... and, furthermore, he himself says in the conclusion that this is a rather limited view of his own experience (which is mainly the (mostly isolated) mainframes of the past); but he still has a couple of points, even with this one.

For example, he says (I'm going only to paraphrase), what's the point of memory protection for the applications, if there is always a system software excluded from this scheme, with no guarantee of correctness (and this is the case, as there is no enforcement of software correctness by language, says he). And, once you have a weak link, it does not matter, how strong the rest of chain is. Practice appears to justify his words; although I think it's an exagerration to claim that it's enough just to use the proper language. I believe in no panacea - being it a superlanguage or bulletproof memory protection.

I'd put it into this perspective: if the memory protection comes at a very low cost of hardware, causes no slowdown of execution, and perhaps only marginal software overhead in the system software, let it be. An economical balance has to be established.

JW