It's nice that they're investing in this. I just wish Edge didn't suck. I have tried using it as my primary browser and it's just not there. It crashes, trying to move tabs around is a pain, sometimes it just isn't performant.
Strengthening the Microsoft Edge Sandbox
11–20 of 58 posts
Re: Strengthening the Microsoft Edge Sandbox
#12just checked my website visitor log. Only 1% people use Edge. It is not a surprise at all. The best way to secure a browser is just like what chrome and firefox do: open source it.
Chrome isn't Open Source. Chromium is Open Source. Chrome adds a lot of proprietary bits including (but not limited to): Audio & Video Codecs, Flash Plugin, Crash Reporting, Metrics, et al.
"Crash Reporting, Metrics,"
These are not proprietary, actually.
" Audio & Video Codecs,"
Neither is this, last i looked (but i haven't looked in a while).
Re: Strengthening the Microsoft Edge Sandbox
#13The earlier post on Code Integrity Guard and Arbitrary Code Guard is also interesting:
https://blogs.windows.com/msedgedev/2017/02/23/mitigating-ar...
Microsoft should apply these same restrictions to all UWP apps. Yes, that means banning JIT compilation, as Apple does on iOS. And desktop applications shouldn't be able to inject DLLs into UWP applications and system components.
Re: Strengthening the Microsoft Edge Sandbox
#14just checked my website visitor log. Only 1% people use Edge. It is not a surprise at all. The best way to secure a browser is just like what chrome and firefox do: open source it.
Your site may be self-selecting for people who don't use Edge somehow. Our session count on a site geared for the average person puts Edge closer to 13%:
Chrome - 57.54%
IE - 14.12%
Edge - 12.88%
Firefox - 9.30%
Safari - 4.13%
Other browsers make up the remainder
Re: Strengthening the Microsoft Edge Sandbox
#15[deleted]
Re: Strengthening the Microsoft Edge Sandbox
#16It's nice that they're investing in this. I just wish Edge didn't suck. I have tried using it as my primary browser and it's just not there. It crashes, trying to move tabs around is a pain, sometimes it just isn't performant.
[deleted]
Re: Strengthening the Microsoft Edge Sandbox
#17It's nice that they're investing in this. I just wish Edge didn't suck. I have tried using it as my primary browser and it's just not there. It crashes, trying to move tabs around is a pain, sometimes it just isn't performant.
It opens web pages very fast, there's that. But, alas, everything else just feels sluggish. In my crazy high-end system, it takes a second for the menu to show up after right clicking the address bar.
What I want is IE's rendering speed with Chrome's UI and Firefox's extensibility (the good old system, not the new one).
Re: Strengthening the Microsoft Edge Sandbox
#18From the comments section: "I want to support MS, I’m a development partner. But I feel like you guys spend way too much time thinking about how to push intrusive ad’s into the OS and trying to get easy ad-based revenue from your browser: Talking very good security talk but not walking a very good security walk." The commenter also makes a comment about how Chrome the older browser was found to be much more secure th…
How would they be better off? Explaining how things work now (even if it's imperfect) tends to be better than stonewalling.
Re: Strengthening the Microsoft Edge Sandbox
#19I assume this wasn't available in the browser when Pwn2Own happened, because Edge was hit hard by the security teams there.
Re: Strengthening the Microsoft Edge Sandbox
#20The earlier post on Code Integrity Guard and Arbitrary Code Guard is also interesting: https://blogs.windows.com/msedgedev/2017/02/23/mitigating-ar... Microsoft should apply these same restrictions to all UWP apps. Yes, that means banning JIT compilation, as Apple does on iOS. And desktop applications shouldn't be able to inject DLLs into UWP applications and system components.
In theory, they've always banned JIT in UWP apps, at least by default. UWP apps can't use VirtualProtect; they have to use VirtualProtectFromApp, which only allows JIT if you have the "codeGeneration" capability (and always enforces W^X). I don't use Windows so I don't know how it interacts with this new thing. Maybe the protection wasn't enforced at the kernel level?
On any platform, it makes sense to enforce code signing by default as a hardening measure, but some apps like browsers cannot operate without a JIT. So there needs to be some exception process - possibly requiring the use of a separate process for JIT compilation, as Edge now does. You don't want to end up like iOS where Safari is the only browser permitted on the platform.