> I've seen security through obscurity misused too often as the only line of defence, or as a "temporary" stop-gap that outlives its usefulness. It can lead to

> I've seen security through obscurity misused too often as the only line of defence, or as a "temporary" stop-gap that outlives its usefulness. It can lead to a false sense of security. Exactly. > we need for some reason make this development-stage service publicly available on the internet, and it's connected to a lot of our services internally, but we can implement AAA only later and we need it now. No issue publishing it on an obscure route/IP/domain name? And the setup stays online for 5 years.