This could be vulnerable to timing attacks, but my (rudimentary) benchmarking shows that while matching identical binaries is faster, the difference between binaries with different lengths of common prefixes is in the 1-5 nanosecond  range. Most of that ends up getting smothered with the catch. It doubt the commit you linked is vulnerable to such an attack, but I need to do more testing and reading to really tell.