&gt; I&#x27;d bet on CPU-enforced isolation over software any day of the week, even memory safe languages have bugs, and so do hypervisors.<p>... and so do CPUs! I do like CPU protections as long as they are dirt-simple, but it really scares me sometimes how complicated CPUs and chipsets are getting with their &quot;advanced&quot; security features. When an exploitable flaw is found, and malware survives OS&#x2F;firmware reinstalls, it will be a mess.