I was thinking maybe this goes back to people in security looking at things in a different way than others? Like ITSec folks spend all day everyday reading abou

I was thinking maybe this goes back to people in security looking at things in a different way than others? Like ITSec folks spend all day everyday reading about every possible way a bad actor can make bad things happen. They look at something like changing the port SSH listens on and think about all the ways the best & brightest bad actors will get around that in no time at all. Everything ends up looking pretty useless at some point, because you end up seeing that it's possible to get around nearly everything. Another example might be folks in the security community saying that SMS 2fa is no good because all it takes is someone taking over your phone account to get around. Sure, that happens, but not all that often, and usually happens to people with something that's worth time & focus by talented bad actors. "Security by obscurity is not enough by itself. You should always enforce the best practices. However, if you can reduce the risk with zero cost, you should do that. Obscurity is a good layer of security." I rather like the conclusion.