I’m never one to victim-blame after a breach. Security is hard, social engineering always works eventually, and risk management is genuinely complex. Unless an org was WILDLY negligent, I’m a big believer in not shaming them for getting breached.

That said, the moment a breached org describes the breach as being the result of a “sophisticated” attack, every neck hair I have stands on end and I prepare to retract the benefit of the doubt. Because 99% of the time*, that “sophistication” was a kid claiming to be the county password inspector in an email or some shit.

Is there a non-US equivalent of the ISRG and/or LetsEncrypt? They’ve done excellent work making a more secure web, but having all our eggs in one country’s regulatory regime makes me nervous

And no, I don’t consider commercial offerings to be a solution — they have their place, but LetsEncrypt-style, no-cost, low-friction TLS certs are important too.