Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Sandbox

techcommunity.microsoft.com

Post reply on HN
Print view View original

151–160 of 328 posts

Re: Windows Sandbox

#151

Post by konschubert »

meritt wrote: post #99
neotek wrote: post #38

Only Microsoft would come up with a new security feature and then intentionally and arbitrarily limit its availability to the most expensive version of their OS. This is the same company that thinks putting ads in the fucking file explorer is appropriate on an OS they charge hundreds and hundreds of dollars for.

While your statement is reasonable, it's interesting seeing a Mac user complain about things being too expensive. Is it fundamentally worse to overcharge for software over the hardware?

I think the problem is not that windows pro costs money. The problem is that Microsoft also sells a second-class version of their OS that is really shitty.

From a pure brand perspective, the smart move for Microsoft would be to stop selling windows home.

Re: Windows Sandbox

#152

Post by Semaphor »

crazysim wrote: post #37
Semaphor wrote: post #34

Earlier quoted context omitted.

Not running a tool that makes your attack surface bigger in exchange for questionable benefits?

They've put Defender into a sandbox nowadays. https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/...

Insider only for now. But a very good move imo.

Re: Windows Sandbox

#153

Post by neotek »

kypro wrote: post #144
neotek wrote: post #38

Only Microsoft would come up with a new security feature and then intentionally and arbitrarily limit its availability to the most expensive version of their OS. This is the same company that thinks putting ads in the fucking file explorer is appropriate on an OS they charge hundreds and hundreds of dollars for.

They'd probably have to raise the price of their cheaper versions if they didn't do this. Seems like a good compromise for the consumer to me. Offset the cost of all of the fancy tech most people won't want or use to those willing to pay more and potentially use it.

Not having to risk your machine being compromised every time you run a third party executable is not fancy tech.

Re: Windows Sandbox

#154

Post by neotek »

analognoise wrote: post #101
kungito wrote: post #96

Earlier quoted context omitted.

What other reason would there be to put an advanced feature in a more expensive version of something?

Agreed. Every time somebody complains about Microsoft doing business shrewdly and increasing their value to customers, I think "This is wht Linux never captured the desktop."

I don't get it. Linux never captured the desktop because they don't arbitrarily limit security features to people who pay more?

Re: Windows Sandbox

#155

Post by alkonaut »

laumars wrote: post #70
finchisko wrote: post #52

Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. And it's same on all known OSes. The side effect we see is system size growing in time. IMO running an app in a sandbox should be the default option. On Windows, I used to like sandboxie, which virtualized every write into single directory. Uninstall was easy as removing that dir. This MS sandbox doesn't a…

> Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. This has always been the case on Windows. In fact if anything, nowadays it’s better than its ever been because thanks to the UAC and other controls Microsoft have put in place, developers aren’t so free to do whatever they like to the host machine. But that’s remember a time before the UAC when it would…

> Of course you still have the problem of the software writing files during its operation but that should be limited to $HOME (on POSIX systems) or any path that is writable by the owner / group of the user that application runs as (which should be limited even if it’s a system service).

The really tricky problem is when a package must modify an existing shared resource. Such as appending lines to an existing config for example.

Re: Windows Sandbox

#156

Post by ezoe »

cm2187 wrote: post #57
ezoe wrote: post #45

Earlier quoted context omitted.

Your problem can be solved by not let your parents use Windows.

Like get them to learn a lot of linux command lines?

Why? Major GNU/Linux based distributions have browsers, LibreOffice and most of the software ordinary people usually want.

Re: Windows Sandbox

#157

Post by neotek »

xoss wrote: post #142
neotek wrote: post #38

Only Microsoft would come up with a new security feature and then intentionally and arbitrarily limit its availability to the most expensive version of their OS. This is the same company that thinks putting ads in the fucking file explorer is appropriate on an OS they charge hundreds and hundreds of dollars for.

> "Only Microsoft would come up with a new security feature and then intentionally and arbitrarily limit its availability to the most expensive version of their OS." What's your point? How is that not a reasonable business model?

Charge more for enterprise features by all means, but if basic security concepts are something you feel the need to charge for, your priorities are fucked up.

Re: Windows Sandbox

#158

Post by alkonaut »

revanx_ wrote: post #36

This is not a sandbox. All this does is launch windows in hyper-v virtual machine and configures the virtual environment automatically for you. You could achieve all of this yourself manually and you still wouldn't call it a sandbox, you would call it VM.

All vm's are sandboxes I suppose. The interesting difference between this and a normal VM is that the files are shared so that it's not using the space of a full VM.

Re: Windows Sandbox

#159

Post by cookiecaper »

coder543 wrote: post #93
cm2187 wrote: post #88

Earlier quoted context omitted.

But I don't think "it just happens" on windows either (outside of OEM crapware, which granted is pure dirt). Most of the time it is unsophisticated users led to click and install things themselves. An application signature won't help.

how would application signing not help? if the OS won't let the user install the malware, that's the end of the line. As I said in my original comment, I don't think Windows 10 is as fragile as earlier versions. A large part of this is the additional enforcement around application signing, even though it isn't as strong as what macOS does by default. In earlier versions of Windows, it absolutely did "just happen" fro…

>if the OS won't let the user install the malware, that's the end of the line.

except there's no definitive, 100% foolproof way to identify something as malware v. not-malware. If you put a bunch of dialogs in front of something, the site will just include a for-dummies illustration of what to click to allow the install. This will especially be the case if doing so is a prerequisite for receiving the new emoji pack, or whatever else it is that the people have been promised on the other side of those clicks.

We've been through this song and dance enough times that it's not a question of whether this will happen or whether users will fall for it. It's clear that it will and they will. Users do not read dialog boxes, they interpret them as noise and click through them. Operating systems can only protect the user from themselves up to a certain point, at least while retaining the ability to install third-party software.

My mom's computer(s) have been running Linux for probably 10 years now. This has kept her reasonably safe (especially as contrasted with my dad, who insists on Windows), but one time I went over to find some PDF injector-thing installed as a Chrome extension. From her POV, this "just happened".

While using a less-targeted platform helps a lot, online malfeasance is not a platform-specific problem. Pretending otherwise is kidding ourselves. Vigilance is always needed.

Re: Windows Sandbox

#160

Post by agumonkey »

laumars wrote: post #70
finchisko wrote: post #52

Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. And it's same on all known OSes. The side effect we see is system size growing in time. IMO running an app in a sandbox should be the default option. On Windows, I used to like sandboxie, which virtualized every write into single directory. Uninstall was easy as removing that dir. This MS sandbox doesn't a…

> Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. This has always been the case on Windows. In fact if anything, nowadays it’s better than its ever been because thanks to the UAC and other controls Microsoft have put in place, developers aren’t so free to do whatever they like to the host machine. But that’s remember a time before the UAC when it would…

As a kid, my favorite game was Norton CleanSweep. I couldn't stop watching it restore state, it was a bliss.

ps: coincidentally, I was just starting to use linux firejail on a daily basis.. very very useful.

Post reply on HN