Hacker News Reader

Sure, if you want to argue this point, you're right--if you're already secure, then security through obscurity won't technically make you less secure.

However, taking literally any actual security measure is a better usage of your time. So sure, when you've audited your entire server carefully and are absolutely sure, then it will be useful to add a security through obscurity layer. That is to say, it will never be.

View on HN

So running your SSH daemon on a port other than 22 will never be better than doing something above patching, a solid config, and key or cert-based auth?

I disagree.

If you're listening you are potentially vulnerable to an 0day that is simply far less likely to hit you on 2222 than 22---especially before you hear about others getting pwned and have time to patch.

If you harden to a certain point (like the list above), the next best thing MAY be to get out of the line of fire, either by moving your listener or putting up a portknocker system or something.

Reply on news.ycombinator.com