Seems more like jumping on the bandwagon to me...

I thought this was all down to an implementation detail and has nothing to do with ISAs.

If you read the very short article:

> the open RISC-V ISA makes it possible for many different groups to experiment with alternative mitigation techniques and share results.

Alternative short article if RISC-V community is target audience:

> [you/we have] an historic opportunity to “do security right” from the get-go with the benefit of up-to-date knowledge [so please let's do this]

High performance microarchitectures for RISCV are still going to be proprietary.

Unlike operating systems, developing high-end microarchitiecture is not someting that bends well to open source model.

Being open doesn't gain you much here either. At the end of the day there is no "updating" it once a vulnerability is found.

It does make it more likely that a compatible replacement can be found on the market, though.

That does not change the fact that SUM(security,speed,price /due to Si area/) == CONST

That equation doesn’t hold, as open source software has demonstrated time and time again.

I was talking about hardware

For example to fix Spectre attack, you would need some extra "speculative cache lines", which you would then copy to real cache lines once you decided they really need to be loaded or dump if not (having not flushed any observable cache lines). That would cost you a lot of extra silicon. Which would cost you dollars. Alternatively, you could just reduce speculation, which would cost you performance. The third alternative is what we're doing now: nothing. That costs you security.

You outline only a single solution of which there are many. The thing RISC-V gets you is the ability to iterate on an implementation while still running the body of existing code. As ridiculous as it seems, this hasn't been possible before. RISC-V didn't technically need to exist but it did politically and legally.

I don't think your equation is fact or rigorous, I respect your work but it call bull on it. And there are way more than 3 options, this is a false dichotomy.

I think this equation actually makes sense when only the same people/minds are changing the factors. If the same team is given the task of improving a product, chances are they will be close minded and only able to tweak say security at the expense of the other two.

To break this equation, you need a new paradigm, which often comes from outsiders adding their perspective. And open source is a great way to do this.