Hacker News Reader

Which one would you recommend instead? Referring dev teams to NIST standards or the like doesn’t work well in my experience.

There doesn't always have to be a resource. Sometimes no resource is better than a faulty one. Cryptography is one of those cases.