An architecture for privacy-sensitive ubiquitous computing
Safe kernel extensions without run-time checking