Security through obscurity is bad only if the obscurity is the only measure