Think so. From an outsider (non-security) point of view at least.
Speculative execution is basically required for fast single-threaded performance, and it also seems to be fundamentally incompatible with running arbitrary programs on the platform securely.
We've all really invested in tricking ourselves into believing otherwise, but this is definitely a tick. It is a trick that many of our careers depend on, so we'll see various 'fixes' bandied about, but they won't solve tomorrow's hole.
Programs running locally should be assumed to have total control. So, like, don't run evil programs. And disable Javascript in the browser. (For the client side, maybe Intel and AMD could put a special in-order, no-speculation, no-branch prediction core on their chips from now on, shunt Javascript to that by default).
Speculative execution is basically required for fast single-threaded performance, and it also seems to be fundamentally incompatible with running arbitrary programs on the platform securely.
We've all really invested in tricking ourselves into believing otherwise, but this is definitely a tick. It is a trick that many of our careers depend on, so we'll see various 'fixes' bandied about, but they won't solve tomorrow's hole.
Programs running locally should be assumed to have total control. So, like, don't run evil programs. And disable Javascript in the browser. (For the client side, maybe Intel and AMD could put a special in-order, no-speculation, no-branch prediction core on their chips from now on, shunt Javascript to that by default).