I'm not quite sure I understand what you are saying here. I don't think anyone is saying that you need to understand all the underlying code, but this is just s

I'm not quite sure I understand what you are saying here. I don't think anyone is saying that you need to understand all the underlying code, but this is just something you should be aware of as you are building network-connected applications. Just like a web developer needs to be aware of CSRF, XSS, etc. Every language that I know of short-circuits string comparisons like this. You should know that you need to seek out a constant-time compare though when comparing hashes or other secrets. Your sleep hack is probably less secure. I remember reading somewhere that doing random sleep() calls is flawed and doesn't completely mitigate the attack, but does increase the number of requests needed to get a good statistical analysis.