This server, maintained by Internet carrier Cogent Communications

Found the problem!

For encryption, the client and server need to share their private keys.

This is incorrect, for asymmetric (public-private) encryption. You never, ever share the private key, hence the name.

The private key is only used on your system for local decryption (someone sent a message encrypted with your public key) or for digital signature (you sign a document with your private key, which can be validated by anyone with your public key).

For the server, they are signing their handshake request with a certificate issued by a known certificate authority (aka, CA, a trusted third party). This prevents a man-in-the-middle attack, as long as you trust the CA.

The current gap is in inconsistent implementation of Organization Validation/Extended Validation (OV/EV), where an issuer will first validate that domains are legitimate for a registered business. This is to help prevent phishing domains, who will be operating with TLS, but on a near-name match domain (www.app1e.com or www.apple.zip instead of www.apple.com). Even this isn’t perfect, as business names are typically only unique within the country/province/state that issues the business license, or needed to be enforced by trademark, so at the end of the day, you still need to put some trust in the CA.

For your last two questions, the counterpoint is, if even Microsoft can’t stop a dedicated nation state, how can any other major service provider say they haven’t been compromised?

The standard now is, assume breach. While unfortunate, the industry average for MTTD is in months. Microsoft was at least good enough to detect it within six.

Can Broadcom or Palo Alto say the same? Amazon, Google, Apple, Cisco?

Isn’t there a filter set for this in uBlock already? Annoyances filter?

While true, it’s pretty asinine to hold companies operating in China accountable for complying with Chinese law. It sucks, but they aren’t just going to abandon the Chinese ~cash cow~ market.

Link to source article. The linked article steals the text and images verbatim.

https://www.bleepingcomputer.com/news/google/google-now-blocks-spoofed-emails-for-better-phishing-protection/

BlackRock, for one, which shouldn’t make you feel any better.

Or, the real sign of gentrification is that the Google Maps car drives by your neighborhood more than once every five years. Guarantee that’s not happening in the projects.

Not cheaper. More likely there is budget available for National Guard resources and things like anti-terror, disaster relief, etc., as opposed to next to nothing for infrastructure improvements and staffing.

It happens because consumers insist on buying and eating processed shit like this decade after decade. In what world were Cheerios considered a healthy option?

This. They clearly overextended due to the boom in streaming during the pandemic, and are now reacting to the contraction in content consumption both here, and on YouTube.

Why are you running a VPN? If you are simply shielding your internet activity from your ISP, Google won’t give a shit where you sign in from.

If you are browsing to shield your identity, you want to be fully disassociated with any non-secure browsing habits. If this is your use case, even if you are using discrete internet accounts, tracking cookies are common enough that, you would still be identifiable from your browser fingerprint. It all depends on what your risk factors are, and how much you want to spend to mitigate them.