> I wonder what people say when they find a bug despite you using standard crypto? Not using TLS doesn't automatically mean you need to "roll your own crypto".

> I wonder what people say when they find a bug despite you using standard crypto? Not using TLS doesn't automatically mean you need to "roll your own crypto". They could have used a well documentend library such as Google Tink[1] instead of doing their own crypto. [1] https://github.com/google/tink https://github.com/google/tink