iOS devices must be activated to use them. This is indeed stored in a database. AppleCare and third-party repair centers can query activation information using GSX.
You are correct about pre-T1 Intel Macs though. Apple will have a blind spot by design, until support is dropped for old machines.
I think the pitch here is “Semi-managed WireGuard peer provisioning and NAT punching as a service” usable by anyone who may not otherwise have a clue how WireGuard works (eg. friends sharing access to a file/media server), within 5 minutes or less from download/login to “done”
How would that work? Connections are mainly peer-to-peer with Tailscale. An attack (I suppose pushing new key pairs to specific peers and pointing them through a malicious endpoint?) would likely require a very noisy and detectable process.
1. You’re allowed to use IDFA. But users will now have to allow access, as a permission dialog will pop up first.
2. The IDFA is just a simple static UUID. It cannot do a very good job at preventing fraud. There is no way to validate anything about it or affirm that it ties to a genuine device.
My understanding is that they are going to simply show a consent dialog before allowing an app to access the IDFA, similar to what they have done for years to access other sensitive data like Contacts, Location, etc.