Security:Bibliography - Revision history

Asqueella: hello, it's not wikipedia, there's no need to get every second word linked

2007-01-17T03:01:16Z

hello, it's not wikipedia, there's no need to get every second word linked

← Older revision		Revision as of 03:01, 17 January 2007
Line 11:		Line 11:
	=== People ===		=== People ===

	[http://www.ics.uci.edu/~franz/ Michael Franz], who is at UC Irvine, spoke at [http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference] (as of [[3 August~~]] [[~~2006]]) two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his past and current work. See links [http://www.ics.uci.edu/%7Efranz/Site/research.html] to his publications.		[http://www.ics.uci.edu/~franz/ Michael Franz], who is at UC Irvine, spoke at [http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference] (as of 3 August 2006) two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his past and current work. See links [http://www.ics.uci.edu/%7Efranz/Site/research.html] to his publications.

	Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.		Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.
Line 17:		Line 17:
	[http://www.cs.cornell.edu/andru/ Andrew Myers], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]. See links [http://www.cs.cornell.edu/andru/pubs-topic.html] to his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages].		[http://www.cs.cornell.edu/andru/ Andrew Myers], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]. See links [http://www.cs.cornell.edu/andru/pubs-topic.html] to his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages].

	Vincent Simonet and the fine folks at INRIA behind [[OCaml]] have given the world [http://cristal.inria.fr/~simonet/soft/flowcaml/ FlowCaml], OCaml with an information flow type system.		Vincent Simonet and the fine folks at INRIA behind OCaml have given the world [http://cristal.inria.fr/~simonet/soft/flowcaml/ FlowCaml], OCaml with an information flow type system.

	Since JS and the other browser-hosted programming languages are not statically typed, FlowCaml may not seem useful, but with [[JS2]] ([[ECMAScript Edition 4]]), we will have type annotations and the option of a static type checker. The JS2 type system won't support [[Hindley-Milner type inference]], but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.		Since JS and the other browser-hosted programming languages are not statically typed, FlowCaml may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.

	=== Papers ===		=== Papers ===

	[Under construction, see links above]		[Under construction, see links above]

BijuGC: /* People */ wikify

2006-10-22T06:26:50Z

People: wikify

← Older revision		Revision as of 06:26, 22 October 2006
Line 11:		Line 11:
	=== People ===		=== People ===

	[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his past and current work. See http://www.ics.uci.edu/%7Efranz/Site/research.html ~~for links~~ to his publications.		[http://www.ics.uci.edu/~franz/ Michael Franz], who is at UC Irvine, spoke at [http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference] (as of [[3 August]] [[2006]]) two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his past and current work. See links [http://www.ics.uci.edu/%7Efranz/Site/research.html] to his publications.

	Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.		Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.

	[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html ~~for~~ his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].		[http://www.cs.cornell.edu/andru/ Andrew Myers], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]. See links [http://www.cs.cornell.edu/andru/pubs-topic.html] to his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages].

	Vincent Simonet and the fine folks at INRIA behind OCaml have given the world [[http://cristal.inria.fr/~simonet/soft/flowcaml/ FlowCaml]], OCaml with an information flow type system.		Vincent Simonet and the fine folks at INRIA behind [[OCaml]] have given the world [http://cristal.inria.fr/~simonet/soft/flowcaml/ FlowCaml], OCaml with an information flow type system.

	Since JS and the other browser-hosted programming languages are not statically typed, FlowCaml may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.		Since JS and the other browser-hosted programming languages are not statically typed, FlowCaml may not seem useful, but with [[JS2]] ([[ECMAScript Edition 4]]), we will have type annotations and the option of a static type checker. The JS2 type system won't support [[Hindley-Milner type inference]], but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.

	=== Papers ===		=== Papers ===

	[Under construction, see links above]		[Under construction, see links above]

Brendan: /* People */

2006-08-03T19:13:22Z

People

← Older revision		Revision as of 19:13, 3 August 2006
Line 11:		Line 11:
	=== People ===		=== People ===

	[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his ~~work~~.		[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his past and current work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his publications.

	Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.		Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.

Brendan: /* People */

2006-08-03T19:10:18Z

People

← Older revision		Revision as of 19:10, 3 August 2006
Line 17:		Line 17:
	[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].		[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].

	Vincent Simonet and the fine folks at INRIA behind OCaml have given the world [[http://cristal.inria.fr/~simonet/soft/flowcaml/ FlowCaml]]. Since JS and the other browser-~~based~~ programming languages are not statically typed, FlowCaml may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.		Vincent Simonet and the fine folks at INRIA behind OCaml have given the world [[http://cristal.inria.fr/~simonet/soft/flowcaml/ FlowCaml]], OCaml with an information flow type system.

			Since JS and the other browser-hosted programming languages are not statically typed, FlowCaml may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.

	=== Papers ===		=== Papers ===

	[Under construction, see links above]		[Under construction, see links above]

Brendan: /* People */

2006-08-03T19:09:40Z

People

← Older revision		Revision as of 19:09, 3 August 2006
Line 17:		Line 17:
	[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].		[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].

	Vincent Simonet and the fine folks at INRIA behind OCaml have given the world ~~FlowCaml (~~http://cristal.inria.fr/~simonet/soft/flowcaml/). Since JS and the other browser-based programming languages are not statically typed, it may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.		Vincent Simonet and the fine folks at INRIA behind OCaml have given the world [[http://cristal.inria.fr/~simonet/soft/flowcaml/ FlowCaml]]. Since JS and the other browser-based programming languages are not statically typed, FlowCaml may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.

	=== Papers ===		=== Papers ===

	[Under construction, see links above]		[Under construction, see links above]

Brendan: /* People */

2006-08-03T19:08:58Z

People

← Older revision		Revision as of 19:08, 3 August 2006
Line 11:		Line 11:
	=== People ===		=== People ===

	[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his work. Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.		[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his work.

			Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.

	[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].		[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].

Brendan: /* People */

2006-08-03T19:08:20Z

People

← Older revision		Revision as of 19:08, 3 August 2006
Line 13:		Line 13:
	[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his work. Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.		[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his work. Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.

	[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, JFlow. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].		[[http://www.cs.cornell.edu/andru/ Andrew Myers]], my old pal from SGI days, is a prof at Cornell who has done wonderful work in this area, going back to his thesis at MIT, [[http://www.cs.cornell.edu/andru/release/tr783.ps.gz JFlow]]. See http://www.cs.cornell.edu/andru/pubs-topic.html for his publications. His slides from this year's PLDI nicely summarize the problem-space we face: [[http://www.cs.cornell.edu/andru/pldi06-tutorial Expressing and Enforcing Security with Programming Languages]].

	Vincent Simonet and the fine folks at INRIA behind OCaml have given the world FlowCaml (http://cristal.inria.fr/~simonet/soft/flowcaml/). Since JS and the other browser-based programming languages are not statically typed, it may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.		Vincent Simonet and the fine folks at INRIA behind OCaml have given the world FlowCaml (http://cristal.inria.fr/~simonet/soft/flowcaml/). Since JS and the other browser-based programming languages are not statically typed, it may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.

Brendan: /* Foreword */

2006-08-03T19:07:18Z

Foreword

← Older revision		Revision as of 19:07, 3 August 2006
Line 3:		Line 3:
	Browser security in my experience turns out to be mostly security in programming language design and implementation. The number of critical security bugs that we've faced over the years that were in the crypto module, or in HTTP code, were very few compared to the total bug count.		Browser security in my experience turns out to be mostly security in programming language design and implementation. The number of critical security bugs that we've faced over the years that were in the crypto module, or in HTTP code, were very few compared to the total bug count.

	By programming language, I mean not only JavaScript, but also CSS, XBL, and lots of DOM APIs and execution rules spanning HTML, SVG, and XUL. We have matching, querying, binding, and term rewriting languages with non-traditional syntax and runtime semantics. Browsers are really "just" big, messy, backward compatible programming language processors.		By programming language, I mean not only C/C++ and JavaScript, but also CSS, XBL, and lots of DOM APIs and execution rules spanning HTML, SVG, and XUL. We have matching, querying, binding, and term rewriting languages with non-traditional syntax and runtime semantics. Browsers are really "just" big, messy, backward compatible programming language processors.

	Rather than attempting a bibliographic summary or history of the state of security research, I am starting with a list of people whose work I know best.		Rather than attempting a bibliographic summary or history of the state of security research, I am starting with a list of people whose work I know best.

Brendan at 19:06, 3 August 2006

2006-08-03T19:06:46Z

← Older revision		Revision as of 19:06, 3 August 2006
Line 6:		Line 6:

	Rather than attempting a bibliographic summary or history of the state of security research, I am starting with a list of people whose work I know best.		Rather than attempting a bibliographic summary or history of the state of security research, I am starting with a list of people whose work I know best.

			/be

	=== People ===		=== People ===
Line 14:		Line 16:

	Vincent Simonet and the fine folks at INRIA behind OCaml have given the world FlowCaml (http://cristal.inria.fr/~simonet/soft/flowcaml/). Since JS and the other browser-based programming languages are not statically typed, it may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.		Vincent Simonet and the fine folks at INRIA behind OCaml have given the world FlowCaml (http://cristal.inria.fr/~simonet/soft/flowcaml/). Since JS and the other browser-based programming languages are not statically typed, it may not seem useful, but with JS2 (ECMAScript Edition 4), we will have type annotations and the option of a static type checker. The JS2 type system won't support Hindley-Milner type inference, but we anticipate using both types and static checking in Mozilla code, and we should aspire to realize both optimization and security wins from the new type system.

	~~/be~~

	=== Papers ===		=== Papers ===

	[Under construction, see links above]		[Under construction, see links above]

Brendan: /* People */

2006-08-03T19:06:17Z

People

← Older revision		Revision as of 19:06, 3 August 2006
Line 1:		Line 1:
	=== ~~People~~ ===		=== Foreword ===

	Browser security in my experience turns out to be mostly security in programming language design and implementation. The number of critical security bugs that we've faced over the years that were in the crypto module, or in HTTP code, were very few compared to the total bug count.		Browser security in my experience turns out to be mostly security in programming language design and implementation. The number of critical security bugs that we've faced over the years that were in the crypto module, or in HTTP code, were very few compared to the total bug count.
Line 6:		Line 6:

	Rather than attempting a bibliographic summary or history of the state of security research, I am starting with a list of people whose work I know best.		Rather than attempting a bibliographic summary or history of the state of security research, I am starting with a list of people whose work I know best.

			=== People ===

	[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his work. Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.		[[http://www.ics.uci.edu/~franz/ Michael Franz]], who is at UC Irvine, spoke at [[http://www.research.ibm.com/vee04/talks.html an IBM virtual machine conference]] two years ago where I spoke on Firefox and Mozilla's VM needs. He was kind enough to stop by Mozilla in early March of this year and speak on his work. See http://www.ics.uci.edu/%7Efranz/Site/research.html for links to his work. Michael's focus on virtual machines and compilers points the way toward real browser as well as OS security, transcending the current mode among browser implementors of hacking and patching memory-unsafe C++ code. The most-trusted computing base must not be megalines of code -- it should be the compiler, VM, and security module, at tens or at most hundreds of KSLOCs.