never call Sys.which directly (do it via findProgram)