I usually go with Ian knot by default but switch to the secure one if it comes undone.
Reply on news.ycombinator.com