[bob1029]

I dont think the full meaning of my post was taken to heart.

> If you have a specific business application that requires additional scrutiny (i.e. nuclear reactor scram control system), then the appropriate domain-specific regulations & certifications should be applied.

Feel free to replace "nuclear reactor scram control system" with "PII" or any other less urgent thing that makes the particular business nervous. There are many problem domains where you literally cannot fuck this stuff up even if you tried.

The stakes for indie game developers are substantially different than those for a F500 insurance company.

We definitely need to get the fuck out of other people's business. If you dont want someone to have your PII, dont share it with them. Regulating everyone on the same axis is pure tyranny when the problem space is so large.

[mschuster91]

> The stakes for indie game developers are substantially different than those for a F500 insurance company.

No they are not, if your indie game has network connectivity that has security bugs it can and will be exploited.