4 ms·
I wouldn't dare name and shame. The worst one liked to sign off phone calls with us and the cliebt with a legal threat in our direction and a horror story in th
by madaxe_again 10y ago
I wouldn't dare name and shame. The worst one liked to sign off phone calls with us and the cliebt with a legal threat in our direction and a horror story in the clients'.
Like I said, there are good PCI QSAs out there, but there are also plenty who'll make you want to jump off a bridge.
In my opinion it's made the entire standard a total joke. Bully the web provider, ignore the bricks and mortar "write the credit card number and cvv in a ring binder 'process'". Does the retailer no good either, apart from making them feel secure, as that cost so much it must have been good, right? Right?!
Yes, I'm bitter.
- mcherm 10y agoPublicly shaming them on Hacker News is one thing, but PCI compliance reviewers are certified; the individual can be reported to the governing agency.
- Normal_gaussian 10y agos/can/should/ I would say we have a social responsibility to do so
- akshatpradhan 10y agoExactly, and if you feel there's isn't a safe place to discuss social responsibility regarding PCI and HIPAA, you can check out http://www.reddit.com/r/hipaa http://www.reddit.com/r/hipaa (250+ redditors) https://www.reddit.com/r/pcicompliance https://www.reddit.com/r/pcicompliance (250+ redditors) As well as ##CompSec in irc.freenode.org