Wait, so you're suggesting developers shouldn't adhere to specs but instead develop their tools / libraries according to whatever they feel it is the cool kids currently do?

Yes, I do. You should be following de-facto real world standards, not fantasy ones. Especially if security is involved.

If there are de facto real world standards, why not write them down?

Ask the guys writing the RFC's, not me. Boggles my mind too.

Have you considered replacing/creating/updating RFCs/BCPs relevant to your field?

i fail to see much difference with:

>>develop their tools / libraries according to whatever they feel it is the cool kids currently do?<<

versus:

>>adhere to the letter of the spec maliciously instead of understanding current practice.<<