[upofadown]

Checking the required hardware noise performance:

>On superconducting architectures with 10−3 physical error rates...

So still 1-2 orders of magnitude better than what we can achieve.

This is against a 256 bit elliptic curve. For some reason most people are stating the difficulty of using Shor's against 2048 bit RSA. Elliptic curves are easier to break with Shor's. I wonder how much of the optimization came from that fact alone...

[pseudohadamard]

That's because it's easier to cheat with the IFP (the underlying problem that RSA is built on) than the DLP, so everyone generates RSA "records" and ignores the actual problem that needs to be solved.