> That lag creates a perverse choice every vendor of validated modules eventually faces: ship the security fix now and fall off the validated list for a year or more, or keep shipping the validated build with the known flaw. Customers whose contracts require an active certificate are, in effect, paying the vendor to choose the second option.

That's what the blog post says about why/when FIPS is turned off, although I'm not sure I completely agree with this take. All forms of compliance in all industries (not just IT) is like this. Otherwise we get a lot of cowboy solutions.

This is why compliance does not operate in a silo. There's the baseline (when FIPS is on) and then there's the real world configuration that the business must carefully accept along with its own risks. This is why you have your own employees auditing and collaborating with everyone else involved in the decisions. That can often include the client wanting your services that depend on the HSMs. I'm not understanding what all the frustration is about unless some people have just never left their silo.

If your client is the government, then of course they're going to be very strict about FIPS. We're all at least in agreement that FIPS sucks because it moves at a glacial pace. There's a reason the phrase: "good enough for government work" means mediocre.