I need to reiterate that optimism ("remove all timing info...") has no place in information security. If you think you have removed all timing information sour

I need to reiterate that optimism ("remove all timing info...") has no place in information security. If you think you have removed all timing information sources you are aware of, many remain: those you aren't aware of at all, those you failed to recognize as exploitable, those you didn't actually remove by mistake, those that are degraded but still present... The attacker should be assumed to be clever and knowledgeable; as the saying goes, creating a system that you don't know how to crack is easy.