Re: const time authentication in bozohttpd
Mindaugas Rasiukevicius <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.security,gmane.os.netbsd.devel.userlevel |
|---|---|
| Message-ID | <[email protected]> |
"Terry Moore" <[email protected]> wrote: > Perhaps this is a silly comment; but wouldn't it be easier to simply time > stamp the incoming request, and then spin for any authentication failure > until a suitable fixed time has elapsed after the inbound arrival? Or are > you worried about local cache-interference attacks as well? Why fixed time? Make it random time. -- Mindaugas