Doesn't this criticism apply to any software that opens a communications channel between the kernel and user space? Also, how does eBPF relate to Spectre?
Yes, but syscalls are properly designed. drivers are a huge problem, always have been.
eBPF on the other hand lacks proper security design. They added it afterwards, to some extent.
> how does eBPF relate to Spectre?
Please read any spectre paper. Besides the known javascript attacks, eBPF is the easiest way to bypass kernel ASLR. google is your friend.
