Live data from Hacker News

Windows Sandbox

techcommunity.microsoft.com

121–130 of 328 posts

Re: Windows Sandbox

#121
post #38

Only Microsoft would come up with a new security feature and then intentionally and arbitrarily limit its availability to the most expensive version of their OS. This is the same company that thinks putting ads in the fucking file explorer is appropriate on an OS they charge hundreds and hundreds of dollars for.

You can get a pro key for 10 bucks.

Re: Windows Sandbox

#122
post #70

Earlier quoted context omitted.

> Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. This has always been the case on Windows. In fact if anything, nowadays it’s better than its ever been because thanks to the UAC and other controls Microsoft have put in place, developers aren’t so free to do whatever they like to the host machine. But that’s remember a time before the UAC when it would…

It really is. I'm not talking about app binaries only. But about all files that app creates after install. Most of the reside in home dir, but stays there forever. Like various cache files, settings, ... And most of the time they are not confined to single dir.

That has always been the case though. For as long as I've use Linux as a desktop my $HOME directory has been littered with dot-files and folders. And as for Windows, things used to be so much worse. Since the UAC, Windows applications have been limited in where they can write to lest they annoy their users with frequent escalation prompts. Before the UAC developers often used to write files all over the place - it was a complete nightmare! In fact one of the primary purposes of the UAC - as I recall - was to reign developers in.

Even the UAC aside, on Windows you now have the application data directory and permissions on the registry which both take some reliance off random files dumped anywhere. Before then Windows was like the wild west. And we're not talking that long ago in terms of the history of Windows - Vista was released 11 years ago and it took a few years after that for developers to catch up.

Plus with the trend of moving everything to the web, you're getting fewer native applications which can write those random files in seemingly random locations (that's one of the few good things about the move to web applications in my personal opinion).

You'll always have problems with developers having their own opinions - that's inescapable. But things used to be so much worse.

Re: Windows Sandbox

#123
Did Microsoft fix the issue that when Windows virtualization is enabled then VirtualBox VMs do not run [0]? Better they focus some of their resources to fix that first.

If not yet, then Windows Sandbox it is a less useful feature that it may seem, because we have to choose between Windows Virtualization and VirtualBox VM snapshots all the time.

[0] https://www.virtualbox.org/ticket/16801

Re: Windows Sandbox

#124

Earlier quoted context omitted.

It seems to me that no matter what happens two classes of users are going to be created: those that can pay for security and those that cannot. Ultimately Apple's pricing means all their users are first class - hence security as a bread-and-butter feature on their platforms. In MSFT's case they're going to have low and high cost consumers, so they segment those users into the two relevant classes. None of this is goo…

> Ultimately Apple's pricing means all their users are first class - hence security Yeah... Good luck running the latest version of iOS on an older iPhone. (Many are still have a 5/6 and you really don't want to update those if you value a reasonable experience and latency.)

I have a couple Android devices and I can't get them to update at all. I'm sure there's some kind of solution, but my time is really valuable to me: If all I have to do is spend £1k every four years (£20 a month) to not worry about this, it's a done deal.

Re: Windows Sandbox

#125

Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. And it's same on all known OSes. The side effect we see is system size growing in time. IMO running an app in a sandbox should be the default option. On Windows, I used to like sandboxie, which virtualized every write into single directory. Uninstall was easy as removing that dir. This MS sandbox doesn't a…

> Uninstall was easy as removing that dir.

File writes for application files are rarely the problem any more.

The problem is that in order to function correctly (For some definition of correct, but say e.g. to associate file extensions, create shortcuts, start automatically, install a dependency such as a C++ runtime patch, whatever) the program needs to write to subsystems of the OS in a non-reversible way. It's also very HARD to do these things (create setups) because systems like Windows Installer aren't trivial to use. Every time a setup author makes a mistake there is a risk of stuff being left behind.

Fundamentally, what you are doing is you are in state A when installing the program, creating state B. Then you continue to modify the system simply by using it or installing some more software creating state C. If you now uninstall the first software you don't have anything but a script undoing A->B, which run backwards can only do B->A, but you are in state C and you don't want to first run C->B because you want to keep the other parts of state C. So the uninstall script has to run in unknown territory (a file may have changed, a later dependency version may have been installed globally, a registry entry may not exist because they are NOT isolated per application etc) so the uninstall script just has to do what it can.

A sandbox could be a solution to this, where the sandbox contains diff views over some immutable base image. It probably is a lot easier to do (and do efficiently) with OS support.

Re: Windows Sandbox

#126

Earlier quoted context omitted.

I totally agree, Apple's markup on products must be astronomically high. Am I the only one who doesn't see where the roughly $1000 price gap between the Honor Play and the newest(?) iPhone XS Max?. Their brand is really not worth that much to me anyhow. "iPhone: About 1250 EUR, Honor Play: About 320 EUR" [1] [1] https://www.gsmarena.com/compare.php3?&idPhone2=9230&idPhone...

For sure apple has a markup, but there is no way the Honor Play compares to the iPhone XS Max. Starting with the camera.

It also has that blank area at the bottom, whereas Apple had to basically invent some insane hardware gymnastics to not have that on theirs. The iPhone X screen bends around backwards at the base.

Re: Windows Sandbox

#127
post #70

Earlier quoted context omitted.

> Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. This has always been the case on Windows. In fact if anything, nowadays it’s better than its ever been because thanks to the UAC and other controls Microsoft have put in place, developers aren’t so free to do whatever they like to the host machine. But that’s remember a time before the UAC when it would…

You're contradicting yourself in your first and second paragraph... Those proper package managers still rely on the packager doing things correctly - just as it would creating a windows .msi. There's plenty of linux packages that creates files during operation in their designated /var/log/xxx /var/db/xxx /etc/xxx /home/xxx/ directories that you're not able to query using the package manager.

Isn't the parallel to UAC a properly configure SELinux? I thought that was the component that lets process rwx from certain locations? I guess a full comparison may be including applocker too.

Not to hot on linux management options I just install the thing over and over.

Re: Windows Sandbox

#129

Earlier quoted context omitted.

It seems to me that no matter what happens two classes of users are going to be created: those that can pay for security and those that cannot. Ultimately Apple's pricing means all their users are first class - hence security as a bread-and-butter feature on their platforms. In MSFT's case they're going to have low and high cost consumers, so they segment those users into the two relevant classes. None of this is goo…

> Ultimately Apple's pricing means all their users are first class - hence security Yeah... Good luck running the latest version of iOS on an older iPhone. (Many are still have a 5/6 and you really don't want to update those if you value a reasonable experience and latency.)

You do realize you're attacking the _one_ company which supports their phone for the longest period, do you?

IOS 12 can be installed on the 5S, which is the oldest 64 bit phone. It was launched in 2013.

Re: Windows Sandbox

#130
post #99

Earlier quoted context omitted.

While your statement is reasonable, it's interesting seeing a Mac user complain about things being too expensive. Is it fundamentally worse to overcharge for software over the hardware?

It seems to me that no matter what happens two classes of users are going to be created: those that can pay for security and those that cannot. Ultimately Apple's pricing means all their users are first class - hence security as a bread-and-butter feature on their platforms. In MSFT's case they're going to have low and high cost consumers, so they segment those users into the two relevant classes. None of this is goo…

> unfortunately for most laypeople it's security and privacy that's on the chopping block.

I think this is why we need legislation: The free market obviously can't sort this out to peoples' benefit.

I have a couple Android devices I can't figure out how to update, so I'm afraid to use them for anything serious. If the author isn't responsible for writing crappy code, and I can't fix it, then where's my lemon law?

Post reply on HN