4 ms·

> We're unlikely to publish all that because doing so would increase two bad things: attempts to game the site, and meta nitpicking. So security by obscurity h

> We're unlikely to publish all that because doing so would increase two bad things: attempts to game the site, and meta nitpicking. So security by obscurity helps at times.

notatoad 9y ago
of course it helps, i don't think anybody's ever denied that. It just shouldn't be relied on.
CydeWeys 9y ago
Passwords are security through obscurity too. Things would be a lot less secure if all passwords were publicly available.
- pdpi 9y ago
  Security by obscurity is precisely defined as security that relies on the algorithm/implementation itself being private to be able to function. Key material being private does not qualify for this. The alternative is that security through obscurity becomes such an all-encompassing term as to become meaningless
- kefka 9y ago
  Indeed. The difference between "Security by obscurity" versus login/passwords is really scale. Usually, some numbnut "programmer" sets a no-login and a simple password as a secret service account. It invariably is found, and badness ensues. Whereas login/password is a 1/password_space chance of getting it. It's the combination of a default hidden account and no way to know/change it.
- tlrobinson 9y ago
  In that case, 256 bit encryption keys are security-through-obscurity too, they're just realllllly obscure.
thejones 9y ago
Reddit has a similar approach if I'm not mistaken.
flukus 9y ago
It's not about security, just content curation.
Houshalter 9y ago
Someone once did an analysis on HN posts and their ranking relative to the time they were posted and votes. And they found posts with certain keywords were heavily penalized and sort of soft banned from the site. IIRC it included stuff like "NSA" and "HN" and posts from certain sites like reddit and youtube (but I could be remembering.) Having the full list of banned keywords, or even acknowledging there is a list, could cause drama. And it's easily evaded if people know about it, like when reddit banned "Tesla" posts got through by misspelling it "Telsa". There's also other stuff like a controversy filter, that detects articles with more comments than votes and penalizes them. I try to avoid commenting in articles that are getting close to the limit to avoid triggering it.

> We're unlikely to publish all that because doing so would increase two bad things: attempts to game the site, and meta nitpicking. So security by obscurity helps at times.

notatoad 9y ago

of course it helps, i don't think anybody's ever denied that. It just shouldn't be relied on.

CydeWeys 9y ago

Passwords are security through obscurity too. Things would be a lot less secure if all passwords were publicly available.

pdpi 9y ago
Security by obscurity is precisely defined as security that relies on the algorithm/implementation itself being private to be able to function. Key material being private does not qualify for this. The alternative is that security through obscurity becomes such an all-encompassing term as to become meaningless
kefka 9y ago
Indeed. The difference between "Security by obscurity" versus login/passwords is really scale. Usually, some numbnut "programmer" sets a no-login and a simple password as a secret service account. It invariably is found, and badness ensues. Whereas login/password is a 1/password_space chance of getting it. It's the combination of a default hidden account and no way to know/change it.
tlrobinson 9y ago
In that case, 256 bit encryption keys are security-through-obscurity too, they're just realllllly obscure.

thejones 9y ago

Reddit has a similar approach if I'm not mistaken.

flukus 9y ago

It's not about security, just content curation.

Houshalter 9y ago

Someone once did an analysis on HN posts and their ranking relative to the time they were posted and votes. And they found posts with certain keywords were heavily penalized and sort of soft banned from the site. IIRC it included stuff like "NSA" and "HN" and posts from certain sites like reddit and youtube (but I could be remembering.) Having the full list of banned keywords, or even acknowledging there is a list, could cause drama. And it's easily evaded if people know about it, like when reddit banned "Tesla" posts got through by misspelling it "Telsa". There's also other stuff like a controversy filter, that detects articles with more comments than votes and penalizes them. I try to avoid commenting in articles that are getting close to the limit to avoid triggering it.