Mitigations landing for new class of timing attack
>  we are disabling or reducing the precision of several time sources<p>I am really happy to see this happening at long last. One can argue that almost every x86 SW side channel attack (Spectre and many prior ones that, for instance, leak parts of cryptographic keys from variable-time SW implementations) are  being aided by userspace processes having access to high-frequency/high-res counters for which, in almost every case, they have no legitimate need. Perhaps future silicon should block direct access to the TSC & friends, except for processes that have a privileged flag set (hardly a new idea; IIRC some IBM PowerPC chips from the late 90s support that).<p>OS-level timing calls such as gettimeofday() could be degraded to a few microseconds resolution by default - poor enough to obscure delays caused by the state of various HW caches, branch predictors, etc.<p>Ultimately there is little reason to give every website js program access to a nanosecond-level counter by default, and many defense-in-depth reasons for <i>not</i> doing that. So kudos to the firefox team here and hopefully chrom[e|ium] quickly copies this.