The security model 2:
There are no executables on Tn (obsolete), so you
can’t run a virus
Even if there is a malicious component, the default
capabilities ensure that it cannot alter anything except
itself and the data you feed it. It could not copy itself
(except into its output), damage data or do anything
worthwhile unless you permit it
Everything, absolutely everything, can specify
what can access it and additionally for processors
of data, what they can access