If you feel yourself technically proficient enough to comment on cryptography (mostly PGP apologia), then you should be capable of looking at source code to fig

If you feel yourself technically proficient enough to comment on cryptography (mostly PGP apologia), then you should be capable of looking at source code to figure out whether or not something "does any real password extension". If anyone else (i.e. "a user") made this mistake, I'd be more sympathetic. But not for you. You don't get to have your cake and eat it too. Are you a cryptography expert, or aren't you? If yes, then failing to bother to check the source code is a faux pas. If no, then I expect you to stop trying to argue as a cryptography expert the next time someone points out that PGP is bad cryptography. I don't care which you choose. I only ask that you stick to it.