Quote:

Doing sanitization at IDL level automates quite a bit of tedious-and-error-prone work, which is always a Good Thing™

Another Quote:

Hey, this whole thing can be made MUCH simpler, the only thing we need to acknowledge is that the best identifier for a string is the string itself!

Abstract:

Password hashing is a Big Headache, and doing it right is complicated

Quote:

Note that none of the C++11 random number engines (LCG, Mersenne-Twister, or Lagged Fibonacci) can be considered good enough for cryptographic purposes – in short, they’re way too predictable and can be broken by a determined attacker, given enough output has leaked.