I agree, security through obscurity is not security. It's like hiding your cash under the mattress.
It is, however, a potential delaying tactic and can work well when paired with good security practices throughout. If few specifics are released, it could add a large time buffer between release and hackers finding an attack vector. If the underlying system is very secure, too, the system could well be past it's expected lifespan before an attack is formed.
It's pretty much like having a hidden safe: Before anyone can even try to break in to it, they have to find it.
That said, there's also the flip side. If details are released, white hats have a better chance of finding any holes before black hats do, which would allow Qually to fix them before an attack is available for use.
Biting the hand that feeds IT
