Most proofs are trivial| lawrencecpaulson.github.io
Program verification is not all-or-nothing| lawrencecpaulson.github.io
