4 ms·
I'll clarify - it _is_ vulnerable to timing attacks (except where explicitly mentioned otherwise) - and you should take care of that in your code. It is pretty
by inglor 9y ago
I'll clarify - it _is_ vulnerable to timing attacks (except where explicitly mentioned otherwise) - and you should take care of that in your code.
It is pretty trivial to defend from timing attacks in a language like go (just race a goroutine with a delay). I agree that it's a good point to bring up though.
- staticassertion 9y agoSeems like something that should be mentioned in the README. Users of this library, by default, are vulnerable. I'm not sold on the 'race a goroutine' solution either, but I'm not much of a Go programmer.
- 0xdeadbeefbabe 9y agoDo you want a situation where the guy who reads the whole README shouldn't use the library?