I have heard many statements with regard to security, that are simply so odd and misinformed to me. Some say iPhones running iOS are the second most secure phones after Google Pixel phones running GrapheneOS. That couldn't be further from the truth. iPhones are literally there, at the rock bottom, among the phones absolutely unfit for security, together with most phones running stock Android. Some say Linux is the desktop OS with the worst security, way worse than MacOS, even worse than Windows. That couldn't be more wrong. The only desktop OS that is more secure than Linux is QubesOS, but Linux is also an excellent choice. If you pick Windows or MacOS, down you will go.
I don't know how this happened. Maybe people are blinded by all the details, all the security features that exists and all the security features that are missing, that people don't see the full picture. Or maybe it is just because I actually have a practical need for security, as a member of a heavily oppressed minority, that I have been forced to look at the full picture from the very beginning, out of necessity to avoid getting physically attacked, doxxed or wrongfully arrested. Either way, I feel like I need to write this writeup, to give my perspective to security, in a constructive manner, in the hope that people will realize my view of security and my threat model is also very much a valid one, and why I defend Linux so much, why I defended Pinephone, and why I wouldn't touch anything Apple, Google or Microsoft even with a stick.
15 years ago, I learned the concept of canaries. A canary is a song bird that in past times where used in coal mines. If toxic gas was mined into, the bird would be the first one to die, and it becoming quiet in the mine, no more bird song, would alert all the miners to evacuate. This concept of a canary was adapted by the security and privacy community. The idea was simple, point out someone who is using the same technology and setup as you, but that is likely to be the first one to fall if the security and privacy of the system would fail. I realized, the people who watch, download and spread child pornography on the web are our canaries. If the security in a system would fail, they are the first ones to disappear. Many would get arrested, the rest would flee in panic. Same with people who make or deal with illegal firearms and drugs, they come as a close second after the people who deal with child pornography, being the next to be arrested or flee. The idea was simple, on a forum, find two or three people you know are downloading and sharing child pornography, but that are relying on the same technology as you, and keep watching them every now and then to see if they are still there. If not, time to pack your things and leave.
Nothing of this was to endorse illegal activity in any way, certainly not with children as victims. The idea was simply that people who do serious illegal activity, especially with children as victims, are always targetted by law enforcement agencies as well as vigilanties to such an extent that they are the first that will end up in trouble if the security or privacy of the technology fails. And the idea was also that you wouldn't have to read any code or be any kind of expert in security; if they are there, the system is likely waaay good enough to protect you too.
It turns out though, that keeping an eye on people doing such activity is pretty hard without getting exposed to that activity yourself, at least to some extent. So it isn't a very practical way after all. After a few years I abandoned this method, and came up with my own. Let's instead pretend I am one of them. Let's pretend I have lots of child porn on my phone, on my computer, and on my external disks and USB sticks. Let's pretend that I am sharing child porn with the people I communicate with. Of course I don't actually have any illegal or unethical content on any device, that would very much go against everything I stand for, but I can for the purpose of evaluating the security pretend I do. Because now I can for real evaluate if the system I am using really is secure and private enough to protect me. With a pretty good margin too, since I would never actually do such things nor be that interesting of a target.
Now hopefully it is far more clear why iPhones are among the absolutely worst choices for security out there. There have been plenty of news articles about people who have gotten reported to the police, by Apple, over things that aren't even child porn but innocent child nudity they have had on their iPhones. Apple used to scan all data connected to their built-in iCloud service, in a way obviously hostile toward their users' security. Now hopefully it is also far more clear why Windows is way way worse than Linux. They also scan files on your device, and you cannot even reliably disable the scanning anymore. I heard people sharing child porn stopped using Windows after Windows 7, it was the last secure version of Windows. Suddenly Linux device, even Pinephone for that matter, does not really seem like such a bad choice anymore. Not F-Droid either. Because they don't scan, log or leak your activity or files, at the very least not intentionally. Open source software seem to have a very strong resistance towards becoming hostile to their users, they tend to stay friendly.
That doesn't mean we shouldn't improve security and privacy features. We absolutely should, but we have to stay aware of how to actually evaluate whether a system is secure, such as with the canary method I described here, and stop claiming heavily insecure systems are secure, just because they have bleeding edge security features, and stop bashing perfectly safe system, just because they don't even have a basic app sandbox.
In the end, what system is it that will actually protect you, or fail you. If you cannot even protect someone engaging in criminal activity, how would you protect whistleblowers like Edward Snowden? If you cannot even protect someone engaging in criminal activity, how are you supposed to protect us who belong to minorities that are followed and oppressed by half of the society.