Counter-example: A few years back, I was looking for a way to do user authentication for HTTP web services; I decided that HTTP Basic/Digest weren't sufficientl

Counter-example: A few years back, I was looking for a way to do user authentication for HTTP web services; I decided that HTTP Basic/Digest weren't sufficiently cryptologically strong - OAuth was the new hotness, so we were going to use that. There was a nice Apache-licenced library, but it wasn't laid out right for our purposes, so I spent two weeks re-writing it [maintenance burden #1]. Then I had to integrate it into our (terribly ill-documented open-source) web services framework [maintenance burden #2], then we had to make it work with the other OAuth libraries [maintenance burden #3]. And of course, it was all new, so there was no documentation anywhere on how to make it work, but if I'd been working with better established tech I wouldn't have wasted those weeks of development work, and that project wouldn't still be using OAuth 1.1. There were no productivity benefits to the new tech (quite the opposite, in fact), and the technical benefits were likely unneccessary.