> If they update the library to match the newer expert opinion, it breaks existing code. If they do not update the library, then new applications using it will

> If they update the library to match the newer expert opinion, it breaks existing code. If they do not update the library, then new applications using it will get the bad default value. This is true for lower-level cryptography libraries like OpenSSL or Libsodium. This isn't true, however, for the sort of higher-level libraries I recommend developers use. See https://github.com/defuse/php-encryption https://github.com/defuse/php-encryption which implements version tagging in its ciphertext output. If Taylor Hornby has to publish a version 3 that uses, say, NORX instead of AES-256-CTR+HMAC-SHA256, the first 4 bytes will identify the version of the library that was used to encrypt the original message. Backwards compatibility is transparent to the end user. (Headers are covered by the HMAC.)