I've used some very tight-arsed VPS providers at the low range (128MB/1IPV4/$12 a year) and some of them mention a high load, and it's mainly due to brute force

I've used some very tight-arsed VPS providers at the low range (128MB/1IPV4/$12 a year) and some of them mention a high load, and it's mainly due to brute force on port 22. It makes sense to change port purely to avoid the low-barrier noise but of course it isn't much better security. Port knocking is on the same lines. I'm by no means a security expert but these measures would surely help: less opportunists = less opportunities. Saying that, I'm public key auth only and disabling any public facing service I'm not using. The "security through obscurity" thing seems like a warning to avoid shortcuts rather than some implementations that help reduce noise. As long as you understand the fundamental problem of security, the obscurity thing is just a sidebar.