The other option is that Microsoft could acknowledge reality - they are not fixing things fast enough to resist targeted attacks. MS's statement about it "not being seen in the wild" demonstrates that they don't understand the current state of exploits. Google's hypothetical attacker is one who will go to lengths to keep an exploit from being used specifically so that MS won't fix it. Also a monthly schedule for updates is a huge liability against such an attacker, as they know their window of opportunity. MS is stuck in the old model that an exploit is not important unless it has been seen in the wild. While that is all well and good for preventing worms from spreading (and therefore protecting MS's image) it is not good enough to protect your company's data from a targeted attack that can buy or discover a zero-day vulnerability. That is reality.
Another way to look at it is that people using MS stuff have chosen interoperability over security. Thus the longer patch testing cycle, and the once-a-month updates. Therefore they shouldn't be surprised when it is demonstrated that... they chose interoperability over security.
You seem to have missed the fact that even with the early google search, they used javascript tricks to send every click on a link back to google. That is pretty darn close to spying, since it was not obvious that they were doing this. You don't seem to have noticed that you were being spied on.
So the model for search as well as for gmail was the user trading their privacy for a service. Thus "built on the concept of invading privacy". I think this is a much more even trade on the search side - I'm not averse to reporting to google which of their search results I looked at for a given query before I left the page. That provides better search. But I think one can make an argument that even offering a service in which you are scanning the user's email to market things to them is inherently evil. If you found out your IT staff at a company was just trolling through email for anything you would fire them in a second. Then it just went downhill from there. Though Big Brother Facebook beat Big Brother Google in the race to the bottom.
The fact is that the vendor you purchased your device from (Verizon) actively discourages third-party updates is between you and them. In most cases you cat jailbreak your device and install cyanogenmod, which is pretty similar to what you describe. The status of vendor-supplied updates has been discussed since the inception of Android. Google has mostly made the situation better compared to before Android, since updates for many devices are now controlled by the hardware vendor instead of the network provider. When you purchased your device, you chose to get something from a vendor (Verizon) who is well-known to be hostile to its customers. Don't complain that google didn't save your bacon. You could have bought a Google nexus 7, which is still getting updates, though the latest makes the old ones too slow to use. (In fact they did save your bacon, because you could just root your device to install cyanogenmod. Except that it appears that verizon patched the hole that was being used to root it! Wow that's hostile.)
In the case of Windows, you probably purchased your machine from someone like Dell (not comcast, which would be the closest analog of Verizon in the PC world) and it at least purported to have software from a separate vendor, Microsoft. Verizon, by locking the bootloader, actively prevents you from using system software from another vendor.
I think typically each file would be encrypted with a separate symmetric key. Then you can choose who is able to decrypt it by sticking a header with this key encrypted for various public/private key pairs. Then all you have to do is remove one of the encrypted keys, not re-upload the whole file.
As far as I know asymmetric encryption is never used the way you say in practice. It is too slow. It is used to encrypt a key for a symmetric cipher that is then used to encrypt the actual data. And that "combining your private key and their public key" statement is nonsense. Your private key is useless for securing information originating from you, since your public key is, well, public. It is useful for authenticating that information came from you, which is independent of recipient.
This is all setting aside the fact that once a party has access to some data, "revoking" that access has a sortof squishy meaning because they can just keep a copy of what they retrieved before.
I would expect removing them would be to prevent anyone else being a victim. Rather than marking every page with him on it with a "warning this former faculty was found to have sexually harassed students," the prudent course of action is to shut it all down and sort things out later. While Lewin is no longer active in the courses, they are still active courses and a student might approach him if they didn't know about the issue. There are plenty of other physics faculty at MIT that can fill in the content.
I have been happily using Friendica for a family network for a while. While quirky, it works, and has a bunch of stuff for interoperating with other sites including facebook and even using RSS feeds. In terms of privacy, development has moved on to redmatrix. The problem being that going to a truly privacy-oriented framework means interoperability is out.
But really it seems like the protocol and the software need to be separated so that different social networking software can interoperate. There is already some of this in friendica for protocols like identi.ca and others. Nominally redmatrix is still largely just a protocol: Zot, but the user interface is progressing.
Sad that neither of these are on this guy's list. I think the wikipedia page on open social networking services is more informative than this article.
The moon is made of green cheese. -- John Heywood