[cgh]

For what it's worth, Apple has refuted this here: https://support.apple.com/en-us/HT202491

"We do not use data from these checks to learn what individual users are launching or running on their devices.

Notarization checks if the app contains known malware using an encrypted connection that is resilient to server failures.

These security checks have never included the user’s Apple ID or the identity of their device. To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.

In addition, over the the next year we will introduce several changes to our security checks:

A new encrypted protocol for Developer ID certificate revocation checks

Strong protections against server failure

A new preference for users to opt out of these security protections"

[dylan604]

>Notarization checks if the app contains known malware using an encrypted connection that is resilient to server failures.

Hmm, was that statement released before or after their servers failed?

[Dylan16807]

"we promise not to store your personal data (from now on)" and "we never used the data" are extremely weak refutations.

[titzer]

I'm with Stallman on this one. Without access to the source code of their entire server stack, there really is no way to be sure of what they are or are not doing.

[orf]

Even with it there is no way to be sure of what they are or are not doing. Trust in an external endpoint is not improved by some theoretical source code dump on GitHub.