The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library

I'm a security noob, but side channel attacks seem to me like something that you fundamentally just can't address by writing better software in a high-level language. The entire point is that they dig underneath all of your abstractions. It doesn't seem particularly tenable to keep playing whack-a-mole in this way.

Nobody was evil you just tried to rely on a property that V8 never promised.

Wasm doesn't promise it either but there's a much better chance you get what you want there.

I was working on reimplementing the WebRTC stack in JavaScript a long time ago, never finished. The crypto folks at Mozilla (ekr@) suggested "maybe don't do that for dTLS."