> all it takes is one bad Chromium commit All it takes is one bad Xen commit, or one bad design choice at Intel, for VM-based clouds to be broken. Every isolat

> all it takes is one bad Chromium commit All it takes is one bad Xen commit, or one bad design choice at Intel, for VM-based clouds to be broken. Every isolation mechanism has bugs, this is not unique to V8. > for this model to fall through regardless of how thorough the defense-in-depth/vetted Workers may be. No no, when I say "defense in depth" I mean we have fallback contingencies to contain the damage of a V8 bug. > Isn't it double whammy then that a V8 isolate + HW attack surface in combination could provide an order of magnitude more hackability? No, the opposite. Having to break two layers at the same time is much harder than breaking just one thing. VM-based clouds are largely counting on just one layer today (most of which is burned into silicon).