I was reading a request on meta Stack Exchange: A request for an informative popup before possible serial voting. It received two seemingly well-informed answers from well-informed users, and I've clipped out the relevant bits of the answers:
This would openly reveal the algorithms used to detect serial voting. Serial voting isn't a problem that only exists if you hit X votes but not X-1 votes. We don't know exactly the algorithm works, but imagine it was 10 votes on a single user in a week: if it warned you when you were about to do vote number 10, then anyone who wanted to manipulate votes in this way would just stop, and wait a few days until the popup stopped being shown to them.
The parameters of serial-vote detection are intentionally kept private. The last thing we want to do is to tell people who intentionally engage in this behavior how to avoid detection.
To me, this looks like the telltale signs of security through obscurity, and wandering around a bit it looks like the SE site also purposely obscures our spam detection logic, though Charcoal seems to provide individual spam detection reasons for debugging purposes. It also appears other big sites obscure spam detection and vote manipulation detection logic (Amazon, Steam, and Youtube so far as I can tell)
One of the first things I learned about computer security is that obscurity tends to be a bad thing and shouldn't be relied upon. Start by assuming your opponent knows your security setup and factor that into your threat model. Yet, when it comes to our spam detection tools and tools from other sites, it seems like obscurity is the cornerstone of the security measures, with the assumption that the opponent doesn't know the logic the tools are using and if they did know then the tools would be worthless. Even the Tag on this question explicitly notes that the tool should not rely only on obscurity, yet here we are.
I'm making the informed assumption that a guy with a CS bachelors isn't smarter than SE's security admins. So the question is, where's the problem with my understanding? Is there some fundamental difference in Spam detection and conventional security as it applies to Kerckhoff's principal that I'm not factoring in, even though both are designed to keep malicious users from corrupting data?