@sicp @scathach @jeffcliff @p @Suiseiseki With a language providing no direct memory access semantics, it is impossible to wrongly access resources without either a broken implementation (for which formal verification methodology is available) or broken hardware (this is a more complicated issue).

This means the implementation can encapsulate resources in opaque structures which cannot be interfered with.

Implementations/compilers can provide APIs for handling cases where such memory access is required, namely hardware support.

> And I don't get how that answers network-transparent storage and IPC; those bits don't just emerge out of thin air.

Neither Erlang nor Goblins have that as zero-cost, they have considerable overhead even if one were to run the messaging for them over RDMA (which requires considerable node trust).

It may be impossible (with near-zero cost) without complete node & network handler program trust.