u/Moral-Relativity

Apparently if your CRLDP end point doesn't set max-age in the response header browsers may use a heuristic method to guesstimate how long to cache it, like (current date - last modified date) / 10. What this means practically is that if say your root CA CRL is refreshed once a year, if a client happens to download it at the wrong time, the browser will consider the cached file to be fresh even if current date is past the NextUpdate date set on the CRL (and remember Chromium browsers don't use CAPI2 to handle CRLs anymore).

So basically in addition to the intended RFC5280 mechanisms for determining when to refresh the cached CRL, it's also subject to browser-side rules on how long to cache files, since CRLs are handled like any other downloaded content under Chromium.

I see this all the time when service providers are notifying clients about certificate rotation on SSL end points. Yes by all means call out any change in root CA, as that's what clients should trust, but asking them to also trust the intermediate CA "just in case" really does more harm than good.

1. If you don't know how to configure your SSL end point to return the CA chain properly you probably should find another line of work.

2. Impressionable clients are gonna think it's always necessary to also trust intermediate CAs for bog-standard one-way SSL.

I know the outer shell isn’t usually cremated, but do families sometimes buy it instead of rent? If the former what happens to the shell after cremation?

I want to use the built-in browser to watch full screen videos from some sites that don’t have dedicated apps. The cursor however is always on the screen and never faded away due to inactivity. I’ve to manually move it to a corner and even then it pokes out.

This is with a brand new QN80F with fully updated software. On my LG TV it sensibly fades after a while.