> A bad RSA implementation leads to weak cryptography, but a bad ECC implementation often leads to something that doesn’t work at all.

Bad RSA implementation => weak cryptography. We agree on that.

Bad ECC implementation => doesn't work. We agree on that.

Working ECC implementation => strong cryptography. We do not agree on that. I think that there are many subtle ways to make a weak ECC implementation.

At the end of the day, I am never going to roll my own crypto implementation. (Well, actually, I already have, but it was for "hey how does this work. oh it works like this. neat!" and promptly deleted the code afterwards) I'm always going to use libsodium or nss or openssl or gnupg or or or. So the fact that RSA is harder to implement correctly than ECC is... well that kinda doesn't matter to me. Implementing it correctly isn't my job. All I need to do is include someone elses' library. And I can be about as sure that libsodium or openssl has implemented the proper precautions to make RSA secure. So the fact that RSA is hard -- well, it's kinda irrelevant.

FWIW, I tend to default to ECC, because ECC is the new hotness, and that appeals to me for entirely superficial reasons. I'm just saying that if you're going to say that RSA is bad, you should have the right reasons for saying so.