Quick pointer over to some nice postings. Rich Mogull pointed to and responded to an article by Bob Russo from the PCI Council. Bob also responded back in the comments. My feelings are also in comment form, there.

Bottom line: PCI is a great value, an excellent value, as long as you don’t think it is the only thing you need to do, or lash back at it in some odd hatred of “best practices” because, god forbid, they’re not perfect. It is the kind of guideline that so many companies need, and so many of us experts can use to make our cases. It doesn’t end with PCI, but for many it does start with PCI.