CroissanthologyIt's better to personally do your part in neutralizing bad actors than to fuss about your cybersecurity stack

It's better to personally do your part in neutralizing bad actors than to fuss about your cybersecurity stack

19 May 2026 also on Substack

Personal cybersecurity is offense dominant (for now)

In principle, I'm partial to the idea of privacy. GrapheneOS sounds cool, and so does a home server for storing one’s 1.8TB of archiving content. Being in full control of your digital wake solves one of the oddest arrangements we have with large companies: “store my data and make it readily available, and in exchange I'll give you effective control of it”??¹ The US government seems starkly unaligned to the American people at the moment, and the less information they have on me, the better. The cost of sifting through mountains of information in the name of a given goal has plummeted, so anyone with access to my data could do many more useful things with it.² “Truesight” by LLMs could have non-linear gains, in the sense that “recognizing this text as Kelsey Piper's” could be the first step in a capabilities buildup that ends up with the ability to do more with your data than “merely” singling you out among billions after sampling a single paragraph (for example, persuading you).

2Tangential, but in some sense, it's a very lucky thing that president Donald Trump and his gang don't have much of an ideology besides a mafiaesque desire to slather themselves in golden tin foil skimmed off the top of the nation while doing their best to do whatever gets the libs to yell at them most. Had they had a more coherent ideology with a set goal (e.g. “establish a dictatorship of the proletariat” for the communists) I think we'd be in a worse situation than we're in. Sparks-of-singularity combined with no ideology in the executive is an improvement over a situation where whoever's in charge could conceivably capture the lightcone because they have a specific shape in mind for it. So while the NSA is increasingly capable of sifting through everyone's data, they don't really have a purpose in doing that (yet).

At the same time, security reasons for privacy are slightly dumb. The NSA has your encrypted data if it’s ever gone through tapped optic fiber wires, and they're storing it in a vault to decrypt later. Superpersuasion by AIs e.g. creating a Xhosa prophecy would probably work on everyone given how similar human minds are, so why bother specifically protecting your own data. Offense is the true way to ensure bad people can't do bad things to you: vote for the right government, work on AI alignment, advocate for policies, support EU-style laws requiring copies of your data be transmitted upon request (even if your account is banned), etc. There are still good reasons, including principle, to build a complicated home server contraption that avoids Google; and doing so is getting cheaper time- and skill-wise. It may even be possible to do it perfectly (see link below). But for security, you're probably better off thinking about the far harder problem of ensuring nothing is coming to get you in the first place.

As the cybersecurity saying goes, your threat is either Mossad or not-Mossad: don't even bother trying to defend against the Mossad. (Unfortunately, acquiring a Mossad is getting cheaper—but the saying still holds!)³

3Specifically this is from a quote by James Mickens in This World of Ours:

My point is that security people need to get their priorities straight. The “threat model” section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN’T REAL. When it rains, it pours.