 Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3Bh biBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFz cz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3Bf ZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNf Zm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0 IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2Rp Y3QzX21hcmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21h cmdpblJpZ2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJp Z2h0Ij48c3BhbiBjbGFzcz0ib3BfZGljdDNfZm9udDI0IG9wX2RpY3QzX21hcmdpblJpZ2h0Ij48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj4mbmJzcDs8L2Rpdj4NCjxkaXY+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+ PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4g Y2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9 Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2Rp Y3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2Zv bnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBv cF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0 M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJn aW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdo dCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNw YW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xh c3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9w X2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3Qz X2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQy NCBvcF9kaWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9k aWN0M19tYXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19t YXJnaW5SaWdodCI+PHNwYW4gY2xhc3M9Im9wX2RpY3QzX2ZvbnQyNCBvcF9kaWN0M19tYXJnaW5S aWdodCI+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9z cGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFu Pjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+Jm5ic3A7PC9kaXY+DQo8ZGl2Pjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNs YXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJv cF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0 M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250 MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3Bf ZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNf bWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2lu UmlnaHQiPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+Jm5ic3A7PC9kaXY+DQo8ZGl2PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3Bf ZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNf bWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2lu UmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQi PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFu IGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNz PSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9k aWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwv c3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+Jm5ic3A7PC9kaXY+DQo8ZGl2PjxzcGFu IGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNz PSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9k aWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19m b250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQg b3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmln aHQiPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3Nw YW4+Jm5ic3A7PC9kaXY+DQo8ZGl2PjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGlj dDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFy Z2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmln aHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxz cGFuIGNsYXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNs YXNzPSJvcF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJv cF9kaWN0M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjxzcGFuIGNsYXNzPSJvcF9kaWN0 M19mb250MjQgb3BfZGljdDNfbWFyZ2luUmlnaHQiPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bh bj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+Jm5ic3A7PC9kaXY+PC9zcGFuPjwvc3Bhbj48 L3NwYW4+PC9zcGFuPjwvc3Bhbj48L3NwYW4+PC9zcGFuPjwvc3Bhbj48L2Rpdj48L2Rpdj4NCjwv ZGl2PjwvYmxvY2txdW90ZT48YmxvY2txdW90ZSB0eXBlPSJjaXRlIj48ZGl2PjxzcGFuPl9fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPC9zcGFuPjxicj48c3Bh bj5kYm91bmQgbWFpbGluZyBsaXN0PC9zcGFuPjxicj48c3Bhbj48YSBocmVmPSJtYWlsdG86ZGJv dW5kQGlldGYub3JnIj5kYm91bmRAaWV0Zi5vcmc8L2E+PC9zcGFuPjxicj48c3Bhbj48YSBocmVm PSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Rib3VuZCI+aHR0cHM6Ly93 d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9kYm91bmQ8L2E+PC9zcGFuPjxicj48L2Rpdj48 L2Jsb2NrcXVvdGU+PC9ib2R5PjwvaHRtbD4= --Apple-Mail-0993ADE4-AB6E-44FE-BB3E-D5C219856D75-- --_9660c38f-c06a-4584-a044-62a42ac01f4a_ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ dbound mailing list dbound@ietf.org https://www.ietf.org/mailman/listinfo/dbound --_9660c38f-c06a-4584-a044-62a42ac01f4a_-- From nobody Tue Oct 13 07:34:47 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 64D481B4441 for ; Tue, 13 Oct 2015 07:34:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6gZeNWYckttf for ; Tue, 13 Oct 2015 07:34:45 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [50.116.54.116]) by ietfa.amsl.com (Postfix) with ESMTP id DD13A1B443D for ; Tue, 13 Oct 2015 07:34:43 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id 2E54010700 for ; Tue, 13 Oct 2015 14:34:43 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cCKZnBBnMl17 for ; Tue, 13 Oct 2015 14:34:42 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id 3C113106FC for ; Tue, 13 Oct 2015 14:34:42 +0000 (UTC) Date: Tue, 13 Oct 2015 10:34:40 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151013143440.GG25369@mx2.yitter.info> References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 14:34:46 -0000 On Mon, Oct 12, 2015 at 11:37:36PM +0800, yaojk wrote: > For example, a user has 2 domain names, a.com and a.net which have applied CA certificates with some expired date. The user would like to configure the same DNS boundaries for these domain names under the https service during the validity period of CA certificates. > The valid period is from the maximum (inception of both domain name certificates) to minimum (expiration of both domain name certificates) > I was afraid you were claiming something like that. I don't think this mechanism should be attempting to override anything from the X.509 certificate and I think if we try that we are bound to make things much more fragile. The expiry times are already part of the certificates. Don't try to do something tricky with that via the DNS. A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Tue Oct 13 07:37:44 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 105791B4467 for ; Tue, 13 Oct 2015 07:37:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KDw1XjP3YGLT for ; Tue, 13 Oct 2015 07:37:42 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [50.116.54.116]) by ietfa.amsl.com (Postfix) with ESMTP id 0ED611B4465 for ; Tue, 13 Oct 2015 07:37:42 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id C0E9A10701 for ; Tue, 13 Oct 2015 14:37:41 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cIOzfCv7__79 for ; Tue, 13 Oct 2015 14:37:41 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id 28A76106FC for ; Tue, 13 Oct 2015 14:37:41 +0000 (UTC) Date: Tue, 13 Oct 2015 10:37:39 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151013143739.GH25369@mx2.yitter.info> References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> <2015101311474918524028@cnnic.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2015101311474918524028@cnnic.cn> User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 14:37:43 -0000 On Tue, Oct 13, 2015 at 11:47:56AM +0800, Jiankang Yao wrote: > if there are centralized mechanism, the dns administrators might need hundreds of DNS SOPA records for constructing pairwise relationship between any 2 of these dozens of domain names. I suspect that "hundreds" is overstating the case (if we really have hundreds of such names, it's pretty clear the DNS is finished anyway), but yes. That is the sort of trivial thing that an uncomplicated script in Python or something similar can handle, and it allows pairwise checking that both sides of the relationship agree. > if there is a centralized mechanism, all these domain names n1, n2, n3, n4,n5 may agree to get the same policy from PSL or some some private URL (controlled by the comany itself). If you really want the URI approach, then I think you should ditch other mechanisms instead. A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Tue Oct 13 09:21:57 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1247E1A8731 for ; Tue, 13 Oct 2015 09:21:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id W2wOs3VnvALa for ; Tue, 13 Oct 2015 09:21:51 -0700 (PDT) Received: from mail-ig0-x22e.google.com (mail-ig0-x22e.google.com [IPv6:2607:f8b0:4001:c05::22e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CFC531A86F1 for ; Tue, 13 Oct 2015 09:21:50 -0700 (PDT) Received: by igbni9 with SMTP id ni9so60995808igb.1 for ; Tue, 13 Oct 2015 09:21:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=deccio.net; s=google; h=mime-version:date:message-id:subject:from:to:content-type; bh=NQwJcp3xoQmFcAUbktISj9zKUcxy6y69WJ5OXa3NBQ0=; b=TNgdmKG/2MoRTSMJCFihH5LyA2fodo4aurKMKfm2hyISLGbIAAXnnBKzP+Hs5/yj1f Qp7eVOj832kvEWI1QWBlbBuPyRRz0DWNr1LFi6mhjFMva/nJBIcGaAD5jQQebCjGHMws iV95uaGP+vppeSahvsT6LFilMjGO04GFkldy8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=NQwJcp3xoQmFcAUbktISj9zKUcxy6y69WJ5OXa3NBQ0=; b=X/9pqx0jdrZrePN72c0hziCKh9gyQvRJ1jwUx55TGeHmraliE1BJ2v06ngM8JpifyV vn93aAMXqJWUmuMeYNeccK0qvzL/ugnA5i4ynmMmE0HzaX/M2KWdDLHbIv3vMR9/KfFr mkMk9nf/6N0Hglo2yDtth70YCrXnsVfcrYE2Q4CxiY/28p6NkG1MQexbnBAPrZinAppb Ghntfmm51SbRku/+L5+7fh8Pyav2G/C/k+XX30F6jLvLpMBkTowGqEL+LqYvz4IxzRRP TZmPujza20wPCyeaWpUTDiZCWjoI4vmmsOKzNVMtXa5/djCQhSkRqDS+9vDubkxGIPZp LyZg== X-Gm-Message-State: ALoCoQnLtAN8gPn1vOgZp6wD6xfJ5ssc+KYXLwpqjS98xv1cCAv6Ml0iS5sxMLbatZXjiLptd/b6 MIME-Version: 1.0 X-Received: by 10.51.17.34 with SMTP id gb2mr17410238igd.80.1444753310272; Tue, 13 Oct 2015 09:21:50 -0700 (PDT) Received: by 10.50.159.230 with HTTP; Tue, 13 Oct 2015 09:21:50 -0700 (PDT) Date: Tue, 13 Oct 2015 12:21:50 -0400 Message-ID: From: Casey Deccio To: "dbound@ietf.org" Content-Type: multipart/alternative; boundary=001a1135ed32d8f8100521fed717 Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Oct 2015 16:21:57 -0000 --001a1135ed32d8f8100521fed717 Content-Type: text/plain; charset=UTF-8 On Tue, Sep 29, 2015 at 5:06 AM, Jiankang Yao wrote: > I submit a draft about dbound solution. > any comments are welcome. > > Thanks for the submission. I have read the draft and provide comments below. General - One of the challenges I have in following this is with lack of use cases, including how this mechanism applies to those cases. Several concrete uses of the PSL are documented elsewhere, and those would be a starting point. It is hard to tell what this adds without those cases. Expiration/Inception - as others have expressed, this is entirely unnecessary and simply adds complexity. Expiration and inception in DNSSEC are to prevent replay, but in this context, the issue seems to be more about convenience. The records could just be added and removed at the desired time to have the same effect. Relation - draft-deccio-dbound-name-relationships-00 (referenced) does indeed mention two types of relationships, but the point of that distinction was to divide the problem space, not to indicate that those relationship types needed to be identified explicitly in a solution. In fact, ancestral relationships are identified simply by comparing two names--that exists inherently in the DNS (and it is noted in the referenced relationships draft). The policy relationship is what is undefined, whether two names are already ancestrally related or not. This field therefore is unnecessary and potentially problematic. How would you anticipate it being used? Target names - the PSL is used as an example for a service location example of the Target Name field. I'm not sure exactly what that means. The PSL only indicates boundaries, not relationships. That is, it cannot confirm relationships, only repudiate them. It seems to me that perhaps this was an attempt to leverage an existing technology for backwards compatibility, but the PSL simply doesn't provide the same type of service as what I think you are trying to provide otherwise. Administrative boundary - the term "administrative boundary" seems to take the place of "relationship" later in the text. There subtle distinctions between boundaries and relationships. For example, there is a reference on page to knowing "whether two names A and B share the same administrative boundary". I suppose I'm still thinking of boundaries in the namespace here, in which case two names might be "policy-related", but they might not "share" boundaries. In any case it is not clear what is being referenced. Examples would be very helpful for clarity. Regards, Casey --001a1135ed32d8f8100521fed717 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Tue, Sep 29, 2015 at 5:06 AM, Jiankang Yao <yaojk@cnnic.c= n> wrote:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 I submit a = draft about dbound=20 solution.
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 any comments are welcome.
Thanks for the submission.=C2=A0 I have read the draft= and provide comments below.

Genera= l - One of the challenges I have in following this is with lack of use case= s, including how this mechanism applies to those cases.=C2=A0 Several concr= ete uses of the PSL are documented elsewhere, and those would be a starting= point.=C2=A0 It is hard to tell what this adds without those cases.
Expiration/Inception - as others have exp= ressed, this is entirely unnecessary and simply adds complexity.=C2=A0 Expi= ration and inception in DNSSEC are to prevent replay, but in this context, = the issue seems to be more about convenience.=C2=A0 The records could just = be added and removed at the desired time to have the same effect.

Relation - draft-deccio-dbound-name-relation= ships-00 (referenced) does indeed mention two types of relationships, but t= he point of that distinction was to divide the problem space, not to indica= te that those relationship types needed to be identified explicitly in a so= lution.=C2=A0 In fact, ancestral relationships are identified simply by com= paring two names--that exists inherently in the DNS (and it is noted in the= referenced relationships draft).=C2=A0 The policy relationship is what is = undefined, whether two names are already ancestrally related or not. This f= ield therefore is unnecessary and potentially problematic.=C2=A0 How would = you anticipate it being used?

Targe= t names - the PSL is used as an example for a service location example of t= he Target Name field.=C2=A0 I'm not sure exactly what that means.=C2=A0= The PSL only indicates boundaries, not relationships.=C2=A0 That is, it ca= nnot confirm relationships, only repudiate them.=C2=A0 It seems to me that = perhaps this was an attempt to leverage an existing technology for backward= s compatibility, but the PSL simply doesn't provide the same type of se= rvice as what I think you are trying to provide otherwise.

Administrative boundary - the term "administra= tive boundary" seems to take the place of "relationship" lat= er in the text.=C2=A0 There subtle distinctions between boundaries and rela= tionships.=C2=A0 For example, there is a reference on page to knowing "= ;whether two names A and B share the same administrative boundary".=C2= =A0 I suppose I'm still thinking of boundaries in the namespace here, i= n which case two names might be "policy-related", but they might = not "share" boundaries. =C2=A0 In any case it is not clear what i= s being referenced.=C2=A0 Examples would be very helpful for clarity.
Regards,
Casey
--001a1135ed32d8f8100521fed717-- From nobody Tue Oct 13 18:13:31 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C541F1AC3E8 for ; Tue, 13 Oct 2015 18:13:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.611 X-Spam-Level: X-Spam-Status: No, score=-2.611 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PS8NYO7fDhdd for ; Tue, 13 Oct 2015 18:13:28 -0700 (PDT) Received: from cnnic.cn (smtp13.cnnic.cn [218.241.118.13]) by ietfa.amsl.com (Postfix) with ESMTP id 5956B1AC3DF for ; Tue, 13 Oct 2015 18:13:26 -0700 (PDT) Received: from yaojiankang (unknown [218.241.103.155]) by ocmail02.zx.nicx.cn (Coremail) with SMTP id AQAAf0A5QDgvrB1WH_SoBA--.7863S2; Wed, 14 Oct 2015 09:13:19 +0800 (CST) Date: Wed, 14 Oct 2015 09:13:19 +0800 From: "Jiankang Yao" To: "Andrew Sullivan" , dbound References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> <2015101311474918524028@cnnic.cn>, <20151013143739.GH25369@mx2.yitter.info> X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7.0.1.92[cn] Mime-Version: 1.0 Message-ID: <2015101409125505494536@cnnic.cn> Content-Type: multipart/alternative; boundary="----=_001_NextPart103746457812_=----" X-CM-TRANSID: AQAAf0A5QDgvrB1WH_SoBA--.7863S2 X-Coremail-Antispam: 1UD129KBjvdXoWrZF17Cw47AryDWr17KF1fXrb_yoWDurX_ua 4xtFn0ka1qkw42yrs7KF4rXFy3Wry2krn8Jw4fA3WFg39xJan2qwn7Kr9xJay2yF4kGrnx CFn0k3WfWw1q9jkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbf8YjsxI4VWxJwAYFVCjjxCrM7AC8VAFwI0_Jr0_Gr1l1xkIjI8I 6I8E6xAIw20EY4v20xvaj40_Wr0E3s1l1IIY67AEw4v_Jr0_Jr4l8cAvFVAK0II2c7xJM2 8CjxkF64kEwVA0rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVWDJVCq3wA2z4x0Y4vE2Ix0 cI8IcVCY1x0267AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I 8E87Iv6xkF7I0E14v26rxl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVCF0I0E 4I0vr24lYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4 IE7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACY4xI67k04243AVAKzVAKj4xxM4xvF2IE b7IF0Fy26I8I3I1lc2xSY4AK67AK6w4l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7 v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUGVWUWwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF 1VAY17CE14v26r1Y6r17MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIx AIcVC0I7IYx2IY6xkF7I0E14v26r1j6r4UMIIF0xvE42xK8VAvwI8IcIk0rVWrJr0_WFyU JwCI42IY6I8E87Iv67AKxVWUJVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r1j6r4UMVCEFc xC0VAYjxAxZFUvcSsGvfC2KfnxnUUI43ZEXa7IU82iiDUUUUU== X-CM-SenderInfo: x1dryyw6fq0xffof0/ Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: yaojk List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Oct 2015 01:13:29 -0000 This is a multi-part message in MIME format. ------=_001_NextPart103746457812_=---- Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 DQoNCg0KDQoNCkZyb206IEFuZHJldyBTdWxsaXZhbg0KRGF0ZTogMjAxNS0xMC0xMyAyMjozNw0K VG86IGRib3VuZA0KU3ViamVjdDogUmU6IFtkYm91bmRdIEZ3OiBOZXcgVmVyc2lvbiBOb3RpZmlj YXRpb24gZm9yIGRyYWZ0LXlhby1kYm91bmQtZG5zLXNvbHV0aW9uLTAwLnR4dA0KPj5PbiBUdWUs IE9jdCAxMywgMjAxNSBhdCAxMTo0Nzo1NkFNICswODAwLCBKaWFua2FuZyBZYW8gd3JvdGU6DQo+ PiBpZiB0aGVyZSBhcmUgbm8gY2VudHJhbGl6ZWQgbWVjaGFuaXNtLCB0aGUgZG5zIGFkbWluaXN0 cmF0b3JzIG1pZ2h0IG5lZWQgaHVuZHJlZHMgb2YgRE5TIFNPUEEgcmVjb3JkcyBmb3IgY29uc3Ry dWN0aW5nIHBhaXJ3aXNlIHJlbGF0aW9uc2hpcCBiZXR3ZWVuIGFueSAyIG9mIHRoZXNlICBkb3pl bnMgb2YgZG9tYWluIG5hbWVzLg0KPg0KPkkgc3VzcGVjdCB0aGF0ICJodW5kcmVkcyIgaXMgb3Zl cnN0YXRpbmcgdGhlIGNhc2UgKGlmIHdlIHJlYWxseSBoYXZlDQo+aHVuZHJlZHMgb2Ygc3VjaCBu YW1lcywgaXQncyBwcmV0dHkgY2xlYXIgdGhlIEROUyBpcyBmaW5pc2hlZCBhbnl3YXkpLA0KPg0K Pg0KeW91IG1heSBtaXMtdW5kZXJzdGFuZCBpdCBoZXJlLg0KSSBtZWFuIHRoYXQgd2UgbmVlZCB0 byBjb25maWd1cmUgaHVuZHJlZHMgb2YgRE5TIHJlY29yZHMgaW5zdGVhZCBvZiBodW5kcmVkcyBv ZiBuYW1lcy4NCkZvciBhIG51bWJlciBvZiBOIGRvbWFpbiBuYW1lcywgd2UgbmVlZCB0byBjb25m aWd1cmUgKE4tMSkgZG5zIHJlY29yZHMgZm9yIGVhY2ggZG9tYWluIG5hbWUuDQpzbyBmb3IgYSBu dW1iZXIgb2YgTiBkb21haW4gbmFtZXMgd2hpY2ggbmVlZCB0byBiZSBjb25maWd1cmVkIHRvIHNo YXJlIHRoZSBzYW1lIGRucyBhZG1pbmlzdHJhdGl2ZSBib3VuZGFyaWVzLCB0aGVyZSBtaWdodCBo YXZlIE4oTi0xKSBETlMgcmVjb3JkcyBpbiB0b3RhbC4NCg0KZm9yIDEwIGRvbWFpbiBuYW1lcywg dGhlcmUgbmVlZCAxMCooMTAtMSk9OTAgRE5TIHJlY29yZHMNCmZvciAyMCBkb21haW4gbmFtZXMs IHRoZXJlIG5lZWQgMjAqKDIwLTEpPTM4MCBETlMgcmVjb3Jkcw0KDQpKaWFua2FuZyA= ------=_001_NextPart103746457812_=---- Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: quoted-printable
 
 
 
 
 
Date: 2015-10-13 22:37
To: dbound
Subject: Re: [dbound] Fw: New Version Notification for=20 draft-yao-dbound-dns-solution-00.txt
>>On Tue, Oct 13, 2015 at 11:47:5= 6AM +0800, Jiankang Yao wrote:
>> if there are no=20 centralized mechanism, the dns administrators mig= ht need hundreds of DNS SOPA records fo= r constructing pairwise relationship between any&= nbsp;2 of these  dozens of domain names= .
>
>I suspect that "hundreds" is overstating=  the case (if we really have
>hundreds of such names, it's pretty = ;clear the DNS is finished anyway),
>
>
you may mis-understand it here.
I mean that we need to configure hundreds of DNS records instead of=20 hundreds of names.
For a number of N domain names, we need to configure (N-1) dns record= s for=20 each domain name.
so for a number of N domain names which need to be configured to= share=20 the same dns administrative boundaries, there might have N(N-1) = DNS=20 records in total.
 
for 10 domain names, there need 10*(10-1)=3D90 DNS records
for 20 domain names, there need 20*(20-1)=3D380 DNS records
 
Jiankang
 
 
------=_001_NextPart103746457812_=------ From nobody Tue Oct 13 18:59:32 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C29F1ACE67 for ; Tue, 13 Oct 2015 18:59:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ge8YrFbdaWlP for ; Tue, 13 Oct 2015 18:59:24 -0700 (PDT) Received: from mail-qg0-x22c.google.com (mail-qg0-x22c.google.com [IPv6:2607:f8b0:400d:c04::22c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A3BFB1ACE62 for ; Tue, 13 Oct 2015 18:59:24 -0700 (PDT) Received: by qgez77 with SMTP id z77so31603607qge.1 for ; Tue, 13 Oct 2015 18:59:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=e4hc1+CgoDflZpuAsNG4i1dzxRHbQoG8JhV/UI9nRwE=; b=CsF9LQw1N8BWHYmcqsTYvGReuiZltVSqsgQXXkWmmgj5EbFWPD0/icHgmbEnRQaVbb KzggZyf+7RcZsscdj/IGjvi30TMO2OU38L/CofucejvoOGeOfb+IL+5EkFEh6wBY/6er QGkDVQt2B4bjTkHXZFXyYFi8SBxClPbE2VNp0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=e4hc1+CgoDflZpuAsNG4i1dzxRHbQoG8JhV/UI9nRwE=; b=XebuRs37B+PQDqeJ8LGHjctSc7oG3wR6qm81MgPltSrsjsDT5MhpP9ZBxhNID01CC3 BBoNbWTzvBi67FMJll1PPQo6ZEPfX4RIAoetI9t31G2uH7JtmqFtHmmBOh38UAMEwlKX BmdIfuMiWHl9kXLJEZCv1a41fVglFx3nvq+GfowdRlHThn4l3PwNptfc+VOPwJgS/B/A 4hpVTL9wlpuWcilFPUrzAlldFe4XOAh1/chq19o5VFPIE9xVVYm7pku2tTTB+JsrmHz6 mPakV3prWBT0xJjxAdCicVyxDPYoaLtwiXcLMXPUroBSO7Vn93Y41abTOtFu00Q9wK1m sFqg== X-Gm-Message-State: ALoCoQmA2SX7VjuNKxvv/iM/JWgopZ7ly7MWcyyMJYSdpgFIuTUXCgNkboDO9vLCCPe52w9pXkvw MIME-Version: 1.0 X-Received: by 10.140.235.216 with SMTP id g207mr722374qhc.98.1444787963813; Tue, 13 Oct 2015 18:59:23 -0700 (PDT) Sender: kurta@drkurt.com Received: by 10.55.98.207 with HTTP; Tue, 13 Oct 2015 18:59:23 -0700 (PDT) In-Reply-To: <20151013143739.GH25369@mx2.yitter.info> References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> <2015101311474918524028@cnnic.cn> <20151013143739.GH25369@mx2.yitter.info> Date: Tue, 13 Oct 2015 18:59:23 -0700 X-Google-Sender-Auth: 7W-80StivSsrli0bTR6Osme6Na4 Message-ID: From: "Kurt Andersen (b)" To: Andrew Sullivan Content-Type: multipart/alternative; boundary=001a11c148245bf777052206e918 Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Oct 2015 01:59:26 -0000 --001a11c148245bf777052206e918 Content-Type: text/plain; charset=UTF-8 On Tue, Oct 13, 2015 at 7:37 AM, Andrew Sullivan wrote: > On Tue, Oct 13, 2015 at 11:47:56AM +0800, Jiankang Yao wrote: > > if there are centralized mechanism, the dns administrators might need > hundreds of DNS SOPA records for constructing pairwise relationship between > any 2 of these dozens of domain names. > > I suspect that "hundreds" is overstating the case (if we really have > hundreds of such names, it's pretty clear the DNS is finished anyway), > All of the companies that I have worked with and for (except for when the internet was really small) have had hundreds or thousands of domains. Many are defensive, but still it's pretty standard these days and it does not seem to be stressing the DNS beyond the limits of reason. --Kurt Andersen --001a11c148245bf777052206e918 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Tue, Oct 13, 2015 at 7:37 AM, Andrew Sullivan <aj= s@anvilwalrusden.com> wrote:
On= Tue, Oct 13, 2015 at 11:47:56AM +0800, Jiankang Yao wrote:
> if there are centralized mechanism, the dns administrators might need = hundreds of DNS SOPA records for constructing pairwise relationship between= any 2 of these=C2=A0 dozens of domain names.

I suspect that "hundreds" is overstating the case (if we r= eally have
hundreds of such names, it's pretty clear the DNS is finished anyway),<= br>

All of the companies that I have worked= with and for (except for when the internet was really small) have had hund= reds or thousands of domains. Many are defensive, but still it's pretty= standard these days and it does not seem to be stressing the DNS beyond th= e limits of reason.

--Kurt Andersen

<= /div>
--001a11c148245bf777052206e918-- From nobody Wed Oct 14 11:28:58 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B4DD1ADEB6 for ; Wed, 14 Oct 2015 11:28:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3VqQ8ZYrTUSz for ; Wed, 14 Oct 2015 11:28:55 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [IPv6:2600:3c03::f03c:91ff:fedf:cfab]) by ietfa.amsl.com (Postfix) with ESMTP id 42A671AD49D for ; Wed, 14 Oct 2015 11:28:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id D8FCB106FE for ; Wed, 14 Oct 2015 18:28:54 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 10n01XvDGTkc for ; Wed, 14 Oct 2015 18:28:54 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id 2E99C106FC for ; Wed, 14 Oct 2015 18:28:54 +0000 (UTC) Date: Wed, 14 Oct 2015 14:28:52 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151014182852.GO32640@mx2.yitter.info> References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> <2015101311474918524028@cnnic.cn> <20151013143739.GH25369@mx2.yitter.info> <2015101409125505494536@cnnic.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2015101409125505494536@cnnic.cn> User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Oct 2015 18:28:56 -0000 On Wed, Oct 14, 2015 at 09:13:19AM +0800, Jiankang Yao wrote: > >I suspect that "hundreds" is overstating the case (if we really have > >hundreds of such names, it's pretty clear the DNS is finished anyway), > > > > > you may mis-understand it here. No. > I mean that we need to configure hundreds of DNS records instead of hundreds of names. Yes. But why would anyone have even 10s of names that share a boundary this way? In the SOPA draft, if you're just trying to say "I'm a public suffix" you can say that without a two-way relationship. > For a number of N domain names, we need to configure (N-1) dns records for each domain name. But if N isn't a small number, I claim, the mechanism will be useless as a foundation for security policy anyway. A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Wed Oct 14 11:30:37 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9A8941B29B0 for ; Wed, 14 Oct 2015 11:30:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n2arQiEVSrq3 for ; Wed, 14 Oct 2015 11:30:33 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [IPv6:2600:3c03::f03c:91ff:fedf:cfab]) by ietfa.amsl.com (Postfix) with ESMTP id 7BA4B1AD2EC for ; Wed, 14 Oct 2015 11:30:32 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id 2F7E3106FC for ; Wed, 14 Oct 2015 18:30:32 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id RV066EH30xNy for ; Wed, 14 Oct 2015 18:30:31 +0000 (UTC) Received: from mx2.yitter.info (c-73-142-68-92.hsd1.nh.comcast.net [73.142.68.92]) by mx2.yitter.info (Postfix) with ESMTPSA id 85682106D8 for ; Wed, 14 Oct 2015 18:30:31 +0000 (UTC) Date: Wed, 14 Oct 2015 14:30:30 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151014183030.GP32640@mx2.yitter.info> References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> <2015101311474918524028@cnnic.cn> <20151013143739.GH25369@mx2.yitter.info> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Oct 2015 18:30:36 -0000 On Tue, Oct 13, 2015 at 06:59:23PM -0700, Kurt Andersen (b) wrote: > All of the companies that I have worked with and for (except for when the > internet was really small) have had hundreds or thousands of domains. Many > are defensive, but still it's pretty standard these days and it does not > seem to be stressing the DNS beyond the limits of reason. Sure, but most of them are in fact parked. They don't need this mechanism at all. If you actually needed to operate even dozens of web servers as though they were tightly linked to one another, it'd be a pain. If you actually just redirect them all to the same place, I can't see why you'd need the mechanism. A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Wed Oct 14 11:58:37 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9D5FE1B29DA for ; Wed, 14 Oct 2015 11:58:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WeGEIdA7R-0b for ; Wed, 14 Oct 2015 11:58:35 -0700 (PDT) Received: from mail-qg0-x236.google.com (mail-qg0-x236.google.com [IPv6:2607:f8b0:400d:c04::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5C4271B29D3 for ; Wed, 14 Oct 2015 11:58:35 -0700 (PDT) Received: by qgeo38 with SMTP id o38so7370446qge.0 for ; Wed, 14 Oct 2015 11:58:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=drkurt.com; s=20130612; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=FzlqvWhkU8eoOiUc6Gd7tB3JLfl4dxbIKG0QHGAaTGw=; b=ev4Oe3ECk3bGrYYsLvC48KsFgp9tMz5QEGyQOMPJMov+Bs5b4Mo0Lbx5QIsqmkYp3+ L1MPGTo0Nb0xX+IHRjZ6OeHvXi6OTcEVp9UBuQLr4H8HKj+9badXSXDozwREtG6YEfFS w/IgQpFjusLOisiaGXZmxwBg4BMTk4/3rmSXI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=FzlqvWhkU8eoOiUc6Gd7tB3JLfl4dxbIKG0QHGAaTGw=; b=KUV4im/uGGAe6ogO8i2A4ZfhJgpoFhY2aSJdAGK9ifWHKPLlrH8fWWjr3BRMyF5sff VK5pGjQF7lMoM16QmZz2tVRAiRCkAtqenQDSytB71lH1yJxbIceAPhiroxPlskW8f67Q k7uV2BtuJWMyP0Cwi8U85rT2jI+++MiIa/rplqdYUWzz5Bn1aYnTN5OPQ3zLtioZfiGb Za427OOGqqGUJ0V0k0ynqx+Cj1NSC+mepW7ttISrkOc13UMpohmQMwLJ0QhrMCjRnrp/ iU38HTSmU9y6yvUThZmH6YxPdwfiz/o3YxBwKXKBdfRxfIopd67/LFG4X6jW+MZceW2Z 0/SA== X-Gm-Message-State: ALoCoQkNrlUAcsGxn0ypxq+FlKHBrmrpCYc2U9Fsd3tLZ//zdEaX6q/CUOO558JkA1aA6SHaNle2 MIME-Version: 1.0 X-Received: by 10.140.97.136 with SMTP id m8mr6121539qge.74.1444849114535; Wed, 14 Oct 2015 11:58:34 -0700 (PDT) Received: by 10.55.98.207 with HTTP; Wed, 14 Oct 2015 11:58:34 -0700 (PDT) In-Reply-To: <20151014183030.GP32640@mx2.yitter.info> References: <2015092917052161861514@cnnic.cn> <20151002213320.GN91013@anvilwalrusden.com> <20151008010037.GI1389@mx2.yitter.info> <2015101311474918524028@cnnic.cn> <20151013143739.GH25369@mx2.yitter.info> <20151014183030.GP32640@mx2.yitter.info> Date: Wed, 14 Oct 2015 11:58:34 -0700 Message-ID: From: Kurt Andersen To: Andrew Sullivan Content-Type: multipart/alternative; boundary=001a113a5d523a133405221526fc Archived-At: Cc: "dbound@ietf.org" Subject: Re: [dbound] Fw: New Version Notification for draft-yao-dbound-dns-solution-00.txt X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Oct 2015 18:58:36 -0000 --001a113a5d523a133405221526fc Content-Type: text/plain; charset=UTF-8 On Wed, Oct 14, 2015 at 11:30 AM, Andrew Sullivan wrote: > On Tue, Oct 13, 2015 at 06:59:23PM -0700, Kurt Andersen (b) wrote: > > All of the companies that I have worked with and for (except for when the > > internet was really small) have had hundreds or thousands of domains. > Many > > are defensive, but still it's pretty standard these days and it does not > > seem to be stressing the DNS beyond the limits of reason. > > Sure, but most of them are in fact parked. They don't need this > mechanism at all. > > If you actually needed to operate even dozens of web servers as though > they were tightly linked to one another, it'd be a pain. If you > actually just redirect them all to the same place, I can't see why > you'd need the mechanism. > Sadly, some of the companies thought that using a vanity domain for every product (both web and email) was a good idea :-( --Kurt --001a113a5d523a133405221526fc Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On Wed, Oct 14, 2015 at 11:30 AM, Andrew Sullivan <a= js@anvilwalrusden.com> wrote:
<= div class=3D"gmail_quote">
O= n Tue, Oct 13, 2015 at 06:59:23PM -0700, Kurt Andersen (b) wrote:
> All of the companies that I have worked with and for (except for when = the
> internet was really small) have had hundreds or thousands of domains. = Many
> are defensive, but still it's pretty standard these days and it do= es not
> seem to be stressing the DNS beyond the limits of reason.

Sure, but most of them are in fact parked.=C2=A0 They don't need= this
mechanism at all.

If you actually needed to operate even dozens of web servers as though
they were tightly linked to one another, it'd be a pain.=C2=A0 If you actually just redirect them all to the same place, I can't see why
you'd need the mechanism.

Sadly, some of the companies thought that = using a vanity domain for every product (both web and email) was a good ide= a :-(

--Kurt

--001a113a5d523a133405221526fc-- From nobody Fri Oct 16 08:43:20 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD0131A9166 for ; Fri, 16 Oct 2015 08:43:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.609 X-Spam-Level: X-Spam-Status: No, score=-2.609 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wcjuPRbQ1osW for ; Fri, 16 Oct 2015 08:43:17 -0700 (PDT) Received: from SNT004-OMC4S12.hotmail.com (snt004-omc4s12.hotmail.com [65.55.90.215]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 170481B3197 for ; Fri, 16 Oct 2015 08:43:17 -0700 (PDT) Received: from SNT152-W67 ([65.55.90.201]) by SNT004-OMC4S12.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23008); Fri, 16 Oct 2015 08:43:16 -0700 X-TMN: [vjEce3ERdIg8/rHrc70+jZ4lHQYoP92d] X-Originating-Email: [jiankangyao@hotmail.com] Message-ID: Content-Type: multipart/alternative; boundary="_48a2af68-5440-45a0-969c-43ee2785dfd9_" From: yaojk To: Date: Fri, 16 Oct 2015 15:43:16 +0000 Importance: Normal MIME-Version: 1.0 X-OriginalArrivalTime: 16 Oct 2015 15:43:16.0557 (UTC) FILETIME=[5FDEBFD0:01D10829] Archived-At: Subject: [dbound] a proposed new mechanism X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 16 Oct 2015 15:43:18 -0000 --_48a2af68-5440-45a0-969c-43ee2785dfd9_ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 RGVhciBhbGwsDQoNCiAgICBBZnRlciBmb2xsb3dpbmcgdGhlIGRpc2N1c3Npb24gaW4gdGhlIFdH IGRpc2N1c3Npb24gbGlzdCwgYSBuZXcgbWVjaGFuaXNtIGlzIHByb3Bvc2VkIGluIHRoZSBzZWN0 aW9uIDYuMSBmb3IgZGlzY3Vzc2lvbiBpbg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2Ry YWZ0LXlhby1kYm91bmQtZG5zLXNvbHV0aW9uLTAxDQoNCiAgICBUaGVyZSB3aWxsIGhhdmUgYSBu ZXcgZGJvdW5kIFJSIHdob3NlIFJEQVRBIGluY2x1ZHMgRmxhZyBhbmQgQW5jaG9yIE5hbWUuDQog ICANCiAgIFRoZSBtYWluIGlkZWEgaXMgdG8gYWRkIGFuIGFuY2hvciBuYW1lIChtaWRkbGVtYW4g b3IgbWlkZGxlIGRvbWFpbiBuYW1lKS4gVGhvc2UgZG9tYWluIG5hbWVzIHdoaWNoIGFyZSBzdXBw b3NlZCB0byBzaGFyZSB0aGUgc2FtZSBkbnMgYWRtaW5pc3RyYXRpdmUgYm91bmRhcmllcyB3aWxs IHBvaW50IHRvIHRoZSBzYW1lIGFuY2hvciBuYW1lIChGUUROKSB3aXRoIHRoZSBmbGFnJ3MgdmFs dWUgb2YgMTsNClRob3NlIGRvbWFpbiBuYW1lcyB3aGljaCBhcmUgc3VwcG9zZWQgdG8gc2hhcmUg dGhlIHNhbWUgZG5zIGFkbWluaXN0cmF0aXZlIGJvdW5kYXJpZXMgdGhyb3VnaCBQU0wgd2lsbCBw b2ludCB0byB0aGUgUFNMIGxpbmsgd2l0aCB0aGUgZmxhZydzIHZhbHVlIG9mIDA7IFRoZSBhbmNo b3IgbmFtZSBjYW4gcG9pbnQgdG8gbmFtZSBjb2xsZWN0aW9ucyB3aWNoIGFyZSBzdXBwb3NlZCB0 byBzaGFyZSB0aGUgc2FtZSBETlMgYWRtaW5pc3RyYXRpdmUgYm91bmRhcmllcyB3aXRoIHRoZSBm bGFnJ3MgdmFsdWUgb2YgMi4NCg0KVGhlIG5ldyBtZWNoYW5pc20gd2lsbCBhbHNvIHdvcmsgZm9y IHdpbGRjYXJkIG5hbWUuDQoNCiAgIFRoZXJlIGFyZSBzb21lIGV4YW1wbGVzIHRvIHNob3cgaG93 IGl0IHdvcmtzIGluIHRoZSBzZWN0aW9uIDYuMSAgaW4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcv aHRtbC9kcmFmdC15YW8tZGJvdW5kLWRucy1zb2x1dGlvbi0wMQ0KDQpJZiBwb3NzaWJsZSwgSSB3 b3VsZCBsaWtlIHRvIGludHJvZHVjZSB0aGlzIG5ldyBtZWNoYW5pc20gaW4gWW9rb2hvbWEgSUVU RiBtZWV0aW5nLg0KDQpJZiB0aGUgc29sdXRpb24gaXMgcmVhc29uYWJsZSwgSSB3aWxsIGRldGFp bCB0aGUgZGVzaWduIGluIGEgbmV3IGRyYWZ0Lg0KDQp0aGFua3MuDQoNCkppYW5rYW5nIFlhbw0K DQoNCg0KIAkJIAkgICAJCSAg --_48a2af68-5440-45a0-969c-43ee2785dfd9_ Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: base64 PGh0bWw+DQo8aGVhZD4NCjxzdHlsZT48IS0tDQouaG1tZXNzYWdlIFANCnsNCm1hcmdpbjowcHg7 DQpwYWRkaW5nOjBweA0KfQ0KYm9keS5obW1lc3NhZ2UNCnsNCmZvbnQtc2l6ZTogMTJwdDsNCmZv bnQtZmFtaWx5Os6iyO3RxbraDQp9DQotLT48L3N0eWxlPjwvaGVhZD4NCjxib2R5IGNsYXNzPSdo bW1lc3NhZ2UnPjxkaXYgZGlyPSdsdHInPkRlYXIgYWxsLDxicj48YnI+Jm5ic3A7Jm5ic3A7Jm5i c3A7Jm5ic3A7QWZ0ZXIgZm9sbG93aW5nIHRoZSBkaXNjdXNzaW9uIGluIHRoZSBXRyBkaXNjdXNz aW9uIGxpc3QsIGEgbmV3IG1lY2hhbmlzbSBpcyBwcm9wb3NlZCBpbiB0aGUgc2VjdGlvbiA2LjEg Zm9yIGRpc2N1c3Npb24gaW48YnI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXlh by1kYm91bmQtZG5zLXNvbHV0aW9uLTAxPGJyPjxicj4mbmJzcDsmbmJzcDsmbmJzcDsmbmJzcDtU aGVyZSB3aWxsIGhhdmUgYSBuZXcgZGJvdW5kIFJSIHdob3NlIFJEQVRBIGluY2x1ZHMgRmxhZyBh bmQgQW5jaG9yIE5hbWUuPGJyPiZuYnNwOyZuYnNwOyA8YnI+Jm5ic3A7Jm5ic3A7IFRoZSBtYWlu IGlkZWEgaXMgdG8gYWRkIGFuIGFuY2hvciBuYW1lIChtaWRkbGVtYW4gb3IgbWlkZGxlIGRvbWFp biBuYW1lKS4gVGhvc2UgZG9tYWluIG5hbWVzIHdoaWNoIGFyZSBzdXBwb3NlZCB0byBzaGFyZSB0 aGUgc2FtZSBkbnMgYWRtaW5pc3RyYXRpdmUgYm91bmRhcmllcyB3aWxsIHBvaW50IHRvIHRoZSBz YW1lIGFuY2hvciBuYW1lIChGUUROKSB3aXRoIHRoZSBmbGFnJiMzOTtzIHZhbHVlIG9mIDE7PGJy PlRob3NlIGRvbWFpbiBuYW1lcyB3aGljaCBhcmUgc3VwcG9zZWQgdG8gc2hhcmUgdGhlIHNhbWUg ZG5zIGFkbWluaXN0cmF0aXZlIGJvdW5kYXJpZXMgdGhyb3VnaCBQU0wgd2lsbCBwb2ludCB0byB0 aGUgUFNMIGxpbmsgd2l0aCB0aGUgZmxhZyYjMzk7cyB2YWx1ZSBvZiAwOyBUaGUgYW5jaG9yIG5h bWUgY2FuIHBvaW50IHRvIG5hbWUgY29sbGVjdGlvbnMgd2ljaCBhcmUgc3VwcG9zZWQgdG8gc2hh cmUgdGhlIHNhbWUgRE5TIGFkbWluaXN0cmF0aXZlIGJvdW5kYXJpZXMgd2l0aCB0aGUgZmxhZyYj Mzk7cyB2YWx1ZSBvZiAyLjxicj48YnI+VGhlIG5ldyBtZWNoYW5pc20gd2lsbCBhbHNvIHdvcmsg Zm9yIHdpbGRjYXJkIG5hbWUuPGJyPjxicj4mbmJzcDsmbmJzcDsgVGhlcmUgYXJlIHNvbWUgZXhh bXBsZXMgdG8gc2hvdyBob3cgaXQgd29ya3MgaW4gdGhlIHNlY3Rpb24gNi4xJm5ic3A7Jm5ic3A7 aW48YnI+aHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXlhby1kYm91bmQtZG5zLXNv bHV0aW9uLTAxPGJyPjxicj5JZiBwb3NzaWJsZSwgSSB3b3VsZCBsaWtlIHRvIGludHJvZHVjZSB0 aGlzIG5ldyBtZWNoYW5pc20gaW4gWW9rb2hvbWEgSUVURiBtZWV0aW5nLjxicj48YnI+SWYgdGhl IHNvbHV0aW9uIGlzIHJlYXNvbmFibGUsIEkgd2lsbCBkZXRhaWwgdGhlIGRlc2lnbiBpbiBhIG5l dyBkcmFmdC48YnI+PGJyPnRoYW5rcy48YnI+PGJyPkppYW5rYW5nIFlhbzxicj48YnI+PGJyPjxi cj4gCQkgCSAgIAkJICA8L2Rpdj48L2JvZHk+DQo8L2h0bWw+ --_48a2af68-5440-45a0-969c-43ee2785dfd9_-- From nobody Mon Oct 19 09:02:17 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 015881A8703 for ; Mon, 19 Oct 2015 09:02:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ilkFM5hr1DbX for ; Mon, 19 Oct 2015 09:02:15 -0700 (PDT) Received: from mx2.yitter.info (mx2.yitter.info [50.116.54.116]) by ietfa.amsl.com (Postfix) with ESMTP id 6A85A1A8702 for ; Mon, 19 Oct 2015 09:02:15 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by mx2.yitter.info (Postfix) with ESMTP id C1EC010709 for ; Mon, 19 Oct 2015 16:02:14 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at crankycanuck.ca Received: from mx2.yitter.info ([127.0.0.1]) by localhost (mx2.yitter.info [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vOGFyQ3MmM47 for ; Mon, 19 Oct 2015 16:02:14 +0000 (UTC) Received: from mx2.yitter.info (23-193.icannmeeting.org [199.91.193.23]) by mx2.yitter.info (Postfix) with ESMTPSA id ACDFD106FE for ; Mon, 19 Oct 2015 16:02:13 +0000 (UTC) Date: Mon, 19 Oct 2015 12:02:10 -0400 From: Andrew Sullivan To: dbound@ietf.org Message-ID: <20151019160210.GA43722@mx2.yitter.info> References: <20151008195908.35761.qmail@ary.lan> <87k2qwyf57.fsf@alice.fifthhorseman.net> <20151009155933.GF20427@mx2.yitter.info> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151009155933.GF20427@mx2.yitter.info> User-Agent: Mutt/1.5.23 (2014-03-12) Archived-At: Subject: Re: [dbound] on "control" X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Oct 2015 16:02:17 -0000 Hi, On Fri, Oct 09, 2015 at 11:59:33AM -0400, Andrew Sullivan wrote: > > Therefore, I claim, the two cases collapse to one, because once you're > in the mode of looking for some overriding ancestor policy (however > you got into that mode), you're looking for the same thing. > > Does that make sense? I didn't get the impression people thought this was nuts. I admit that I think it is quite unlikely I will get the update done today before the deadline, however. My apologies. A -- Andrew Sullivan ajs@anvilwalrusden.com From nobody Sun Oct 25 22:34:26 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A83AF1B3772 for ; Sun, 25 Oct 2015 22:34:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.738 X-Spam-Level: * X-Spam-Status: No, score=1.738 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, HTML_MESSAGE=0.001, MIME_CHARSET_FARAWAY=2.45, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KqL6MmhC8955 for ; Sun, 25 Oct 2015 22:34:23 -0700 (PDT) Received: from cnnic.cn (smtp13.cnnic.cn [218.241.118.13]) by ietfa.amsl.com (Postfix) with ESMTP id AA0C11B3770 for ; Sun, 25 Oct 2015 22:34:21 -0700 (PDT) Received: from yaojiankang (unknown [218.241.119.121]) by ocmail02.zx.nicx.cn (Coremail) with SMTP id AQAAf0ApMDhXuy1WBhNuBQ--.11230S2; Mon, 26 Oct 2015 13:34:15 +0800 (CST) Date: Mon, 26 Oct 2015 13:34:16 +0800 From: "Jiankang Yao" To: dbound References: X-Priority: 3 X-Has-Attach: no X-Mailer: Foxmail 7.0.1.92[cn] Mime-Version: 1.0 Message-ID: <2015102613340222521386@cnnic.cn> Content-Type: multipart/alternative; boundary="----=_001_NextPart010736043873_=----" X-CM-TRANSID: AQAAf0ApMDhXuy1WBhNuBQ--.11230S2 X-Coremail-Antispam: 1UD129KBjvJXoW7CFWftF1rJF1ruFWkZrWxXrb_yoW8XrWUpF 4Y9w1fWwsxCr4fCas7Ww1xWr18Z393XwsrArn8XryDZFW5XFykKr1rKw43A34DC34vyFW0 qF4xA3sxGF45ZFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUB0b7Iv0xC_Cr1lb4IE77IF4wAFF20E14v26r1j6r4UM7CY07I2 0VC2zVCF04k26cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rw A2F7IY1VAKz4vEj48ve4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xII jxv20xvEc7CjxVAFwI0_Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_Cr1j6rxdM28EF7xvwV C2z280aVCY1x0267AKxVW0oVCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40E42I2 6xC2a48xMcIj6xIIjxv20xvE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4I kC6x0Yz7v_Jr0_Gr1lF7xvr2IYc2Ij64vIr41lFcxC0VAYjxAxZF0Ew4CEw7xC0wACY4xI 67k04243AVC20s07MxkIecxEwVAFwVW8WwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7x kEbVWUJVW8JwC20s026c02F40E14v26r106r1rMI8I3I0E7480Y4vE14v26r106r1rMI8E 67AF67kF1VAFwI0_Jr0_JrylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCw CI42IY6xIIjxv20xvEc7CjxVAFwI0_Jr0_Gr1lIxAIcVCF04k26cxKx2IYs7xG6rW3Jr0E 3s1lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8Jr1l6V ACY4xI67k04243AbIYCTnIWIevJa73UjIFyTuYvjxU2ku4DUUUU X-CM-SenderInfo: x1dryyw6fq0xffof0/ Archived-At: Subject: [dbound] meeting agenda ( Re: a proposed new mechanism) X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: yaojk List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Oct 2015 05:34:25 -0000 This is a multi-part message in MIME format. ------=_001_NextPart010736043873_=---- Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 SGVsbG8sDQoNCiAgICBEbyB3ZSBoYXZlIGEgbWVldGluZyBhZ2VuZGEgZm9yIEphcGFuIGlldGYg bWVldGluZz8NCiAgIEkgd291bGQgbGlrZSB0byBpbnRyb2R1Y2UgdGhpcyBuZXcgbWVjaGFuaXNt IGR1cmluZyB0aGUgbWVldGluZyBpZiBjaGFpcnMgY2FuIGFsbG9jYXRlIDUgb3IgMTAgbWludXRl cyB0byBtZS4NCg0KICAgIHRoYW5rcy4NCg0KDQoNCg0KSmlhbmthbmcgWWFvDQoNCreivP7Iy6O6 IHlhb2prDQq3osvNyrG85KO6IDIwMTUtMTAtMTYgMjM6NDMNCsrVvP7Iy6O6IGRib3VuZEBpZXRm Lm9yZw0K1vfM4qO6IFtkYm91bmRdIGEgcHJvcG9zZWQgbmV3IG1lY2hhbmlzbQ0KRGVhciBhbGws DQoNCiAgICBBZnRlciBmb2xsb3dpbmcgdGhlIGRpc2N1c3Npb24gaW4gdGhlIFdHIGRpc2N1c3Np b24gbGlzdCwgYSBuZXcgbWVjaGFuaXNtIGlzIHByb3Bvc2VkIGluIHRoZSBzZWN0aW9uIDYuMSBm b3IgZGlzY3Vzc2lvbiBpbg0KaHR0cHM6Ly90b29scy5pZXRmLm9yZy9odG1sL2RyYWZ0LXlhby1k Ym91bmQtZG5zLXNvbHV0aW9uLTAxDQoNCiAgICBUaGVyZSB3aWxsIGhhdmUgYSBuZXcgZGJvdW5k IFJSIHdob3NlIFJEQVRBIGluY2x1ZHMgRmxhZyBhbmQgQW5jaG9yIE5hbWUuDQogICANCiAgIFRo ZSBtYWluIGlkZWEgaXMgdG8gYWRkIGFuIGFuY2hvciBuYW1lIChtaWRkbGVtYW4gb3IgbWlkZGxl IGRvbWFpbiBuYW1lKS4gVGhvc2UgZG9tYWluIG5hbWVzIHdoaWNoIGFyZSBzdXBwb3NlZCB0byBz aGFyZSB0aGUgc2FtZSBkbnMgYWRtaW5pc3RyYXRpdmUgYm91bmRhcmllcyB3aWxsIHBvaW50IHRv IHRoZSBzYW1lIGFuY2hvciBuYW1lIChGUUROKSB3aXRoIHRoZSBmbGFnJ3MgdmFsdWUgb2YgMTsN ClRob3NlIGRvbWFpbiBuYW1lcyB3aGljaCBhcmUgc3VwcG9zZWQgdG8gc2hhcmUgdGhlIHNhbWUg ZG5zIGFkbWluaXN0cmF0aXZlIGJvdW5kYXJpZXMgdGhyb3VnaCBQU0wgd2lsbCBwb2ludCB0byB0 aGUgUFNMIGxpbmsgd2l0aCB0aGUgZmxhZydzIHZhbHVlIG9mIDA7IFRoZSBhbmNob3IgbmFtZSBj YW4gcG9pbnQgdG8gbmFtZSBjb2xsZWN0aW9ucyB3aWNoIGFyZSBzdXBwb3NlZCB0byBzaGFyZSB0 aGUgc2FtZSBETlMgYWRtaW5pc3RyYXRpdmUgYm91bmRhcmllcyB3aXRoIHRoZSBmbGFnJ3MgdmFs dWUgb2YgMi4NCg0KVGhlIG5ldyBtZWNoYW5pc20gd2lsbCBhbHNvIHdvcmsgZm9yIHdpbGRjYXJk IG5hbWUuDQoNCiAgIFRoZXJlIGFyZSBzb21lIGV4YW1wbGVzIHRvIHNob3cgaG93IGl0IHdvcmtz IGluIHRoZSBzZWN0aW9uIDYuMSAgaW4NCmh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvaHRtbC9kcmFm dC15YW8tZGJvdW5kLWRucy1zb2x1dGlvbi0wMQ0KDQpJZiBwb3NzaWJsZSwgSSB3b3VsZCBsaWtl IHRvIGludHJvZHVjZSB0aGlzIG5ldyBtZWNoYW5pc20gaW4gWW9rb2hvbWEgSUVURiBtZWV0aW5n Lg0KDQpJZiB0aGUgc29sdXRpb24gaXMgcmVhc29uYWJsZSwgSSB3aWxsIGRldGFpbCB0aGUgZGVz aWduIGluIGEgbmV3IGRyYWZ0Lg0KDQp0aGFua3MuDQoNCkppYW5rYW5nIFlhbw== ------=_001_NextPart010736043873_=---- Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: quoted-printable
Hello,
 
    Do we have a meeting agenda for Japan ietf=20 meeting?
   I would like to introduce this new mechanism during the=20 meeting if chairs can allocate 5 or 10 minutes to me.
 
    thanks.
 
Jiankang Yao
 
=B7=A2=BC=FE=C8=CB=A3=BA yaojk
=B7=A2=CB=CD=CA=B1=BC=E4=A3=BA 2015-10-16 23:43
=CA=D5=BC=FE=C8=CB=A3=BA dbound@ietf.org
=D6=F7=CC=E2=A3=BA [dbound] a proposed new mechanism
Dear all,

    After following th= e=20 discussion in the WG discussion list, a new mechanism is proposed in the s= ection=20 6.1 for discussion=20 in
https://tools.ietf.org/html/draft-yao-dbound-dns-solution-01

=     There=20 will have a new dbound RR whose RDATA includs Flag and Anchor=20 Name.
  
   The main idea is to add an anchor n= ame=20 (middleman or middle domain name). Those domain names which are supposed t= o=20 share the same dns administrative boundaries will point to the same anchor= name=20 (FQDN) with the flag's value of 1;
Those domain names which are suppose= d to=20 share the same dns administrative boundaries through PSL will point to the= PSL=20 link with the flag's value of 0; The anchor name can point to name collect= ions=20 wich are supposed to share the same DNS administrative boundaries with the= =20 flag's value of 2.

The new mechanism will also work for wildcard=20 name.

   There are some examples to show how it works in = the=20 section=20 6.1  in
https://tools.ietf.org/html/draft-yao-dbound-dns-solu= tion-01

If=20 possible, I would like to introduce this new mechanism in Yokohoma IETF=20 meeting.

If the solution is reasonable, I will detail the design in= a new=20 draft.

thanks.

Jiankang=20 Yao



------=_001_NextPart010736043873_=------ From nobody Tue Oct 27 12:15:11 2015 Return-Path: X-Original-To: dbound@ietfa.amsl.com Delivered-To: dbound@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EB2551ACE63 for ; Tue, 27 Oct 2015 12:15:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.378 X-Spam-Level: X-Spam-Status: No, score=-1.378 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bMj-SSEyQUma for ; Tue, 27 Oct 2015 12:15:08 -0700 (PDT) Received: from mail-io0-x22a.google.com (mail-io0-x22a.google.com [IPv6:2607:f8b0:4001:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EAED31ACE60 for ; Tue, 27 Oct 2015 12:15:07 -0700 (PDT) Received: by iody8 with SMTP id y8so76984448iod.1 for ; Tue, 27 Oct 2015 12:15:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=deccio.net; s=google; h=mime-version:date:message-id:subject:from:to:content-type; bh=XWmvJT0Qd6aOpuUMymOjsgnYMSytK86KD/GrWmOGHss=; b=YPrOy7JW5SX4rQTr0X+fEju1jkuYm0cfS5OQRhIF86q/B2dJRLjVdT+7TUIJchGoRi 1YkdHQDV2lmOuvgaCJPYHjHf3Ka4gVn9AZge7YdV0tTX+7nikGyXqy2TBObaY6ockWb8 AEDswEll0E1lNbMatIlr4p9WIlVKOF/fABnGQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=XWmvJT0Qd6aOpuUMymOjsgnYMSytK86KD/GrWmOGHss=; b=kWiY/thlbzReXcJB/Eabg9zMKPLZOiHImE3jqImP9zRDywg9b+OHyGdfeZwUKxOLov KnrFJhERjlPbNIOoYXT/BJp5sSJ0MFnWuIPATvB0rxJgVLTCbyNkrLxgAHpirG/BIPfJ aUVCzg/lTzs8p6mWrGyENo5VM/gUkzby1O5xlWkZaUdG4tlnacuKqknASN71f4Dn9r/3 zNs/9kItCRmJcyxoRKp+8dsEmamDed2wTnUKJu0gS82tcmV5WxcoZg3eCrENYPGCkumr uwC5uomAIV7Gc1xiDSb/SMR6QaLmywQsJx5m6wJphxxG3bEQx5ZoPzrnmJFw8K3qyVez N+Rw== X-Gm-Message-State: ALoCoQlH2llwsKq7L4J/lZrTyzvCKKpLGpdHHUU0bsML2+lpFn2zU8MX2F7FhqtaXRrwQ0r5JMVq MIME-Version: 1.0 X-Received: by 10.107.152.2 with SMTP id a2mr32264075ioe.123.1445973307156; Tue, 27 Oct 2015 12:15:07 -0700 (PDT) Received: by 10.50.91.202 with HTTP; Tue, 27 Oct 2015 12:15:07 -0700 (PDT) Date: Tue, 27 Oct 2015 15:15:07 -0400 Message-ID: From: Casey Deccio To: "dbound@ietf.org" Content-Type: multipart/alternative; boundary=001a1140e9d25404d705231ae5d7 Archived-At: Subject: [dbound] Minutes, milestones, and meeting X-BeenThere: dbound@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DNS tree bounds List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Oct 2015 19:15:10 -0000 --001a1140e9d25404d705231ae5d7 Content-Type: text/plain; charset=UTF-8 I've been reviewing the IETF93 DBOUND WG meeting minutes [1] in preparation for the IETF 94 meeting. Some thoughts follow. There was discussion in the meeting about the subdivisions of the problem, specifically identifying (or repudiating) relationships for names that are ancestrally related (hierarchical relationships) vs. for those that are not (cross-domain relationships). There was agreement that both should be addressed (confirmed with a hum in the room), but there was some sentiment expressed that they might best be considered separately and that the hierarchically related aspect should be considered first. One of the reasons for that was that was to avoid blocking solution of one problem by waiting on a one-size-fits-all solution. Among the actions from the last meeting were to revise some of the questions fundamental to the problem statement, flesh out terminology in a glossary, and develop revised milestones based on the WG discussions. While there has been some discussion on the list directly or indirectly addressing these, it seems to me that there is more work to be done. Some of the "questions" are somewhat clear because they are based on current application use, e.g., HTTP cookie allowed domains and organizational domain identification for DMARC. Others that are part of the discussion are higher level, and while they might encompass the others, there seems to be less agreement and more discussion. I tend to think we should focus on where there the most relevant usage and consensus. The terminology glossary was begun (thanks, Kurt!) [2], though we have some work yet to do by way of enumerating the terms whose definitions are useful for defining and solving the problems. The current list includes the following: Control:: (as in "Is domain X under the same control as domain Y") Compatibility:: Complexity (implementation + operations):: Portability:: Will this solution work for both offline as well as online Scalability:: I'm somewhat concerned about spending cycles defining "control". The others were terms associated with solution considerations for rating their effectiveness. Also, other terms might need to be added, if they are helpful to the problem. For the "milestones", I would propose that we add different milestones for the different subdivisions of the problem. This doesn't tie us to multiple solutions, but it does allow it, and it also allows prioritized consideration of the subdivisions of the problem. I have authored a draft with the intent of embodying some of the principles of the problem. The draft addresses the "hierarchical" aspect of the DBOUND problem and focuses on current application use. It also includes the considerations for solutions (e.g., compatibility, portability). The draft is here: https://datatracker.ietf.org/doc/draft-deccio-dbound-organizational-domain-policy/ If you haven't already read it, I ask that you give it a read and provide feedback. For the IETF 94 meeting, I propose to take some WG time to present and discuss this draft. As a preface to discussion of this draft, I think it would be valuable to recap and have some follow-up on the key discussion points from the last meeting (e.g., those pointed out above). That would present a natural segue into the draft presentation/discussion. I am happy to lead that discussion as well as present the draft, though I have constraints that prevent me from attending this meeting in person. I am asking the chairs to acquire the means for remote presentation, which might at least enable presentation of the draft. Cheers, Casey [1] https://www.ietf.org/proceedings/93/minutes/minutes-93-dbound [2] http://trac.tools.ietf.org/wg/dbound/trac/wiki/Glossary --001a1140e9d25404d705231ae5d7 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I've been reviewing the IETF93 DBOUND WG meeting = minutes [1] in preparation for the IETF 94 meeting.=C2=A0 Some thoughts fol= low.

There was discussion in the meeting about the subdivisions of t= he problem, specifically identifying (or repudiating) relationships for nam= es that are ancestrally related (hierarchical relationships) vs. for those = that are not (cross-domain relationships).=C2=A0 There was agreement that b= oth should be addressed (confirmed with a hum in the room), but there was s= ome sentiment expressed that they might best be considered separately and t= hat the hierarchically related aspect should be considered first.=C2=A0 One= of the reasons for that was that was to avoid blocking solution of one pro= blem by waiting on a one-size-fits-all solution.

Among th= e actions from the last meeting were to revise some of the questions fundam= ental to the problem statement, flesh out terminology in a glossary, and de= velop revised milestones based on the WG discussions.=C2=A0 While there has= been some discussion on the list directly or indirectly addressing these, = it seems to me that there is more work to be done.

Some o= f the "questions" are somewhat clear because they are based on cu= rrent application use, e.g., HTTP cookie allowed domains and organizational= domain identification for DMARC.=C2=A0 Others that are part of the discuss= ion are higher level, and while they might encompass the others, there seem= s to be less agreement and more discussion.=C2=A0 I tend to think we should= focus on where there the most relevant usage and consensus.

<= div>The terminology glossary was begun (thanks, Kurt!) [2], though we have = some work yet to do by way of enumerating the terms whose definitions are u= seful for defining and solving the problems.=C2=A0 The current list include= s the following:

Control:: (as in "Is domain X under the same c= ontrol as domain Y")
Compatibility::
Complexity (implementation = + operations)::
Portability:: Will this solution work for both offline a= s well as online
Scalability::

I'm somewhat concerned about s= pending cycles defining "control".=C2=A0 The others were terms as= sociated with solution considerations for rating their effectiveness.=C2=A0= Also, other terms might need to be added, if they are helpful to the probl= em.

For the "milestones", I would pr= opose that we add different milestones for the different subdivisions of th= e problem.=C2=A0 This doesn't tie us to multiple solutions, but it does= allow it, and it also allows prioritized consideration of the subdivisions= of the problem.

I have authored a draft with the intent = of embodying some of the principles of the problem.=C2=A0 The draft address= es the "hierarchical" aspect of the DBOUND problem and focuses on= current application use.=C2=A0 It also includes the considerations for sol= utions (e.g., compatibility, portability).=C2=A0 The draft is here:

= https://datatracker.ietf.org/doc/draft-deccio-dbound-or= ganizational-domain-policy/

If you haven't alread= y read it, I ask that you give it a read and provide feedback.

For t= he IETF 94 meeting, I propose to take some WG time to present and discuss t= his draft.=C2=A0 As a preface to discussion of this draft, I think it would= be valuable to recap and have some follow-up on the key discussion points = from the last meeting (e.g., those pointed out above).=C2=A0 That would pre= sent a natural segue into the draft presentation/discussion.=C2=A0 I am hap= py to lead that discussion as well as present the draft, though I have cons= traints that prevent me from attending this meeting in person.=C2=A0 I am a= sking the chairs to acquire the means for remote presentation, which might = at least enable presentation of the draft.

Che= ers,
Casey

[1] https://www.ietf.org/proceedings/93/minutes/m= inutes-93-dbound
[2] http://trac.tools.ietf.org/wg/dbound/trac/wiki/Glossar= y
--001a1140e9d25404d705231ae5d7--