Building a trusted computing base
The Importance of Type Safety