@Mock
    private DcerpcHandle mockDcerpcHandle;

    // Mocking MsrpcLsarOpenPolicy2 and MsrpcLsarClose is tricky because they are created inside the constructor/method.
    // We need to use ArgumentCaptor or a custom Answer to control their behavior.
    // For now, let's assume we can mock their behavior through the sendrecv method of DcerpcHandle.

    @BeforeEach
    void setUp() {

  }

  /**
   * This test creates a long random sequence of inputs, then a lot of differently configured sinks
   * process it; all should produce the same answer, the only difference should be the number of
   * process()/processRemaining() invocations, due to alignment.
   */
  @AndroidIncompatible // slow. TODO(cpovirk): Maybe just reduce iterations under Android.

    ...
```

Python 會必須先比較完整的 `stanleyjobso`（在 `stanleyjobsox` 與 `stanleyjobson` 之中都一樣），才會發現兩個字串不同。因此回覆「Incorrect username or password」會多花一些微秒。

#### 回應時間幫了攻擊者 { #the-time-to-answer-helps-the-attackers }

此時，透過觀察伺服器回覆「Incorrect username or password」多花了幾個微秒，攻擊者就知道他們有某些地方猜對了，前幾個字母是正確的。

接著他們會再嘗試，知道它更可能接近 `stanleyjobsox` 而不是 `johndoe`。

#### 「專業」的攻擊 { #a-professional-attack }

For any non-trivial change, we need to be able to answer these questions:

* Why is this change done? What's the use case?
* For user-facing features, what will the API look like?
* What test cases should it have? What could go wrong?
* How will it roughly be implemented? We'll happily provide code pointers to save you time.

        batches.add(new String[] { "c" }); // second batch
        batches.add(new String[] {}); // last -> NO_MORE_FILES

        // send() answer that mutates the provided response
        when(tree.send(any(Trans2FindFirst2.class), any(Trans2FindFirst2Response.class))).thenAnswer((InvocationOnMock inv) -> {
            Trans2FindFirst2Response resp = inv.getArgument(1);

    ...
```

この場合、Python は `stanleyjobsox` と `stanleyjobson` の両方で `stanleyjobso` 全体を比較してから、文字列が同じでないと気づきます。したがって、「ユーザー名またはパスワードが正しくありません」と応答するまでに余分に数マイクロ秒かかります。

#### 応答時間が攻撃者を助ける { #the-time-to-answer-helps-the-attackers }

ここで、サーバーが「ユーザー名またはパスワードが正しくありません」というレスポンスを返すまでに、わずかに長い時間がかかったことに気づけば、攻撃者は何かしら正解に近づいた、すなわち先頭のいくつかの文字が正しかったことを知ることができます。

すると、`johndoe` よりも `stanleyjobsox` に近いものを狙って再試行できます。

labels.chat_phase_evaluate=Reviewing search results...
labels.chat_phase_fetch=Retrieving documents...
labels.chat_phase_answer=Generating answer...
labels.chat_messages_area=Chat messages
labels.chat_welcome_title=Ask and Discover.
labels.chat_welcome_description=Ask questions and I'll search through documents to find the answers you need.
labels.chat_step_intent=Analyze
labels.chat_step_search=Search
labels.chat_step_evaluate=Evaluate

labels.chat_phase_evaluate=Reviewing search results...
labels.chat_phase_fetch=Retrieving documents...
labels.chat_phase_answer=Generating answer...
labels.chat_messages_area=Chat messages
labels.chat_welcome_title=Ask and Discover.
labels.chat_welcome_description=Ask questions and I'll search through documents to find the answers you need.
labels.chat_step_intent=Analyze
labels.chat_step_search=Search
labels.chat_step_evaluate=Evaluate

          }
        });
  }

  /**
   * An immutable snapshot of the current state of the service. This class represents a consistent
   * snapshot of the state and therefore it can be used to answer simple queries without needing to
   * grab a lock.
   */
  // @Immutable except that Throwable is mutable (initCause(), setStackTrace(), mutable subclasses).
  private static final class StateSnapshot {
    /**

    }

    Ordering<Object> arbitrary = Ordering.arbitrary();
    sort(list, arbitrary);

    // Now we don't care what order it's put the list in, only that
    // comparing any pair of elements gives the answer we expect.
    testComparator(arbitrary, list);

    assertThat(arbitrary.toString()).isEqualTo("Ordering.arbitrary()");
  }

  @J2ktIncompatible // ArbitraryOrdering