Inferno is another example of a system that did not expose the ability to dereference raw pointers to user programs: https://en.m.wikipedia.org/wiki/Inferno_(operating_system)