And yet, you shouldn't give your attackers information to make their lives easier.

That sentence is about relying on 'obscurity' instead of security, not _in addition to_

Ignoring that security through obscurity is a part of a layered security approach (and the rote "security through obscurity is bad" noise is silly), this isn't about security through obscurity: These profoundly incompetent clowns are taking private networks and port mapping RDP servers, web apis, and other systems to the public internet. Much of what they are doing is profoundly criminal (quite aside from the grotesque incompetence), but they have the out that they'll just get a pardon.

This submission will be flagged off the front page soon enough as the raw, profound incompetence of this crew of misfits leads to too much strife, but it is simply staggering to think that anyone thinks these clowns know what they're doing. Government is fat and has loads to improve, but having a group of big ball morons looking at line item descriptions and going with whatever their first impression of its meaning is is just so catastrophically stupid, yet here we are.

Keeping stuff airgapped and away from public networks isn't security through obscurity, what are you even talking about?