> I'm trying to understand

Well on the one hand you make it seem like you're here for genuine adult conversation.

On the other hand you call people that disagree with you the "NSA".

And that is the point this conservation has outlived its usefulness :)

Yeah, it might read like that, but it also is how I feel. If I was running a crypto farm, or if I was doing security research, I would have different levels of concerns.

But, in fact, hosting a competitive gsmijg website, I did experience common brute force and and other types of attacks, but fail2ban did foil them for years :)

None of the attackers were ever sophisticated enough to come up with a successful attack (that I know of :))

The point is, should everything be do all the best practices as if they were equally likely to be attacked?

It’s like saying that everyone should also have a faraday cage house, and electrified fences, it is the best practice, after all.

For the record, and whatever worth - it is the (it seems, serious) conviction of here folks (and I concur) that the NSA is at least a reader of these threads.-

PS. So, hi!

PS. I'll take the negvotes as confirmation I guess ...

Every large- or medium-sized multi-user server disables passwords for SSH login, because they're worried about things like password stuffing - and because they know password reuse is unavoidable when you've got even a small fleet of servers.

At the same time for most users certificate-based login is easy (no need to enter a password every time) and they've already got it set up, because github and AWS work that way.