4 ms·
What’s the alternative tho?
by valuearb 6y ago
What’s the alternative tho?
- LgWoodenBadger 6y agoPublish revocations as security updates to the OS?
- valuearb 6y agoSecurity updates take too long. How bout each copy of MacOS keeps local copy of revocation database, and updates in background? Much faster, updates relatively quickly, and not subject to network outages.
- cromka 6y agoI'd imagine that revocations don't happen often. And when they do, Apple has a perfectly capable infrastructure to push those small incremental changes on demand. It's almost as if they intentionally ignored such superior solution and chose calling home for other reasons...
- throwaway888abc 6y agoThat way (current) Apple also has the app usage statistic ?
- jimmaswell 6y agoYou don't need an alternative. The entire concept is totally unnecessary.
- loeg 6y agoA limited change would be to fail-open more of the time, e.g., if the OCSP server does not respond within a few milliseconds. (MacOS already fails-open in some internet scenarios.) A better option is to asynchronously update a Certificate Revocation List ("CRL") and perform any check local to the machine. This avoids disclosing to Apple every single time you run a program, which program it is, and what network you're on. It could also emergency-revoke certificates just as quickly as the OCSP design by polling at the same frequency (every app startup).
- valuearb 6y agoThis is exactly right, and given Apple’s privacy commitment should have been implemented already.
- fortran77 6y agoMicrosoft Windows 10.