use factory, encapsulate unsafe