I agree, on both counts. For some applications (web browsers top that list nowadays) ASLR has a lot of demonstrable value as a mitigation measure. I could easil

I agree, on both counts. For some applications (web browsers top that list nowadays) ASLR has a lot of demonstrable value as a mitigation measure. I could easily imagine security-critical systems where even proper strong ASLR (with randomized page tables or even fundamentally different caching and MMUs) would make sense. However, it's always important to keep things in perspective. Hardware solutions to this attack would impose major performance penalties across the board, so I hope to never see them in mainstream CPUs. Software solutions to make the attack even harder to pull off might make sense for specific applications, but any ASLR implementation (either OS-wide or at the compiler level) needs to be easy to turn off.