JSjschanck·Sep 16, 2025
Actually, the story in this case is a bit more complicated than I initially thought: https://github.com/mozilla/crlite/issues/367.
In Not all browsers perform revocation checkingmozilla
crlite
Go2020–2025
mozilla / crlite
crlite
Compact certificate revocation lists for the WebPKI
4Distinct people
4Mentions
0Explicit recommenders
161GitHub stars
What to know before exploring
What it is
Compact certificate revocation lists for the WebPKI
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year4 dated mentions
Observed mentions: 2020-11-15 00:16:33 UTC to 2025-09-16 19:32:48 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
What Hacker News says
4 sourcesThe Github repo for the backend implementation is here: https://github.com/mozilla/crlite/
Notably, you can query CRLite from the CLI using https://github.com/mozilla/crlite/tree/main/rust-query-crlit... - like:
$ git clone https://github.com/mozilla/crlite.git
$ cd crlite/rust-query-crlite/
$ cargo run -- -vv --update prod https github.com
INFO - Loaded 21 CRLite filter(s), most recent was downloaded: 0 hours ago
DEBUG - Loaded certificate from github.com
DEBUG - Issuer DN: C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo ECC Domain Validation Secure Server CA
DEBUG - Subject DN: CN=github.com
DEBUG - Serial number: 00ab6686b5627be80596821330128649f5
DEBUG - Issuer SPKI hash: 6YBE8kK4d5J1qu1wEjyoKqzEIvyRY5HyM_NB2wKdcZo=
TRACE - 20250809-1-default.filter: Good
TRACE - 20250810-0-default.filter.delta: Good
TRACE - 2025
Read the rest
0810-1-default.filter.delta: Good
TRACE - 20250811-0-default.filter.delta: Good
TRACE - 20250811-1-default.filter.delta: Good
TRACE - 20250812-0-default.filter.delta: Good
TRACE - 20250812-1-default.filter.delta: Good
TRACE - 20250813-0-default.filter.delta: Good
TRACE - 20250813-1-default.filter.delta: Good
TRACE - 20250814-0-default.filter.delta: Good
TRACE - 20250814-1-default.filter.delta: Good
TRACE - 20250815-0-default.filter.delta: Good
TRACE - 20250815-1-default.filter.delta: Good
TRACE - 20250816-0-default.filter.delta: Good
TRACE - 20250816-1-default.filter.delta: Good
TRACE - 20250817-0-default.filter.delta: Good
TRACE - 20250817-1-default.filter.delta: Good
TRACE - 20250818-0-default.filter.delta: Good
TRACE - 20250818-1-default.filter.delta: Good
TRACE - 20250819-0-default.filter.delta: Good
TRACE - 20250819-1-default.filter.delta: Good
INFO - github.com Good
Ahh thanks for the link and sorry for the snark; the finite universe optimization is cool! [0]
# Why is CRLite able to compress so much data?
Bloom filters are probabilistic data structures with an error rate due to data collisions. However, if you know the whole range of data that might be tested against the filter, you can compute all the false positives and build another layer to resolve those. Then you keep going until there are no more false positives. In practice, this happens in 25 to 30 layers, which results in substantial compression.
EDIT: Is there any risk of filter blow up (think 1000's of layers) if a CA did a mass revocation (maybe some root key leak)?
[0] https://github.com/mozilla/crlite/wiki#why-is-crlite-able-to...
In A New Life for Certificate Revocation ListsAs the set of certificates is bounded and known by apple, they can also adopt crlite and just push all CRLs they have to all users, using CRLite.
https://github.com/mozilla/crlite
In Does Apple really log every app you run? A technical look