My favourite is the nineteen meetings it took to convince a security team to approve the use of unencrypted HTTP for the certificate revocation list endpoint.

My favourite is the nineteen meetings it took to convince a security team to approve the use of unencrypted HTTP for the certificate revocation list endpoint. No amount of RFC references, live demos of “see, www.google.com does it with HTTP also” would tick the checkbox. “We have a security standard, sir.” over and over, for months.