alt Hacker NewsIt seems like we've all just... given up on certificate revocation? CRLs and OCSP were designed for exactly this sort of thing, but they both seen to have been abandoned as unworkable with no replacement.
Replies
boston_clone • yesterday at 3:07 PM
Same here - I genuinely thought this would have been easily, and almost immediately, remediated vis-a-vis CRLs. I'm not in the vuln management space anymore, but is there some sort of caching system used which would affect software differently than a typical browser?
Editing to add a link to this Apple support article which is unsurprisingly detailed - https://support.apple.com/en-us/149555
➕ show 1 reply
ycombinatrix • yesterday at 4:54 PM
[dead]
It’s a hard problem: if you query on use, you not only introduce delay but also leak information about what servers people are connecting to. Dealing with that starts looking a lot more complicated (bloom filters per CA of recently-revoked cert IDs?) needing to be implemented into multiple libraries and the failure mode is an outage unless you fail open.