Attack of the Canaries! (Interview)

The Changelog: Software Development, Open Source

This week we’re joined by Haroon Meer from Thinkst — the makers of Canary and Canary Tokens. Haroon walks us through a network getting compromised, what it takes to deploy a Canary on your network, how they maintain low false-positive numbers, their thoughts and principles on building their business (major wisdom shared!), and how a Canary helps surface network attacks in real time.

Join the discussion

Changelog++ members get a bonus 4 minutes at the end of this episode and zero ads. Join today!

Sponsors:

• Statsig – Build faster with confidence. Startups to Fortune 500s rely on Statsig to make data-driven decisions. Ship smarter and faster with the unified platform for feature flags, experimentation, and analytics. Our listeners get free white-glove onboarding, migration support, and 5 million free events per month.
• Sentry – Watch Lazar Nikolov livestream on YouTube at youtube.com/@nikolovlazar. Use the code CHANGELOG and get the team plan FREE for three (3) months.
• Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today.
• Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com

Featuring:

• Haroon Meer – Website, LinkedIn, X
• Adam Stacoviak – Website, GitHub, LinkedIn, Mastodon, X
• Jerod Santo – GitHub, LinkedIn, Mastodon, X

Show Notes:

• Thinkst Applied Research
• Thinkst Canary

Something missing or broken? PRs welcome!

Capitole

1. This week on The Changelog (00:00:00)

2. Sponsor: Statsig (00:01:00)

https://statsig.com/changelog

3. Start the show! (00:04:28)

4. Canary tokens (00:05:32)

5. The footprint of a Canary (00:10:03)

6. The Homelab lens (00:14:23)

7. Fingerprinting a Canary (00:16:43)

8. Masquerading as many things (00:18:45)

9. Ratio of Canaries to real hardware? (00:24:02)

10. Sponsor: Sentry (00:28:47)

https://sentry.io/changelogpod

11. False positives (00:32:26)

12. How are attackers getting in? (00:34:11)

13. How do you masquerade well? (00:39:10)

14. Bootstrapping Thinkst and Canary (00:41:45)

15. Adding too many things (00:53:31)

16. Just be kind (00:59:35)

17. Regarding dead Canaries (01:03:21)

18. How Canaries get deployed (01:05:53)

19. Sponsor: Changelog News (01:12:00)

https://changelog.com/news

20. Do you care about hardware? (01:13:44)

21. Adam's attack!! (01:20:06)

22. Where else can/will you go? (01:25:10)

23. Thoughts on the VC model (01:29:04)

24. Save it for ++ (01:40:51)

25. Up next! (01:41:40)