The analogy to "security through obscurity" is flawed. Open security works when there's an obvious way a secure system should behave, say, make it infeasible to

The analogy to "security through obscurity" is flawed. Open security works when there's an obvious way a secure system should behave, say, make it infeasible to open a lock/decrypt data without the correct key. In Google’s, case the correct relevancy ordering of the web is a huge point of contention. So they cannot simply open it up hoping to close out all the holes in the open. It is also hard to distinguish acceptable behavior (linking) from unacceptable behavior (selling links) except in the aggregate through heuristics that assume ignorance on the part of the attacker. In this sense, Google’s system is a lot closer to an intrusion detection system than a lock or a cipher suite. You want to establish some ground rules but there’s no added security in declaring what you’re monitoring on your servers and how.