People were doing POCs before the browser makers nerfed the hell out of timing APIs especially from web assembly and autoupdate distributed the nerfs out.
'Nerf' is a term used for when game developers update a game and reduce the effectiveness of something. 'My sword attack ability was nerfed in the latest patch'. In this context I suppose the API capabilities was reduced in browser updates.
In particular, the word is derived from a brand of toy foam arrows. Basically, it refers to negating the possible damage of something.
Lower the precision by adding random noise.
Browser manufacturers changed the behavior of APIs like performance.now() [0] to add slight rounding 'errors' or limit the granularity of timing functions. That function used to report on the microsecond level in (most) browsers, but now is generally limited to around 1ms due to timing attacks.
surely high precision clocks can be constructed via busy waits or random api calls that hit hardware to do things with fixed latency, no?
All those can be limited, because thankfully JS is not multithreaded (otherwise you could do busy-loop timing).
Yes, like the SharedArrayBuffer that browsers disabled. There are probably roughly infinite ways to construct clocks. Closing the obvious leaks has been a stop gap while other mitigation techniques are rolling out, like site isolation.