Well, I was going to say more on the subject, but didn't want to get flamed by JS lovers. I did say "If you can execute JS in a browser, you can do whatever yo

Well, I was going to say more on the subject, but didn't want to get flamed by JS lovers. I did say "If you can execute JS in a browser, you can do whatever you want to that page in the browser." I don't disagree with your point, but there is another perspective that the mitigations aim to stop, which is cross-tab/window data gathering (and cross process), which is most of the point of Spectre and friends anyways, which is stealing data from some other process, not the process you are running under. Stealing from your own process is easy. Stealing from another process is supposed to be hard, and stealing from the kernel is supposed to be impossible.