I'm guessing they're using the Web Audio API which allows you to generate audio samples:

https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_A...

And I assume that different audio drivers and software will produce minutely different outputs. It's also possible that they're queueing a sound to be played then canceling the sound after reading the raw computed signal out of the buffer.

Sleezy sleezy crap.

It was my understanding that these methods profile performance of the API which will execute at different speeds on different devices. The samples themselves shouldn't be different if they're using AudioBuffer and typed arrays.

Time to add random delay and noise then.

True, but I think the technique points to the way that other timing attacks used as fingerprinting vectors can and will work. Profiling performance of network requests, image rendering time, etc will always be risks unless all Javascript features employ that kind of mitigation.

I believe Firefox adds random delays, if you enable one of the Tracking Protection settings.