4 ms·

Awesome writeup, I crave this type of content. My question to sec enthusiasts and pros: isn't the whole point of security to disclose as little as possible? Se

Awesome writeup, I crave this type of content. My question to sec enthusiasts and pros: isn't the whole point of security to disclose as little as possible? Security through obscurity? I realize that most of this information is public knowledge and there are all kinds of double agents, but this really seems like a lot of information! It just seems to me as though we have everything wrong. China raises children to be hackers and hires criminals to do their bidding, or subs it out to whoever while you can't even get a government job if you have a DUI?

diminoten 11y ago
> My question to sec enthusiasts and pros: isn't the whole point of security to disclose as little as possible? Security through obscurity? Security through obscurity is considered a bad idea, not a good one.
- ohsnap 11y ago
  Only for cryptography. People often mistake the 'security through obscurity' slogan has good for every system.
- philtar 11y ago
  Security through obscurity is good. Security through obscurity only, is bad.
  - BorisMelnik 11y ago
    crazy that I get 2 answers that differ 100% completely, with zero to data to back it up yet my question is the one that gets downvoted, twice.
    - diminoten 11y ago
      You shouldn't use HN as a place to gain knowledge itself; Google is much more useful for that. HN is best seen as a place to expand one's awareness of knowledge. For example, people here have provided their thoughts on "security through obscurity" -- a clear controversy exists! Your next task would be to Google the phrase, and read the Wikipedia article[1] that comes up. Then, if you still have questions, check out the references the Wikipedia article cites[2][3][4][5], or perhaps visit other results from your Google search[6][7][8]. In other words, Internet social media sites are terrible places to learn -- use the greater web to do actual learning. Use social media sites like HN and Reddit to expand your awareness of ideas. [1] http://en.wikipedia.org/wiki/Security_through_obscurity [2] http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf [3] https://www.schneier.com/crypto-gram/archives/2003/0815.html [4] http://tech.slashdot.org/story/01/07/23/2043209/when-security-through-obscurity-isnt-so-bad [5] http://catb.org/jargon/html/S/security-through-obscurity.html [6] http://users.softlab.ntua.gr/~taver/security/secur3.html [7] http://www.pearsonitcertification.com/articles/article.aspx?p=2218577&seqNum=7 [8] https://danielmiessler.com/study/security_and_obscurity/

diminoten 11y ago

> My question to sec enthusiasts and pros: isn't the whole point of security to disclose as little as possible? Security through obscurity? Security through obscurity is considered a bad idea, not a good one.

ohsnap 11y ago
Only for cryptography. People often mistake the 'security through obscurity' slogan has good for every system.
philtar 11y ago
Security through obscurity is good. Security through obscurity only, is bad.
- BorisMelnik 11y ago
  crazy that I get 2 answers that differ 100% completely, with zero to data to back it up yet my question is the one that gets downvoted, twice.
  - diminoten 11y ago
    You shouldn't use HN as a place to gain knowledge itself; Google is much more useful for that. HN is best seen as a place to expand one's awareness of knowledge. For example, people here have provided their thoughts on "security through obscurity" -- a clear controversy exists! Your next task would be to Google the phrase, and read the Wikipedia article[1] that comes up. Then, if you still have questions, check out the references the Wikipedia article cites[2][3][4][5], or perhaps visit other results from your Google search[6][7][8]. In other words, Internet social media sites are terrible places to learn -- use the greater web to do actual learning. Use social media sites like HN and Reddit to expand your awareness of ideas. [1] http://en.wikipedia.org/wiki/Security_through_obscurity [2] http://csrc.nist.gov/publications/nistpubs/800-123/SP800-123.pdf [3] https://www.schneier.com/crypto-gram/archives/2003/0815.html [4] http://tech.slashdot.org/story/01/07/23/2043209/when-security-through-obscurity-isnt-so-bad [5] http://catb.org/jargon/html/S/security-through-obscurity.html [6] http://users.softlab.ntua.gr/~taver/security/secur3.html [7] http://www.pearsonitcertification.com/articles/article.aspx?p=2218577&seqNum=7 [8] https://danielmiessler.com/study/security_and_obscurity/