What advanced type of stupid makes articles like this seem completely fine to individuals in the tech sector?
Brian Krebs, as a high-profile author on security who actively antagonizes black-market groups on the internet, is a common target. He has had all of his basic personal information posted on the internet publicly for some time. The credit cards that were used for this attack were all old, disabled ones, since he disabled them after the numbers were leaked; but apparently PayPal still has them listed on the account and so you can use knowledge of them to "prove" your identity to PayPal.
Sounds to me like they're both at fault then. It's really nice and idealistic to have this mentality that you're doing it in the name of infosec, but it's a position held from an ivory tower.
If he's in software, what did he expect? This isn't a wise approach. This is the advanced stupid I'm talking about. Someone who thinks it's wise to antagonize, but then cries and writes an article over it when they're attacked. It's a joke. Conventional wisdom here is nonexistent.
To me, that's a far less complicated question than anything security related at a technical level. You can literally ask a child this question and they'll tell you it's not smart.
This is advanced stupid.
He's not just some internet troll, he's doing real good that you very well may have personally benefited from as a result.
Your solution is to somehow perfectly protect all CC and SSN info?
How do you propose to do that?
This problem isn't unique to Krebs and it doesn't just affect people deliberately sticking their hands in fire.
Regular people have their CC and SSN posted online too.