Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Sandbox

techcommunity.microsoft.com

Post reply on HN
Print view View original

201–210 of 328 posts

Re: Windows Sandbox

#201

Post by AsyncAwait »

alkonaut wrote: post #155
laumars wrote: post #70

Earlier quoted context omitted.

> Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. This has always been the case on Windows. In fact if anything, nowadays it’s better than its ever been because thanks to the UAC and other controls Microsoft have put in place, developers aren’t so free to do whatever they like to the host machine. But that’s remember a time before the UAC when it would…

> Of course you still have the problem of the software writing files during its operation but that should be limited to $HOME (on POSIX systems) or any path that is writable by the owner / group of the user that application runs as (which should be limited even if it’s a system service). The really tricky problem is when a package must modify an existing shared resource. Such as appending lines to an existing config…

> The really tricky problem is when a package must modify an existing shared resource. Such as appending lines to an existing config for example.

Pacman creates a .pacnew file and lets you merge it yourself for this very reason.

Re: Windows Sandbox

#202

Post by pjmlp »

hawski wrote: post #182
pjmlp wrote: post #19

Earlier quoted context omitted.

That is what Windows store apps and MSIX sandbox are for.

I'm not much of a Windows user, but MSIX sounds great. Does it add a simple context menu entry to convert an installer? Bonus points for straight up Install and even more for Run. I see it's open source, so if it's missing it may be possible to make a distribution of it with those things implemented. Then one could install it and make it a default msi handler. Edit: from what I see conversion is much more involved. C…

MSIX is a developer feature, replaces appx and msi installers, while adding support for sandboxing in the process.

https://blogs.msdn.microsoft.com/sgern/2018/06/18/a-closer-l...

A generic user is supposed to just double click on an *.msix file to get it installed on the Windows Store infrastructure.

Re: Windows Sandbox

#203

Post by pjmlp »

SmellyGeekBoy wrote: post #191
pjmlp wrote: post #16

Earlier quoted context omitted.

Power users get Pro, typical home users think that sandboxes are children playgrounds.

I'd argue that typical home users are the people who need this feature the most.

And I would argue they are better off with Windows S mode.

Re: Windows Sandbox

#204

Post by AsyncAwait »

kevingadd wrote: post #197
laumars wrote: post #70

Earlier quoted context omitted.

> Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. This has always been the case on Windows. In fact if anything, nowadays it’s better than its ever been because thanks to the UAC and other controls Microsoft have put in place, developers aren’t so free to do whatever they like to the host machine. But that’s remember a time before the UAC when it would…

I've had the installation of apt-get packages permanently hose an ubuntu or debian install. It's all up to packagers to author their packages right so they don't leave garbage on your machine that you have to manually clean up (or give up and reformat).

Don't know about apt specifically, but using pacman (Arch Linux), you can list exactly what files on your filesystem were installed by what package and remove them. You can't do this on Windows, as far as I know.

Re: Windows Sandbox

#205

Post by haolez »

geocar wrote: post #130
zaksoup wrote: post #104

Earlier quoted context omitted.

It seems to me that no matter what happens two classes of users are going to be created: those that can pay for security and those that cannot. Ultimately Apple's pricing means all their users are first class - hence security as a bread-and-butter feature on their platforms. In MSFT's case they're going to have low and high cost consumers, so they segment those users into the two relevant classes. None of this is goo…

> unfortunately for most laypeople it's security and privacy that's on the chopping block. I think this is why we need legislation: The free market obviously can't sort this out to peoples' benefit. I have a couple Android devices I can't figure out how to update, so I'm afraid to use them for anything serious. If the author isn't responsible for writing crappy code, and I can't fix it, then where's my lemon law?

It is not a better solution to take away the freedom of people who are willing to sell their privacy. For some, it’s the only way to afford a computer.

Re: Windows Sandbox

#206

Post by the8472 »

voltagex_ wrote: post #145
Semaphor wrote: post #34

Earlier quoted context omitted.

Not running a tool that makes your attack surface bigger in exchange for questionable benefits?

Okay, even if I take your comment about attack surface at face value, what are you suggesting? Surely not avoiding AV completely.

You could use an AV but only run offline scans on a schedule.

Re: Windows Sandbox

#207

Post by wtallis »

meritt wrote: post #177
neotek wrote: post #147

Earlier quoted context omitted.

You misunderstand me, it has nothing to do with Windows being "too expensive", the point is that you've paid for it and they still abuse your privacy and shove ads down your throat at every opportunity. By way of comparison, I willingly and happily pay more to use Apple hardware and software specifically because that money buys me a hell of a lot more privacy, security, and functionality than the equivalent amount of…

I am not misunderstanding you. Your entire comment was centered around a perceived unfairness regarding price: > most expensive version of their OS. > they charge hundreds and hundreds of dollars for. To be clear here, I'm not defending Windows. I agree with you that what they do is not constructive for their users. I'm merely pointing out it's ironic for Mac users sit on their throne and decry Windows' practices whi…

Are you seriously trying to claim that Macs are overpriced by hundreds of dollars by trying to compare them against an ATX desktop? Or do you have some more reasonable comparison in mind of Apple and non-Apple products that actually compete in the same market segment, and where the Dell/Lenovo/HP/whatever is significantly more upgradable?

And do you have any reasonable complaints about the security and privacy of a modern Mac with the T2 chip, or are you saying that anyone who cares at all about security should run Linux and spend 30% of their time wrangling with SELinux policies?

Re: Windows Sandbox

#208

Post by zozbot123 »

cm2187 wrote: post #57
ezoe wrote: post #45

Earlier quoted context omitted.

Your problem can be solved by not let your parents use Windows.

Like get them to learn a lot of linux command lines?

If you start from a rock-solid distro, install an adequate DE and do troubleshooting the Windows way (i.e. just reinstall and restore your data from a manual backup whenever things go haywire - which they shouldn't, anyway), you can absolutely get away with not using the Linux CLI, ever. Is this a sensible way of using a computer system? Perhaps not. Is it better than just staying on Windows 10 (provided that Linux itself addresses your needs, of course)? Absolutely!

Re: Windows Sandbox

#209

Post by zozbot123 »

ForHackernews wrote: post #167
mosselman wrote: post #98

Earlier quoted context omitted.

The same goes for full disk encryption, it isn’t included in the cheapest edition I installed on an old laptop for my mother. Now booting with veracrypt takes 2 minutes. Needless to say I had to get her a chromebook: new laptop, easy to use, secure and for the price of one windows license. This is what will get Microsoft in the end.

Secure and inexpensive as long as you don't mind paying with your privacy. I'm worried that this is going to be the compromise we're all forced to make in the future.

> Secure and inexpensive as long as you don't mind paying with your privacy.

There are obvious alternatives to ChromeOS that are just as secure and just as inexpensive (especially if you have some old hardware just laying around, or else you can just buy refurbished hardware - just about anything made in the last 10 years will do, if not more than that) - and not any less useful than a Chromebook. And they can be updated for as long as the hardware keeps going - they won't suddenly become "unsupported" after a mere five years.

Re: Windows Sandbox

#210

Post by laumars »

kevingadd wrote: post #197
laumars wrote: post #70

Earlier quoted context omitted.

> Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. This has always been the case on Windows. In fact if anything, nowadays it’s better than its ever been because thanks to the UAC and other controls Microsoft have put in place, developers aren’t so free to do whatever they like to the host machine. But that’s remember a time before the UAC when it would…

I've had the installation of apt-get packages permanently hose an ubuntu or debian install. It's all up to packagers to author their packages right so they don't leave garbage on your machine that you have to manually clean up (or give up and reformat).

You're comment is very light on detail so it's hard to understand your issue properly but I've been running Linux as my primary desktop for more than 15 years and have managed literally hundreds of Linux servers too and never had a package manager hose my platform (big caveat: aside the notorious `filesystem` update on ArchLinux but that one is an extreme edge case scenario due to the rolling release nature of Arch. However even package was well documented on Arch's site beforehand as being a package that required manual steps to upgrade).

It's true that Linux package managers used to be buggy and problematic in the 90s but those days have long since gone. And while I'm not discounting that a package upgrade could damage your system, the instances when they do are highly unusual rather than a typical problem users face with each and every upgrade. In fact Windows sysadmins have far more dread with running Windows updates than Linux admins do and yet Windows updates are only focused on Microsoft products rather than every piece of software on the system.

> It's all up to packagers to author their packages right so they don't leave garbage on your machine that you have to manually clean up (or give up and reformat).

Actually it's not. It's up to the application developers to do that. If you specify a package to install a file `x` to location `y` then the package manager will uninstall that file automatically too. You don't specifically need to tell the package manager to do that (or at least not with any of the packaging systems I've used). But if the application developer writes the application to spew out thousands of files into $HOME, that happens outside of the package manager. There isn't a whole lot you can do to stop that aside limit the directories which your application has permission to write to (either via chroot, containerisation, user/group permissions, SELinux, or other forms of ACL. There's actually plenty of tools on Linux / UNIX to handle that problem).

Post reply on HN