Heartbleed was in openssl, and Log4J in java. What does it have to do with openssh ?

> Heartbleed was in openssl... What does it have to do with openssh ?

Exactly.

I can't speak for Log4J as I have no experience, but I do know that anyone sensible agrees that OpenSSL is a pile of bloated dog poo.

OpenSSH, as I've already said, is written by the OpenBSD crew. They have a track record of having OCD about writing secure and correct software.

Okay, so are they going to live forever and keep writing impeccable software for eternity? What happens when they tire of their immortality, and decide to pass the torch?

Then we'll stop using it? On any port number?

One day it will be openssh.

> One day it will be openssh.

As I said mate, go look at CVE.

Its been YEARS/DECADES since the last serious vulnerability in OpenSSH.

That's despite being one of the most widely deployed pieces of software on the internet.

Have you ever been responsible for security in a professional sense? Hiding attack surfaces is standard operating procedure. No one with a triple digit IQ seriously thinks any piece of software is going to be secure to infinity.

When that day comes, a machine running sshd on a high port will have to be wiped, because how can you trust that nobody’s scanned your ports, exploited your server, and eliminated the traces?

When an OpenSSH zero‐day gets released, you can bet your bottom dollar people will be scanning full port ranges for SSH servers. And only one of them has to find you.

If that’s the scenario you’re worried about, don’t rely on obscure ports. Run your sshd behind a VPN.

The gnashing of teeth from those running on standard ports would probably be loud enough to give at least some of us time patch.