The Curious Engineer

All blogs / Security

Thinkst Thoughts

blog.thinkst.com

Writing about our experiences and research findings

SecurityDevOps / SRE / infrastructureSoftware / engineering practice

’10’15’20’25
Posts
170 from 2 Mar 2010 to 4 Sep 2026
Posting
monthly (7 in the last year)
Kind
company blog
Feed
https://blog.thinkst.com/feed

2026 7

  1. Getting Agents to tell on themselves
  2. (Other) lessons for security product founders (from the Wright brothers)
  3. One for all the models out there!
  4. Introducing Package Proxy: supply-chain safety checks without client-side software
  5. Thinkst Canary Alerts in Google Security Operations
  6. RSAC, Infosec-themes, and crummy products
  7. Thinkst Canary acquires UK-based DeceptIQ

2025 6

  1. Introducing the AWS Infrastructure Canarytoken
  2. 2025 Hacker Summer Camp talks to watch
  3. Don’t Settle for Mediocre Frontend Testing: Build Stable, Reliable Systems Instead
  4. On Caring
  5. Detect Identity Compromise with SAML IdP App Canarytokens
  6. Almost famous: behind the scenes of a feature that didn’t make the cut

2024 20

  1. It’s Baaack… Credit Card Canarytokens are now on your Consoles
  2. RSAC/Blackhat booths don’t have to suck
  3. Hacking as a pathway to building better Products
  4. How we built the Pyramid!
  5. Practical tips for debugging Flask under remote uWSGI with rpdb
  6. Do well by doing good: our Thinkst Canary Bags
  7. Introducing our new Canarytoken: the Fake App
  8. Building VMware Linux VM Automation Tooling
  9. What we’re excited about at the 2024 Hacker Summer Camp
  10. From Detection to Response: Automated Phishing Defense with Azure Entra ID Login Token
  11. Unfashionably secure: why we use isolated VMs
  12. Refreshing Canarytokens.org: a new interface, new functionality, and our security assessment results
  13. Unobtrusively Upgrading Ubuntu Underfoot
  14. A Bird’s-eye view: ShareFinder-How Threat Actors Discover File Shares (The DFIR Report)
  15. Glory to the Glorifier
  16. A Bird’s-eye view: IceID to Dagon Locker (The DFIR Report)
  17. Defending against the Attack of the Clone[d website]s!
  18. Video File Canarytokens: to be or not to be
  19. What “personality” should I give my Canary?
  20. Oh Crumbs! (Breadcrumbs in Beta)

2023 8

  1. A (beta) Canarytoken for Active Directory Credentials
  2. Cloned Website Token and Reverse Proxies
  3. CourtVision – Where’s my padel at?
  4. Default behaviour sticks (And so do examples)
  5. Meet “ZipPy”, a fast AI LLM text detector
  6. Birds at (Tail)scale
  7. Canarytokens.org welcomes Azure Login Certificate Token
  8. Swipe right on our new credit card tokens!

2022 8

  1. Seasonal themes, delighting users & small UX touches
  2. Company Lessons (from YouTubes “Hot Ones”)
  3. Sensitive Command Token – So much offense in my defense
  4. Canaries as Network Motion Sensors
  5. Always be Hacking…
  6. Creating REST API Canary endpoints
  7. A “Safety Net” for AWS Canarytokens
  8. Canary Rice Toss

2021 7

  1. Building WireGate: A WireGuard front to detect compromised keys
  2. A Kubeconfig Canarytoken
  3. Good attacks make good detections make good attacks make..
  4. RDP, cmdkey, Canary (and thee)
  5. Would you know if your phone was hacked?
  6. We bootstrapped to $11 million in ARR
  7. On SolarWinds, Supply Chains and Enterprise Networks

2020 13

  1. Hackweek 2020
  2. New features aren't Solved Problems
  3. Small things done well¹
  4. Something fresh
  5. 3rd-party API-Key Leaks (and the Broker)
  6. A Steve Jobs masterclass (from a decade ago)
  7. Good UNIX tools
  8. Canarytokens.org – Quick, Free, Detection for the Masses
  9. Why control matters
  10. Canarytokens: Token Anything, Anywhere
  11. 3D-Printed Emergency Services Face Shields
  12. If i run your software, can you hack me?
  13. Are Canaries Secure?

2019 12

  1. HackWeek 2019
  2. Canary Alerts, Part 2 – Bonus Flavours
  3. Alerts Come in Many Flavours
  4. I'm Running Canaries, but…
  5. Introducing Rapsheet
  6. Introducing the Office 365 Mail Token
  7. USENIX Security Symposium 2019
  8. One Month with Thinkst
  9. When document.domain is not equal to document.domain
  10. Developing a full stack… of Skyballs
  11. When you can’t do awesome things, because of crushing bureaucracy
  12. Save My Vid

2018 13

  1. HackWeek 2018
  2. Making NGINX slightly less “surprising”
  3. Good Pain vs. Bad Pain
  4. They see me rolling (back)
  5. Some OpenCanary Updates
  6. (Better) Canary Alerts in Slack
  7. A Week with Saumil (aka "The ARM Exploit Laboratory")
  8. Using the Linux Audit System to detect badness
  9. RSAC 2018 – A Recap…
  10. Considering an RSAC Expo booth? Our Experience, in 5,000 words or less
  11. Considering an RSAC Expo booth? Our Experience, in 5,000 words or less
  12. A third party view on the security of the Canaries
  13. Sandboxing: a dig into building your security pit

2017 11

  1. On anti-patterns for ICT security and international law
  2. A Geneva convention, for Software
  3. Canarytokens' new member: AWS API key Canarytoken
  4. Farseeing: a look at BeyondCorp
  5. Disrupting AWS S3 Logging
  6. All your devs are belong to us: how to backdoor the Atom editor
  7. BlackHat 2017 Series
  8. A guide to Birding (aka: Tips for deploying Canaries)
  9. Get notifications when someone accesses your Google Documents (aka: having fun with Google Apps Script)
  10. Introducing our Python API Wrapper
  11. Cloud Canary Beta

2016 2

  1. Slack[ing] off our notifications
  2. Certified Canarytokens: Alerts from signed Windows binaries and Office documents

2015 8

  1. Enterprise Security: The wood for the trees?
  2. Stripping encryption from Microsoft SQL Server authentication
  3. Unicorns, Startups and Hosted Email
  4. Canary Overview
  5. BlackHat 2015 – Bring back the HoneyPots
  6. If the NSA has been hacking everything, how has nobody seen them coming?
  7. Introducing our newest creation: Thinkst Canary!
  8. Troopers15 Keynote: The hard thing about hard things

2014 6

  1. YABOTSB – Yet Another Blog on the Sony Breach ?
  2. Weapons of Mass Distraction: Sock Puppetry for Fun & Profit
  3. Cyberwar – Why your threat model is probably wrong!
  4. ThinkstScapes on Risky.Biz
  5. (Waaay overdue) 2013 – the year in review..
  6. What the Snowden leaks mean for South Africa

2013 6

  1. "When we win, it is with small things, and the victory itself makes us small"
  2. Phish your company, before someone else does!
  3. Introducing Consli, easy scheduling and feedback for conference organisers and attendees
  4. ThinkstScapes 2013-AH1: On the China report
  5. Your company's security posture is probably horrible (but it might be OK).
  6. Introducing.. Signalnoi.se

2012 5

  1. Etsy shows established companies the way..
  2. The lamest hacks
  3. marco@thinkst.com
  4. Penetration Testing considered harmful today
  5. Penetration Testing considered Harmful Today

2011 17

  1. Chrome Extension for gpg in Gmail
  2. BlackHat according to Twitter
  3. ShoulderPad Slashdotted! (and two clarifications)
  4. On-screen Keyboards Considered Harmful
  5. Simple Graphs with Arbor.js
  6. ThinkstScapes (Quarter One Recap)
  7. Cyberwar, Stuxnet and people in Glass Houses
  8. iTried Update (oops)
  9. (ComputerSecurity) Conference Collecting
  10. Interview with the Infosec Institute
  11. Nothing (really) new under the Sun – Verizon Breach Report..
  12. What Anonymous taught us about Cyber War
  13. Our Upcoming Security Apocalypse!
  14. Eurotrash Security Podcast
  15. A freshly etched MacBook Pro (Aka – Welcome Jameel!)
  16. Is the answer more InfoSec Conferences?
  17. Shameless (aka: iTried on the Mac App Store)

2010 21

  1. Anonymity loves company…
  2. ZaCon2 & Fig Leaf Security
  3. Cute (if nothing else) OSX Application..
  4. You have to love attention to detail…
  5. Capital Magazine Article (in German)
  6. Why Intel's purchase of McAfee is a good indicator for Africa..
  7. BlackHat 2010 – Slides / Paper / Rest..
  8. Viva las Vegas?
  9. Conference on Cyber Conflict – Slides..
  10. 200 Young South Africans you must take to Lunch
  11. Memory Corruption and Hacker Folklore
  12. Vicarious Success
  13. "Your submission for Black Hat USA 2010 was accepted"
  14. Memory Corruption and Hacker Folklore
  15. (YaTT) Yet another Twitter Tool ?
  16. Cargo Cult Startups
  17. 37Signals, ReWork, and ReThink..
  18. Portswigger rocks..
  19. TRIBUTE TO FATIMA MEER
  20. The Passing on of a Legend..
  21. And now for something a little different…