[MailNerd]

Most of these techniques are engineered to not cause much of a performance degradation. Otherwise there would not be much uptake. Also they are often implemented in compilers which produce native binaries so the impact is low.

The mitigations for the various hardware sidechannel attacks discovered in the past year have a bit larger impact. But you don't need these at all on your local computer, only in shared environments.

As a rule of thumb each mitigation usually costs a single digit percentage, seldom double digit. Of course in a system multiple mitigations will be at play but the impact should be far below 100%.

The performance impact of scripting languages, interoperable web standards and bad implementations are far worse :)