Hacker News Reader

Although I agree with your premise, I don't know if it would work out. Look at PCI compliance nowadays: it's all bullshit. PCI is really there for the bank to pass the buck when something goes wrong. It pretends that it's making things more secure, but IME, it does not.

I don't know the answer to this problem though

View on HN

Don't have any experience with PCI compliance but I assume this kind of stuff _should_ remove the most idiotic security holes.

You'd think so, and it's supposed to. IME: As long as your not audited, nobody cares. I know of a place that was PCI approved for over 3 years that was doing every single item on the "do not do list". Since they weren't audited, nobody cared.

Reply on news.ycombinator.com