> Actually it is needed to tell the clients which authentication apps are enabled.
> This even has to be exposed without login because it is before login. ;-)

Only if they add additional forms to the login screen, and in this case: Exposing it is fully ok.  
But in other cases like `user_ldap` this can be hidden at all because it doesn't change anything on the login screen.

> The only problem might be if one of the apps has a security problem and we tell the users that it is installed. 

The point there is that I'm as admin maybe don't want my users to know which apps are all enabled. Why should my users know that there is the - imaginary - app `spy_my_users`? :-)

Also: Security through obscurity adds only a little bit of additional security, but sometimes this is the additional little bit which is required to prevent an attack. (Btw. for me this has the same impact as displaying an user list, which we doesn't do)

But ok, I won't put a veto or something here. If you really think you *need* this function *this way* (without exposing the apps manually, as suggested in my comments above) - I'm ok with this, even if I wouldn't be thrilled about the solution ;-)

(You know, I'm even "this ugly guy" who hates it that ownCloud is exposing the version with status.php ;-) )

> But then the solution is to fix the security problem and not hiding it from the users.

:-)