But doesn’t your argument that the principal risk [with ssh] is vulnerabilities also apply to the alternatives you say is best practice? Firewalling off ssh (but not http(s)) has the risk of vulns in the FW software. Tailscale, wireguard etc also has the risk of vulns in that software?

So what’s the difference in risk of ssh software vulns and other software vulns?

Also, another point of view is that vulnerabilities are not very high on the risk ladder. Weak passwords, password reuse etc are far greater risks. So, the alternatives to ssh you suggest are all reliant on passwords but ssh, in the case, is based on secure keys and no passwords. Should “best practices” not include this perpective?

▲

rl3 11 hours ago | parent [-]

Good defense is layered.

For vulnerabilities, complexity usually equals surface area. WireGuard was created with simplicity in mind.

>So, the alternatives to ssh you suggest are all reliant on passwords but ssh, in the case, is based on secure keys and no passwords.

WireGuard is key-based. I highly suggest reading its whitepaper:

https://www.wireguard.com/papers/wireguard.pdf

	▲	Msurrow 6 hours ago \| parent [-]
		Sure, no one said it wasnt layered. But saying ssh is a risk “on principle” due to possible vulnerabilities, and then implying that if wireguard is used then that risk isnt there is wrong. Wireguard, and any other software, has the same vuln risk “on principle”. > For vulnerabilities, complexity usually equals surface area. WireGuard was created with simplicity in mind. That is such consultant distraction-speak. Simple software can have plenty vulns, and complex software can be well tested. Wireguard being “created with simplicity in mind” doesn’t not make it a better alternative to ssh, since it doesn’t mean ssh wasnt created with simplicity in mind. I don’t disagree that adding a vpn layer is an extra layer of security which can be good. But that does not make ssh bad and vpn good. Further, they serve two different purposes so its comparing Apples to oranges in the first place.