>And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target. This seems like a threat model swap in

>And if I was an intelligence agency trying place spies, Cloudflare would be among the first tech companies I'd target. This seems like a threat model swap in the conversation. The subject threat model here is (1) defending against companies stealing and selling my data. You swapped in the threat of (2) state level agencies spying on you through these companies. The problem is that #2 seems to be an intractable problem. (but not so much because of an infiltrated DNS provider, more like cable taps and infiltrated hardware manufacturers) #1 seems to be a more solvable problem (albeit at increasing levels of complexity). When you bring #2 into the conversation, it defocuses on the solution to #1 and gets to a point where we all throw up our hands and admit helplessness and defeat. I see this happen often and I think every conversation should be clearly grounded in the threat model that is being addressed.