Dan Luu

do you really think people with transmeta/centaur 0-days are just waiting for someone to add NaCl support to pounce?

intel actually has the longest errata lists bc complexity. If security were the real reason, they'd remove intel.

the idea is, one platform less to test. Huge relief to the whole pipeline, negligible cost. Security QA is costly.

My real concern was: what are they gonna do if an Intel CPU has NaCl-security-relevant errata? Blacklist Intel too?

The current approach flat-out _doesn't work_ if they ever actually run into a relevant 0-day.

A workable approach can certainly include more fine-grained white-/black-listing based on family ID etc.

But right now, none of that kind of logic exists. No good. Once you need it, you want it battle-tested already!

The *last* thing you want for security is to have to roll out untested extra infrastructure on a 0-day patch.