> The simplicity of cheri itself makes it easier to be confident that its protection is correct-- relative to the entirety of a compiler/libc/etc. To get confi

> The simplicity of cheri itself makes it easier to be confident that its protection is correct-- relative to the entirety of a compiler/libc/etc. To get confidence in Fil-C’s safety, you don’t have to prove anything about the libc because the libc is compiled with Fil-C. You have to prove stuff about the compiler and Fil-C’s runtime. The runtime is about 100KLoC.