My beard is not grey enough to know about how the Security by Obscurity meme/mantra have evolved in the tech community. But one thought I have is that this mor

My beard is not grey enough to know about how the Security by Obscurity meme/mantra have evolved in the tech community. But one thought I have is that this more nuanced picture is much more complicated to tell beginners. Beginners / not as security conscious developers often, wrongly, assume that obfuscation is much more powerful than it is. The safest digest of the "Apply ≈Kerckhoff's principle, but some obscurity on top of that is not a bad idea if it's cheap to implment", is probably "security by obscurity is bad!1!". Certificate pinning or sandboxing in mobile apps won't stop people from reverse engineering your API's. But if your personal belief is that it's like almost a state actor level attack to see your API routes or modify requests, it will undoubtedly influence how you implement them. I've seen some serious problems where companies do really bad things (like sending the ID of the currently logged in user and not checking it server side, allowing for execution as arbitrary user), which I guess at least partly arose from thinking along the lines of "It's only our signed code that will ever make these requests". Even bad developers wouldn't make the same misstakes in ≈2020 on the web, where the understanding that the client is untrustworthy have fully statured the common understanding.