Good, thought-provoking article, but use with caution. I've seen security through obscurity misused too often as the only line of defence, or as a "temporary"

Good, thought-provoking article, but use with caution. I've seen security through obscurity misused too often as the only line of defence, or as a "temporary" stop-gap that outlives its usefulness. It can lead to a false sense of security. Such measures also do not tend to keep up with changes as attacks become more sophisticated or cheaper to carry out. You also need to make sure that there are no unintended consequences - does your non-standard configuration make it harder to apply upgrades? Does your own penetration testing also scan all ports, or is it only going to discover weak servers running on port 22 on your network? That said, I would do the type of things mentioned in the article as an "added bonus", but try to exclude them from my overall security evaluation (either rough mental model or formal threat model).