This article says: "Writing custom cryptographic code such as a hashing algorithm is really hard and should never be done outside of an academic exercise." I w

This article says: "Writing custom cryptographic code such as a hashing algorithm is really hard and should never be done outside of an academic exercise." I would like to remind readers that the same applies to "salting and hashing". Developers who are not cryptographers should be using an accepted "key derivation function" and not salting or hashing themselves. Examples of KDFs are PBKDF2, bcrypt and scrypt. That's not to dismiss discussion of how KDFs should be implemented. That's presumably very on-topic for HN. But this shouldn't be confused with best practice in using a KDF. If you're implementing a KDF in your application instead of using a pre-built one, you're probably doing it wrong.