> it's kind of a security-by-obscurity measure This comes up as a point of confusion often, so allow me to clarify: A non-standard port as the only security m

> it's kind of a security-by-obscurity measure This comes up as a point of confusion often, so allow me to clarify: A non-standard port as the only security mechanism (e.g., an unauthenticated HTTP admin-interface) would indeed be 'security through obscurity', but a non-standard port as an extra mitigation layer on top of existing security mechanisms (e.g., SSH authentication) is 'defense in depth'.