Why not instead alert the programmer that compiling this code would call such-and-such system calls? That's IMO how all software should work. Apple did somethi

Why not instead alert the programmer that compiling this code would call such-and-such system calls? That's IMO how all software should work. Apple did something similar, AFIAK, in the latest version of MacOS, and failed - it's obviously something that is extremely hard to retrofit onto existing software. But allowing arbitrary execution for new software, and sensibly limiting it (e.g. "this program cannot access the internet") is, I predict, fairly feasible.