Top all-time · #1746
Thinkst Thoughts
Company blog · blog.thinkst.com · on HN as mh_securitysystems
Thinkst Thoughts is the company blog at blog.thinkst.com, writing about security and systems. Since 2010, 42 different Hacker News readers have linked it 99 times, most often “Canarytokens.org – Quick, Free, Detection for the Masses”. It is still writing: the last post was on 2026-09-04, and you can follow it by feed.
Too few sampled comments (14) to say how often HN recommends it.?
Why HN links it
HN readers link Thinkst's blog for explanations of canary tokens and deception-based detection, plus commentary on NSA surveillance, SolarWinds and related security incidents.
Summarised by Claude from a sample of 14 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Writing about our experiences and research findings
Most-linked posts?
- Canarytokens.org – Quick, Free, Detection for the Masses8 people · 8 mentions · first linked 2015-09-09
- Getting Agents to Tell on Themselves4 people · 4 mentions · first linked 2026-09-04
- NSA Owns Everything (2015)3 people · 4 mentions · first linked 2020-08-13
- Detect breaches with Canary credit cards3 people · 3 mentions · first linked 2023-01-21
- Building WireGate: A WireGuard front to detect compromised keys3 people · 3 mentions · first linked 2021-11-19
- Canarytokens.org – quick, free, breach detection for the masses3 people · 3 mentions · first linked 2018-11-30
- Why Pareto optimality might be wrong for building products2 people · 3 mentions · first linked 2020-11-23
- We bootstrapped to $11M in ARR2 people · 3 mentions · first linked 2021-03-17
- As a young security startup, should you have a booth at the RSA Expo?2 people · 2 mentions · first linked 2018-04-30
- Use Windows signing to get notified on file opens / executions2 people · 2 mentions · first linked 2016-05-25
What Hacker News says?
Something not widely used are canary tokens: https://blog.thinkst.com/p/canarytokensorg-quick-free-detect... The general idea is to insert some kind of bogus information into a system, with no links to other systems, and then trigger a notification if someone accesses it.
Comment linking /p/canarytokensorg-quick-free-detection.html
on “Marriott hack hits 500M Starwood guests”Submitted We bootstrapped to $11M in ARR as a story · 387 points
HN discussionThe NSA couldn't care less about you and your customers, nor do they have any interest whatsoever in the megaton of worthless internet traffic that goes through Cloudflare. This article, from over a decade ago now, explains how they actually operate. Gobbling up all the traffic is a 20+ year old idea that never bore any fruit and is amazingly pointless. Instead, they might drop an implant in the SSD firmware of devi…
Comment linking /2015/08/if-the-nsa-has-been-hacking-everything-how-has-nobody-seen-them-coming-3.html
on “Among European Companies That Use a CDN, Nearly 9 in 10 Use Cloudflare”Submitted NSA Owns Everything (2015) as a story · 355 points
HN discussionThinkst Canary | Full Stack Software Engineer, Frontend Engineer | REMOTE or Cape Town / Johannesburg, South Africa | https://canary.tools Thinkst Canary is a unique honeypot system deployed across networks you frequently use, with customers including a bunch of Valley unicorns, research labs, retailers, financial services, academic institutions, mining, defence, and more, across all seven (yes, seven!) continents.…
Comment linking /2021/03/we-bootstrapped-to-11-million-in-arr.html
on “Ask HN: Who is hiring? (June 2021)”Submitted A Steve Jobs masterclass from a decade ago as a story · 339 points
HN discussionHe jumped to a conclusion, not realizing that the NSA had plenty of perfectly legal reasons to have split off copies of backbone fiber trunks. A great example is point #4, "Some beautiful misdirection", in https://blog.thinkst.com/p/if-nsa-has-been-hacking-everythin... discussed 3 days ago at https://news.ycombinator.com/item?id=24139828 That's some ingenious stuff that is 100% legal. Plus, it's not as if foreign da…
Comment linking /p/if-nsa-has-been-hacking-everything-how.html
on “Trump says he is considering pardon for Edward Snowden”Submitted Unfashionably secure: why we use isolated VMs as a story · 305 points
HN discussionThat's what they want you to think. :-) There's also point #4, "Some beautiful misdirection", in https://blog.thinkst.com/p/if-nsa-has-been-hacking-everythin... discussed 3 days ago at https://news.ycombinator.com/item?id=24139828 Maybe they'd really prefer to take the public relations hit of everybody thinking that they spy on Americans.
Comment linking /p/if-nsa-has-been-hacking-everything-how.html
on “Trump says he is considering pardon for Edward Snowden”Submitted Unicorns, Startups and Hosted Email as a story · 49 points
HN discussionHere's an excellent article on the topic, this is a huge uproar on an everyday occurrence. https://blog.thinkst.com/p/if-nsa-has-been-hacking-everythin...
Comment linking /p/if-nsa-has-been-hacking-everything-how.html
on “The Story of the SolarWinds Hack”Submitted Canarytokens.org – Quick, Free, Detection for the Masses as a story · 32 points
HN discussionCool, thanks. I found https://blog.thinkst.com/p/canarytokensorg-quick-free-detect... is there a better writeup you have offhand? https://github.com/cowrie/cowrie has been on my todo list for a while too, but more as a toy than a serious thing. > The networks I'm describing aren't "ideal" or "highly secured". I am describing table stakes. While I was at Latacora, most of the clients we engaged with were already at t…
Comment linking /p/canarytokensorg-quick-free-detection.html;
on “Port knocking”Submitted Automated Shoulder Surfing Attacks (Computer Vision meets on screen keyboards) as a story · 18 points
HN discussionThanks! We also think they’re one of the few things available that work well for agentic threats. You might find some recent work we did on agent deception interesting as well: https://blog.thinkst.com/2026/09/getting-agents-to-tell-on-t...
Comment linking /2026/09/getting-agents-to-tell-on-themselves.html
on “Canary Tokens”Submitted If the NSA has been hacking everything, how has nobody seen them coming? as a story · 11 points
HN discussionThe first version used a provider that started rate-limiting us pretty heavily. It meant a pretty crappy experience for folks creating the Canarytoken. We decided to pause and look for alternatives. We’re using Airwallex now. They’ve been great. You can read more about the implementation in our blogpost: https://blog.thinkst.com/2024/12/its-baaack-credit-card-cana...
Comment linking /2024/12/its-baaack-credit-card-canarytokens-are-now-on-your-consoles.html
on “Canary Tokens”Submitted Disrupting AWS S3 Logging as a story · 10 points
HN discussionThe updates in universe are definitely best effort. We were paying for Ubuntu Pro through an AWS subscription on 2k EC2 instances, and could not get Canonical to update a package with a CVSS 7.8 in the 18.04 LTS. We've moved off Ubuntu Pro as a result. Blogged it at https://blog.thinkst.com/2024/07/unobtrusively-upgrading-ubu...
Comment linking /2024/07/unobtrusively-upgrading-ubuntu-underfoot.html
on “Ubuntu Security Updates Are a Confusing Mess”Submitted Building WireGate: A WireGuard front to detect compromised keys as a story · 8 points
HN discussionAgree 100%. In fact in 2010 I wrote a post titled:Cargo Cult startups on exactly this: http://blog.thinkst.com/2010/04/cargo-cult-startups.html
Comment linking /2010/04/cargo-cult-startups.html
on “The culture myth”Submitted Canarytokens.org – Quick, Free, Detection for the Masses as a story · 7 points
HN discussionhttps://blog.thinkst.com/2023/01/swipe-right-on-our-new-cred... https://canarytokens.org/ https://news.ycombinator.com/item?id=34476507
Comment linking /2023/01/swipe-right-on-our-new-credit-card-tokens.html
on “1Password detects "suspicious activity" in its internal Okta account”Submitted We Bootstrapped to $11M in ARR as a story · 6 points
HN discussionYeah, I think that's the gist. Fake PoC of a CVE, people ran random code, author caught them in the act via a canary token [0] and rickrolled them. 0: https://blog.thinkst.com/p/canarytokensorg-quick-free-detect...
Comment linking /p/canarytokensorg-quick-free-detection.html
on “The day I trolled the entire internet: accidental research project CVE-2020-1350”Submitted Getting Agents to Tell on Themselves as a story · 5 points
HN discussionI ran across this service while reading a blog post from Corey Quinn about AWS security. It turns out that CanaryTokens has a AWS IAM token generator that alerts whenever someone tries to use it. That's a great idea and I can see sprinkling credentials around would make a great tripwire. https://blog.thinkst.com/2017/09/canarytokens-new-member-aws...
Comment linking /2017/09/canarytokens-new-member-aws-api-key.html
on “An insanely easy-to-use honeypot solution that deploys in just four minutes”Submitted Canary tokens: a painless way to help defenders discover they've been breached as a story · 5 points
HN discussionI blogged earlier this year about companies that try to copy the beanbags, but miss the point (cargo cult startups) http://blog.thinkst.com/2010/04/cargo-cult-startups.html
Comment linking /2010/04/cargo-cult-startups.html
on “Thoughts from my Google tour”Submitted If the NSA has been hacking everything, how has nobody seen them coming? as a story · 5 points
HN discussion
