Butler W. Lampson Making untrusted code useful: technical perspective. 92 2011 54 Commun. ACM 11 http://doi.acm.org/10.1145/2018396.2018418 db/journals/cacm/cacm54.html#Lampson11