Spectre mitigations in Clojure Compiler

Question

I was looking up everywhere and could not find any mitigations for Spectre attack by the Clojure compiler! I don't know if my question is correct or how feasible it is, but do you guys know if there are any mitigations for different variants of Spectre attacks Specter v1 (Spectre-PHT), v2 (Spectre-BTB), v4 (Spectre-STL) and v5 (Spectre-RSB) at the compiler level for Clojure?
Looking forward to hearing from you guys ;)

Answer 1

I'm not an expert, but seems like the compiler is a wrong place to fix such a vulnerability. Some details: https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html

Comments

I genuinely do not think of it as a rule of thumb. You can see that there are some mitigations in some other compilers!

https://gcc.gnu.org/onlinedocs/gcc-10.2.0/gcc/Other-Builtins.html#Other-Builtins
https://gcc.gnu.org/legacy-ml/gcc-help/2018-06/msg00066.html
https://devblogs.microsoft.com/cppblog/spectre-mitigations-in-msvc/

Answer 2

Clojure really depends on the JVM for this kind of thing and as mentioned in the other answer, the JVM team has decided this is not something they can address.

This was explored in http://openjdk.java.net/jeps/342.

Comments

True, but isn't that only from the OpenJDK team? Is it the same other JDKs like Oracle's?

---

I would consider it up to the developer to pick a JDK that is secure -- and keep it updated as new patches come out.