I think the article confuses two concepts. "Security by obscurity is bad" usually applies to things like "our own proprietary hash function", or "our own propri

I think the article confuses two concepts. "Security by obscurity is bad" usually applies to things like "our own proprietary hash function", or "our own proprietary remote control protocol", or sometimes even just "well, noone has the code, right?". I call this obscurity proper. This is often little more than an omission. All the positive examples in the article mean actively obscuring the view of an attacker. This is an addition of things like camouflage or distraction. Proper obscurity is obviously bad, because there simply is no security concept behind it. Additive obscurity is obviously smart because it adds to an existing concept.