Hacker News Reader

One day it will be openssh.

When that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces?

When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you.

If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.

> One day it will be openssh.

As I said mate, go look at CVE.

Its been YEARS/DECADES since the last serious vulnerability in OpenSSH.

That's despite being one of the most widely deployed pieces of software on the internet.

Have you ever been responsible for security in a professional sense? Hiding attack surfaces is standard operating procedure. No one with a triple digit IQ seriously thinks any piece of software is going to be secure to infinity.

Reply on news.ycombinator.com