apparently ldif just really loves its parens