The famous phrase don't roll your own crypto, also featured in our memes list, is frankly getting a bit annoying.
There are times when including that advice in an answer is called for, but after a casual skim of the "hot" questions, I see the phrase is something of a universal signature.
The main issue I have with it is if you don't roll your own crypto (and see it crash and fail), how will you ever learn? One could say this site does just that: Post a really clever scheme, and see it torn apart.
A justified inclusion of the phrase in an answer IMO would be in an answer to the Dave variety, where the scheme in question is used in production, and someone's paycheck (or more) depends on it.
To quote a relevant question from The Workplace (emphasis added)
It's way too easy to post "quit your job" as an answer, and almost every post on our site could be answered in this manner.
Replace quit your job with don't roll your own crypto and the situation is almost identical.
Possible ways to answer a question:
- This can be broken by doing [X]. Use [Y] instead, and don't roll your own crypto.
- Don't do that. Use [Y]. Don't roll your own crypto.
- This can be broken by doing [X]. To avoid this, use [A] and [B] but that could leave an opening for [C], depending on the moon cycle. Use [Y] instead to be safe, and don't roll your own crypto.
Frankly the last phrase in all three can be replaced with "may the Force be with you" and the result will still be the same: The OP will (hopefully) use [Y] untill he comes up with the next brilliant idea. He will then probably ask about it here, get told not to roll his own crypto again and think "boy I must be useless - I think I don't like security after all".
We need people in security, we need people rolling their own crypto. Telling people off isn't doing anyone any good in the long run.
Should the use of don't roll your own crypto it be limited, abolished alltogether, or be kept as the mandatory mantra it seems to be today?