Google to strip Chrome of standard SSL revocation checking

Re:Google to strip Chrome of standard SSL revocation checking by drblue on Tuesday February 07, 2012 @12:00AM (#3560520)

Edit: Maybe wrong? see reply.

If I'm reading the sample implementation[0] correctly, the update mechanism isn't Omaha[1] (aka Google Update), but the CRX extension update mechanism[2] that keeps extensions and app bundles up to date.

[0]: https://github.com/agl/crlset-tools/blob/master/crlset.go [1]: http://code.google.com/p/omaha/ [2]: http://code.google.com/chrome/extensions/autoupdate.html

[ Parent | on HN ]

Re:Google to strip Chrome of standard SSL revocation checking by agl on Tuesday February 07, 2012 @06:52AM (#3561392)

Omaha is a service which we ask questions like: "I've got version $x of $foo, what should I do?". We use it for extensions as well as the main browser update.

The CRLSet is packaged as an extension (it's actually a .crx), but with a custom install callback that delta updates the current version.

[ Parent | on HN ]

Re:Google to strip Chrome of standard SSL revocation checking by groby_b on Tuesday February 07, 2012 @12:29AM (#3560582)

Uh, [0] explicitly refers to Omaha all over the place?

See e.g. this comment: // update and the related structures are used for parsing the XML response from Omaha. The response looks like:

[ Parent | on HN ]