I largely agree with the article, with one caveat: > ...we "just" have to specify the states and behaviors that are not safe and prevent the software from gett

I largely agree with the article, with one caveat: > ...we "just" have to specify the states and behaviors that are not safe and prevent the software from getting into those states. In general, the number of ways how things can go south tends to infinity, while the desired outcomes are easier to enumerate. I think it would be safer and more feasible in most cases to identify states and behaviours that are valid than the other way round.