It is possible, with an http proxy / pihole to upgrade all of your local network connections to https when speaking to gs.apple.com.
My guess is that a change is coming, but the pieces aren't all in place yet.
Question about this article: At what point exactly during the update process does this happen?
As a workaround, could one do softwareupdate --download from Terminal, turn off your internet connection, and then do softwareupdate --install?
Remember TinyUmbrella and backing up your SHSH blobs so that you could downgrade to previous OSes? It's that same API.
Thanks. I see now that it's somewhat documented by Apple, except the plaintext aspect. So it seems that "Reduced Security" would be the workaround.
https://support.apple.com/guide/security/startup-disk-securi...
See:
Shoutout to the Asahi Linux team and Godspeed.
I was doubly surprised when they failed to follow through; it is unlike Apple to lie.
Note also that the link to my site in the first part of TFA is to the wrong article; the OCSP issue is related to app launches ("Your Computer Isn't Yours"), not the fact that each Mx macOS update phones home a) in plaintext and b) with hardware unique identifiers (your ARM's ECID) on every single OS update (this is TSS, not OCSP). This allows passive listeners to sniff your unencrypted HTTP TSS traffic that contains your system's unique ECID, and, via client IP geolocation, infer your travel/location history unless you remember to always update over a VPN.
Different types of bad plaintext phone home APIs. Apple uses at least 2: OCSP and TSS. :)