There is a warning in the @Page directive regarding the EnableViewStateMac setting found here that states:
"Security Note This attribute should never be set to false in a production Web site."
This warning seems unconditional, regardless of the Page ViewState setting (true or false). Does this warning apply to @Pages that have EnableViewState set to false? If the warning does apply in this case, why, when ViewState is turned completely off for the page and its child controls, is this a concern?
Upgate: The warning seems to apply, being that some doofus could drop a control that uses Control State on to a page that has ViewState = false AND ViewStateMac = false.