This is a big capability. Right now it's quite difficult (requiring pinning together a few pieces of technology) to protect one process from another, especially

This is a big capability. Right now it's quite difficult (requiring pinning together a few pieces of technology) to protect one process from another, especially if the other process is root. This isn't enough to get quite there, but it's a good start. Windows has been working on similar tech via Protected Processes[0], notably used for both LSASS and their new eBPF verifier. That's been a tricky technology to get right but I think it's interesting. > Andy Lutomirski repeatedly opposed making uncached mappings available, objecting to the performance cost and more; Interesting. I'll want to read more into this. My guess is that for the next 5 years there will be endless ways to leak these secrets and maybe, if we're lucky, things will improve over that time. [0] https://www.alex-ionescu.com/?p=97 https://www.alex-ionescu.com/?p=97