3 ms·
>I'm fascinated in this affaire how technically knowledgeable people loose common sense to defend their favorite brand...when it happens in plain text I'm fasc
by athms 6y ago
>I'm fascinated in this affaire how technically knowledgeable people loose common sense to defend their favorite brand...when it happens in plain text
I'm fascinated how technically knowledgeable people don't understand OCSP.
Checking the revocation status of certificates is why OCSP was created. It happens via HTTP. Why? Because you cannot check a certificate used for the HTTPS connection when you are using HTTPS for the connection. Apple leveraged OCSP for Gatekeeper since it does the same thing, checking certificates, in this case a developer certificate. That is all it does.
- moduspol 6y agoIt's also easy to imagine what the blog posts would look like if they did the same thing except over TLS--in a way that the harmlessness / purpose of the request was not immediately apparent. I agree with you, though--it seems like they solved a valid problem with the most obvious, commonly-used solution. The real debate is probably just over whether or not the problem is a sufficiently large threat to justify the downsides.