4 ms·

Okay, but we're not talking about that here. This is very much the case of a service being exposed that shouldn't be and relying on obscurity to try and avoid a

Okay, but we're not talking about that here. This is very much the case of a service being exposed that shouldn't be and relying on obscurity to try and avoid actually getting compromised

dijit 1y ago
ironically I would double down even harder then; If something was temporary then it’s likely that it wouldn’t have been found in a meaningful amount of time to be exploited. As an only line of defence it’s not good, but its also not good to hand-deliver your entire personal information to fraudsters and then claim that the systems should be more robust.
- aspenmayer 1y ago
  If you have a target on your own back thanks to cert transparency logs, it's a bit like closing the barn door late for you to find fault in your own being in Texas when sharpshooters are about. If your only defense was obscurity, your ass is hanging out, and it's no one's fault but your own when you find fault with others for simply saying so. https://en.wikipedia.org/wiki/Texas_sharpshooter_fallacy https://en.wikipedia.org/wiki/Texas_sharpshooter_fallacy
  - dijit 1y ago
    In my original comment I said (I thought) quite clearly that obscurity as your only defence is a terrible idea. But painting a target on your back is not exactly justified just because hiding yourself isn’t a good defence in of itself.
    - aspenmayer 1y ago
      Obscurity couldn't be anyone's last/best defense, unless it was their only defense, was my point. In any case, I think we agree.