anjbe

Good post! I must point out, though, the correct symbol for minutes and seconds is actually the prime. As in, 10° 33′ 19″.

That’s the Unicode way of doing things (which I heartily subscribe to), but in ASCII’s original conception what you describe as “abuse” was a feature. For instance, in RFC 20 which is dated 1969, 0x27 is named “Apostrophe (Closing Single Quotation Mark/Acute Accent)” and 0x60 is named “Grave Accent (Opening Single Quotation Mark)”. Additionally, double quote also served as a diaeresis, and comma as a cedilla.

Of course, your links are right: it makes no sense to overload these characters anymore now that we have character sets and software capable of providing typographic niceties. But it’s fun to know the history.

In the old days of ASCII several characters were heavily overloaded. On teletypes it was not unusual to create accented characters by typing ` or ' (which looked more like ´), then backspacing and typing a vowel, to get (e.g.) è or é. The same could be done with ~ to create ñ, if the tilde were high up like ˜, or with " to simulate an umlaut.

And of course there’s the overload of hyphen and minus, such that Unicode gave up and named U+002D “hyphen‐minus,” and created two separate characters U+2212 “minus” (−) and U+2010 “hyphen” (‐) to use in situations where the typography matters. Most fonts seem to use identical glyphs for hyphen‐minus and minus, but I’ve seen some that try to split the difference, giving hyphen‐minus a glyph with a height and width somewhere in between hyphen and minus.

If you find minus and hyphen‐minus hard to distinguish visually, just remember that a true minus sign looks just like a plus without the vertical part. Compare the alignments:

- example (U+002D hyphen‐minus)

+ example (plus)

− example (U+2212 minus)

When that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces?

When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you.

If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.

If animals in nature had a defense against predators as effective as “PasswordAuthentication no”, they wouldn’t need camouflage.

> You can maintain a .ssh/config file with all the port that you used (and backup it)

Once you start distributing config files to all your clients you might as well switch to keypair authentication, which so completely reduces risk of intrusion that leaving sshd on 22 simply does not matter.

> that consumes resources (even if minimal)

I suspect practically immeasurable.

Do people using high ports actually check their logs enough for it to matter?

The thesis of the article, that security through obscurity is underrated, is “because it has a low implementation cost and it usually works well.”

But I contest both of those things. Common obscurity methods provide low benefit for the amount of work put in, relative to methods with a better foundation.

One of the best examples of this is port knocking, a resurging fad in self‐hosting circles, that is completely beaten both in simplicity and in actual protection by putting your SSH server behind WireGuard.

Even the example in the article seems ridiculous. I always advocate disabling SSH passwords and using FIDO‐backed SSH keys instead, but of course people will complain that they lose the ability to log in from arbitrary machines (well worth it in my opinion, but fine). So rather than using SSH with a weak password on a non‐default port, why not use SSH with a strong password on a default port, which provides more entropy and also some protection against attacks by a local user, without having to remember weird port numbers?

Star Wars is a particularly salient example because the original cuts that made the films such cultural icons are completely unavailable from anyone other than third‐party sellers, due to the wishes of the (former) rights holder. After the Special Editions were released, the theatrical editions made it onto DVD one time, and never did again. J.J. Abrams has indicated that there are difficulties behind the scenes (perhaps some clause in the Disney purchase) that prevent the originals from being made available for sale. So people who want to avoid the CGI and bad redubs of the Special Editions are stuck scrounging eBay, or more likely, grabbing an “unofficial” scan of the theatrical editions.