I've noticed there's an absurd amount of time, effort and arguments about whether or not we should use certain crypto ciphers or encryption methods.
In this link some people go into how certain ciphers at minimum are required per level of security clearance in the DOD. They go into detail about how each cipher is built to a certain degree of strength for the importance of the information.
The thing is, eventually their recommendations for even touching things like SHA-128 certificates for "low priority items" is going to make them have to go back one day and change out everything once that is declared unsafe. (which the security community knows most people won't)
There is plenty of debate about safety. The thing is though, we have the capacity to come together and agree that certain reasonable methods are stronger than others like when a certain method was openly selected for veracrypt as the safest.
My question
Why are encryption methods when being taught to new admins and engineers in the industry with the approach of:
"From what we have heard about, this list seems okay to use for now. These ones are broken and over there are fine for now but will need to be upgraded in around 4 years from now. There are recommendations that will put you to new levels of security standards but, we'll let the security gurus worry about that for now."
instead of:
"We know you're busy, so this is the strongest practical option we have today. It runs everywhere math works and it's the most solid solution we have come up with. So, use it. Don't consider anything else until the industry has decided there is something better. If you find something using something weaker, improve it. If you can't, move it. Otherwise don't come to us when you're dealing with the consequences of not just locking onto the best option that the security community openly handed you when you decided it was fine to just use something else."