Hacker News Reader

> Security by obscurity does not work. You can not rely on "people won't find it". Once it's online, everyone can find it. No matter how you hide it.

Especially do not name your domainnames in a way that leaks MNPI! Like, imagine if publicly traded companies A and B were discussing a merger or acquisition, do not name your domainname A-and-B.com, m'kay?

View on HN

Case in point: When Daimler and Chrysler merged, they had a law firm (with no other ties to either company) register the DaimlerChrysler domains weeks before the merger was made public.

I don’t recall if anybody noticed before they went public, but as this thread shows, today it would be noticed for sure.

One of the earlier seasons of Survivor had the winner leaked because of something similar.

Their website had bios of every player, with a <playername>.jpg headshot. As they were voted out, their headshot was replaced with <playername>_eliminated.jpg.

As soon as someone realized that, they entered in every player's name with _eliminated.jpg. One player had a 404 for that file.

Reply on news.ycombinator.com