[michaelg7x]

We often see the "don't roll your own crypto", and of course, in a production setting that's obligatory advice. I think that it's a valuable exercise for anyone to implement some of the algorithms and protocols, just to understand the complexity within. I did that for a minimal TLS1.2 implementation, just because, and it was a valuable exercise. Do you see any value in changing the slant you put on "don't try this at home"?

[munchbunny]

I think there has always been an implied exception for doing things for their pedagogical value. In the case of my previous comment, I think it’s pretty clear that I’m talking about production code.

As far as rolling your own crypto goes, I think the advice should be “only try it at home and don’t ever use it in production even for yourself”.