My point is that it is a lot of people's problem. Mine isn't the only company using large-scale, off-the-shelf, really-very-normal firewall and network safety equipment and software. Just because you work at a start up, doesn't mean most people do. Lots of us work at banks, financial institutions, insurance companies. These companies make a lot more money than the average start up, and are risk averse and care a lot about compliance. They house a lot of "dark matter" developers and technology professionals.

The whole way this debate is going irks me. It's like there is two camps: those who think all the world is smart phones being used by people way out in the desert and everyone else. There are lots and lots of devices that have high speed, low latency connections. The people that use those devices are people, too. We should not over optimize for the remote smart phone user over everyone else.

Enterprises can still have all this stuff that is supposedly so important to them, like network interception and "compliance". But they might have to upgrade their software, insist that their vendors implement standards correctly, or maybe change the way they do some things. As you point out, these companies make more money than anyone else. That means change shouldn't be a problem for them. But of course they would prefer to externalize their costs onto less-resourced companies and individuals. It's everyone else's job to make sure they can't get away with that.

The biggest users of MITM technologies are companies but there are probably quite a few individual users too --- I have a proxy for network-wide adblocking and page rewriting/filtering.

I encourage you to reach out to your elected representatives and let them know you are opposed to things like banking regulations that require corporations to capture all employee communications.

Am I missing something? Aren‘t you supposed to do this via end point protection these days? In the same way that big corps should deploy zero trust models.

But I get it. Security and Privacy is really only about ‚compliance‘ and legal protection for large corps.

Why would I need to do that? Banks can still intercept employee communication with QUIC: https://news.ycombinator.com/item?id=24712673