The “actually scary stuff” is extremely important, should definitely worked on and improved. It’s important to advocate for that and educate the common user.

But in my opinion for the regular user, this is not an immediate problem.

They seem scarier. In reality it's not so clear what is the bigger threat. Many got a taste of this with COVID restrictions, but that is clearly tame to what would be possible with the information that was already gathered or if they had even more info about you.

> But in my opinion for the regular user, this is not an immediate problem.

At least not as obvious and many do not seem interested in privacy. Not sure if they are very afraid of being robbed, but it is a more tangible threat. One can only see what mass collection of sensitive information can lead to when looking at (relatively recent) history.* And it is as easy as ever to create lists of whatever needs to be erased by whoever can command this.

*: i.e. https://de.wikipedia.org/wiki/Rosa_Liste (can't find the English article on Wiki)

Even open-source require a level of trust, at least of the contributor ecosystem, because no one has time to read every line of code that makes up a modern operating system, let alone understand the implication of every line.

So are/were Microsoft, Yahoo!, Google, Facebook/Meta, YouTube, AOL and Skype. The Washington Post stated, after analysis 98% of PRISM production is/was based on Yahoo!, Google, and Microsoft. Not defending or apologising - merely stating fact. This is trotted out so often that it needs highlighting. Not trying to change your mind either - you do you. Just offering some balance to your opinion. I know that you are "holding a trillion dollar business accountable(tm)", but lets hold all these multi-billion dollar business accountable too.

> Apple put iCloud in Chinese government datacenters.

As does every company that has a market presence in China. iCloud is hosted in China and operated by GCBD. Effectively nothing to do with Apple and has little baring on iCloud. It's not private for local users, and that is bad. This does not mean that China legitimately has access to iCloud globally.

Oh, for sure. Microsoft is far-and-away one of the worst handlers of data, Yahoo and Google aren't much better either. This is a strawman though, and while it provides a nice bit of context around the rest of the status-quo for privacy, it doesn't absolve Apple of the fact that their security is half-theater, and the other half has convenient backdoors and workarounds for the involved parties. Given that the topic of this article is "Hardening MacOS" and not "Reviewing The Standards of Security in Big Tech", I chose to focus on Apple's particular issues, especially since the issues with those other companies are so well-documented on HN.

> It's not private for local users, and that is bad.

This is what I used that point to illustrate. Apple claims that privacy is a human right, yet apparently not all humans are created equal? It's a strange bit of hypocrisy, one they could easily avoid by refusing to negotiate with countries that take advantage of them.

The “petty threats” make up the large majority of risk for average users. Faaaar larger.

If your threat model includes worry about state level actors, Tails or QubesOS is the only thing I would recommend

The article does a fantastic job covering the fundamentals.

How do you build on that and take it further?

Is it even worthwhile or possible to have a reasonable chance of thwarting a state level actor?

All fantastic topics.