I wonder what is the PCI DSS audit committee doing? I mean the world is fool of idiots that need policing and that's why such organs exists at a first place.
Shit like this just shows that being a PCI DSS level 1 certified means absolutely nothing in the real world.
The great benefit of PCI DSS is that a huge number of places choose not to store CC numbers when given a choice of trying to get an expensive PCI DSS certification and not storing CC numbers.
We get less of small, random places handling data that they won't ever be able to secure (since it really is completely prohibitively expensive for a small shop to do it properly), and that is a good thing.
Of course, the fact that certified places still often fsck up in some way is a bit sad, but at least there are less of them.
You got that right. Most IT shops I've noticed (at least in Australia) used to ask software vendors if their software was "PCI-DSS 2.0 compliant".
Stupid thing to ask. The only key things a software vendor can really answer is that they don't store credit cards in their database, or if they do then they don't display them to anyone. Everything else (well, almost everything else) can be dealt with on the infrastructure side of the equation.
I have to disagree with you most emphatically. PCI DSS was a response to a very bad issue, which was and is credit card fraud.
If you look at the DSS, it's eminently sensible and in fact if you implement it properly you will most definitely have a secure environment for credit card transactions. If you do not follow it, then you are leaving yourself at significant risk to be being breached and credit card data being stolen.
I'm curious though: what part of the PCI-DSS merely creates "a racket", and what parts "extract money"?
Shit like this just shows that being a PCI DSS level 1 certified means absolutely nothing in the real world.