> Yeah again, that's a carefully controlled research setup. The POC runs in visitors browsers lol it's a public demo that runs in your browser, not in a "caref

> Yeah again, that's a carefully controlled research setup. The POC runs in visitors browsers lol it's a public demo that runs in your browser, not in a "carefully controlled research setup". > that very probably don't contain anything of value Lots of things are valuable other than passwords. Even just leaking addresses can be useful for further exploitation. The main issue is it's a violation of a security boundary. > The first guy I responded to was making an assertion that running without spectre/etc mitigations means you should turn off javascript. They said "I hope you <do that>". Presumably because it would also mitigate the issue.