"the way, to sign a piece of software, you
need to pay an extortive $100/year fee to Apple"
This is the main reason I hate these notarization. And the worst thing is if you want to work on some software that require network extension, you can't even do it without paying apple $99 a year. There are workaround like turning off SIP, but it isn't recommended.
Deactivating SIP is not that dangerous if you know what you’re doing. All it does it give back write access to root to some parts of the system.
Obviously, for the commoners, it is definitely not recommended, especially since they usually run random commands from stochastic engines w/o supervision… oh…… engineers do that too now? how in the hell???
> Deactivating SIP is not that dangerous if you know what you’re doing. All it does it give back write access to root to some parts of the system.
To be fair, given the increasingly sneaky cyber attacks these days, the more layers of security between you and root access the better IMHO. Turning off SIP in today's environment is a bit nuts as it is a genuinely sensible security layer.
It’s much easier to insert persistent malware when you can modify the operating system. I remember Windows viruses that would disable windows update. Very annoying!
If you're going to insist on being one of those hardcore "I must be root" people then there's nothing I can say that will satisfy your urge. The same if you are one of those permanent Apple bashers.
However, for the benefit of more sensible people, I will point out:
1. I used the terminology "layered security" twice in my post above
2. By definition if you have a blind hatred of Apple SIP, you must also have a hatred of SELinux or AppArmor or dm-verity or kernel lockdown mode on Linux.
I'm a huge proponent of SELinux, you as the user are totally in control of it. The thing I disagree with philosophically is putting barriers between or outright locking the user out of root. Software running on the system is fine to be locked in various jails but the user shouldn't be.
Community approach basically failed in building a "web of trust" with all the PGP/GPG signing parties: both tools were tricky to use, integrating PGP/GPG signing into common tools (like email, word processors, web, but also version control systems like CVS, SVN, bzr, git...) was always lackluster.
LetsEncrypt is a surprising success, but it's still a centralized system running as a non-profit — which means that it's always at risk of not being funded and/or to be under influence of big sponsors. It also came too late, app stores were already centralized.
Obviously, enterprises prefer to be the one to gate the access, so with a situation as it was, they jumped on the opportunity.
Apple won't even let you pay the fee in some cases. I've been fighting with them trying to figure out why they won't accept my ID verification since March. They keep saying my devices are linked to another Apple Account, but I purchased them all directly from the Apple Store and none of them have ever touched another account, so what the fuck.
You could try returning them, if apple say they were tampered with before you got them then apple will either have to accept the return or say apple are lying.
Apple says that some device linked to my Apple Account is associated with some other Apple Account already in the Apple Developer Program. They give generic advice like "try removing linked devices and linked phone numbers that are not yours" and "try asking the owner of any other Apple Accounts to unlink your devices". Because of the lawyerish nature of their wording, there is no way to prove they are actually talking about my particular devices or my particular phone numbers, or which ones they are talking about, or what other Apple Accounts they may be talking about, or what types of association they may be talking about. So there is no way to call them out on anything because they haven't actually said anything.
There aren't any devices or phone numbers on my Apple Account that aren't mine, and I have literally no fucking clue who could possibly have my devices or phone numbers linked to their account, given that the devices are my own devices, each purchased in-person at an Apple Store, that I've never even let anybody else hold, let alone link to a different Apple Account, and the phone number is one I've owned for probably close to a decade at this point. I'm at a complete loss.
I almost wonder if tech support failures could be posted on prediction markets like Polymarket or Kalshi, so maybe you could bet $10 against them resolving the issue by such and such date. That way a lot of people could make money on their inadequacy to bring embarrassment to companies having incomplete disputes, and it's worth losing your $10 to get the matter resolved.
This is the main reason I hate these notarization. And the worst thing is if you want to work on some software that require network extension, you can't even do it without paying apple $99 a year. There are workaround like turning off SIP, but it isn't recommended.