This misunderstands how "security by obscurity" came about, because there are good and bad types of obscurity. Back in the 1800s people were selling shoddy loc

This misunderstands how "security by obscurity" came about, because there are good and bad types of obscurity. Back in the 1800s people were selling shoddy locks that were easy to pick and they were mad that people were disclosing lock picking methods: https://www.okta.com/identity-101/security-through-obscurity/ https://www.okta.com/identity-101/security-through-obscurity... This history repeated later, with people making shoddy cryptography where they didn't want anyone to know how it worked, and similar things, most of which got broken in embarrassing ways. This sort of obscurity was actively harmful and let people sell defective products that people relied upon to their detriment. Meanwhile, there are good types of obscurity, too. For example, there are the information disclosure CWEs that tell users of products not to disclose version numbers, stack traces, etc. to users, and this sort of "obscurity" is perfectly reasonable and widely accepted. So it's not the case that all things that might be termed "obscurity" are bad.