3 ms·
Fair. Level 1 can be heavy on paperwork, and compliance code can add complexity. But ‘algorithm certs are worthless’ is overstated: lots of crypto failures are
by firesteelrain 9mo ago
Fair. Level 1 can be heavy on paperwork, and compliance code can add complexity. But ‘algorithm certs are worthless’ is overstated: lots of crypto failures are silent misuse (modes/nonces/RNG/key handling), not ‘AES won’t decrypt.’ FIPS isn’t a magic shield, it’s a baseline control. Whether it’s net-positive depends on how much it slows upgrades and how disciplined the team already is.