My latest article for ACM Queue about CHERIoT is live! This describes the design decisions that we made in designing an aggressively privilege-separated OS with a single address space for embedded systems. It's part of a series of articles about designing single-address-space systems and aims to highlight which parts of CHERIoT are things that are a good idea everywhere and which are a good idea only for embedded systems. EDIT: Looks as if they mangled the title, it should read 'usable' not 'able'. EDIT2: And now they have fixed it. #CHERIoT #CHERI #ACMQueue