> which mean a malicious client could circumvent rulesets we have in place Note that your HTTP certificate pinning is easily bypassed on both Android and iOS b

> which mean a malicious client could circumvent rulesets we have in place Note that your HTTP certificate pinning is easily bypassed on both Android and iOS by a determined actor. A malicious client will circumvent rulesets you have in place. If you do not validate client inputs, you will be exploited. Indeed, it doesn't really differ that much from DRM. It's an attempt by the author of the software to impose control over the user, preventing them from using the software how they see fit. If I've trusted my own root, and you've decided you wont trust anything on my root, I now need to take steps to disable the certificate validation routines completely on my device, in order to bypass your restrictions. I get that there are cases where it's extremely valuable (and in some cases, required by regulators) to enforce certificate pinning, e.g. mobile banking apps, but there are plenty of cases where it's just bullshit DRM (e.g. gym app that performs unauthenticated requests to an https endpoint to retrieve occupancy stats on each of the chain's gyms). In the latter case, all I wanted was to track how busy the gym was over time, so I could adjust my schedule to enable me to go when the gym was quiet. I couldn't be bothered to jailbreak my iphone and install nabla-c0d3/ssl-kill-switch2, so instead I quit my gym and switched to one that was less stupid.