Personally, I would never make recommendations on best-practices for security related questions. I may offer suggestions on the code style, and other items, but never pass opinion on whether the code is secure enough.
I have no problem reviewing the code, but have a problem reviewing the math/cryptography/algorithm. Those require an expert, and I am not one.
For the same reason, I would hesitate to ask questions on InfoSec either... If I want arm-chair commentary on my security then I may as well ask my kids. But my kids can still tell me if I have a fat ass.... ;-)
So, from what I can tell, the difference between CR and InfoSec is:
- CR can tell you whether your security-related code has a fat ass.
- InfoSec can tell you whether that code is, in fact, an ass, (and even then, only with armchair certainty).
If I want to know if I have an ass, I go to infosec. If I want to know whether that thing I call an ass is fat, I ask on CR.