```Python
if not (credentials.username == "stanleyjobson") or not (credentials.password == "swordfish"):
    # Return some error
    ...
```

Porém, ao utilizar o `secrets.compare_digest()`, isso estará seguro contra um tipo de ataque chamado "timing attacks".

### Ataques de Temporização { #timing-attacks }

Mas o que é um "timing attack"?

Vamos imaginar que alguns invasores estão tentando adivinhar o usuário e a senha.

import org.mockito.junit.jupiter.MockitoExtension;

import jcifs.CIFSException;
import jcifs.SmbTransport;
import jcifs.SmbTree;

/**
 * Tests for SmbSessionInternal interface using Mockito to exercise
 * method contracts, checked exceptions, and interactions with collaborators.
 */
@ExtendWith(MockitoExtension.class)
public class SmbSessionInternalTest {

    @Mock
    private SmbSessionInternal session;

    @Mock

    /** Number of bits represented in the terminal node. */
    val terminalBitCount: Int

    /** Construct an internal node. */
    constructor() {
      this.children = arrayOfNulls(256)
      this.symbol = 0 // Not read.
      this.terminalBitCount = 0 // Not read.
    }

    /** Construct a terminal node. */
    constructor(symbol: Int, bits: Int) {
      this.children = null
      this.symbol = symbol

Esto contrasta con las etapas de **desarrollo**, donde estás constantemente cambiando el código, rompiéndolo y arreglándolo, deteniendo y reiniciando el servidor de desarrollo, etc.

## Estrategias de Despliegue { #deployment-strategies }

 * implementing new escapers. It is strongly recommended that when implementing a new escaper you
 * extend one of these classes. If you find that you are unable to achieve the desired behavior
 * using either of these classes, please contact the Java libraries team for advice.
 *
 * <p>Popular escapers are defined as constants in classes like {@link
 * com.google.common.html.HtmlEscapers} and {@link com.google.common.xml.XmlEscapers}. To create

   * useful to call from vanilla JavaScript because it returns an instance of Class, which can't be
   * converted to a standard JavaScript type. (Contrast to something like String or boolean.) Since
   * we're not calling it from JavaScript, we suppress the warning.
   */
  @JsMethod
  @SuppressWarnings("unusable-by-js")

   *
   * @throws NumberFormatException if the string does not contain a valid unsigned {@code long}
   *     value
   * @throws NullPointerException if {@code string} is null (in contrast to {@link
   *     Long#parseLong(String)})
   */
  @CanIgnoreReturnValue
  public static long parseUnsignedLong(String string) {
    return parseUnsignedLong(string, 10);
  }

  /**

 */
@Deprecated(since = "4.0.0")
public class ObjectBasedValueSource extends AbstractValueSource {

    private final Object root;

    /**
     * Construct a new value source, using the supplied object as the root from
     * which to start, and using expressions split at the dot ('.') to navigate
     * the object graph beneath this root.
     * @param root the root of the graph.

    static {
        PREFERRED_MECHS.add(new ASN1ObjectIdentifier("1.2.840.113554.1.2.2"));
        PREFERRED_MECHS.add(new ASN1ObjectIdentifier("1.2.840.48018.1.2.2"));
    }

    /**
     * Construct a <code>Kerb5Authenticator</code> object with <code>Subject</code>
     * which hold TGT retrieved from KDC. If multiple TGT are contained, the
     * first one will be used to retrieve user principal.
     *

            return new DcerpcException(getResultMessage(this.result));
        }
        return null;
    }

    private DcerpcBinding binding;
    private int max_xmit, max_recv;

    /**
     * Construct bind message
     *
     */
    public DcerpcBind() {
    }

    DcerpcBind(final DcerpcBinding binding, final DcerpcHandle handle) {
        this.binding = binding;
        this.max_xmit = handle.getMaxXmit();