At that point, by noticing that the server took some microseconds longer to send the "Incorrect username or password" response, the attackers will know that they got _something_ right, some of the initial letters were right.

And then they can try again knowing that it's probably something more similar to `stanleyjobsox` than to `johndoe`.

#### A "professional" attack { #a-professional-attack }

        // Verify buffer structure
        assertTrue(buffer.length >= 14, "Buffer should contain header, params and data");
    }

    @Test
    public void testByteOperations() {
        // Test byte operations that were used in the original test
        byte b = (byte) 0xFF;
        int value = b & 0xFF;
        assertEquals(255, value, "Byte to unsigned conversion should work");

        // Test comparison operation

    * `200` ist der Default-Statuscode, welcher bedeutet, alles ist „OK“.
    * Ein anderes Beispiel ist `201`, „Created“ („Erzeugt“). Wird in der Regel verwendet, wenn ein neuer Datensatz in der Datenbank erzeugt wurde.
    * Ein spezieller Fall ist `204`, „No Content“ („Kein Inhalt“). Diese Response wird verwendet, wenn es keinen Inhalt gibt, der zum Client zurückgeschickt wird, diese Response hat also keinen Body.

				bucket, humanize.Ordinal(er.setIndex+1))
		}

		disks, _, healing := er.getOnlineDisksWithHealingAndInfo(true)
		if len(disks) == healing {
			// All drives in this erasure set were reformatted for some reasons, abort healing and mark it as successful
			healingLogIf(ctx, errors.New("all drives are in healing state, aborting.."))
			return nil
		}

  public static <T extends @Nullable Object> Collector<T, ?, T> onlyElement() {
    return (Collector) ONLY_ELEMENT;
  }

  /**
   * This atrocity is here to let us report several of the elements in the stream if there were more
   * than one, not just two.
   */
  @SuppressWarnings("EmptyList") // ImmutableList doesn't support nullable element types
  private static final class ToOptionalState {
    static final int MAX_EXTRAS = 4;

   * analysis that that means "plain {@code T}" rather than the inferred type {@code @Nullable T}.
   * (And even if annotations on local variables were permitted as an optional hint, no annotation
   * would be the right tool for the job here: {@code @Nullable} is the annotation that we're trying

   * with {@code FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-6409434">JDK-6409434</a> is fixed. It's unclear
   * whether nulls were to be permitted or forbidden, but presumably the eventual fix will be to
   * permit them, as it seems more likely that code would depend on that behavior than on the other.

  private static final long K1 = 0x0f0e0d0c0b0a0908L;
  private static final HashFunction SIP_WITH_KEY = Hashing.sipHash24(K0, K1);
  private static final HashFunction SIP_WITHOUT_KEY = Hashing.sipHash24();

  // These constants were originally ported from https://www.131002.net/siphash/siphash24.c. See:
  // https://github.com/nahi/siphash-java-inline/blob/master/src/test/java/org/jruby/util/SipHashInlineTest.java
  private static final long[] EXPECTED =

   * with {@code FeatureSpecificTestSuiteBuilder.suppressing()} until <a
   * href="https://bugs.openjdk.org/browse/JDK-6409434">JDK-6409434</a> is fixed. It's unclear
   * whether nulls were to be permitted or forbidden, but presumably the eventual fix will be to
   * permit them, as it seems more likely that code would depend on that behavior than on the other.

     * we did list an exclusion on c, it was only from within the context of
     * project b.  We will pick up project c in this case because no
     * restrictions were placed on d.  This demonstrates that a, b, c, & d will
     * all be collected.
     *
     * @throws Exception
     */
    @Test