Security consultant here - I put it in many of our reports (whenever we notice such a policy). They're not exactly changing course just yet, but we do try to co

Security consultant here - I put it in many of our reports (whenever we notice such a policy). They're not exactly changing course just yet, but we do try to communicate the good news where relevant. Also to avoid complexity requirements ("you don't have any digits in correct horse battery staple, that cannot be secure!") but to use a blacklist and length requirement instead, as recommended by NIST and NCSC (hopefully other countries will follow suit).