First, a VPN would best be used as an additional layer of security for the whole network, not as a shell for one particular box. Second, a group very publically announced, by hacking imageshack, that they were going after full-disclosure security blogs. A little later, they warned that they had an ssh 0-day. The prudent thing for a full-disclosure security blog to do would be to put some additional security around their internet-facing ssh.