> lots of articles about best practice leave out very rare edge cases I don't think that's an argument in support of leaving out edge cases, and even if you di

> lots of articles about best practice leave out very rare edge cases I don't think that's an argument in support of leaving out edge cases, and even if you disagree in general, I think security articles should be more diligent than random best-practices articles. > Far more than one in a thousand will use it as an excuse to do the wrong thing. If an article says "always do X" and someone does X and the implementation is subtly wrong or insecure, that's an argument to improve the article (which is what I'm suggesting). But if an article says "almost always do X, and be aware of this edge case" and someone gets it wrong by not following instructions, then I don't think the article is at fault. I would personally want my security advice to cover any edge case I could think of, even if only in the footnotes.