It used to be you could trust your software—even most closed source—because only bad guys wanted to exfiltrate data from your system. The simple advice of “never run an unknown executable” was an effective security practice.

Now, the incentives of software vendors—even open source—have changed to include data exhilaration en masse. Off the top of my head:

* Games that scan and upload the file hierarchy of your system.

* Software sync packages that casually provide third parties for research (Dropbox).

* Keyloggers embedded in the default operating system (web search in windows start; Ubuntu web search; Siri web search.

* Pervasive practice of running untrusted code with JavaScript and the seemingly inexorable march of granting web pages greater system access. Copy something to your clipboard, open a web page, and it can grab it, along with so much more.

* The push toward ever greater “telemetry”.

* Automatic background file uploads, like Microsoft defender sample submission.

* Pervasive ingestion of our data by governments.

The greatest threat to our security has become the vendors and government—the very entities whose job it is to protect us.