Directly related, if you've been keeping up: RC4 is considered weak crypto and, now that CVE-2013-2566 has a base score of 4.3 (i.e. more than 4.0) and RFC 7465 has been published forbidding its use, offering or accepting RC4 should be considered an automatic fail by any PCI compliance scan.

Most of the tiny percentage of sites which only offer RC4 that I've found have been financial. They may not all necessarily fall under PCI themselves, but this is probably about all we can do.

The next round is on the browsers: IE, Chrome and Firefox turning it off completely (it's already only offered on fallbacks for IE, and recent Firefox; Fx nightlies only offered it on a whitelist of sites which still needed it but I don't think that change made it to release because it broke sites, although obviously breaking sites which will only use weak ciphers is unavoidable).

Now this is out of the way, all we really need to do is set a flag day and throw the switch.

If you're still using or offering RC4 for some reason, for heaven's sake stop, because you're going to regret it if you don't. XP has been out of extended extended support for more than a year now, and even unsupported early Android versions have alternatives.

"Early TLS" means TLS 1.0

This is not very clear until you start digging in. I've never heard TLS 1.0 referred to as "early TLS" and nobody should do that; it has a very specific version number, please use it.

We're going to be stuck with TLS 1.0 for a long time due to Android. Only Kitkat and above support TLS 1.1 and 1.2. Right now Kitkat/Lollipop around hanging around 50% market share for and it's only moving a few percent per month :(

IE<11 on Windows 7 require TLS1 or SSL3, which is not approved by PCI DSS :( How will that work in reality?