In case you weren't aware, the accuracy of "The Big Hack" (3rd citation) has been widely called into question. There has been no corroboration of their claims, despite a lot of interest in locating one of these compromised servers. While it raises an important point about the plausibility of supply chain compromises (see NSA and Cisco), the case in the article has not been shown to be a matter of fact.

The story earned two sarcastic Pwnie Awards from the security industry last year, "Most Epic Fail" and "Most Overhyped Bug".

https://pwnies.com/previous/2019/most-epic-fail

https://pwnies.com/previous/2019/most-over-hyped-bug/

> - While "10x less", iPhone still sends your private information (such as location) to Apple on a regular basis[1].

Apple documents cases where private information is used, even if it is never sent off device. macOS and iOS users would be familiar with the interstitial privacy screens that show up the first time you use a feature.

iOS has always shown an icon in the status bar when the location information is accessed and provides a log of recent accesses. Recent versions have been more aggressive of reminding you when location data is being shared.

The most common reason location data is sent to Apple is for navigation purposes; if you opt into Location Services, Apple uses your device location for traffic aggregation. You can turn this off at any time.

> new privacy-focused ad framework

App developers incorporate ad frameworks to monetize their apps. An advertiser pays for an ad, and the ad framework displays it in the app. If the user taps on an ad, the framework communicates this back to its servers to make sure the app developer gets credit.

Most ad frameworks try to slurp up as much information as possible about the user in order to tailor more ads to them. Apple's new SKAdNetwork API does not send user information back to the network, only the app identifier that is needed for paying the app developer.