Right. Quote from article: "In some respects, the severity of vulnerability can be viewed as mild. But that assumes OpenSSH users are using a cryptographic key

Right. Quote from article: "In some respects, the severity of vulnerability can be viewed as mild. But that assumes OpenSSH users are using a cryptographic key for authentication. Under such an arrangement, only computers with the private key are able to access the Internet-facing server. On top of that, servers themselves should be configured to limit the number of login attempts, and that measure should also go a long way toward making exploitation impractical."