Why create potentially large bytes objects initialized with null bytes ?

[joergschulz]

otpauth/src/otpauth/rfc6238.py

Line 43 in 22368eb

return hmac.compare_digest(bytes(self.generate(timestamp)), bytes(code))

hmac.compare_digest() accepts either str or bytes and python doc says it should be used to lower the risk of timing attacks.

But what's the purpose of creating potentially large bytes objects initialized with null bytes ?

Shouldn't be simply the strings of the codes be compared ?

[lepture]

Oh, you are right. This is certainly a wrong way. You're welcome to send a PR.

[lepture]

2.1.1 released