Changing a port adds one bit of entropy. Not being forced to use "admin" as a username adds a whole bunch, but at least one bit. Not being forced to use https:/

Changing a port adds one bit of entropy. Not being forced to use "admin" as a username adds a whole bunch, but at least one bit. Not being forced to use https://url/admin https://url/admin also adds another bunch, but at least 1 bit. Of course, if any of these things are known the entropy drops to zero... Just like a private ssh key that gets pwnd. All too often I see tickets on open source projects asking for changes to allow better obfuscation, which are then denied using the mantra "obscurity is not security". They all add bits of entropy to a security and/or threat model that maintainers ignore.