Re: const time authentication in bozohttpd

On Wed, Jun 25, 2014 at 08:08:57PM +0100, Mindaugas Rasiukevicius wrote:
> "Terry Moore" <[email protected]> wrote:
> > Perhaps this is a silly comment; but wouldn't it be easier to simply time
> > stamp the incoming request, and then spin for any authentication failure
> > until a suitable fixed time has elapsed after the inbound arrival? Or are
> > you worried about local cache-interference attacks as well? 
> 
> Why fixed time?  Make it random time.

Random noise can be filtered out moderately easy.

Joerg