OK, I just had to write it up: https://lcamtuf.coredump.cx/blog/hope/