Hiding open ports with shimmer

The argument is that using Shimmer reduces the exposure of any bugs in, say, OpenSSH's
authentication code.

But given that OpenSSH uses privilege separation during the authentication phase, and that
using Shimmer adds more code to the application stack, it's possible (probable?) that Shimmer
could increase susceptibility and exposure to attack. Just because Shimmer doesn't exchange
messages over the network doesn't mean its immune to bug exploitation.

It may prove in this case that "less is more" is a more apposite cliche than "defense in
depth".

As for the argument that Shimmer is just obsfuscation, I agree. At best it adds only a few
bits of potential entropy to the access key. As regards better passwords or public/private
keys it hardly compares favorably.

On OpenBSD I just use PF rate-limiting to keep the bots from filling my logs. It's the only
use I have for a packet filter (or traditional "firewall"). Most anything else just adds
additional work for no appreciable gain.