There's a reality that the second you put something on the Internet it starts being scanned by bots and bad actors. The problem with the various "checking your

There's a reality that the second you put something on the Internet it starts being scanned by bots and bad actors. The problem with the various "checking your door is locked" analogies is that you'd have to picture a locksmith putting in a door with five bad actors lined up behind up waiting to check it immediately. The HN crowd is probably thinking about startups with in-house apps, but the canonical case for this argument is the Microsoft Exchange or Confluence servers that are consistently abused by ransomware actors - which then go on to cost that Government a lot of money as they get dragged into suppliers and contractors being held up for ransom, or investigatory resources being spent in response. It's very easy to tell who owns such a server, and being proactive helps address that. It's fine to "not trust", but if this service poses any more of a threat to an organisation than the dozens of services already running you've got other issues.