From 464d7ec3c67f45a1bdbe0549dd8cc9e305d9cbab Mon Sep 17 00:00:00 2001 From: Jonah Aragon Date: Sat, 30 Mar 2024 18:16:46 -0500 Subject: [PATCH] Separate browser extensions page (#2461) Co-authored-by: redoomed1 <161974310+redoomed1@users.noreply.github.com> Signed-off-by: Daniel Nathan Gray --- config/mkdocs-common.yml | 1 + docs/browser-extensions.md | 115 ++++++++++++++++++ docs/desktop-browsers.md | 84 +------------ docs/desktop.md | 2 +- docs/mobile-browsers.md | 31 ----- docs/tools.md | 22 +--- .../assets/img/cover/browser-extensions.webp | Bin 0 -> 11770 bytes 7 files changed, 127 insertions(+), 128 deletions(-) create mode 100644 docs/browser-extensions.md create mode 100644 theme/assets/img/cover/browser-extensions.webp diff --git a/config/mkdocs-common.yml b/config/mkdocs-common.yml index e22f0549..39b409d3 100644 --- a/config/mkdocs-common.yml +++ b/config/mkdocs-common.yml @@ -279,6 +279,7 @@ nav: - "tor.md" - "desktop-browsers.md" - "mobile-browsers.md" + - "browser-extensions.md" - !ENV [NAV_PROVIDERS, "Providers"]: - "cloud.md" - "dns.md" diff --git a/docs/browser-extensions.md b/docs/browser-extensions.md new file mode 100644 index 00000000..fcd80901 --- /dev/null +++ b/docs/browser-extensions.md @@ -0,0 +1,115 @@ +--- +title: Browser Extensions +icon: material/puzzle-outline +description: These browser extensions can enhance your browsing experience and protect your privacy. +cover: browser-extensions.webp +--- + +In general, we recommend keeping your browser extensions to a minimum to decrease your attack surface. They have privileged access within your browser, require you to trust the developer, can make you [stand out](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint), and [weaken](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ) site isolation. + +However, some provide functionality which can outweigh these downsides in certain situations, particularly when it comes to [content blocking](basics/common-threats.md#mass-surveillance-programs). + +Don't install extensions which you don't immediately have a need for, or ones that duplicate the functionality of your browser. For example, [Brave](desktop-browsers.md#brave) users don't need to install uBlock Origin, because Brave Shields already provides the same functionality. + +## Content Blockers + +### uBlock Origin + +
+ +![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ align=right } + +**uBlock Origin** is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts. + +[:octicons-repo-16: Repository](https://github.com/gorhill/uBlock#readme){ .md-button .md-button--primary } +[:octicons-eye-16:](https://github.com/gorhill/uBlock/wiki/Privacy-policy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/gorhill/uBlock/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/gorhill/uBlock){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/ublock-origin) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm) +- [:simple-microsoftedge: Edge](https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak) + +
+ +
+ +We suggest following the [developer's documentation](https://github.com/gorhill/uBlock/wiki/Blocking-mode) and picking one of the "modes". Additional filter lists can impact performance and [may increase attack surface](https://portswigger.net/research/ublock-i-exfiltrate-exploiting-ad-blockers-with-css). + +These are some other [filter lists](https://github.com/gorhill/uBlock/wiki/Dashboard:-Filter-lists) that you may want to consider adding: + +- [x] Check **Privacy** > **AdGuard URL Tracking Protection** +- Add [Actually Legitimate URL Shortener Tool](https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt) + +### uBlock Origin Lite + +uBlock Origin also has a "Lite" version of their extension, which offers a very limited feature-set compared to the original extension. However, it has a few distinct advantages over its full-fledged sibling, so you may want to consider it if... + +- ...you don't want to grant full "read/modify website data" permissions to any extensions (even a trusted one like uBlock Origin) +- ...you want a more resource (memory/CPU) efficient content blocker[^1] +- ...your browser only supports Manifest V3 extensions + +
+ +![uBlock Origin Lite logo](assets/img/browsers/ublock_origin_lite.svg){ align=right } + +**uBlock Origin Lite** is a Manifest V3 compatible content blocker. Compared to the original *uBlock Origin*, this extension does not require broad "read/modify data" permissions to function. + +[:octicons-repo-16: Repository](https://github.com/uBlockOrigin/uBOL-home#readme){ .md-button .md-button--primary } +[:octicons-eye-16:](https://github.com/gorhill/uBlock/wiki/Privacy-policy){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://github.com/uBlockOrigin/uBOL-home/wiki){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/gorhill/uBlock/tree/master/platform/mv3){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/addon/ublock-origin-lite) +- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh) + +
+ +
+ +We only recommend this version of uBlock Origin if you never want to make any changes to your filter lists, because it only supports a few pre-selected lists and offers no additional customization options, including the ability to select elements to block manually. These restrictions are due to limitations in Manifest V3's design. + +This version offers three levels of blocking: "Basic" works without requiring any special privileges to view and modify site content, while the "Optimal" and "Complete" levels do require that broad permission, but offer a better filtering experience with additional cosmetic rules and scriptlet injections. + +If you set the default filtering mode to "Optimal" or "Complete" the extension will request read/modify access to **all** websites you visit. However, you also have the option to change the setting to "Optimal" or "Complete" on a **per-site** basis by adjusting the slider in the extension's pop-up panel on any given site. When you do so, the extension will request read/modify access to that site only. Therefore, if you want to take advantage of uBlock Origin Lite's "permission-less" configuration, you should probably leave the default setting as "Basic" and only adjust it higher on sites where that level is not adequate. + +uBlock Origin Lite only receives block list updates whenever the extension is updated from your browser's extension marketplace, as opposed to on demand. This means that you may miss out on new threats being blocked for weeks until a full extension release is published. + +### AdGuard + +We recommend [Safari](mobile-browsers.md#safari) for iOS users, which unfortunately is not supported by uBlock Origin. Luckily, Adguard provides an adequate alternative: + +
+ +![AdGuard logo](assets/img/browsers/adguard.svg){ align=right } + +**AdGuard for iOS** is a free and open-source content-blocking extension for Safari that uses the native [Content Blocker API](https://developer.apple.com/documentation/safariservices/creating_a_content_blocker). + +[:octicons-home-16: Homepage](https://adguard.com/en/adguard-ios/overview.html){ .md-button .md-button--primary } +[:octicons-eye-16:](https://adguard.com/privacy/ios.html){ .card-link title="Privacy Policy" } +[:octicons-info-16:](https://kb.adguard.com/ios){ .card-link title=Documentation} +[:octicons-code-16:](https://github.com/AdguardTeam/AdguardForiOS){ .card-link title="Source Code" } + +
+Downloads + +- [:simple-appstore: App Store](https://apps.apple.com/app/id1047223162) + +
+ +
+ +Additional filter lists do slow things down and may increase your attack surface, so only apply what you need. AdGuard for iOS has some premium features; however, standard Safari content blocking is free of charge. + +## Criteria + +- Must not replicate built-in browser or OS functionality. +- Must directly impact user privacy, i.e. must not simply provide information. + +[^1]: uBlock Origin Lite *itself* will consume no resources, because it uses newer APIs which make the browser process the filter lists natively, instead of running JavaScript code within the extension to handle the filtering. However, this resource advantage is only [theoretical](https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ)#is-ubol-more-efficient-cpu--and-memory-wise-than-ubo), because it's possible that standard uBlock Origin's filtering code is more efficient than your browser's native filtering code. This has not yet been benchmarked. diff --git a/docs/desktop-browsers.md b/docs/desktop-browsers.md index fb8225e1..dcf17883 100644 --- a/docs/desktop-browsers.md +++ b/docs/desktop-browsers.md @@ -94,7 +94,7 @@ Like [Tor Browser](tor.md), Mullvad Browser is designed to prevent fingerprintin Note that while you can use Mullvad Browser with any VPN provider, other people on that VPN must also be using Mullvad Browser for this "crowd" to exist, something which is more likely on Mullvad VPN compared to other providers, particularly this close to the launch of Mullvad Browser. Mullvad Browser does not have built-in VPN connectivity, nor does it check whether you are using a VPN before browsing; your VPN connection has to be configured and managed separately. -Mullvad Browser comes with the *uBlock Origin* and *NoScript* browser extensions pre-installed. While we typically [don't recommend](#extensions) adding *additional* browser extensions, these extensions that come pre-installed with the browser should **not** be removed or configured outside their default values, because doing so would noticeably make your browser fingerprint distinct from other Mullvad Browser users. It also comes pre-installed with the Mullvad Browser Extension, which *can* be safely removed without impacting your browser fingerprint if you would like, but is also safe to keep even if you don't use Mullvad VPN. +Mullvad Browser comes with the *uBlock Origin* and *NoScript* browser extensions pre-installed. While we typically discourage adding *additional* [browser extensions](browser-extensions.md), these extensions that come pre-installed with the browser should **not** be removed or configured outside their default values, because doing so would noticeably make your browser fingerprint distinct from other Mullvad Browser users. It also comes pre-installed with the Mullvad Browser Extension, which *can* be safely removed without impacting your browser fingerprint if you would like, but is also safe to keep even if you don't use Mullvad VPN. ### Private Browsing Mode @@ -288,7 +288,7 @@ Brave allows you to select additional content filters within the internal `brave -1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode) or the [NoScript](https://noscript.net) extension. +1. This option provides functionality similar to uBlock Origin's advanced [blocking modes](https://github.com/gorhill/uBlock/wiki/Blocking-mode). 2. If you wish to stay logged in to a particular site you visit often, you can set exceptions on a per-site basis by clicking on the Shield icon in the address bar. ##### Privacy and security @@ -351,76 +351,6 @@ Brave's Web3 features can potentially add to your browser fingerprint and attack ## Additional Resources -In general, we recommend keeping your browser extensions to a minimum to decrease your attack surface; they have privileged access within your browser, require you to trust the developer, can make you [stand out](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint), and [weaken](https://groups.google.com/a/chromium.org/g/chromium-extensions/c/0ei-UCHNm34/m/lDaXwQhzBAAJ) site isolation. However, uBlock Origin may prove useful if you value content blocking functionality. - -### uBlock Origin - -
- -![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ align=right } - -**uBlock Origin** is a popular content blocker that could help you block ads, trackers, and fingerprinting scripts. - -[:octicons-repo-16: Repository](https://github.com/gorhill/uBlock#readme){ .md-button .md-button--primary } -[:octicons-eye-16:](https://github.com/gorhill/uBlock/wiki/Privacy-policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/gorhill/uBlock/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/gorhill/uBlock){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/ublock-origin) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm) -- [:simple-microsoftedge: Edge](https://microsoftedge.microsoft.com/addons/detail/ublock-origin/odfafepnkmbhccpbejgmiehpchacaeak) - -
- -
- -We suggest following the [developer's documentation](https://github.com/gorhill/uBlock/wiki/Blocking-mode) and picking one of the "modes". Additional filter lists can impact performance and [may increase attack surface](https://portswigger.net/research/ublock-i-exfiltrate-exploiting-ad-blockers-with-css). - -These are some other [filter lists](https://github.com/gorhill/uBlock/wiki/Dashboard:-Filter-lists) that you may want to consider adding: - -- [x] Check **Privacy** > **AdGuard URL Tracking Protection** -- Add [Actually Legitimate URL Shortener Tool](https://raw.githubusercontent.com/DandelionSprout/adfilt/master/LegitimateURLShortener.txt) - -### uBlock Origin Lite - -uBlock Origin also has a "Lite" version of their extension, which offers a very limited feature-set compared to the original extension. However, it has a few distinct advantages over its full-fledged sibling, so you may want to consider it if... - -- ...you don't want to grant full "read/modify website data" permissions to any extensions (even a trusted one like uBlock Origin) -- ...you want a more resource (memory/CPU) efficient content blocker[^1] -- ...your browser only supports Manifest V3 extensions - -
- -![uBlock Origin Lite logo](assets/img/browsers/ublock_origin_lite.svg){ align=right } - -**uBlock Origin Lite** is a Manifest V3 compatible content blocker. Compared to the original *uBlock Origin*, this extension does not require broad "read/modify data" permissions to function. - -[:octicons-repo-16: Repository](https://github.com/uBlockOrigin/uBOL-home#readme){ .md-button .md-button--primary } -[:octicons-eye-16:](https://github.com/gorhill/uBlock/wiki/Privacy-policy){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://github.com/uBlockOrigin/uBOL-home/wiki){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/gorhill/uBlock/tree/master/platform/mv3){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/addon/ublock-origin-lite) -- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh) - -
- -
- -We only recommend this version of uBlock Origin if you never want to make any changes to your filter lists, because it only supports a few pre-selected lists and offers no additional customization options, including the ability to select elements to block manually. These restrictions are due to limitations in Manifest V3's design. - -This version offers three levels of blocking: "Basic" works without requiring any special privileges to view and modify site content, while the "Optimal" and "Complete" levels do require that broad permission, but offer a better filtering experience with additional cosmetic rules and scriptlet injections. - -If you set the default filtering mode to "Optimal" or "Complete" the extension will request read/modify access to **all** websites you visit. However, you also have the option to change the setting to "Optimal" or "Complete" on a **per-site** basis by adjusting the slider in the extension's pop-up panel on any given site. When you do so, the extension will request read/modify access to that site only. Therefore, if you want to take advantage of uBlock Origin Lite's "permission-less" configuration, you should probably leave the default setting as "Basic" and only adjust it higher on sites where that level is not adequate. - -uBlock Origin Lite only receives block list updates whenever the extension is updated from your browser's extension marketplace, as opposed to on demand. This means that you may miss out on new threats being blocked for weeks until a full extension release is published. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. @@ -433,7 +363,7 @@ uBlock Origin Lite only receives block list updates whenever the extension is up - Available on Linux, macOS, and Windows. - Any changes required to make the browser more privacy-respecting should not negatively impact user experience. - Blocks third-party cookies by default. -- Supports [state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning) to mitigate cross-site tracking.[^2] +- Supports [state partitioning](https://developer.mozilla.org/docs/Web/Privacy/State_Partitioning) to mitigate cross-site tracking.[^1] ### Best-Case @@ -448,10 +378,4 @@ Our best-case criteria represents what we would like to see from the perfect pro - Provides open-source sync server implementation. - Defaults to a [private search engine](search-engines.md). -### Extension Criteria - -- Must not replicate built-in browser or OS functionality. -- Must directly impact user privacy, i.e. must not simply provide information. - -[^1]: uBlock Origin Lite *itself* will consume no resources, because it uses newer APIs which make the browser process the filter lists natively, instead of running JavaScript code within the extension to handle the filtering. However, this resource advantage is only [theoretical](https://github.com/uBlockOrigin/uBOL-home/wiki/Frequently-asked-questions-(FAQ)#is-ubol-more-efficient-cpu--and-memory-wise-than-ubo), because it's possible that standard uBlock Origin's filtering code is more efficient than your browser's native filtering code. This has not yet been benchmarked. -[^2]: Brave's implementation is detailed at [Brave Privacy Updates: Partitioning network-state for privacy](https://brave.com/privacy-updates/14-partitioning-network-state). +[^1]: Brave's implementation is detailed at [Brave Privacy Updates: Partitioning network-state for privacy](https://brave.com/privacy-updates/14-partitioning-network-state). diff --git a/docs/desktop.md b/docs/desktop.md index 2f39ff14..9c6380d1 100644 --- a/docs/desktop.md +++ b/docs/desktop.md @@ -175,7 +175,7 @@ Tails [doesn't erase](https://gitlab.tails.boum.org/tails/tails/-/issues/5356) t Tails is great for counter forensics due to amnesia (meaning nothing is written to the disk); however, it is not a hardened distribution like Whonix. It lacks many anonymity and security features that Whonix has and gets updated much less often (only once every six weeks). A Tails system that is compromised by malware may potentially bypass the transparent proxy allowing for the user to be deanonymized. -Tails includes [uBlock Origin](desktop-browsers.md#ublock-origin) in Tor Browser by default, which may potentially make it easier for adversaries to fingerprint Tails users. [Whonix](desktop.md#whonix) virtual machines may be more leak-proof, however they are not amnesic, meaning data may be recovered from your storage device. +Tails includes [uBlock Origin](browser-extensions.md#ublock-origin) in Tor Browser by default, which may potentially make it easier for adversaries to fingerprint Tails users. [Whonix](desktop.md#whonix) virtual machines may be more leak-proof, however they are not amnesic, meaning data may be recovered from your storage device. By design, Tails is meant to completely reset itself after each reboot. Encrypted [persistent storage](https://tails.net/doc/persistent_storage/index.en.html) can be configured to store some data between reboots. diff --git a/docs/mobile-browsers.md b/docs/mobile-browsers.md index 6b5596f9..2495834c 100644 --- a/docs/mobile-browsers.md +++ b/docs/mobile-browsers.md @@ -208,32 +208,6 @@ You can enable E2EE for your Safari bookmarks and downloads by enabling [Advance If you use iCloud with Advanced Data Protection disabled, we also recommend checking to ensure Safari's default download location is set to locally on your device. This option can be found in :gear: **Settings** → **Safari** → **General** → **Downloads**. -### AdGuard - -
- -![AdGuard logo](assets/img/browsers/adguard.svg){ align=right } - -**AdGuard for iOS** is a free and open-source content-blocking extension for Safari that uses the native [Content Blocker API](https://developer.apple.com/documentation/safariservices/creating_a_content_blocker). - -AdGuard for iOS has some premium features; however, standard Safari content blocking is free of charge. - -[:octicons-home-16: Homepage](https://adguard.com/en/adguard-ios/overview.html){ .md-button .md-button--primary } -[:octicons-eye-16:](https://adguard.com/privacy/ios.html){ .card-link title="Privacy Policy" } -[:octicons-info-16:](https://kb.adguard.com/ios){ .card-link title=Documentation} -[:octicons-code-16:](https://github.com/AdguardTeam/AdguardForiOS){ .card-link title="Source Code" } - -
-Downloads - -- [:simple-appstore: App Store](https://apps.apple.com/app/id1047223162) - -
- -
- -Additional filter lists do slow things down and may increase your attack surface, so only apply what you need. - ## Criteria **Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you. @@ -246,8 +220,3 @@ Additional filter lists do slow things down and may increase your attack surface - Android browsers must use the Chromium engine. - Unfortunately, Mozilla GeckoView is still less secure than Chromium on Android. - iOS browsers are limited to WebKit. - -### Extension Criteria - -- Must not replicate built-in browser or OS functionality. -- Must directly impact user privacy, i.e. must not simply provide information. diff --git a/docs/tools.md b/docs/tools.md index 7c9609d0..41df2a37 100644 --- a/docs/tools.md +++ b/docs/tools.md @@ -40,17 +40,6 @@ For more details about each project, why they were chosen, and additional tips o [Learn more :material-arrow-right-drop-circle:](desktop-browsers.md) -### Additional Resources - -
- -- ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](desktop-browsers.md#ublock-origin) -- ![uBlock Origin Lite logo](assets/img/browsers/ublock_origin_lite.svg){ .twemoji } [uBlock Origin Lite](desktop-browsers.md#ublock-origin-lite) - -
- -[Learn more :material-arrow-right-drop-circle:](desktop-browsers.md#additional-resources) - ## Mobile Web Browsers
@@ -62,16 +51,17 @@ For more details about each project, why they were chosen, and additional tips o [Learn more :material-arrow-right-drop-circle:](mobile-browsers.md) - -### Additional Resources +## Browser Extensions -
+
-- ![AdGuard logo](assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for iOS](mobile-browsers.md#adguard) +- ![uBlock Origin logo](assets/img/browsers/ublock_origin.svg){ .twemoji } [uBlock Origin](browser-extensions.md#ublock-origin) +- ![uBlock Origin Lite logo](assets/img/browsers/ublock_origin_lite.svg){ .twemoji } [uBlock Origin Lite](browser-extensions.md#ublock-origin-lite) +- ![AdGuard logo](assets/img/browsers/adguard.svg){ .twemoji } [AdGuard for iOS](browser-extensions.md#adguard)
-[Learn more :material-arrow-right-drop-circle:](mobile-browsers.md#adguard) +[Learn more :material-arrow-right-drop-circle:](browser-extensions.md) ## Service Providers diff --git a/theme/assets/img/cover/browser-extensions.webp b/theme/assets/img/cover/browser-extensions.webp new file mode 100644 index 0000000000000000000000000000000000000000..e3717a3af84b9adf60330becb4cc24c00c46fcf0 GIT binary patch literal 11770 zcmYj!WmH_t)@{>`yE_CA?ry;e?k>UI9fCU{I0SchcXxMp*WfMzK637P_uc)Y$L<=n zb}gA}&6r8iD||soJXBVxj0z=^plV8qJfVL%n{pN(gr-HY zfCp^dyrS=Cwep8DLdeJdOk})&4LbCU|FO^-Zt`9F*TjS^e9525 zQagGKg0X%{Y5Y+1F+3K>w*aTYr&ofdk^UYKJvef%R+Wf(0upO@q!DEp76eTC>nA18;&QpvM__$r(xU?tSLUSfVy zw8Nj+pJVAWJ3?nUVDXqQNVVii{`;g{>Dl6cJ?|^T_?&+jR53Vore~rKr8%bU?8D-w zY2-raUmxg@^mXHh$pWO(-%wQwCPV)TRfU;nFOzm14GSAv%sxxalD9Aetm+n{bSDAQ zU`q1Cu$$iaenXaQmUHP5`Ck|N@bCJ;VdvD?96IUeaFDZ!E@OMdeR+lkX;Jym%RD?RF3T3o4?Vb zTdPz^4gU?>M>pq$6ZtB4w570ny~rVpM&$Us6y_(GJ{hA)prNVoXermY%G+XEdA}m` zN5Y*A;to1w`XE2BQczvAZIET2#XOE|5Dx8)1^z{$SHOQu`4NuMnmmH@Ih zdr2}uNLF8==0|yRL+EURWMxhM0>4V;FR=eMLW%W1zdG-<4hpz0)E|Yafn_g=ci>US zkx|LZ=RsmGteaP{G5(9b|7jKfp7rxZIQ9?x=p6$Don^k^%h&23(Wp)KLL&(eGXL9M zR#_i5|7jLDT|S!3$!<1Tk9!+%j;3I>s78|wlU$0j$=4-IfFZmOS}xB82Yf2w(p zA9`A1l*Q*U|Ai{;^*HFG`=ouT4&pqrKb%v(r@9}Nqt=8~;{6pcwU8#Tq>}ZhjGF!t zm^6}JOG-g;9DY1I>1+iTz=3DWOl&pF+EX!WD6G<8ieu<3wW#k*g`v>$>88Gr{n5f; zi}w*$DWaZl&%sFoMu(ElZ#B1N6rs-cHV#Z9O=hIjztAaewkok%+T}la2fF#%61~Pk z1m_a^J}qsHwI8dxtRM+nH+>2>+%yXtQ!eZ*&PRjX0U3Q%obo>@k#mmFr-A-{%F*;7 zs{l8J(~4$j-4@?a&2J?G@7(})xe9K-43q(PmEW9t4#Al@F^kK*Rp@PYIlNzdZjm;5 zcwj@JrA<5uzRd1UM=wRKRFtsT`~bwbOjZblNdHzCRP~gcL|{xtrb0CZ(omYq58oGG z!r{DqClmY-NYojAVob>+IdrydXfxH1He80l``h{kNb+_bDhu1K^?~|fvm8-1K95lo|-+W>NDH@t%xc;&sVslJ{3nXVG zeg#8IR}Q+_D=caYt;}O!W@g6&qZFM!GV^Hm#@hm~D8RZD7spDd8?Iw!vVuCjKGQ7F zAzMHh`R}0pJMIXGG+nvwckLdeuKzr+bt9)T27cp%E(nXGWX;l0M~N%ym82rIAbiEq=!gx2iqAx1quB%^)93fWv@)@0ExG&oIfb zBUB}ZgM~{Xta(;*O*n5&pv_eDgApzwk7>ut5MZj)>m8Z;0qGJ#Cl){?&0;kshm3HRyino31t17m|LfBzNb33gnvj=-U3i29`e#`sj~_tLU()qq%J_wA9j z*`~@1nsTLN@1vMx%!I6P%q~^DlAxruWB@6^3ZwXC;Vp1hE>_Q-1MB$ET&qYjfP@*O zf0@|!eW88w9G&`JFF+y(&4|tVE7trUmXUKLv1cL!9@9Pw2sX~H?j!2O_b^kPxnr%n zQ{RIFfiD*X9x3lKa~|M(pl_mw;G1aX0sy4gMiJwIayLWkq0#&rErrt+<>FxK=#a93;RMZv zHw(midMZ=l$lKUl&w?Q^nU-D>k5@2MimvU-RJG1o(hH7Yduq_kK!D02NzsCcwJK>|l74E{3L|(&c61^UCG{#uD9H)00Up;~Np-drk$E|1JygvgG>N?HREhlNC>WJP z@~USqr-|GUXSFh~&+j*s4+FRqg#AU3d*J14_|FQeMKl%fp8RxK%Kh5(WM+h1jx&rS zsL%t<0XpVVFA*@0IJ}I$17VDX@geHMl<95-%>hwRsOLUrk#2B5-cBkL(3$jJhy(O{`J-`?Tk#;C#>LW&I5qH19YRIwA1{$Aw1gxhXDOD2l zX1M@7IP_2!7PruJ&0dBzopxS!+N$3quVcD9j{KbD^;aTD7ue1zRBR1N6ug_zWaJLX z!waZ}=51w7Iev%xV!89e13(o5!Zda?Xa3p9sZ^T@l|eyQ8#={01eF3QXIWm44y(G-J{zv-E4)+O+J{X!u zrO)!2c?Zfvz(>vqb~87Mr#Ds_8cF(;rZti}zeNzke7InqLq2JBD;4Z+Fy+=1Y=4kQ zi#;=1-68sfiqUgf<4@JcxKL$ZBHpM2w%o%=MQIy&bnjQQubv~d?TK-Yl5 zhF@JIa^IsPl*2e?<=e({P!^n27M8Eu2 zWSKtZrD5<%gW-P_fIN@8Dxt3b2t7D{wO=Ehs8}+JX0_+?!g=wH0X0dKzHA_*ArgR>L=YqA%_o2QWhKg~Y1#8Uw|~XLf_uIr~~wM_}YdPnHFmC?V*pqZv4WSS31)7Bfp7$ouywBTHCJ=apznlb= zt4V!!X-JSsZb{a`Zp!}>S$V#thd`mR!fBKj3Z#rIGKj{vf66As@iCRETKw*t>}{)8 z_$=U`xs!o`di)_pztsg*-!62Nb4cK4PO^EAX!$Nav=X(Xp^%o@HkhiJ*F&hj`r&|u z91XnMgO)c3WW-y4%8rONu1u4@1fb@md}ICQir^k?6rz-?v?<#JV>c-C$163NF2SUC zo}gigV-3<{8ae70(ep+5;X9GV`>#?#M}y=0KsMwfTcEZF&mZujhQ}lv87<0>F3n~k zX!rYk+%NEKhm?bccy8^xJ6O!=AFf=-L&rSY5|ZNg)tLP#Iz%M}!i8)r5BPo7Vj@oZ zp5>QYVx!sQQ)2vi>1>tA^`l1BEfu=I@;Z&$;7Rtw@bpS&oS00W#m`Zaq9I61c#KN( z;{Xfk)G}p+zl^OEFDcB;nTwqg9XZPF*_p~$6F1PFU|S9sLtl}^m5OCcZ<#Q?c6pO~ z{L8JjDy3t?0y*U4V0z z6Zf+zXNpAxYm1KupIY>A5otf;ctabmhsYXJZ_I!?)r3n@8Nu8d;50U(zq`P+F@#~! zH8o6?ziLqubG*aOIzn4D;b1p@y5qqUox^BvZWMc4)X2Oke$q0@4dVB*HTPxTpe%Do zZ?HSVf7eorjPrj4my7FNjjDV*%3Xk&xztSX^3*gb$-c;$eJK> z=qQI-sdH$NWg`t~Y2;q7=7lRy)l(ibpr~9Q6pPS|F7q)nJu}oN{AUx<*pUgbmc<{IY^{#)_5p#v4kT_ydV& zVTEIf%lf@#j!YF{vS_2iI>x4-N`Qsz#!{ufD1M9HEmm3R`HY4TS|VURoTLjDwfsOH zhpcwVJZEePvRueZ=ViW5l&bf9`9U{1_c;gdL(Tg)cIh(q#8d)KG!{|zL3-kynd>$r z;-8ZIt&K)Xw)@D0<+HFy?5AB}JSy4GD7kY-0_;*Pl{_{+y+oLzV5(56cohU_f@0N$Rd8B+J8U?Vp|b0VA6qf8E!Wk$6h{4xQzVJY1QA$npN} z`TvW&=cP?K`+pbf;b}t;81r)VSn?f^0e>Gjp+S);-Sf-jVQ6STDsn^gwLbuOgM6jp z%^adz!{V_f0L=OIv5!;mKrlU$4GhjZ6mZB0003v4uHqoY9wt@r6aV>=?Z*1(;_vk! zB|Wy^H9e{sb^x#)L`8W)+}7PHXxeJ6FsEP&i_qU;5}8Td87>5}A<7E!G8V!6FTMb< zyA_#jE-`}(9=uw^BNORag)FZ%yh#u3ObY69BF%1^T#0gE(FksRQEWO&WN+VJzY(C{ zL?=86ag^}2#W8{6bzxk04rz}LeMT$;y^ExAxKYxx8qWTk_7^P+nXuui)~H_~hX4S1 zx+!qos6U0}Hm=(qYXfBoDzoO6t}91r(E@0(l=lRNb^+ExZTB^VW(v-qsBby&p;1~# zO487h<9F1aPUpza0I=171YcveVjc*PT8RaV@VCAa{YXO)u(^cY>C20m*T^E_v@9wOJW(CnW^b zPH{_BfYWwFzc1i62#+N5BY`ec(?+L{r$VVYLrr1A3e(F^Kt`Ui2TPAWx$QS@2S!{h#rXysu)pS@5Ny`sHY>^t)(A}M4^%0KiT&!QH5Q1&jb zvrK8StkfoRrw{4Lt)Ek1;01nm?SXy%V@5K|p4ElE#3h1TL8}+muNbaawI-qwOJ+Jj z@~K^AQa*4B;`^>vf9wOpUO*)vmn@a&^7SIEh#WNx`w{@?LE*BJ%rq+M_1!wiTa13O zl`cS{HgGD(g#H!zW`70)7%A5G;3W-k%NDeZB;B}xI++es!LyWfsN_T3 zQH10$gwEiFCA!uT1V&Qh37xR!q7ST9e*(To6-VG(p}~9akX(UNA5K-$+V_@F%yYyb zzKGUM_;c_fiuw`9?smj(tUh>E2}o>_8`&WQf#&j=UVEvX3nxLe@yJR!lqJQ@xD+90 zb*pGIXX2u1^d&y}N8W4BU)(u^<*emo>Ptf({ZIP4xzYiIA_4$oX)uboX_V!dt2*TL z?)OFdsu7JIOrVL*rrbAiS7R}&0o#a%@DSGQ_gz^=*v9!~QyfnRD3f&A9Qr=^&~iT< zo=d>=R_S)R8F$UE4aCTgYhs(H^EcEHU*#*=SQ!g4o9vpAsT^DLt_xJ?lM(L_b(_jD z{M|CshQiq9!?KJNB=FsJM~Oo4Kb=!I(j@sz+#-0AQ+c*#Cs|+W{Vkt>?OF1Vvc%5Z z6*k@{UvjUDzsfS#kgr62;kyu_k_R(H%AtZHCj88vH>Bnl;SO&Yc$uF`1TBty5@L4f zDR5El!zlW+ac#3KY$+|NxUgb$n9XqF&HEYF4?Qk9_}Et+8KArcTe;o`2*t+ptY`ZH zE?Nea9c8LpMw$gML}SIn;T`6n+mF`^-U5IN*8zZQ-_(k1@Pfj~zDg!hkU|M-{jlM& zr;0w{ND!Sn+#?Kaqq81{!I@)p%@>djGEr)BYB5y)T9~i>F|a|(zAZ^$6MK5ng~5AE zCiDcUa|Izw!qvQ+%aJ-t4gp;rMm6*t8^ItyM~FK(!(cYs?SgPibSf<16agKFo%#m? zZN=`1K%t)~-5`*kAm~E(MKV_vRi(dM35+M|a3scgc(c8c|DBN7<%$J+N>S zz*Xx=j5`q%`$tG`(KK0D;(FpxBECrBzQ1n)aQb29YFQ_R%H&+D6>D>l&NCdu`Yd6f zuOhABj#Z3JhtxY}?(u`UVKrNYgm!>2#xeU>mC-$gx5FS!yB|VU)mhbGFgRPJkJBSD z%loXA`J0^kQ2ICCRDAE*Hshwh3el~$P~3xidn+8kwc}lnyf};1gZ8?DEo4SdR4@tT zk}Trql&?vW5@P{q#4B$EoKd}WTj907-kmH#Cp)VQr-CdcHf@mgb@s&soa6S8_6;a^ z%|24P!jNaDb+(1`r{o7mel*edeCY8Owd)O@j(GT^>dzr67N61CuZsLk;A=LJ?xRC+ z^wt4bi0C+knZX5CnN>sQ>4_C(A~&I?EkE1HZ?d1%vkdD$r25+#QYq4nlkV@T_(Egs zm~Y9ag!A6CX0<7pPM>E7Qh%8xrkkZYvpXx4XAJNKUk#!Jn_V9)U=;}bsD6Ap?^&-2 zJaWG{RDn;0;rUENlkC}H(mK1$QT&S{hZ1~>N3c=cO;B!?b%Qv*#J&6v)&?Co9MZMT z+eB5hn#5P(n88*}71al9tX>Z)W62rV%ht_-rQf-DJ+?!cC!DgdxvqWmdHCVqduh~C zp9|(zv)y)1uu>Va9>JuAknf`|8PdznI`+ElrDx@%ep6DBRFMdog4C#M5@Af|H+X$U z@n+Crw$18L^6Z3rQFlof@bC1GvK^}O-}U_;OqXWQ)G&8;jq09f*ncNR|5*x?AM?<| zH6ctJZ7#E6IaSHI-G_8qR%4)ez5?r4=qhA_IX1c9dm^B}vViWtje2u6-LT?^8!h1= zE4L0Ci%39D)G|;|Ht!8}o=>x<4EPLv2moLn3~o9no?GCv170) zXrg3?4m2P{6l#oWLKz3+F{eVe-jWzwn)Y0aq-A8cvu{<8M|wXbgZiCOqPf=NO+;)1 zv1|)2M-cEibqomu?3$E9M@}p)F{M;t9QT=?i) z?0N?Y>K!qX?E2kI9iaUJ_7U4@dH*D0O`4Dfi%y>9sG(`P>&92r-k9-MZ9WQEk77K+ zIa7ZDwNLQ*7JIs0lS%KWK=iC|>)tDeQxYV>D3eNBiGpe5#R)B5`*r-MFGzE-4v%xv z4n(33GePN^;-7;musmuQKlL^gj2l&WP*zw9H21 zi7OHM>pVKY{BihrOqD{d>#BiE$P4q$mJ6LuZ|1CQC{LnKcCF!y0UwVJ4xMpfByC4e zNp5^r=(dt2XPklWm#+PIa<6INap$|H2!E$UeG1;K@W^KD1%SJ^C`C8HiAlhn9l~mf zLs;^A;IB5Y3+nC_Wo~MY&wqvqKgG$jRNJkAjOp5>FVz@?!{PPbx5Tj9!3o(lNxI-Z zk9a~lK4zV-Gmz2~(;9MAgib~W-!vo{#5;{;@DC#1@*-Q`E%H)Iu26Sze$GXgf{-$b zYQkXQmd4LR$ud|)rZlpR=1D$e^bwm<%|2?iE}*>S!92t0GVf;RxMdBkZ#=oUHP$H# z)RP$x$(qkoaWENepqE#3L)GrE<&lCb#e2ocM}n>_(bAOBnf%U*cT&n7y>Ose;k4^G zBbz*dH`ju9{EEOhSO^i)xq2RB1j8YTg-$!mCZ^X2zvB8(O@3d1_IV*D9wJ>;6DRFx z*LP3}me%to;pfozYCH-0$2j2L&;ik{NHVvMc!B);a$vB+U)>iW|o62{t{S55W9rKyaC`_%$`R0c;f9R1fJ!L+0)06mJhP3EI>m*=4U zM6vHh@Ftf&7m)V3%}uDNeC-wF=@=JOId$IKPaw@slTugrUeW)ht;ClN2i| z7=sr!itMs196k^qaE#BXw7u8zv&r zV_e}>Qg^=mn+=bhv=f6P4%7Ti%gPr>1XMg#-`!n{G-XXY>t#NS}(W6 zI>2(bLeY#$s0sUqMU9^I&;{B+(6v(y->NHLsn3~R=w<^be~EaY264exD;S+@L|2%4Wge8Y-hLp#SRgIv;_pA}T9Bw;9FG5mVZj$C zRjsJWS7f^cO+*)%E5&IQ`ZP`2+Rnl>uk?90L4pggyd{$$k*%0&M=2*WU){4p-^JErpOeMl$9U+}1mqpRuW4lI;y743$bL=-pW9jG)L5N{_l*_|& zwhN|Vx(SP-0O@DwN0D>j_}gu%EWH3teO=CE4I}_2MQPz;4#FFo6#(FX*#3?Y!E&Gw zTtiSV$3u1LVX~NpPKt4U`aMZ(4s!dhMAdddY1R3LmQydKv#&A@13&r}n$}CVF}S1R z;8476p)j7h06B!#7)K=~COl6U`zR$&Qg~1bue{|{_lKQh!TcvxuiQY3S`POemyIc8 z9^b*Oc)4v;rda!uciB~u>`{|AMQV|nFPdt4`5X}vQLeAL`b%{+JugjfWrK+x+r!Joa)vMoYfP)J11t<}`jNxt(RulKuLlOJs;E7Y_ znbt_Q4pGuQ=ukgm1t9@mu_RJNHp7C(Psh8Y7%vszSjQ|IFo*EaKw#VWv#XcUGfHkf zVeo6zv%`{3E234idU5QLzM^6{5jel3bn*9oV+!x8b6(N!qe%N%O1GenLPaJV+C2+Ru)!B8i+U}H z^eGY5xjDN$2nMCZ-Fu7z5%`n_#Ps85bQs6Q)BT)$$V{=)$rXT~8HN$SU~XMPH69(j zbKM_{sD@xCZ$e9qKq;9^>6qgCb$-Gh&r*C5Hy`bepfDYh}jJ(>3^(sEeP^ z0(t6*NAdIo7YDHmkhEu$=t&R66CmDhhaRH+v)lRei9NlKPR^K>9ULh0#P*+PjW1ZM zbmh;Ky2ER^N@kAm`vgee7a_7a2s)a7AA1hsw;pnUB-;8f+Bp77xYi=P8Hem}KVdYq{gyYmI+dVHU%;BfY7Nw{U@ z1mWyGVQ}YXMKVLw+ffz-2^BRXn0H6fj3Q@RtE$ocL}|-(A{qVR-9=%}8wLDnz#GjW z{hid#izPi8)-TpWvr3ALE2eGU{MeeX`VqY?9h63mAvtirL1l32VBJ)HE0m37dG+;f zm+7fpygTc~*?_A7z%9)F5O@Vvsd3!~n ztfkA}(Bj7P@1m*{AWBTkt0NdL2^dP94u-L<`0v3Cet-vETFH?bln5EIItf5}pS)oW zq#|kD-ZgA3r=(zvzltkdsKnYdD|48E(U!^?2OK_$TwGNXwYC_k)+gjIZ}hE=i4X6W zZw(JxKHU@6Xja64UznKcOGIa!h-1#cNMFU@I(?yt>b0@5c|Rjba3;f-_Kkd>vneB4Uaq=n8Naa&W%v>s zGY1^_9_uDsIro5NySs@zv6L2~azxeyE4u8#`~@9z* zd5DHGBr-lQ^2Y}6fcuQ+~KjA+oe!_|PQ$xthQigaJOGxQ3bINsjb(?1n z*}Nskp5?MYY90*t6YEokQXjDay*5JsB()5NYwYxZgbLBoeFQ>hPMx}^k+R>__^uSne=ENG}(UjmMUrH2hO&MRg z)KK^FL~M`N<$Q8C`ZsV#vlzPX+m+eRWneV) zk=Dj&u$!Rw{oF#eg6>plO)2It!gEYGy5Hp-UyH}*gI7+ux!0>G^A!yGpNsv!1_A|` zSY}_Cn4da|zGuIQjWZ&SI8w8@H~D*t84X~Q9R#Lq&J9WqZ)gX54>E&#=`z;iqJ8c} z#&I|!F@XtypVKRAvZX{c8J2_3Ur(ZCDDBASvIeMDq1XW5JnkI%S{AdsvcB6y=B2%K z;~?&xWAVzucG7eH@i4e@W}eM4BBK$wY{7TGI%0A(m_|-~D>6>A$5KLy_S^ql#|Xea zxP&bjchf`-b45EVFA|<440Dg%9dtRg$Y{tD)x7eq7~ULaI*&GLY8cncJ2=|8JmB7- z3Y`+vqmhmpGO1DaG>GY+(eTKInNCjyQixNy` z?Ydq^xt%`QPe@fSM|A5k+fM$;vmbbD7e1R%7qx8Atw_}4 zlY1h|NlH_+XH{Q3y1hr$72^SBC}`2kZUybz?5Ifdb9Z%ls2_96URx%uOfHyV)Fh2p z*{je1LB@@6P(?cEGXw8qq?6HpRLA}nE1o4n$yU&^gKOz^Iv!|o6S;am@Zx=lddp{i zGSAv`zVeT5_)5V0>33%_=YJAHq-Esb>cM9S)DB~8UEkMN6hT%7F@rsVyEzrvRF@!EUG+u`QRMT6~W z9A+w&&|^Hj(?%u%4ZOQbc7b5XLfoo>8A|1X;*OkRAX!kmw~8LW)eHGRL8qGR@1S6( zt7)lM=j1{8aez8)Q5<34%|#_+TQIZ(w0OG3b&Tfh*|`EorK(Nho&}L($dqJ+6YG#= z!v>0S+LaC(?W@`=$UpI03zSoq+lY+ zp73IWm`a&)c$oO}&G(&8_>q}!>R1*J*=vaf26kgh3)*pfdoKM&vWyv-?%+F>r-jv5 z6>b#voErYLrX+$?`J}&Ty6ErlQJ6+@G~CBqdT~$n_5lW|9cU