You'd be surprised (or maybe not) on the number of experts who fight out about security through obscurity these days - because it's cool to do so. One particul

You'd be surprised (or maybe not) on the number of experts who fight out about security through obscurity these days - because it's cool to do so. One particular example is using non-standard database ports. I have to fight all the time. "It's pointless. You make it harder for users (well, not really, the one-time setup of an application maybe), and it's not any more secure because it can be port scanned." Personally I disagree because I think port scans are the kind of thing you should, you know, pick up through other software. Their response to this is that nobody tracks internal port scanning, and that it's always external. I give up by that point. Because you can't complain about insider threats but then decide not to bother looking at anything internal.