zang
Senior Member
Without wishing to derail the thread too very much, are you saying that "no security" is more secure than "security"? If so, I imagine that plenty of IT security professionals would disagree with that statement. Also: when you say "publicly visible", do you instead mean "likely to be indexed by a search engine"? Just because c12987324987.whatever.com doesn't immediately describe the site content doesn't mean that it's not publicly visible.
As you point out, nothing inherently wrong with having a live dev/demo site, but to have such a thing for a client like Ford (definitely not an international celebrity, after all!) shows a stunning lack of awareness on the part of whoever put it up.
It is a campaign website, with little on it. You're over valuing it. It's not much more than a digital campaign brochure.
I'm not defending the developer's lack of wisdom, I'm saying that in this case the amount of security people seem to think there should've been is quite hilarious.
Re: security: "security through obscurity" is a poor practice, if you have something worth protecting, and unnecessary login requirements create potential vulnerabilities (to the server itself, and any other site hosted on it) and doubly attract attention from hackers and script kiddies once indexed. A campaign site like this doesn't require that level of security. It's not Mt. Gox.