> Logical thought and analysis has no place in PCI compliance. Only at a local level. If you're writing standards that are going to be rolled out to the whole

> Logical thought and analysis has no place in PCI compliance. Only at a local level. If you're writing standards that are going to be rolled out to the whole world and are difficult to change, and where the potential downside is people losing a lot of money, then a 'better safe than sorry' heuristic is the correct choice. Monkey-patching into your payments library at runtime certainly doesn't seem like a 'safe' practice that PCI ought to endorse at all. It's essentially impossible to write a standard that perfectly anticipates every edge case. And if it were possible, the list of rules would be even longer and more difficult to follow.