DJB had some interesting thoughts on AES and its vulnerability to timing based attacks, here: http://cr.yp.to/antiforgery/cachetiming-20050414.pdf

While network latencies would definitely make this type of attack more challenging to implement, AES is not invincible.

And that's just the stuff we hear about :)

If you're sending encrypted files across the internet, the government doesn't get to see how long it took to encrypt the data. And if you're running an open "encrypt anything my secret key" oracle, well, you get what you deserve.

Indeed. This sort of attack is good for breaking DRM, but not so good for any legitimate uses of cryptography.