That is truly amazing. I know precious little about encryption, but I assumed everyone knows that ECB is bad and that CBC is the only sensible way to do AES.
[edited for typo]
Your first point is correct, second is definitely not.
See how precious little I know about encryption? And yet even I know that ECB is a terrible choice!
(In minor defense of self, I should have said CBC or "later").
Hint: copy-pasters*
* from internet or from old codebases of one’s company