This is some of the most awful writing I've seen on the HN front page in a while. I'm sure if you're well-versed in the issues surrounding revocation the discussion makes a great deal of sense.

For the rest of us, it's a forrest of technical jargon, which is stunning to me given that the concepts at play here aren't insanely complicated.

>So I think the claim is that doing blocking OCSP lookups is a good idea because, if you use CAPI on Windows, then you might cache 50 OCSP responses for a given CA certificate. Then you'll download and cache a CRL for a while and then, depending on whether the CA splits their CRLs, you might have some revocations cached for a site that you visit.