I think explaining why the crypto usage is wrong is useful, where a straight-up admonishment that someone is doing it wrong isn't. The principle here is explai

I think explaining why the crypto usage is wrong is useful, where a straight-up admonishment that someone is doing it wrong isn't. The principle here is explained, at least partially: if you don't use a random IV for every message, you're not secure. So if the API you're using doesn't let you specify the IV, or doesn't default to a random IV that leaves you with undecipherable blocks if you don't fetch its assigned value, you know it's wrong. It's good info.