| The
security model 2: |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| � | There
are no executables on Tn (obsolete), so you |
||||||||||||
| can�t
run a virus |
|||||||||||||
| � | Even
if there is a malicious component, the default |
||||||||||||
| capabilities
ensure that it cannot alter anything except |
|||||||||||||
| itself
and the data you feed it. It could not copy itself |
|||||||||||||
| (except
into its output), damage data or do anything |
|||||||||||||
| worthwhile
unless you permit it |
|||||||||||||
| � | Everything,
absolutely everything, can specify |
||||||||||||
| what
can access it and additionally for processors |
|||||||||||||
| of
data, what they can access |
|||||||||||||