The request obviously sends lots more information than just the serial number of the developer certificate. Is it "harmless" data or could they have more info a

The request obviously sends lots more information than just the serial number of the developer certificate. Is it "harmless" data or could they have more info about the executable in there? Why don't the author post the OCSP request of Thunderbird too? And how about another request for Firefox so we can compare the data? This article really doesn't clear anything up for me...