I think again, that you are perhaps a bit too idealistic here.

The secret fisa courts run by handpicked judges mediating pushback against demands that someone or some company give up any data they have only apply to Americans.

So the fake made up process to keep the us government from performing bulk data collection on citizens only applies to citizens. Noncitizens have no similar protection under law, fake or otherwise.

Not to break out the rasp and put too fine a point on it: noncitizens have no protection under law, fake or otherwise.

We already know that us telecommunications infrastructure has hardware (not software, baseband level) backdoors built into it by design in order to facilitate spying. I can say this for a fact because it was a low key huge deal that the lawful intercept backdoor was compromised a year or two ago.

Anti communists like to scream about huawei telecom equipment being compromised by the evil ccp, but rarely make the factual statement that it is all designed with built in backdoors to meet the requirements of the nations who order it. All those nations also use telecom equipment backdoors just as much as American intelligence agencies do. When nations rip out Chinese made stuff and replace it with something from what passes for an ally at the moment they aren’t giving up their backdoors.

Just off the top of my head, and this post likely has some awkward phrasing I owe you an apology for because it is all off the dome, the English had to do a heavily redacted investigation into their own complicity with telecom spying that was done on British soil by Americans as part of the prism program with no us oversight to protect British citizens.

All that is to say: even if you live in a nation outside the five, nine, fifteen, ct, club du berne, special committee or any other intelligence sharing organization and your data never flows into American jurisdiction and you run some ideal operating system and service compliment that has no surface for interface with the authorities, you are not safe from the bulk collection of encrypted data under prism.

Which is what prism is. Bulk collection of encrypted data for processing at a later date.

The two possible ways to get safe about it are to be in and be accessing systems in the Russian federation or the prc. Neither is a good shield because China isn’t trying super hard to keep spooks out and the Russians are currently in the Treehouse Made from Old Pallets stage of their new Internet.

You cannot escape prism because it does not require access to your device and is not constrained by borders. I encourage you to investigate which Android systems can be hardened to the extent of ios. I have concluded after years of observation that it is graphene and only graphene.

Okay with that mega downer out of the way:

When I brought up the phenomenal amount of long running vulnerabilities in the kernel (which I hate other people pointing to because it doesn’t reflect the extent to which ai tooling has allowed much more extensive and expansive testing but coincides with a change in the maintainers policy around the cve system!) and the lz fiasco, I was hoping it would be clear that vulnerabilities and bugs often are backdoors and interference, we have recent examples of that as well as a historical record of explicit attempts to insert bugs and vulnerabilities as literal backdoors and interference and there is a frightening pattern present even in my own favorite distribution Debian that alludes to that process.

I said those things to illustrate that to the extent there is a community reading the source it’s either merely equivalent to the private software world, infiltrated by operatives or populated with useful idiots like the eos knucklehead who said graphenes security is for pedophiles.

That situation combined with the fact that there is no pretense of legal protection for a person running open source means that it’s a pretty hard sell for regular people to rely on code reading instead of recognizing that the control causes a change to happen.

Again my point is that you are making a wild, indefensible leap of reasoning and judgement when you say that the only way to tell if a control is doing something is to read the code.

I also maintain that you are mistaken about antivirus. Even if the third party program relies eitirely on the hooks within the defender subsystem and only provides recognizable warnings that don’t slide off the users frontal lobe like butter across a skillet that is safety.

You even admitted that antivirus could be “implementing real safeguards”.

There are terrible antivirus programs and some that are pretty good. The presence of data collection in a eula doesn’t mean it’s a bad program. People choose to use Facebook knowing that it’s a nightmare panopticon because they want what it’s providing.

I don’t think you’re arguing in bad faith or being oppositional, what it sounds like to me is that you believe in the ability to escape bulk surveillance of encrypted transmissions and that it’s possible for all users to aspire to understand what’s going on at all (or enough to make informed decisions!) times and therefore a method of securing oneself that doesn’t provide 100% protection from that spying or put all those controls in front of the user with as much granularity as possible doesn’t count.

To bring it all the way back to the start though, ios hardening is real.