Comment by apitman

> I think Spectre probably kills the security model

What's the threat model exactly? As far as I can tell all the apps are compiled directly into the kernel, and the web browser doesn't run JavaScript. So I don't see any way to get untrusted code into the thing.