Live data from Hacker News

Microsoft unveils sandbox boundaries for Windows 8/Metro developers

blogs.msdn.com

11–20 of 29 posts

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#11

Apps can only access files with the same file type association? What about generic text editors? SSH clients? :/

Whoa there, read more carefully. It seems that if you use the built-in FilePicker then your app can use any file on the system, provided that the OS is sure that the user has actively given you access to it. Also, there appear to be ways to obtain permissions beyond the default level.

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#12
post #2

One upside of this is that it looks like they're really pushing the one-click installs. It isn't apt or yum, but it's certainly better than what Windows has now..

How? Windows installation has been fine for a decade and a half. Actually, it's going BACKWARD, with vendors now not bothering to ask you WHERE you want application links stored and instead littering your machine's program menu with endless directories named after themselves. Who the hell organizes their applications by vendor? I want my graphics apps together, my audio apps in another group, general office-type apps in another.

With every release, Windows has made this basic function (organizing applications) a bigger pain in the ass. If Microsoft is going to start enforcing policies, then this should be one: No application can simply barf a bunch of crap into your Start menu without ASKING where you want it to go.

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#13
post #3

"While it is possible to hide or obfuscate calls to APIs that are not included in the SDK, this is still a violation of customer expectations and Store policy." Wait, does the platform not include a sandbox to make sure this doesn't happen? What "security" can you expect to get out of such a platform?

The problem likely is that part of the public API is in DLLS that use a private API to talk to the system. For example, public class AddressBook extends AddressBookBase, with 'Base' having a couple of private fields that may come in handy.

Third parties could figure out that private API and call it themselves.

I do not think it is practical to defend the system against thos. Moving that base class into the kernel takes performance and includes its own security risks. Shipping multiple versions of the OS with different layouts or even implementations for such subclasses might help a bit, but also would open the system for bugs that show up on only 1/N of the machines.

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#14
post #4
post #3

"While it is possible to hide or obfuscate calls to APIs that are not included in the SDK, this is still a violation of customer expectations and Store policy." Wait, does the platform not include a sandbox to make sure this doesn't happen? What "security" can you expect to get out of such a platform?

isn't it the same that happens on iOS ?

Yes, this is exactly the same (or at least awfully similar). iOS has some APIs that are technically available to 3rd parties, but disallowed by the terms of service. It was news in 2008 when Google Mobile violated the guidelines to access some useful features.

http://daringfireball.net/2008/11/google_mobile_uses_private...

(Disclaimer: I work for Microsoft, though not on Windows.)

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#15
post #2

One upside of this is that it looks like they're really pushing the one-click installs. It isn't apt or yum, but it's certainly better than what Windows has now..

How? Windows installation has been fine for a decade and a half. Actually, it's going BACKWARD, with vendors now not bothering to ask you WHERE you want application links stored and instead littering your machine's program menu with endless directories named after themselves. Who the hell organizes their applications by vendor? I want my graphics apps together, my audio apps in another group, general office-type apps…

Sorry, I think you missed a pretty big memo. The Start Menu is gone in Windows 8.

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#16
post #3

"While it is possible to hide or obfuscate calls to APIs that are not included in the SDK, this is still a violation of customer expectations and Store policy." Wait, does the platform not include a sandbox to make sure this doesn't happen? What "security" can you expect to get out of such a platform?

The sandbox (AppContainer) and the SDK API restrictions are two separate things. Capabilities and isolation are enforced by the AppContainer, not the set of available APIs. AppContainer is actually a general system feature that can be used by desktop apps too to sandbox plugins and such (IE10 uses it in "Enhanced Protected Mode").

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#17
post #6

Earlier quoted context omitted.

Windows 8 Metro apps can be written in real C++. How could they sandbox a custom C++ app? There's no virtual machine to do it. http://msdn.microsoft.com/en-us/library/windows/apps/hh46504...

It's C++/CX. It's not just "real C++".

They can be written in ISO C++ (or if you're a masochist, in C) as well, just without some conveniences.

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#18
post #6
post #3

"While it is possible to hide or obfuscate calls to APIs that are not included in the SDK, this is still a violation of customer expectations and Store policy." Wait, does the platform not include a sandbox to make sure this doesn't happen? What "security" can you expect to get out of such a platform?

Windows 8 Metro apps can be written in real C++. How could they sandbox a custom C++ app? There's no virtual machine to do it. http://msdn.microsoft.com/en-us/library/windows/apps/hh46504...

>How could they sandbox a custom C++ app? There's no virtual machine to do it.

They could use NaCl [1] or develop a similar SFI technology just for Windows.

[1] http://en.wikipedia.org/wiki/Google_Native_Client

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#19
There are a lot of claims made here with regards to how end-users will effectively like to download and try apps from the metro store and take the time to write a good reasoned review about their experience.

Given the average response i've heard from end-users however, i somewhat doubt this. Most people i've talked to simply hate metro. Looking at other app stores, most reviews i've seen are low quality and emotionally driven.

Will be interesting to see how it all pans out.

Re: Microsoft unveils sandbox boundaries for Windows 8/Metro developers

#20
post #6
post #3

"While it is possible to hide or obfuscate calls to APIs that are not included in the SDK, this is still a violation of customer expectations and Store policy." Wait, does the platform not include a sandbox to make sure this doesn't happen? What "security" can you expect to get out of such a platform?

Windows 8 Metro apps can be written in real C++. How could they sandbox a custom C++ app? There's no virtual machine to do it. http://msdn.microsoft.com/en-us/library/windows/apps/hh46504...

Virtual machine is not required for sandboxing C++ apps in 21st century.

[1] http://code.google.com/p/nativeclient/

[2] http://www.cl.cam.ac.uk/research/security/capsicum/

Post reply on HN