Of course, no one can actually be certain of this, because any MITM could have injected anything they wanted into the website, including something asking for your credit card (which they would then steal). Plain http is commonly MITM'd to inject tracking and ads, even on an ISP you pay for with money, and has been for decades at this point.
Just because you own the website does not mean you get to choose the threat model your visitors have to operate under.
If you posted your credit card number to someone's blog over HTTPS, is that any more secure?
Blog operator Vs blog operator + network operator.
It's still not 100% secure.
This is the main reason I hate these notarization. And the worst thing is if you want to work on some software that require network extension, you can't even do it without paying apple $99 a year. There are workaround like turning off SIP, but it isn't recommended.
Obviously, for the commoners, it is definitely not recommended, especially since they usually run random commands from stochastic engines w/o supervision… oh…… engineers do that too now? how in the hell???
I’m out.
To be fair, given the increasingly sneaky cyber attacks these days, the more layers of security between you and root access the better IMHO. Turning off SIP in today's environment is a bit nuts as it is a genuinely sensible security layer.
However, for the benefit of more sensible people, I will point out:
1. I used the terminology "layered security" twice in my post above
2. By definition if you have a blind hatred of Apple SIP, you must also have a hatred of SELinux or AppArmor or dm-verity or kernel lockdown mode on Linux.I think we could say AppArmor is more akin to TCC on macOS, though AppArmor would be much more flexible.
LetsEncrypt is a surprising success, but it's still a centralized system running as a non-profit — which means that it's always at risk of not being funded and/or to be under influence of big sponsors. It also came too late, app stores were already centralized.
Obviously, enterprises prefer to be the one to gate the access, so with a situation as it was, they jumped on the opportunity.
There aren't any devices or phone numbers on my Apple Account that aren't mine, and I have literally no fucking clue who could possibly have my devices or phone numbers linked to their account, given that the devices are my own devices, each purchased in-person at an Apple Store, that I've never even let anybody else hold, let alone link to a different Apple Account, and the phone number is one I've owned for probably close to a decade at this point. I'm at a complete loss.
Longest ‘paper’ I’ve read in ages, I’m slightly ashamed to admit.