Hacker News Reader

Comment by colejohnson66 | Hacker News Reader

Someone has to give you the revocation list, and consumers generally aren’t smart enough to know even what a revocation list is. On Windows, it’s Microsoft. On macOS, it’s Apple.

View on HN

Apple's revocation policy gives you no control over the revocation–you ask them to revoke things for you by contacting them, and then they decide whether this seems like a valid request, then they grant it for you. This is not how revocation usually works, so if so, why is Apple not vetting requests when they are placing themselves into the process?

That's the same way a CA works (except with a bit of automation instead of emailing someone).

I go to the CA that issued my cert and say "I'd like to revoke this" (whether that is an API call or an email), they then publish the cert into their certificate revocation list.

Now, Apple could deny a request, but they are under no obligation to do so, and I would argue that they shouldn't be making those judgement calls.

As they did here, they get the email, they then publish the CRL, and wash their hands off it.

But that is exactly what they claim they are there to do. They should either just accept any request, or do a good job at denying incorrect revocations.

Where do they claim to do that? Maybe there is no API for it because it happens so rarely that letting the Apple Security team push a few buttons is more cost effective.

Reply on news.ycombinator.com