I'd much rather have it as a well known meme that "md5 is broken, don't use it. Period." than a list of caveats like "ok for non security" or "ok with hmac". I

I'd much rather have it as a well known meme that "md5 is broken, don't use it. Period." than a list of caveats like "ok for non security" or "ok with hmac". I've seen many claims from good engineers of the sort "this design is ok because it's not for security" when it absolutely was. A simpler rule wins, even if it costs a bit now. It'll save someone in a bigger way later.