> consequences of incorrect code either ... The point is it's trivial in the language to write incorrect code that behaves differently on different hardware. T

> consequences of incorrect code either ... The point is it's trivial in the language to write incorrect code that behaves differently on different hardware. To write robust code you need to know how the underlying hardware behaves, how it can vary across platforms, and write code very carefully to ensure you write code that operates properly on the hardware. All these issues are consequences of the underlying hardware, including hardware errata and bugs. >This is a different class of problem from that of correct code being turned into a security problem by the hardware. Where would you put cache timing attacks then? It's "correct" code, the hardware performs as intended, yes the error is a result of the code + hardware interaction in a manner the programmer did not understand. All of these are related: programmer + language + hardware interact to make code that is exploitable. C/C++ in the mix makes this harder to do correctly.