It all comes down to configuration/choice. Its not bad to have OSCP to improve security, but there should be a simple way to turn it off (without those /etc/hosts or similar hacks).
But I don't want to turn it off. I want to benefit from checking the revocation list without sending my data to Apple on every app start, even if I am vulnerable for a few hours, until my computer syncs the revocation list. I want a middle way, not an ON or OFF button.
It sends a hash of the certificate in use to Apple, which happens to be an Apple certificate that is used to sign many applications running on your system.
Mapping developer certificates to apps is trivial. If you’re launching a Guardian Project app, for example, it’s almost certainly Tor.
Given the presence of the NSA and their ability to send NSLs or FISA warrants, this information should not be hitting the Apple network. A CRL would have been a perfectly acceptable solution.
So it’s slightly less worse than sending the hash of the app. Still very bad. And as I said previously, depending on a network call to start any app is not ideal.