If you assume lack of cooperation and separation of duties it can sometimes make a microscopic amount of sense. So security says thou shall not VNC and configu

If you assume lack of cooperation and separation of duties it can sometimes make a microscopic amount of sense. So security says thou shall not VNC and configures a very tight system level firewall, preventing some jerk end user from compiling and running a VNC server over port 10000 because the system level firewall blocks everything that's not explicitly permitted. Oh you've "broken" the system SSHD such that I can't even use it, I'll just compile and run my own sshd as an end user and run it on port 11000 or whatever. In practice I'd agree with you in that an org where security, admins, and users are pulling opposite directions is going to have massive problems in general and a mere system level firewall isn't going to patch over all of it. For a distant historical example I've worked at places where for temporary use I've had to shut down apache on port 80 and run sshd there on port 80 for a few moments, just to copy a config file over. A REALLY smart deep packet inspection firewall would notice the conversation on port 80 was very SSH like not HTTP like, but whatever. Speaking of VNC that made me LOL at the linked article suggestion to block X11 traffic, an end user who "really wants GUI" will simply fire up an unauthenticated possibly passwordless VNC server on some port. Security would have been a lot better off with SSH trying to be secure rather than VNC not trying at all. Some end users are just crazy some times. Oh I'm not allowed to run NFS because "security theatre", well OK them I'll just set up anonymous FTP because that's not blocked. I've seen some stuff...