# Does this board use a security company like Cloudflare or BitMitigate? **URL:** \ **Category:** About This Message Board\ **Created:** [August 6, 2019, 1:39am UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212 "2019-08-06T01:39:02Z")\ **Posts on this page:** 10\ **Page:** 2
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [August 6, 2019, 8:58pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/21 "2019-08-06T20:58:31Z")
> [@Snowboarder\_Bo](#): > > …and that’s why governments everywhere no longer classify information as secret, right? :dubious: OK, tell me how DDoS protection even _can_ be secret. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [August 6, 2019, 9:01pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/22 "2019-08-06T21:01:40Z")
> [@Snowboarder\_Bo](#): > > …and that’s why governments everywhere no longer classify information as secret, right? :dubious: Do you have a cyber security background that I’m unaware of? It seems like you have strong feelings about the field, but this is more of a non sequitur than anything else. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [August 6, 2019, 9:15pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/23 "2019-08-06T21:15:30Z")
In any security system, you need to make a strong distinction between information which can and should be secret, and information which can’t or shouldn’t. If I tell you that I’m transmitting a message using RSA encryption, then I’m giving away nothing. If I tell you what private key I’m using to encrypt my message, then you’ll eventually figure out what encryption method I’m using that key with. Security by obscurity is an especially bad idea in cybersecurity, because for any given cybersecurity task, there are a very small number of good solutions, and a very large number of terrible solutions, and the small number of good solutions are all well-known. So if you make an effort to avoid the well-known solutions, you’re likely to end up with a terrible solution. ---
**Author:** ![Sunny\_Daze](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunny_daze/32/438_2.png) [@Sunny\_Daze](https://boards.straightdope.com/u/Sunny_Daze)\ **Post date:** [August 6, 2019, 10:43pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/24 "2019-08-06T22:43:02Z")
I specifically noted that security by obscurity is insufficient. I disagree that you need to (or should) tell others what your protection is. For example, a shopping website might disclose their vendor (McAfee or Norton say) to assure customers their data is protected. They don’t tell customers exactly how that works. ---
**Author:** ![steronz](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steronz/32/11765_2.png) [@steronz](https://boards.straightdope.com/u/steronz)\ **Post date:** [August 6, 2019, 11:50pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/25 "2019-08-06T23:50:06Z")
> [@Sunny\_Daze](#): > > I specifically noted that security by obscurity is insufficient. I disagree that you need to (or should) tell others what your protection is. For example, a shopping website might disclose their vendor (McAfee or Norton say) to assure customers their data is protected. They don’t tell customers exactly how that works. That’s certainly one way to operate, but I’d disagree – McAfee should disclose exactly how it works, because then security flaws in their methods can be identified and fixed by white hats before exploits are developed. This is the entire concept behind open source software. Most of the internet’s security apparatus is open source so, yes, everyone knows exactly how it works. See the Heartbleed bug from a few years back for an example how removing all obscurity makes things more secure. Obviously there are differing opinions, and some companies prefer proprietary, secret security code. But even right here, the SDMB is run on vBulletin, which isn’t open source but the code is published so anyone can find security flaws. eta: In reference to Heartbleed, we see one of the limited cases where secrecy is important. That is, knowledge of the vulnerability was kept secret by a select few individuals until a patch was ready. That’s good security, so there is a place for secrecy. ---
**Author:** ![Duckster](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/duckster/32/1244_2.png) [@Duckster](https://boards.straightdope.com/u/Duckster)\ **Post date:** [August 7, 2019, 1:21am UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/26 "2019-08-07T01:21:29Z")
> [@TubaDiva](#): > > Dunno but that’s part of the deal, isn’t it? That’s not the kind of information a company wants to make public – they don’t want to talk about their security measures because it IS a matter of security. The SDMB IP address tells you a lot. You can infer security by knowing the ISP. ---
**Author:** ![Ludovic](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@Ludovic](https://boards.straightdope.com/u/Ludovic)\ **Post date:** [August 7, 2019, 11:29am UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/27 "2019-08-07T11:29:12Z")
> [@Sunny\_Daze](#): > > I specifically noted that security by obscurity is insufficient. I disagree that you need to (or should) tell others what your protection is. This. Not revealing what your vulnerabilities are is not _worse_ than revealing them, so all else being equal, why say what your security is? I could understand it if a billion dollar company with millions of peoples personal information were at stake. Then the million people could collectively criticize the security and move it toward rock solidness, and you may as well tell everyone what your security is because the organized criminals trying to hack in will find out anyway. This is the opposite of that. There isn’t enough money and users in the Dope for crowdsourced security, and I’m not sure if there is enough money in it for criminals to try to find out what the security is, whereas if it were given on a golden platter they might try it for the lulz or for practice. ---
**Author:** ![Derleth](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Derleth](https://boards.straightdope.com/u/Derleth)\ **Post date:** [August 7, 2019, 6:10pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/28 "2019-08-07T18:10:10Z")
> [@Sunny\_Daze](#): > > I specifically noted that security by obscurity is insufficient. Impossible, in this case, showing that security through obscurity is utterly irrelevant to DDoS protection. I really wish the people who didn’t know what they were talking about would stay _out_ of these threads. ---
**Author:** ![Sunny\_Daze](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sunny_daze/32/438_2.png) [@Sunny\_Daze](https://boards.straightdope.com/u/Sunny_Daze)\ **Post date:** [August 7, 2019, 9:09pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/29 "2019-08-07T21:09:31Z")
I have no idea what you think DDoS protection is or why you think its presence or implementation would or should be obvious to anyone who isn’t involved in network security at the company prior to the time it’s needed. I’m done engaging with you on this. ---
**Author:** ![engineer\_comp\_geek](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/engineer_comp_geek/32/504_2.png) [@engineer\_comp\_geek](https://boards.straightdope.com/u/engineer_comp_geek)\ **Post date:** [August 7, 2019, 9:12pm UTC](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212/30 "2019-08-07T21:12:56Z")
**Moderator Action** Since this is getting a bit snippy, and the OP has been answered about as well as it can be under the circumstances, I am going to close this. [Previous page](https://boards.straightdope.com/t/does-this-board-use-a-security-company-like-cloudflare-or-bitmitigate/838212.md?page=1)