it's not nasty in the same way as Spectre/Meltdown, but it's still nasty. Spectre/Meltdown is bad because of the trust model. As a tenant of a cloud platform,

it's not nasty in the same way as Spectre/Meltdown, but it's still nasty. Spectre/Meltdown is bad because of the trust model. As a tenant of a cloud platform, you somewhat implicitly trust your cloud provider, but you distrust your neighbor, and Spectre/Meltdown can be used to breach that trust guarantee. With the Spectre JS attacks, it's a similar situation where a user can't necessarily trust tenant code, and that security layer is breached. SGX is "secure" in the other direction. The executing code presumes to not be able to trust the hosting hardware. For example, you are a copyright-happy media company and you want to deliver DRM'd content to a customer who might be trying to crack your keys, you might want to run code inside of an enclave that is "protected", from even ring 0 or ring -1, -2, etc. from ever getting at your code. I was wondering why a BIOS patch would work, but I guess your SGX-using software could pretest if the patch exists.