I agree that people are often too zealous about "don't do it yourself", whether in the name of security or preventing duplicate work. md5 hashing unsalted passw

I agree that people are often too zealous about "don't do it yourself", whether in the name of security or preventing duplicate work. md5 hashing unsalted passwords is bad, but so is critically misconfiguring an off-the-shelf password tool you didn't understand. Not Invented Here Syndrome is bad, but so is breaking the entire internet because you didn't want to write 20 lines of NPM left-pad yourself. That said, I think there's still a major difference between roll-your-own-crypto and other "unless you do it right" topics. Securely storing passwords and preventing XSS are things that can look ok and be insecure unless you do it right, but I'm not (always) against people (carefully) handling those things themselves. Rolling your own signatures or encryption are infamous because a "best practices" list and good code review won't save you; even if you root out all the actual bugs, your process can still be cripplingly vulnerable. As Schneier said, anyone can create an alogorithm they can't compromise.