The argument is that using Shimmer reduces the exposure of any bugs in, say, OpenSSH's authentication code. But given that OpenSSH uses privilege separation during the authentication phase, and that using Shimmer adds more code to the application stack, it's possible (probable?) that Shimmer could increase susceptibility and exposure to attack. Just because Shimmer doesn't exchange messages over the network doesn't mean its immune to bug exploitation. It may prove in this case that "less is more" is a more apposite cliche than "defense in depth". As for the argument that Shimmer is just obsfuscation, I agree. At best it adds only a few bits of potential entropy to the access key. As regards better passwords or public/private keys it hardly compares favorably. On OpenBSD I just use PF rate-limiting to keep the bots from filling my logs. It's the only use I have for a packet filter (or traditional "firewall"). Most anything else just adds additional work for no appreciable gain.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds