Hacker News new | past | comments | ask | show | jobs | submit login

Because people who wish you harm for various reasons really exist, and nobody's figured out how to tell the entire world every detail about our defensive capabilities without substantially weakening them in the process.

I'm a little-l libertarian and I'll happily join the calls for "more transparency" where appropriate, but "government should have no secrets", especially in the area of self defense, is not a realistic position. It's an abusable-but-necessary evil.




I don't want to be dragged into politics right now, but

> Because people who wish you harm for various reasons really exist, and nobody's figured out how to tell the entire world every detail about our defensive capabilities without substantially weakening them in the process.

..sounds like security through obscurity to me.


..sounds like security through obscurity to me.

That sounds like you are echoing something you heard once without understanding the reasoning behind it.

security through obscurity usually doesn't make sense WRT computer security because the attacks the computer systems are often subject to are sustained for long periods and can't be stopped (think of someone downloading your software to attack it).

In a military situation you do have the capability to retaliate and/or reinforce. This changes the situation because it makes time a critical factor. In that case, obscurity makes a lot of sense because it slows down the attacker. When you have the ability to change things yourself anything that slows down the attack is useful.

This applies to computer security too - if you can detect an attack, then anything that stops that attack from being successful for long enough that you can neutralize the attack vector is useful. This doesn't imply "security though obscurity", but it does imply that you have defence-in-depth, and you don't give out information about what those lower level defences are. Then if your outer layer is breached there is at least some chance the attacker will trigger some kind of alert while working out what the next layer of defence is. That isn't "security though obscurity", it is "security and obscurity".


No more than keeping your encryption keys a secret is security through obscurity.

Even if you're transparent about your overall scheme, you need to keep some execution details hidden.


no. security and government decency is telling everyone "we spend x billions here and use z and y to encrypt access to it"

what happens is "we spent x billions on toilet seats (to quote an alien movie) and password go over the air unencrypted, but we are not telling you the frequency"




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: