> I can tell you for certain that when I was connecting to my own website, there was no attacker trying to "steal my credit card."

Of course, no one can actually be certain of this, because any MITM could have injected anything they wanted into the website, including something asking for your credit card (which they would then steal). Plain http is commonly MITM'd to inject tracking and ads, even on an ISP you pay for with money, and has been for decades at this point.

Just because you own the website does not mean you get to choose the threat model your visitors have to operate under.

Or if you prefer the paper in video form: https://www.youtube.com/watch?v=M1si1y5lvkk

"the way, to sign a piece of software, you need to pay an extortive $100/year fee to Apple"

This is the main reason I hate these notarization. And the worst thing is if you want to work on some software that require network extension, you can't even do it without paying apple $99 a year. There are workaround like turning off SIP, but it isn't recommended.

I came here to say the same thing! I’m not sure I have the author’s vehemence, but I enjoyed the read.

Longest ‘paper’ I’ve read in ages, I’m slightly ashamed to admit.