the main difference is that I'd be able to use IsoAlloc to actually write interesting features which allow me to isolate data inside a process depending on the

the main difference is that I'd be able to use IsoAlloc to actually write interesting features which allow me to isolate data inside a process depending on the security context (confine data to certain zones). nice to get an additional introspection capability which allows verification for correctness during execution. This is a killer feature but I think the main purpose here is the isolation. Performance overhead for this seems also reasonable considering what you get for it (security/sandboxing).