> This is because you have full control over your computer. You can decide what to do with it<p>"A little knowledge does much harm" as the saying goes.<p>You can decide what to do with it including screw up your security. End users, especially power users make the most risky decisions because of over confidence. How do you know I am not accidentally exposing NFS unsecured to the internet or exposing my pc to the internet but forgetting I have elastic search listening in all IPs, install random packages without checking and haven't updated my browser this year? Maybe I do everything right but don't have off-device backups, availability is also a security property.<p>I am not saying the cloud is better, I am saying the cloud is better depending on the threats you reasonably anticipate. Let's take emails as a common example, everyone and their mother use the cloud (that's where webmail lives), you trust your email provider be it gmail, proton or aol.com to not only access your private information but more or less take over most accounts and do a lot of serious damage to your life. Now if you trust google with gmail, why would you not trust them with gcp? Again, I am not pro-cloud, I am just laying out the concept of having a threat model.<p>Can you reasonably expect some threat actor to target or opportunistically compromise a security property you value with respect to spcific information? Is it more cost prohibitive for that threat actor to acheive their goals in a cloud VM or on your laptop?<p>Let's say your threat actor is someone you live with or someone that could harm you physically, that is different than someone doing a perimeter attack which is also different than someone targeting you with exploits and social engineering lures without even bringing up their specific capabilities.<p>In general, if you are hiding from the government of the cloud provider or you have reason to distrust the employees of the cloud provider (be it intent or competence) your PC might indeed be more secure. But realistically and objectively, a cloud provider will have better security both from defaults and monitoring perspective.<p>I use to share OPs sentiment but I repeated the terms "reasonably" and "reason" because the more I learned the more I realized how suspicion,intuition and hypotheticals are not enough to measure risk. You need a a vulnerabilty and exposure and you need motives and incentives for humans that will gain from exploiting them.<p>Yes, the NSA can hack my ec2 using a bunch of 0days but what they have to gain as a result if that is not worth burning a 0day or even the time and effort of a paid human. Even for bored kids showing off it isn't valuable (interesting) enough.