“If you examine a system’s security and it’s weakened, that system is flawed,” says Ormandy. With things like encryption schemes, definitely. But is this true

“If you examine a system’s security and it’s weakened, that system is flawed,” says Ormandy. With things like encryption schemes, definitely. But is this true for detecting malicious behavior? If you show your criteria for finding it, doesn't that tell malware writers how to avoid detection? If I'm wrong - if openly saying "there are our criteria for identifying bad behavior" won't help people avoid it - then shouldn't Google release its criteria for identifying spam sites? I don't see Ormandy advocating for that.