Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Jeff read the headline in Craig's newsletter and assumed a digit had slipped. One password at one auto insurer — Assurance America — and seven million people's records left the building. Names. Driver's licenses. Insurance history. Social Security numbers.

That is the smaller of the two numbers this week. The other is roughly 220 million voter records, which makes it larger than Equifax. Craig walks through what a file that size is actually used for: not fabricated messages from an obvious source, but ads, search results and AI answers that arrive with an opinion already attached, aimed at people identified by town, by voting history, by reach.

He also makes a point about Social Security numbers issued at birth that is worth the segment on its own. Nobody looks at that number for sixteen years. Plenty of young adults are learning at their first job that it has been in use the entire time.

Also in this segment:

• Iran moving oil money through cryptocurrency — and why "anonymous" was never the right word for a public ledger
• The patch window: it used to run six months to a year between a flaw being found and being used. It now runs about a day.
• Windows Update covers Microsoft software, and not all of it. Adobe Reader is among the worst of what it leaves behind.

Craig previews Thursday's free session at 2 p.m.: which programs on your computer are not being patched, how to find them, and how to fix them.

Free newsletter and session signup: CraigPeterson.com

Microsoft Defender is the antivirus built into Windows, and it has a major flaw: if an attacker gets onto the machine, they can take complete control and everything on it. Microsoft shipped the fix alongside 569 others — a record 570 security flaws in a single release. Hundreds of millions of machines are affected.

Craig knows why people put updates off — they've been burned before and they're afraid of the blue screen of death. His answer: Microsoft fixed that. There is no more blue screen of death. It's a black screen of death now.

Then the story closer to home. Hampden voted against a municipal ban on data centers while New York considers a statewide moratorium. Craig separates the real concerns from the noise: power is legitimate, and studies do show electricity prices rise when a data center arrives. Water is real in Utah and not in Maine, where the water is cold — France had to shut nuclear plants and data centers in 105-degree heat because the water got too warm.

His preferred answer is the one some communities have already found: don't ban it, zone it, and make them bring their own power plus 20% back into the grid. Three new-design nuclear reactors went critical by the Fourth of July, and Microsoft has restarted Three Mile Island for its own data center.

Also in this segment:

• OpenAI's screen-free smart speaker with cameras and sensors, and why Apple is suing over it
• The hiring-interview trick at the root of that suit — bring in your hardware, show us what you're working on
• Johnny Ive's brooch, Meta's camera glasses, and a Levi Strauss jacket from years ago that was going the same direction
• Why therapists are alarmed that people are using AI for therapy, and Craig's line: these are not intelligent machines, but they are very good assistants

Free newsletter: CraigPeterson.com

A caller wanted to know why autonomous drones can't simply find and remove hostile commanders. Craig answers with what Ukraine and Russia have actually learned in the field: drones jammed by their own side and falling back onto their own troops with live explosives, a Russian autonomous drone that hunted down a Russian helicopter, and a mini-gun mounted to a truck bed with more torque than the truck could hold.

The recognition problem is the real one. Uniforms look alike. So do the Toyota pickups everybody uses. Machine learning is genuinely good at identifying equipment types and giving ground commanders real-time knowledge of where their people and munitions are — and it is nowhere near good enough to pick a person out and act on it alone.

Also in this segment:

• Iran's "jellyfish" drone formation — a wall of drones in the air, and what it may have done to a fighter jet's engines
• Windows Defender: a flaw in the antivirus built into every modern Windows machine that lets an attacker who is already on the box do anything they want. Microsoft has shipped the patch. Install it.
• Grok's newest release: hallucination rate roughly doubled, from about 25% to about 54% — wrong more than half the time, and sounding more confident than ever

Craig recaps the first Insider Session and previews the next.

Free newsletter and Insider Session announcements: CraigPeterson.com

Windows Defender ships with every modern Windows computer, and it has carried a serious flaw. An attacker who has already gotten onto the machine can use Defender itself — the thing that was supposed to stop them — to do whatever they want. Microsoft has released the fix. Craig's message this week is short: patch it.

That leads Jeff to the obvious question. Billions of dollars and thousands of brilliant people — why is it still like this? Craig's answer is a history lesson worth the segment. Windows and classic Mac OS started as toys and had security crowbarred in afterward. Unix was designed with it in mind, and the internet was built on Unix. Chromebooks run Linux. Macs run a FreeBSD lineage. And Microsoft's real constraint is compatibility: the same discipline that lets decades-old software keep running is what keeps the old architecture in place. Intel has the same problem.

Also in this segment:

• The MacBook Neo — Apple's first genuinely low-end laptop, and the clever part: it's built from iPhone chips that failed binning, with the bad cores switched off. Nothing wrong with the rest of them.
• Why the $500 price Craig quotes is $699 on Amazon by the end of the segment, and what the RAM shortage has to do with it
• Grok's new release hallucinating around 54% of the time, up from about 25% — and what folding everything into one company does to the downside
• The homework: get rid of programs you don't use and programs that stopped being updated. Those are the doors.

Free newsletter: CraigPeterson.com

A Maine candidate deleted his Reddit history before anyone went looking. People found it anyway. Craig explains the mechanism most people have never heard of: Reddit and Facebook both ran a firehose feed, selling everything posted the moment it was posted to anyone who could pay. Deleting your account doesn't reach those copies. They were never yours.

Matt raises Europe's right to be forgotten. Craig's answer is that it doesn't really work — and what Google actually does is remove an item from its index so it stops being easy to find, while the page itself stays exactly where it was.

He makes it concrete with his own site: decades of history, crawled by AI and search engines multiple times per hour. And a detail worth sitting with — part of why hard disk prices have climbed is that these companies are storing all of it long term. The NSA drove disk prices up on its own.

Then the week's larger story. A run of studies over six to eight weeks says AI is not the win businesses expected. Microsoft, Amazon and Google have all pulled back their own initiatives. One Fortune 50 company gave employees access and spent half a billion dollars on tokens in a single month before pulling it. Craig returns to the 80% figure — most companies found it made things worse for employees, not better.

Matt pushes back usefully: isn't this an overcorrection? It's obviously useful, people are doing things they could never do before. Craig agrees it settles, and adds the structural problem — you now need petabytes of data and a nuclear reactor's worth of electricity to compete, so this becomes a game for 800-pound gorillas. China's approach is to train its models on U.S. models.

Also in this segment: what the forensic examination of everyone running for office does to a generation that grew up online, and where each of us draws the line on what we did when we were young.

Free newsletter and Insider Sessions: CraigPeterson.com

Three new-design nuclear reactors went critical ahead of the Fourth of July, one of them housed under a positive-pressure tent instead of a containment dome. Craig explains why that isn't as alarming as it sounds, what changed on the regulatory side to make it possible, and why cheaper electricity is the precondition for nearly everything else people want from technology.

Then the reactor you might one day own: a European design meant to sit at a house, using lead as its heat-transfer medium. Lead boils above 3,000 degrees where water boils at 212 — so a leak doesn't go anywhere, it just solidifies. Craig covers the salt-cooled designs moving in the same direction.

Also in this segment:

• The rule of 20 for air conditioning — why setting the thermostat lower doesn't get you colder, it just runs the compressor harder
• Craig on leaving Canada as a teenager with $20 and eighteen months on a friend's concrete slab
• Canada Day, Dominion Day, and the loyalist title still held in perpetuity by descendants

Craig previews Thursday's free Insider Session: the 40 to 60 programs on a typical computer that receive no automatic patches, and the single most-exploited piece of software on that list right now.

Free newsletter and Insider Session announcements: CraigPeterson.com

Six months ago the forecast was that AI would take half of all jobs. What actually happened is that companies which laid off thousands are hiring them back, and the measured result of handing employees an AI is that 80% of the time it creates more work rather than less.

Craig's explanation is that AI needs a babysitter, and the babysitter has to know what they're doing. Which sets up the real problem: the jobs it *is* displacing are entry-level — so if nobody learns the detailed work, who is left to supervise it in ten years?

He also covers the week's shift. Anthropic pulled its most capable model. OpenAI announced a competitive one, likely headed for the same restriction. China announced one too. Craig's position as a defender is blunt: he has trained thousands of government IT personnel, and he can't get the tools he needs to defend against nation-state attackers who already have them.

Matt asks the obvious follow-up — is this a regulatory problem or does it sort itself out? Craig answers with the historical record: Russia, China's Great Firewall, and Iran, which discovered the only way to stop information spreading online was to shut the internet off entirely, taking every online business and vendor email with it. Nobody has successfully controlled the internet, because it was built by the DOD to route around damage.

Where he does think regulation fits: keeping these systems away from physical controls. An AI that turns on your lights is fine. An AI with access to a gas pipeline is not — that needs an air gap. Craig ran the FBI's InfraGard webinar series and notes the uncomfortable precedent: Iran air-gapped its centrifuges too.

Also in this segment: 250 years of American technological change, why electricity may be the bigger revolution, and the free Insider Sessions starting next week on the ~60 programs on your computer that never get patched.

Free newsletter and Insider Sessions: CraigPeterson.com

Anthropic built a model good enough at finding software flaws that the NSA's own red team couldn't keep it out — then pulled it from the market rather than police who could use it. This week OpenAI announced an equivalent. So did China.

Craig walks Jim through what that actually means for the person listening: if defenders lose access to the tools attackers already have, the gap doesn't close, it widens. He explains why the average computer is running roughly 60 programs Windows Update never touches, what a "zero day" really is, and why "patch your computer" stopped being useful advice the moment the timeline collapsed.

Also in this segment:

• The guardrails story — Anthropic's Fable release, how Amazon's researchers got around them, and the executive order that followed
• Why an export ban is close to unenforceable on software
• Craig's own start in security: the 1991 Morris worm that took down his email service business and three days to unravel
• The InfraGard critical-infrastructure training program Craig ran for the FBI
• Genealogy, the Daughters of the American Revolution, and a Norwegian family line traced back to the 8th century

Craig announces the launch of his free Insider Sessions — live walkthroughs of what is being actively exploited right now, how to tell whether it's on your machine, and what to do about it.

Free newsletter and Insider Session announcements: CraigPeterson.com

Anthropic shut down its most capable model rather than try to enforce who could use it. OpenAI now has one it says is just as good, likely headed for the same restriction. And China has one too.

Craig lays out the problem that creates for anyone whose job is defense. You cannot protect a network with tools a generation behind the people attacking it — and the people attacking American critical infrastructure are not amateurs. Craig ran the FBI's InfraGard webinar training program for two years, and he walks Jeff through how wide "critical infrastructure" actually reaches: pipelines and water and power, yes, and also law firms, because every business is somebody's supply chain.

He also explains the two things most people have never had put plainly:

• The 60-odd programs on an average computer that nobody is patching, because Windows Update only covers Microsoft
• What a zero-day actually is — and that Microsoft's average lag between knowing about a flaw and shipping the fix runs two weeks at minimum, often far longer

Craig announces the Insider Sessions starting next week: not "keep your software updated" hand-waving, but what is being exploited this week, how to check whether it's on your machine, and where to get the fix.

Also: Jeff's new AR-15, and the New Hampshire T-shirt that reads "no one needs an AR-15 — maybe two or three, but not just one."

Free newsletter: CraigPeterson.com

Anthropic handed its newest model to some of the country's top software companies and asked them to run it against their own code. It found serious security problems in every major piece it examined — not the click-this-link kind, but remote access: connecting to a machine that would normally reject you and taking full control.

That included OpenBSD, an operating system reviewed by hand hundreds of times and widely held to be the most carefully built in the world.

Then the NSA ran it against their own systems, red team against blue team. It broke into every one they tested.

Craig walks Matt through what followed: the guardrailed release, Amazon getting around the guardrails, the call to the President, the order restricting access to U.S. persons, and Anthropic pulling it entirely once it became clear that restriction couldn't be enforced. His read on what it means for the next month or two — patches arriving faster than anyone can track them, and no good way to know which of your programs are affected.

Then the second story: an executive order committing the U.S. to lead in quantum computing. Craig explains why that matters to anyone holding cryptocurrency — quantum machines can open a wallet in well under a second, and the encryption underneath Bitcoin was not built for it.

Also in this segment: Matt asks the question everyone with a lost 2012 wallet is thinking, and Craig's answer is that it has already happened. Plus Meta's move into prediction markets, and why Craig thinks Zuckerberg pulls it off — "if you're not growing, you're shrinking."

Free newsletter: CraigPeterson.com