4 ms·
There's also a principle in security that's called simplicity. "Defense in depth" is often quoted when people want to add further complexity to a system. There
by hannob 5y ago
There's also a principle in security that's called simplicity.
"Defense in depth" is often quoted when people want to add further complexity to a system. There are cases where adding a security mechanism that adds complexity has a benefit that is so large that it's justified (e.g. adding TLS or ASLR). But it always needs to be balanced, because complexity adds attack surface.
The system linked here seems like it's adding a whole lot of complexity and only has a very weak case to be made for what it's good for.
- Aeolun 5y agoThat’s probably why it is described as a toy.
- CydeWeys 5y agoNot making your servers SSHable from the public Internet is absolutely worth it though, and has better simplicity than exposing them (which requires setting up firewall/NAT routes). To be clear, we haven't been talking about the OP port-shuffling scheme for many posts now in this subthread. We're talking about not having your servers be externally SSHable, period.