I think there's two things at work here. 1. It's extremely frustrating how much bad security work is done, and how much of it is justified in the name of "defe

I think there's two things at work here. 1. It's extremely frustrating how much bad security work is done, and how much of it is justified in the name of "defense in depth". So many useless hours spent on mitigation without understanding the threat. 2. Everyone talks in hyperbole. It's shorter and more to the point, and nuance is usually not important in conversation among experts - we already know the nuance. The difficult bit is if you're not an expert, but talk with them, the implicit nuance is lost. There's also a lot of resentment. I resent compliance. It is a massive waste of both time and money at my company, and is driven purely by sales. We would be safer without compliance because we could have spent that time elsewhere. > In reality there can be a lot of value in keeping an attacker guessing and creating uncertainty by using deception or a variety of other techniques that could be described as obscurity. This isn't security through obscurity. I see this all the time, really. If you're keeping an attacker guessing, that's not obscurity, that's a secret. If you're doing it via deception, that's not obscurity, that's a trap. Security through obscurity is "the implementation is less popular, therefor safer", which is nonsense. I agree with many of the statements though.