Security quotes of the week

Timing attacks are well known and popular crypto libraries like OpenSSL take them into account. Newer algorithms and implementations are designed with timing attacks in mind. (They were known before DJB's paper, but it wasn't until around that time that public proof of concepts were published.)

The fact that cryptographic protocols can be commonly circumvented by bugs and laziness in the employing applications is also not new. But it usually takes proofs of concepts to catch people's attention.

I wouldn't call common protocols security theater. Security theater usually refers to tactics and procedures which are fundamentally insecure, or at least not based in any rigorous methodological science. The characteristics of cryptographic algorithms and protocols, OTOH, are quantifiable, and you can reason about them, including making assessments about the difficulty of their use.