He's correct: PCI is about Visa, MasterCard, Discover and Amex covering themselves, and shifting the blame (and penalties) to merchants.<p>Sure, PCI is written in a way that when you read it you think "random collection of best practices from places that got hacked and learned something from it", but the definition of "compliance" is such that a merchant just can't stay in "compliance".  It's impossible.<p>So, this leads us to two inescapable conclusions:
1. "Best practices" are just CYA.
2. Any time someone in power says "compliance" keep your hand on your wallet and start edging towards the door.