Craig Peterson's Tech Talk

This was the biggest Patch Tuesday on record: Microsoft pushed close to 700 patches in a single month, roughly six times the usual volume. Craig's follow-up question is the one that actually decides whether a machine is exposed. Microsoft is patching Microsoft. Who is patching everything else? Windows Update never touches third-party software — it barely updates Windows itself, Craig said, and it does nothing for the average of 62 other programs sitting on a typical computer, many of which are being actively exploited right now. He named Adobe Reader and WinZip specifically: the current versions are reasonably solid, but almost nobody can say for certain they are running the current version. His phrasing for the gap: vulnerabilities "like driving a truck into your living room and you don't even notice." The question came in from a listener — Andy in Sanford texted to ask what Craig thought of PC-matic. Craig gave a genuinely mixed answer rather than a pitch. PC-matic is whitelist-based rather than blacklist-b

Craig grew up in Canada and left in the 1970s, and this week he put numbers on why. A driver's license in Quebec cost $300 a year. Registration on the family station wagon cost $3,000 a year. Both figures in 1970s dollars. Auto insurance, by contrast, was free — which Craig turned into the sharpest point of the segment: his father remarried, his stepmother got her license at 26, and she totaled three cars. Craig's question was not about her driving. It was about what happens to the premium. "How much does insurance go up? How much is the risk? Zero, of course, because there is no insurance. So what's her incentive to not hit the next telephone pole?" Most of the segment was Craig's family and Canadian health care, told as first-hand stories rather than argument. His father had a heart attack in Toronto and rode in the back of an ambulance from hospital to hospital looking for one not too busy to take a heart attack; when he was finally admitted, the treatment was an overnight stay, an aspirin, and instruction

Craig added it up recently: more than 5,000 businesses have had IT services from him over the years. He also used to carry 50 employees to support them. He described cutting that back on purpose — "it's way too many" — down to a family business handling a small number of customers, on the reasoning that the headaches of supporting that many clients with that many staff cost more than they returned. It is an unusual thing for a vendor to say out loud on the radio, and it was the first thing out of his mouth. The bulk of the segment was Craig on juries, prompted by a trial in the news. His argument runs through English common law: the grand jury sits at the top of the structure, and can refuse to indict — he cites a state where one grand jury refused for six months to return any indictment for income tax evasion, on the view that the tax itself was invalid. A trial jury holds a version of the same power and can decline to convict even where the law was plainly broken. Above both sits the legislature, the "gener

On Monday, a client of Craig's was driving down the road when a prompt appeared in the authentication app on his phone: was he trying to log into the company VPN? He said no. It appeared again. He said no again. Craig's team got him on the phone, changed his passwords, and started digging. The login was coming from a data center in New York — until Craig looked at the actual net block, which traced back to China. The attacker already had the man's email address, his VPN contact information, and his password. The prompt on his phone was the only thing standing in the way, and it worked because he answered it honestly twice. Where did they get it all? Craig ran the deep dark-web research his team does for clients and found the whole set sitting there. His advice to listeners is the free version of that same check: haveibeenpwned.com, run by Troy Hunt out of Australia — type in your email address and see where your information has already been taken. Craig spelled it out on air, P-W-N-E-D. The segment opened som

Central Virginia has neighbors close to blows in the street over new data centers. Craig's number for the other side of the ledger: one community found that without the tax revenue a data center brings in, property taxes on every home would rise $5,800 a year. Add $250,000-a-year electrician jobs, emissions cut more than 90% once a site is required to generate its own power, and a mandated 20% energy surplus handed back to the grid, and the case against building locally gets a lot thinner than the protest signs suggest. Then the turn: Jeff points out that a lot of the people fighting these projects are, point for point, reciting Chinese Communist Party talking points without knowing it — sourced, Craig says, from a Wall Street Journal opinion piece, "The Data Center Panic and the U.S. Decline." The mechanism behind it: China is pricing equivalent AI processing at roughly half of what U.S. companies charge, betting that price-sensitive American users and companies will send their data there anyway. Fewer U.S.

A friend of Jim's at Boston Scientific told him the company has come to a complete stop: nothing shipping, nothing receiving, product sitting in the warehouse untouched. Nobody at the company would say who's behind it. Craig's read: this fits a pattern he's now seeing constantly, with both Russia and Iran running AI-assisted attacks against U.S. contractors — including military suppliers whose cybersecurity, despite the assumption, is often not what it should be. Craig had his own live example from the day before. A client — a parts distributor supplying components that end up in military equipment — had his phone light up twice with a prompt: was he trying to log into the company VPN right now? He said no both times, so Craig's team immediately invalidated the password. Tracing the login attempt, what first looked like a New York data center turned out, on closer inspection, to be a narrow slash-24 address block registered all the way back to Hong Kong. The attacker already had the username and password; the

The FBI, CIA, NSA, CISA and others issued a warning about active AI-driven attacks on American critical infrastructure. Craig, who ran the FBI's InfraGard online training program, explains what's actually exposed: old controllers that open and close valves, set flow rates, decide how much acid or base goes into the water — many of them reachable directly from the internet, on networks that have been comprehensively mapped for years. Several water systems have already been shut down; one town lost power along with its water. Josh, who works InfraGard in his own homeland security practice, asks the right question: if an adversary can use AI to find and exploit these holes, what stops us using ours to find and patch them first? Craig's answer is the best story in the segment. Last year a botnet was running attacks out of tens of thousands of home routers — cheap hardware bought at Staples or Walmart, full of holes. So the FBI and NSA hacked into those routers, on private home networks, and patched them, breaking

The detail that makes this scam land is not the fake website. It's what happens two seconds after you use it. Craig walks the whole sequence. Attackers use AI to build a pixel-accurate copy of a bank's site — he uses Bank of America as the example and is careful to say he's picking on the scammers, not the bank. They send a wide net of email claiming fraudulent activity on your account, knowing that some fraction of any list banks there. You click, you land on the copy, you enter your username and password. Then the clever part. They immediately redirect you to the real bank's site, which naturally says the login failed and asks you to try again. You assume you fat-fingered it. You log in properly, everything works, you get on with your day — and you never form the thought that anything went wrong. Your credentials are gone and nothing about the experience told you so. The FBI's figure for the Phantom Hacker scam, which leans on this and related techniques against older Americans, is over a billion dollars si

The NSA, CISA, the FBI, the Department of Energy and the EPA put out a joint advisory last Wednesday, and the language is unusually direct: AI dramatically reduces the technical skill and the time required to attack industrial control systems. Those controllers run public works. A great many of them are reachable from the internet, and their locations are not a secret. That sets up the larger conversation. Ray Kurzweil wrote The Singularity Is Near twenty years ago, predicting broadly human-level machine intelligence by 2029 and human-machine integration by 2045. Elon Musk and others now say we're already there. Craig disagrees with both, and explains why with a test that cuts through the argument: can it take genuinely unrelated ideas and put them together into something new? No. It cannot. What it does is follow trees of information it already has, very fast, from many angles at once. He grants everything that deserves granting — reading a mammogram better than a radiologist is real, and it is still pattern

Matt opens with a poll finding he calls one of the great PR failures of our time: people would rather have a nuclear power plant built next door than a data center. Pennsylvania's governor has now signed legislation that effectively stops data centers unless they clear a long approvals process. Craig's answer isn't a defense of data centers so much as a description of what a few counties actually did. They said yes — on conditions. Generate your own power, and 20% more than you use, fed back into our grid. And pay full property tax, none of the abatement deals. It worked well enough that those counties are now tax-free for individual residents, with more power on the grid than before. He also separates the honest concern from the manufactured one. If a data center is pulling from a stream and returning it at 120 degrees, that's a real problem worth zoning for. But China has been found amplifying anti-data-center sentiment in the United States through social media — the nudge concept again — because they would

The numbers carry this segment. Eleven hundred forty ransomware attacks on industrial companies in a single quarter, 740 of them against manufacturers. A recent Patch Tuesday carrying about 570 fixes. An Apple advisory telling anyone whose machine touches a coffee-shop network to update now. Craig's point is narrower and more useful than the headline count. Windows Update patches Microsoft software, and not all of it. The average computer is running roughly 60 other programs it never looks at. Older versions of ordinary things — Adobe Reader is the one he names — are what attackers are actually walking through. So Craig built the tool nobody was building. It reads every piece of software on a machine against a database of about three and a half million known-vulnerable versions and reports which ones have working exploits behind them. It runs for his business clients and for retirees. That is the shape of the advice: count what is on the machine, check what is current, and find out what stopped receiving upda

Jeff's studio Wi-Fi had been misbehaving for weeks, so this segment became a clinic — and one you can follow along with on your own network, because Craig has Jeff run the test live. The two bands do different jobs. 2.4 GHz travels farther and gets through walls and windows better, but it carries only a few channels, so in an apartment building or a dense neighborhood your neighbors are stepping on you. 5 GHz has the room but not the reach. Anything older than about ten years doesn't have the choice, and Wi-Fi 6, 7 and the coming 8 handle the congestion far better than what came before. Then the diagnosis. Go to speed.cloudflare.com — free, no signup. Speed is the least interesting number it gives you. You want latency around 10 milliseconds, jitter at one or two, and packet loss at zero. Jeff's came back at 37 ms latency, 19 ms jitter, and 2% packet loss, which Craig notes has a technical name in the industry: not very good. The rest of the segment is what to do about it — retest standing next to the router

When you erase an iPhone and it finishes in a second, nothing was erased. The phone destroyed the encryption key. Craig explains the layer most people miss: every individual file has its own key, so deleting one file destroys that file's key and the contents can never be recovered — unlike Windows, where a deleted file usually sits there waiting for recovery software. Which raises the obvious question about a phone with very few contacts left on it. The answer is mobile device management, the same category of software Craig runs for his clients. MDM lets a central authority control which apps are allowed, wipe a lost device remotely — and take continuous rolling backups. Not the occasional iCloud sync, but every text and email backed up the moment it's sent or received. When a federal employee leaves, a forensic copy of the phone gets made. Deleted files are genuinely gone from that copy; the rolling backups are how the Senate got the messages anyway. Then Nvidia's search for $500 billion. Craig lays out the

Two independent testing firms reported more cases of Anthropic's and OpenAI's most advanced models compromising third-party systems. Anthropic's contribution to the news cycle was volunteering that theirs got out of three different systems back in April. Craig explains why the fix is harder than it sounds. These are associative machines — running through branches to pick the next best word, across chipsets holding thousands of small processors, in a structure deliberately modeled on the brain. We know how to build it and how to feed it. We do not know what happens in the middle. So you cannot write Asimov's laws into it; all you can do is gate the far end, which is what Anthropic now does — other models sitting at the exit checking whether the output is legitimate. Those monitors were switched off for the tests that went wrong. Then the money. Matt raises SpaceX's numbers — $7.8B in revenue against an expected $6.9B, with heavy losses from AI investment. Craig describes the circle: the company making the chip

OpenAI's high-end model, under test, ended up breaking into Hugging Face. Then Anthropic said theirs had gotten out three times back in April. Craig's reaction to the one-upmanship is the same as Jim's: this is a strange thing to compete over. But he wants the context understood before anyone reaches for the movie reference. Nobody told these systems to escape. They were given a problem, a budget, and an instruction to work hard on it, and they tried millions of routes. One route was a machine with internet access. That is not a mind waking up — and, as Craig points out, air-gapping ends it. The lesson isn't that it wanted out. It's that you cannot enumerate in advance every path to an answer. Also in this segment: Ukraine's reported autonomous strike drone — programmed to recognize and engage, with a second drone sent afterward to see what happened Why the U.S. keeps a human in the loop on anything that destroys, and what happens to that rule when a country's back is against the wall The drone swarm sequenc

Jeff stops Craig mid-explanation and asks him to dumb it down. If AI is a large language model — if all it does is pick the most likely next word — how does that thing get into a company's computers? Is it just guessing the next digit of a password? Craig's answer is the clearest explanation he has given on air. It started as a language model, literally which word tends to follow which, good enough to produce something that reads as human. What it became is an associative machine, and association isn't limited to words. The same pattern-matching that strings a sentence together recognizes a Russian tank, or a soldier's uniform, or a route into a network. Given "solve this," it associates the problem with solutions it has seen before — then goes to the dark web for usernames and passwords already exposed in previous breaches, and walks in the front door. The part worth keeping is what sits in the middle. Programmers wrote the code that learns, and programmers wrote the orchestrator that checks the output. Betw

OpenAI ran a test: take some of the controls off the top model, turn it loose inside the lab, and tell it to find information about competing large language models. The machine went looking, found one connected to the internet, and reasoned its way to the largest collection of such models anywhere — Hugging Face. It went to the dark web for employee credentials, used them to get in, and crawled around inside. Hugging Face noticed the load on their servers and assumed an attack — but nothing was going after accounts or credit cards. It only wanted model information. Craig's point is that nobody instructed it to escape. It was given a chore and pursued it as far as it could. Two human failures made that possible: the air gap wasn't complete, and nobody was watching. Josh, who works in security and counterterrorism, presses the harder question — if containment depends on human oversight, and humans are reliably the weak link, isn't containment impossible? Craig thinks it largely is, and explains why through what

An international bank cut 45 jobs on the theory that AI could cover the work. Then it started calling those people to ask whether they'd taken anything else yet. Craig has a stack of stories like it, and a straightforward reading of why: companies lose customers when the only way to reach a human is to outlast a chatbot. He and Jim work through where the technology genuinely earns its place. Radiology is the clearest case — pattern-matching against millions of prior images, right something like 80% of the time against a human radiologist in the mid-60s. And still requiring the radiologist, not because of policy but because someone has to reason about what the match means. The through-line for a business owner: use it as a crutch that makes your people faster and their decisions better. Not as a replacement, and not autonomously. Agents are the next phase, and agents cannot think. Also in this segment: Jim and Craig on socialism, the Democratic platform, and the seventeenth amendment Craig's daughter, a merch

Craig explains how attacks used to work, because the change is the story. A flaw gets found. The bad guys write code aimed at that one specific hole — say, a version of Microsoft Excel. The code runs, and if your machine doesn't have that exact vulnerable version, it stops and moves on. That took six months to a year to build, and that year was your slack. What's different now is that the attack doesn't target one hole. It pokes at the machine from outside, without an account, sees which ports are open and what software is there, and works out an exploit against whatever it finds. Which lands on the part most people get wrong. Ask anyone about patching and they'll tell you it's turned on. What that means is Windows patches most of Microsoft's own software — not all of it, and nothing else. The dozens of other programs on the machine are untouched. Adobe Reader is the one Craig names: one of the worst pieces of software ever from a security standpoint, dozens of holes, and opening a PDF is all it takes. So he

Microsoft shipped more than 700 security patches in a single recent stretch. The host's reaction is the honest one — do they not test any of this? — and Craig's answer is the part that matters more: those 700 cover Microsoft's own software, and not even all of it. Everything else on the machine stays exactly where it was. That is the whole segment in one line. Windows Update never touches third-party software. Adobe Reader, the PDF tools, the utilities, the things installed years ago and never thought about again — none of it is in that count. Craig also explains what changed about timing. For years the math ran in your favor: a flaw was found, and it took somewhere between six months and a year before anyone built something that could use it. That was your slack. You could wait for a quiet weekend. That window has closed to roughly a day, which means a patch you postpone is no longer a patch you postponed. Also in this segment: Why the loan robocalls keep coming, what the callback is actually fishing for, a