News for hackers. Stuff that matters.
Re:A New Life for Certificate Revocation Lists by agwa on Wednesday September 07, 2022 @06:45PM (#32758153)
J.C. has already answered for Firefox; for Apple's system (valid.apple.com), if there's a bloom filter hit, the client double checks via OCSP before failing the connection.

Source: a WWDC 2017 talk which unfortunately I can't find online anymore

Re:A New Life for Certificate Revocation Lists by tialaramex on Wednesday September 07, 2022 @07:27PM (#32758665)
A concern is: Does it fail closed? It's easy to imagine an Apple engineer finds this fails sometimes for crap-CA whose OCSP server is kinda-sorta maybe working, in Bremen at least, usually, although not on weekends, and they go "Oh, I can fix this, just ignore if it fails" and now we've got our old friend the "Seatbelt that snaps when you crash" back.

Mozilla's choice here avoids that problem coming up which means nobody needs to push back when it gets "solved" in this regressive way.

Re:A New Life for Certificate Revocation Lists by agwa on Wednesday September 07, 2022 @07:31PM (#32758725)
That is a very good question and I don't know the answer, but if you want to go source code spelunking, you can probably find the answer on https://opensource.apple.com/