Security by obscurity isn’t even bad. It’s only bad if it’s your sole defence. I am confident that my non-default SSH ports, that only accept connections after

Security by obscurity isn’t even bad. It’s only bad if it’s your sole defence. I am confident that my non-default SSH ports, that only accept connections after a sequence of port knocking, adds a slight bit of security to nothing. For example: xz backdoor.