> Like many with a background in programming languages and their implementations, the idea that safe languages enforce a proper abstraction boundary, not allowi

> Like many with a background in programming languages and their implementations, the idea that safe languages enforce a proper abstraction boundary, not allowing well-typed programs to read arbitrary memory, has been a guarantee upon which our mental models have been built. As an aside, the notion that it's very risky to rely only on the type system to enforce security boundaries is not new. In 2003, Govindavajhala and Appel [1] showed that you can break the security of the JVM through memory errors. Basically, an untrusted attacker fills memory with a specially formatted data structure such that in case of a random bit flip, with high probability, you get an integer field and a pointer field aliasing each other, allowing you to do pointer arithmetic. By contrast, it's extremely unlikely that a random bit flip allows (say) an unprivileged Unix process to get root access. [1] https://www.cs.princeton.edu/~appel/papers/memerr.pdf https://www.cs.princeton.edu/~appel/papers/memerr.pdf