For anyone working in the lucrative space of backasswards, miserable enterprise IT systems, this is really easy to understand. However, because it's so broad in

For anyone working in the lucrative space of backasswards, miserable enterprise IT systems, this is really easy to understand. However, because it's so broad in actual scope of what it actually does (no actual law / compliance standards mentioned like PCI, HIPAA, FIPS, etc), it is really just a marketing headline. Tack on a bunch of standards like Kerberos, OAuth, LDAP, etc. and most people that are the target audience will roll their eyes and just write the project off as neckbeard-ware because they don't have a peer that they can talk about high level enterprise BS with. Basically, the point of the project is to make it easier for programs written by folks like the usual HN reader (not J2EE enterprise crapware) to be compliant with the needs of Big IT that is primarily focused around security and consolidating herds of acquired and bought applications while being able to say that these services all meet different regulatory requirements with a straight face. This is quite different of an approach than most in that this is open sourced, not some proprietary thing made by a system integrator nobody on HN would recognize. Disclaimer: I've been pitching and writing stuff like this as an engineer for years, so I am probably biased a lot.