How lucky then that we all live in the cloud now and running code on other people's computers is the only place anybody runs code anymore.

In addition to that all sorts of vendors run their code on our systems to provide us with their features. And then there's the idea that some of these bugs have been demonstrated to be exploitable from within a JavaScript VM!

There's a lot more attention to this threat than there would be if the cloud wasn't ubiquitous. Could be a net positive.

This is somewhere between misleading and wrong -- Spectre-ish attacks can be conducted by JavaScript when you visit a random web page. It's mostly appropriately-proportioned.

What is JavaScript except code being remotely executed?

It's code being executed in a well-tested sandbox that should not be able to steal your machine's secrets, so it's appropriate to freak out over the fact that these attacks allowed it to do that.

It's code that can run for arbitrary amounts which can't be killed without killing the browser and affecting _other_ services to.

It's user hostile code executed by foreign entities on devices that you are supposed to "own"

In recent browsers you can certainly kill just one tab's JavaScript without taking out anything else.

It doesn't feel very different to printing a PostScript file to me. You're giving someone access to run their "arbitrary code" in a VM on your system with very limited permissions.

JavaScript can run code on your computer, and used to be possible to get accurate timings out of it.

Only if you allowed the website to run its JavaScript. There are tools to restrict and more people should use those tools.

They make many useful websites unusable though. And when you whitelist you're then vulnerable, because there's no way to know some Javascript doesn't contain an exploit (do you run anti-virus on the web pages you visit?)

Any downloaded executable might contain a virus. That does not mean that I'm not going to download anything from the Internet. But also I'm not going to run every executable that happened to load in my browser. Good websites take a great care to protect their users from malicious scripts. So you should use your own judgement to decide whether you trust that website or not. I definitely don't trust some random website that I've opened by following some links. So I'll browse it without JS and if it does not work, I'll think twice whether I want to risk opening it. But if I'm opening something like stackoverflow, probably I'm safe and they won't run side channel attacks on my computer.