Yeah, it's not 100% obvious to me that you couldn't stage some variant of Spectre against even this more limited form of speculation. In the comments on the ar

Yeah, it's not 100% obvious to me that you couldn't stage some variant of Spectre against even this more limited form of speculation. In the comments on the article the author argues: "Why don’t speculative instruction (and data) fetches introduce a vulnerability? Because unlike speculative execution they don’t lead to a separation between a read instruction and the process (whether a hardware page fault or a software bounds check) that determines whether that read instruction is allowed." but that would seem to be confusing the details of Spectre with Meltdown (which is happening a lot right now). Spectre doesn't depend on unauthorized reads succeeding.