Loading comment...
Loading parent story...
Loading comment...
Loading parent story...
Loading comment...
If this is still true in the latest versions, I find it pretty amazing that something like this has been maintained all the way until 2023.
Since the build is reproducible, it should not matter when it was built. If you want to trace a build back to its source, there are much better ways than a timestamp.
The opposite of "bad security through obscurity" is using completely public and standard mechanisms/protocols/algorithms such as TLS, PGP or pin tumbler locks. The security then comes from the keys and other secrets, which are chosen from the space permitted by the mechanism with sufficient entropy or other desirable properties.
The line is drawn between obscuring the mechanism, which is designed to have measurable security properties (cryptographic strength, enumeration prevention, lock security pins), and obscuring the keys that are essentially just random hidden information.
Obscuring the mechanism provides some security as well, sure, but a public mechanism can be publicly verified to provide security based only on secret keys.
Loading parent story...
Loading comment...
[0]: https://en.wikipedia.org/wiki/Museum_of_Bad_Art#Collection_h...
Loading parent story...
Loading comment...