> Those people (a minority for sure) know who they are, I highly doubt that. Most developers, by far, could not tell you the threat model for these attacks. >

> Those people (a minority for sure) know who they are, I highly doubt that. Most developers, by far, could not tell you the threat model for these attacks. > but we shouldn't be crippling the performance of everyone else just for them. You can turn the mitigations off.