I've heard an expert (or "expert") laugh the current focus on Meltdown and Spectre off by arguing that dcache timing and dcache leak issues have been known and around for years (so nothing new there ...)
Does such belittlement have (some) merit or is the comparison fundamentally misplaced?
Your "expert" is correct that figuring out memory access patterns by cache timing is nothing new. But the "expert" has completely missed the point of Meltdown and Spectre by focusing on the method that proof-of-concept exploits are using to exfiltrate data.
At its core, Meltdown and Spectre are about on-demand reading of memory that a program doesn't have permission to read. This is new -- prior cache-timing attacks had to rely on the target program reading the memory the attacker is interested in, in a manner that the attacker can make use of. Spectre uses the branch predictor to force a target program to perform the desire reads, while Meltdown uses speculative execution to read the memory directly.
The attacks don't require the use of the cache: other timing-based side effects can be used, but don't have the favorable signal-to-noise ratio of cache timing.
