Sigh.

http://codahale.com/a-lesson-in-timing-attacks/

Preemptively:

* Yes, a realistic attack.

* Yes, very difficult over the Internet.

* Still difficult but not implausible if the attacker can colocate near your app; ie, if you deploy anywhere on EC2.

* Measurement bounds are high nanoseconds LAN, tens of usecs WAN.

* HMAC verification, unlike password hash comparisons, is a place where timing actually does matter.

Not to suggest that I occupy the high road when it comes to snarky comments, but consider whether your snarky comment in this case suggests an unearned (and thus dangerous) level of confidence about crypto app security. This problem (HMAC timing) is so well known that it's generated many hundreds of comments over the years on HN.