> I listen to his weekly Security Now podcast and without failure he is well-prepared, thorough, accurate and correct. Even when he makes a small mistake next week he comes along, specifies the exact mistake and apologises and corrects it.

> Perhaps he made some mistakes or took controversial positions like ... when? 10 years ago? and people wont let it go.

According to archive.org [1] the password haystack page [2] is from June 2011. He hasn't changed his "controversial" opinion on that matter yet.

[1] http://web.archive.org/web/*/https://www.grc.com/haystack.ht...

[2] https://www.grc.com/haystack.htm