The author is referring to the case where you use a blacklist to drop traffic to certain ports. Dropping traffic looks different than responding with a RST, whi

The author is referring to the case where you use a blacklist to drop traffic to certain ports. Dropping traffic looks different than responding with a RST, which distinguishes that port (since all the others respond with an RST). But, if you instead have a default policy of "drop all incoming traffic", then it doesn't look weird that traffic to port 3306 is dropped, since traffic to all other ports is also dropped. More importantly, you also get the security benefit of using a whitelist rather than a blacklist.