1546675 - Ship security settings JSON dumps on mobile?

Status: NEW

(Core :: Security: PSM, enhancement, P3)

Description

[Mathieu Leplatre [:leplatrem]]

In Bug 1512451 some comments were made about the size of the JSON dump for our mobile installer.

Basically we only ship OneCRL https://searchfox.org/mozilla-central/rev/ec489aa170b6486891cf3625717d6fa12bcd11c1/mobile/android/installer/package-manifest.in#98

Having this dump just reduces the amount of data to be downloaded during the first synchronization, and we're not obliged to ship it.

Shall we remove it?

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Well, it's a security trade-off. If we ship it with the installer, users are a bit safer because they have revocation information they wouldn't otherwise have (particularly since we don't fetch OCSP for non-EV certificates on mobile).