To defend against a CPU vulnerability that just won’t die, it all boils down to fundamentals