Why do you think such an architecture is completely invulnerable? The Summary #2 slide lists the following as a benefit of the Mill: - Can load across protecti

Why do you think such an architecture is completely invulnerable? The Summary #2 slide lists the following as a benefit of the Mill: - Can load across protection boundaries Valid data is usable; invalid data cannot be seen At the very least, this probably makes ASLR pretty easy to defeat across protection boundaries. Are you really willing to bet that there will never be a more clever exploit that can determine more information? In slide 51 of the IPC talk[0] they explicitly say that they put permissions checking after the cache, and that this is essential for their performance and power claims. [0] https://millcomputing.com/docs/inter-process-communication/ https://millcomputing.com/docs/inter-process-communication/