To expand on this - only running trustworthy programs is a far superior approach to this threat model than trying to somehow contain the damage from malicious c

To expand on this - only running trustworthy programs is a far superior approach to this threat model than trying to somehow contain the damage from malicious code running on your machine. Siloing programs so you can run random crap feels like keeping the interior doors in your house locked to slow the progress of home invaders, while leaving the front door wide open - it's the wrong security boundary and it inconveniences you more than the attackers. Meltdown should have been the nail in the coffin for this philosophy.