Hector Martin

Of course that doesn't mean you should never do it, since sometimes obfuscation is all you *can* do, but what they've done here is silly.

I agree in this particular case, but which is safer, a safe on a street corner or a safe buried in an unknown field?

Bad analogy; in this world everyone owns a copy of the safe and can make safe-cracking robots for free and combine efforts.

Maybe having access to the same model safe, but not necessarily a copy of the safe with the same contents. That would depend on situation.

For obfuscation it's always a copy of the safe with the same contents. Otherwise there is other security involved. Obfuscation is cloneable.

Maybe we have a different understanding of what "security by obscurity" means. Consider: place an encrypted file on obscure url vs obvious

That's actually not obscurity, it's real security (akin to a password), assuming no directory listing etc.

Obviously there are potential pitfalls, but the concept is secure and putting security tokens in URLs is common practice.