HW/FW security researcher & Demoscene elder.

I started having arguments online back on Fidonet and Usenet. I’m too tired to care now.

  • 0 Posts
  • 147 Comments
Joined 2 years ago
cake
Cake day: June 12th, 2023

help-circle





  • Especially in coding?

    Actually, that’s where they are the least suited. Companies will spend more money on cleaning up bad code bases (not least from a security point of view) than is gained from “vibe coding”.

    Audio, art - anything that doesn’t need “bit perfect” output is another thing though.










  • Still no. Here’s the reasoning: A well known SSHd is the most secure codebase you’ll find out there. With key-based login only, it’s not possible to brute force entry. Thus, changing port or running fail2ban doesn’t add anything to the security of your system, it just gets rid of bot login log entries and some - very minimal - resource usage.

    If there’s a public SSHd exploit out, attackers will portscan and and find your SSHd anyway. If there’s a 0-day out it’s the same.

    (your points 4 and 5 are outside the scope of the SSH discussion)




  • A few replies here give the correct advice. Others are just way off.

    To those of you who wrote anything else than “disable passwords, use key based login only and you’re good” - please spend more time learning the subject before offering up advice to others.

    (fail2ban is nice to run in addition, I do so myself, but it’s more for to stop wasting resources than having to do with security since no one is bruteforcing keys)