I don’t know how Mandanis grocery stores will work out, but it _is_ kinda wild seeing the All-in/VCs clutching their pearls about unsustainable business models being made to look workable in the short term..
Remote
Haroon Meer
@haroonmeer@infosec.exchange
mastodon 4.8.0-alpha.3+glitchSecurity Geek at Thinkst. We build https://canary.tools (he/him)
0 Followers
0 Following
30 Posts
Joined November 06, 2022
Canary:
Blog:
If you built a company in the past decade you probably received advice from the Eric Ries classic: “The Lean Startup”.
His new book, “Incorruptible” is more important.
We’ve been told constantly how choices we made at @ThinkstCanary@mastodon.sdf.org are unique/non-repeatable. He shows otherwise.
If you are building a cyber-startup, you should read this book.
You will always be told that it’s too early to think about building a company that aims to do good (until you are told it’s too late).
There are heaps of examples that just aren’t talked about as often.
A writeup of @ThinkstCanary@mastodon.sdf.org (& our other tools) 🤯🥲💚
"this is my love letter to a company"
"something rare in this industry: it made me feel good about detection again"
"gave me back .. signal over noise, and something close to joy in the process."
https://www.linkedin.com/pulse/little-bird-told-me-catching-intruders-thinkst-canary-kyle-goode-pdzcc/
There are many well-discussed upsides/downsides to building a company.
One that's seldom discussed is the unexpected joy from something like a customer writing a ~2000 word "love letter" to the company.
Hit me right in the feels. 10/10. Will recommend.
https://infosec.exchange/@haroonmeer/116941632029750478
Quoting
A writeup of @ThinkstCanary@mastodon.sdf.org (& our other tools) 🤯🥲💚
"this is my love letter to a company"
"something rare in this industry: it made me feel good about detection again"
"gave me back .. signal over noise, and something close to joy in the process."
https://www.linkedin.com/pulse/little-bird-told-me-catching-intruders-thinkst-canary-kyle-goode-pdzcc/
Niels Provos posting smart security stuff, Dave Aitel knows stuff he can’t share, Halvar exploring the current space, and people arguing loudly about disclosure ethics..
This could totally be 2002..
I think one of the most subtly damaging notions that was popularized over the past decade, was that of “imposter syndrome”.
Lots of people quote “imposter syndrome” and “dunning-kruger” - but we’d be better off if we spotted our occurrences of the latter more the former.
RE: https://mastodon.social/@campuscodi/117054483452378870
You should absolutely watch this talk.
1) It is totally ok to not have a strong opinion 5 secs after it's done;
2) It's kinda great that the agents first created #hack & it all went wrong from there;
3) http://canarytokens.org remains free - you should absolutely deploy tokens¹
__
¹ not a gratuitous ad - tokens/deception are the only defensive measure the talk mentions.
I’ve avoided saying it for a bit, but in a world where everyone can find/exploit everything easily - what you need more than ever, is knowing when serious attackers are exploring your “internals”.
It’s where @ThinkstCanary shines..
__
¹ for values of [everyone|internal]
We’ve always had a problem with least privilege, but users needed to be owned for it to visibly hurt the enterprise.
Kevin didn’t know what to do with the extra creds, but his agent will.
Maybe the first run of the “paperclip” problem will be agents wiping shares to save us..
For decades(?) we laughed at the hacker-news commenters who felt they could build Dropbox in a weekend.
We knew that engineer was confusing the ability to write a POC with an actual enterprise-ready solution.
AI now lets everyone be that engineer.
When we first showed up at BlackHat as unknown S Africans, we were kinda shellshocked (& awestruck) by it all.
FX was one of the first people to pull us in & hung out with us. We kept in touch but not nearly as much as I should have.
He will be missed.
It sounds childish, but the weirdest part of how we seem to be marching towards wars & global uncertainty, is how unnecessary it seems 🤷♂️
(“Evil” sounds too judgmental, but) this seems like the stage we’ll later recall as “the banality of evil”
RSAC was more subdued this year.
Although the floor was plastered in AI, AI protection & Agentic*, everyone knows its a placeholder while we figure things out..
So it's more performative than normal:
Vendors act like they have the solutions & attendees act like they believe it
Can we at least agree that anyone who did an ICO or tried to convince us that NFTs were a thing, shouldn’t be trusted with “crypto” market advice.
A quick thought on RSAC (while flying home).
On why the show floor keeps making promises it cant keep (and why Dave Aitel actually had a valid point¹).
https://blog.thinkst.com/2026/03/rsac-infosec-themes-and-crumby-products.html
__
¹ All those years ago
Replying to
@Viss@mastodon.social we are getting so old, that we now have arguments on the internet by pasting links to old talks/blogposts..
we need a phrack article on how to age gracefully in the space..
Chris Nolan (indirectly) weighs in on the raising vs bootstrapping debate:
“You’re encouraged in a big movie to rapidly hire an enormous number of people... Then you have to feed that beast.”
“If I can work a little cheaper than ppl expect.. they’ll let me do my thing”
People often spout lines about how better products don't win, "X" actually wins..
I've seldom found this to be true..
Build better products..
Important, business-critical need..
A sticker vendor aware of Apples corner radius..
A common startup meme has been how shipping velocity trumps all.
With people on the fringes “shipping” thousands of lines of code per day, it’s now “obvious” that startups should be adopting this new paradigm and just —yolo’ing it…
Except maybe… not.
Apple and google have long had (near)infinite dollars to hire ppl to generate thousands of lines of code per day… but great products are much more than just code velocity..
Run the idea maze.. build beautiful things.. org tempo matters, not klocs of slop…
Only just caught up with this older episode of “Inside the Network” with Michelle Zatlyn.
Cloudflare impressively manages to keep shipping cool stuff despite their size, and she shares a bunch of down-to-earth, startup advice (even for non cyber-sec startups).
The main problem that Docusign seems to have solved, was getting people over “wet signatures”.
Technologists often slam Slack/Docusign/companies like this, but they’ve been life changing for me/us.
Everyone is talking about the effect of Kimi on OpenAI and Anthropic, but imagine if you were a Space Exploration company that recently IPO'd at a hugely inflated valuation based on your future AI/model dominance 🤯
That no actual friend, or board of directors is able to tell Musk (in a week when both Tesla and SpaceX stock is crashing) that maybe he should park the culture-warrior, Gad-Saad BS.. is a strong reason to be careful investing in his companies..
Many mad-kings started sane..
An odd side effect of decades in infosec, is having visited Las Vegas more times than normal people would expect.
Replying to
@RoganDawes@infosec.exchange @whitequark@social.treehouse.systems @ThinkstCanary@mastodon.sdf.org yeah. The book talks about several types of short term bargains companies get used to that lead down that path.
I just did a podcast episode with @caseyjohnellis@infosec.exchange where we discussed this sorta thing. Should be out next week.