Let's say my server has a non-constant-time compare function for checking if the visitor has a valid session id. The time it takes for the comparator to run would be very insignificant, usually within 1 millisecond (I've tried to compare two strings that are both 1000 characters long). Not to mention the variance in time for the network speed. So does it mean timing attack is not practical? What do web developers have to be aware of regarding timing attack?