10.5.7 MobileMe sync failure and Verisign

On an idle afternoon, I did whate very other sane computer user did: pushed update to upgrade my laptop to OS-X 10.5.7.  Peachy.  As per every other upgrade in the last 3 years, everything just worked as expected.  Except MobileMe sync'ing.  Grr...

Turns out Apple was sold a bill of goods from Verisign and in 10.5.7 Apple made the mistake of using Verisign's "Online Certificate Status Protocol" service. If I weren't using bfilter, I would've never noticed this bit of pseudo-evilness. Every time you sync with MobileMe, Verisign gets a series of connections to either evintl-ocsp.verisign.com or evsecure-ocsp.verisign.com. This is only an issue if you 1) don't want Verisign to know when you connect to MobileMe, or 2) you happen to use BFilter along with MobileMe, in which case you'll have noticed syncing suddenly stopped working.

There are two solutions: bypass bfilter and let Verisign receive these connections, or deadend requests to Verisign before bfilter has a chance to mangle the response. I'm including the /etc/hosts entry below (my preferred alternative). Add the following to /etc/hosts and you should be good to go:

127.0.0.1    evintl-ocsp.verisign.com
127.0.0.1    evsecure-ocsp.verisign.com

Eff Verisign.