Node.js example:

    return new Buffer(sig).toString('base64') == signature;

PHP example:

    return hash_hmac("sha512", $string_to_verify, $shared_secret) == $signature;

Yeah, like fdomig said: timing attacks. The Python example included a mitigation. PHP includes hash_equals() and a constant time comparison in Javascript isn't difficult to write.

Possibly also, the Ruby example:

    return OpenSSL::HMAC.digest('sha512', shared_secret, string_to_verify) == signature

(I don't write Ruby so I don't know if this is overloadable somewhere.)