[geocar]

> Browsers ought to run the fastest JS interpreters already

Well they don't.

Users want the website to work sooner, and care little about whether a for-loop of elements take 10ms or 20ms if it only happens once.

JS can be AOT compiled if you can wait a few _seconds_ -- which users don't want, so browsers don't bother.

Our attacker however, rightly observes they only have to pay that compilation cost once.

[swinglock]

If it takes seconds to compile it then the browser wins. The PoW only runs for seconds already.

[geocar]

No no no. You don’t realise the compiled intermediate can be _trivially_ reused for every request, and identified by the hash of the JavaScript code. Browsers already do this, it’s just your attacker has a bigger cache, and not by a little bit.

Browsers _intentionally_ limit the amount of memory and cpu cycles a tab can consume to make for a nicer human experience.