HT enables some side-channel attacks due to its architecture of "let's allow two threads to share the same pipeline and use the unused parts to allow more work to go through".

In practice this allows some attacks to attach themselves to the same pipeline with the target process and nibble required information slowly, but surely.

IIRC FreeBSD disabled HT out of the box at the kernel level for this reason.

I'm tired and it's late here. I may worded some stuff wrong or plainly misremembered it. Please feel free to correct.