> They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it. First of all, I don't think that's true, a

> They have tried repeatedly for decades and spent huge gobs of money. It is not a choice, they are incapable of it. First of all, I don't think that's true, and if it is, I would like to see proof of Apple submitting their products for evaluation. Second, you are judging an entire industry. This is not about Apple shortcomings, there isn't a single vendor doing what you say needs to be done. Regardless, and this is more a personal opinion than a hard fact, most certifications out there are BS. PCI-DSS is basically a checklist of best practices, CC goes from common sense stuff to essentially impossible to achieve unless designed for the specific purpose, etc. Yes, all these helped create a very healthy - and profitable - industry where consultants have thrived on Powerpoints and PDFs, without really creating any tangible value.