3 ms·
And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. Related: https://news.y
by harperlee 3y ago
And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy.
Related: https://news.ycombinator.com/item?id=24444497 https://news.ycombinator.com/item?id=24444497
- xpe 3y agoNubank’s goal to keep the Datomic source code private remains secret is based primarily on IP law and internal security controls (on employees, contractors, and possibly obfuscating compilation). Disagree?
- deleted 3y ago[deleted]
- harperlee 3y ago> Disagree? No idea! Just speculating…
- xpe 3y ago> And I’d add that security by obscurity is also a valid reason. It’s bad as a standalone strategy, but good as a complementary strategy. As the thread you link mentions, the phrase “security by obscurity” historically means (more of less) “security primarily by obscurity”. But sometimes this point gets lost. The thread you mention is interesting. Wikipedia: > Security through obscurity (or security by obscurity) is the reliance in security engineering on design or implementation secrecy as the main method of providing security to a system or component. Summary: Layers of security (which can include a wide range of techniques, including obfuscation, etc): useful, because delaying attacks and/or making them less likely is useful. Obscurity as a main method: theatre, because it often leads to self-deception about the true risks involved