I agree that developers make mistakes and humans are fallible. Why then do you want me to list permissible cipher systems off the top of my head? Of course I wo

I agree that developers make mistakes and humans are fallible. Why then do you want me to list permissible cipher systems off the top of my head? Of course I would look that up. (I’ve got a JIRA issue from a couple of years ago about this topic.) By saying that I want developers to worry about TLS algorithms, I mean that I want developers to worry about everything and understand that they have shared ownership of the production system. I lead a small dev team working in a reasonably sized division of a large company. We’re accountable for both operations and development, and we’re security-sensitive (I have domain expertise in DFIR). It’s my ass if we screw up any of the ways you cite. We mitigate that risk in a lot of different ways, and I try to seek out new things we can do to ratchet up the quality of our build products. Again, I think your insistence that things be a certain way doesn’t fit my situation. Have a good evening.