i now understand what this does

1 files changed, 2 insertions, 2 deletions

diff --git a/pyramid/session.py b/pyramid/session.py
index bbb08622a..b4bc34a6a 100644
--- a/pyramid/session.py
+++ b/pyramid/session.py
@@ -244,8 +244,8 @@ def signed_deserialize(serialized, secret, hmac=hmac):
 
     sig = hmac.new(secret, pickled, sha1).hexdigest()
 
-    # Avoid timing attacks (note that this is cadged from Pylons and I
-    # have no idea what it means)
+    # Avoid timing attacks (see
+    # http://seb.dbzteam.org/crypto/python-oauth-timing-hmac.pdf)
 
     if len(sig) != len(input_sig):
         raise ValueError('Wrong signature length')