Code compiled for NaCL is in a word-aligned subset of machine code that can be quickly verified before execution and can only generate interrupts to the NaCL ho

Code compiled for NaCL is in a word-aligned subset of machine code that can be quickly verified before execution and can only generate interrupts to the NaCL host (no syscalls). It's currently i386, but x86_64 and several ARM variants are being worked on, hopefully with fat binaries. The only security hole is timing attacks, because there's no latency hits or blown caches from having a runtime or GC or even any preconceived notions about what your language looks like.