3 ms·

I don't apologize for it, but I don't think yours is the only argument that can be made. What if a security hole is discovered in OpenSSL and overnight all tho

I don't apologize for it, but I don't think yours is the only argument that can be made. What if a security hole is discovered in OpenSSL and overnight all those bots smashing port 22 are tweaked to take advantage of it? Let's assume a vulnerability that doesn't care about password auth being disabled. Sure, they might discover my sshd on port 17263 or whatever eventually but I am surely going to get a significant head start on all of the people having their boxes hacked left right and center. Sure, it's still security by obscurity, but it's nothing like the napkin example. It's more like hiding your phone under a table that has 20 other phones on top of it. When I hear about phones getting stolen, I've got a while to get mine back.

thinkharderdev 6y ago
That works both ways though. Imagine in your scenario you have thousands of servers across a large organization, many that may be running on auto-pilot and don't have any active team maintaining them. When the hypothesizes critical OpenSSL bug pops up, the first thing you will want to do is find out all the server in your network running sshd so you can patch them. If they are all listening on some random port then that task becomes much, much harder.