Hacker News Reader

> obscurity is a totally valid tactic to impose additional costs on attackers

But there's the rub: you'll only impose additional costs to the least sophisticated/determined adversaries. While that works to keep random scriptkiddies/scans out, I'd argue it has little to no effect if you require serious security guarantees.

View on HN

It imposes costs on all attackers. The value of that cost is skill dependent, but no one has unlimited time on their hands. In other contexts, like hiding an admin login page, shutting out low skill attackers means your log files have better signal to noise, and you can focus more resources on the more significant threats.

The reason I say to think of it as a preemptive strike rather than a defense is that you still do need strong defensive layers.

This is basically just setting a compiler flag. It's free for you and costs something for the attacker.

At least the bar for entry is a little bit higher, this in itself might be worth it then

Reply on news.ycombinator.com