Setting OCSP checking to best attempt doesn't really solve anything because, if you're assuming that an attacker is MITMing your HTTPS connection, it's not too much more to assume that they can intercept your OCSP checks too.
On the other hand, setting strict checking means that large parts of the web become unusable when a major OCSP server goes down and that would immediately make them juicy DDoS targets.
IIRC, another drawback of enabling this is that you reveal your browser history. On mobile device right now so not easy to find article to cite but should be avail via a quick search
And of course after enabling this for Safari the Mac App Store starts to hang on startup in Certificate check code path. :(
I recently enabled "Logout after idle for [ ] min" setting to be more secure on OSX and LoginWindow just hangs if I leave the laptop idle and let it go to sleep.
Looks like Apple only tests for default and common settings.
I enabled it as well. App store doesn't hang, but is much slower: downloading an app normally starts after 1 second, with the fix enabled it takes 8s to even start.
LoginWindow sleep worked fine when logging off and pressing the sleep button. Didn't have time to properly test your case.
The big question for me is: How do people with iPhone and iPads enable this? The test in the article yields "not trusted" instead of revoked...
Funny that Apple has revoking turned on for App certs, but not for SSL. Guess they value their platform higher than user data...
I have been filing bugs at that URL since some time but they invariably go nowhere - no updates for years, bugs aren't fixed most times. So kind of kills my incentive. And no, anyone can report bugs using that URL - no need to be a registered developer, at least not yet.
Brings the incentive back: if Apple doesn't fix things, there is still a public record of the open bug.
Prevents people from wasting time writing up the same bug over+over.
Also increases the likelihood of getting fixed: if somebody else sees your open bug at openradar, they can file a second bug at Apple. Apple detects that they're duplicates, which "votes up" your bug.
http://www.imperialviolet.org/2011/03/18/revocation.html
On the other hand, setting strict checking means that large parts of the web become unusable when a major OCSP server goes down and that would immediately make them juicy DDoS targets.