Earlier quoted context omitted.
The thing is, your friendly scammer could also publish checksums on their website. It is clear to you that you're writing fine open source software, not malware. But how is the consumer supposed to tell? If people trust you, why bother with the checksums? (Over HTTPS, the downloaded content cannot be tampered with. If someone tampered with the content on your website, or performs a MITM, they can also replace the che…
The checksums are there if they happen to grab the binary in some way that is not "using HTTPS directly from my website" and they'd like to check. Why do the know I'm not writing malware? Trust in my software, mostly? It is unclear that notarization actually stops malware–Apple has failed to explain how it helps, but enforces it by decree.
1. You submit your app bundle and your credentials to Apple for notarization.
2. Apple records your information and goes through each library, framework, and your code, checking the code signing info and "fingerprint" of each for known malware.
3. Apple issues the ticket for stapling to the app bundle.
Now say, for example, that libffmpeg-0.1.2-beta2.dylib is found to mine cryptocurrency:
1. Apple goes through their database and finds the app where the malware was reported.
2. Apple marks that fingerprint as malicious.
3. Apple now flags any other apps that use libffmpeg-0.1.2-beta2.dylib (by checking the fingerprint) and disables any versions of any app running that version. Additionally, any other attempts to notarize apps with the malicious dylib are rejected.
Notarization provides 2 major benefits for devs that I can see:
1. Apple doesn't need to revoke your entire certificate just to block one version of an app.
2. Apple's audit trail of who notarized the app (and from where) prevents cases where stolen credentials result in a DoS of the victim (e.g. your account being locked, your name and address permabanned, and funds frozen).