The problem isn’t JavaScript: To competitively run web app code written in any language, modern CPUs depend heavily on speculative execution, caching, and other

The problem isn’t JavaScript: To competitively run web app code written in any language, modern CPUs depend heavily on speculative execution, caching, and other complex, stateful implementation techniques that are inherently susceptible to side-channels. This is especially true when the only separation between attacker code and victim code is conceptual: Cloudflare is running them side by side in the same thread. Since Cloudflare cares more about scale & throughput than single-worker performance, you could imagine security wins from a CPU design that forgoes modern stateful complexity wherever possible. Say, using a totally random cache replacement algorithm instead of the vulnerable LRU approach described in this article. But the hit would be signficant, and Cloudflare is almost surely better off remediating the problems of complex hardware with software.