<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jul 23, 2018, at 3:27 PM, Rob Thomas <<a href="mailto:xrobau@gmail.com" class="">xrobau@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" class="">But shouldn't your public mail server be out of scope for PCI?<br class=""></blockquote><br class="">Here. ladies and gentleman, is a nerd that has never encountered the<br class="">insanity and conflicting information that is PCI. Be quiet, we don't<br class="">want to scare it.<br class=""><br class="">In all seriousness, yes, they will fail you if you have anything<br class="">listening on a machine that accepts TLS1.0 connections. </div></div></blockquote><div><br class=""></div><div>Then you push back, and they don’t.</div><div><br class=""></div><div>That’s how it works.</div><div><br class=""></div><div>If you have an incompetent auditor <i class="">and </i>you’re a passive customer, you’re going to have a bad time.</div><div><br class=""></div><div>If you know what you’re doing, know where the boundaries of the CDE are, and know what the PCI-DSS spec actually says, <i class="">and push back on the auditor’s nonsense when they step out of bounds</i>, then you’ll have a better time.</div><div><br class=""></div><div>You’re the auditor’s customer. You have a right to expect that they aren’t shit.</div><div><br class=""></div><div> - mark</div><div><br class=""></div></div><br class=""><div class=""><br class=""></div></body></html>