> And yet is a requirement for many compliance policies. I didn't claim there aren't any incompetent people out there. > For PCI Compliance (ie to store and t

> And yet is a requirement for many compliance policies. I didn't claim there aren't any incompetent people out there. > For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet. "Not having access to the internet" != "private address range". A private address range does not prevent someone external from accessing your machine. That people think that is a dangerous misconception. Also, private address ranges make it much, much harder to reason about your firewall's correctness.