One narrative I'm particularly tired of, is the "you shouldn't self-host anything, it's never going to be as secure as using something by Google/Microsoft/etc. who have entire security teams", especially coming from security people.

Like, aside from a completely unwarranted confidence in the security competence of those corporations (believe me, it ain't that amazing), and completely ignoring all the *very concrete* safety risks in using those services given who runs them and why... it's also just entirely unconstructive.

Okay, so maybe you think self-hosting is not secure enough. Why are you not spending your energy and skills helping to fix this problem, rather than going "oh well, guess nothing can be done"? *You are* one of the people directing all the expertise to corporate platforms!