Most of the time I check if these articles chastising a particular industry are written after some consulting experience or is it just hubris. This article see

Most of the time I check if these articles chastising a particular industry are written after some consulting experience or is it just hubris. This article seems to be based on the latter - But for anyone with even a beginners knowledge of security, it’s bullshit. To avoid a rant, let me give an example about a social networking site. Back in 2015 with the announcement of SHA1 vulnerability, the company started systematically replacing stuff with SHA2. The issue came - some users in APAC region were on old mini browsers and unable to connect to the site. Given the SHA2 was still 2 years away the company shaped the traffic to accommodate SHA1 users. So the company was doing, as mentioned by the author minimum possible as required. But to accommodate all users, there was no other choice.