Why is this enterprise only?
Introducing Windows Defender Application Guard for Microsoft Edge
31–40 of 59 posts
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#32I sense this is the same feature that is used to implement Docker containers. Possibly browser isolation was the primary driver and it got co-opted for the server.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#33Fewest vulnerabilities: I suspect that Chrome and Firefox being open source is a factor here. Thus it seems possible to me that they actually have fewer vulnerabilities than Edge—Edge’s just haven’t been found yet. This is pure speculation on my part; I have no evidence nor any investigation, deep or otherwise.
Chrome and Firefox has a much larger userbase than Edge has. (As of now). As Edge matures and its userbase grows we will have a chance to see how it measures up :)
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#34Why is this an enterprise-only feature? Do regular user not deserve the same level of security for their browsers? Will this tech even be available to non-Microsoft apps in the future?
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#35Why is this an enterprise-only feature? Do regular user not deserve the same level of security for their browsers? Will this tech even be available to non-Microsoft apps in the future?
It's not very useful for regular users outside of private browsing - the WDAG windows are unable to persist any state at all since their container is discarded at the end of the browsing session to thwart malware persistence.
It does sound like an interesting capability for private browsing, but existing mechanisms mostly cover that. Even if WDAG applied to private Windows, ordinary users aren't so likely to open private browser windows just to check a link from an email.
I expect that if you had a copy of Win10 Enterprise you could configure the feature yourself for added security in paranoid cases (e.g. journalist covering abusive regimes who might be targeted by state-level malware).
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#36Earlier quoted context omitted.
Yes, because it has helped OpenSSL a lot.
The point isn't that every open source app is awesome, it is that now you KNOW. You're directing snark towards OpenSSL presumably because you think it's a poorly coded. If it was closed source you might not even be aware of the issues and there certainly wouldn't be the open source efforts to code alternatives.
What matters most is the amount of security effort paid to the project, not whether it is open- or closed-source. Commercial decompilers, reverse-engineering tools and automated bug finders have come a long way - a determined reverser can find bugs in closed-source code almost as easily as in open-source code. But, both kinds of bug finding take time and loads of manual effort (despite good tools), and will often only happen with appropriate incentives.
This is where closed-source has a major advantage: companies put up money (in the form of bug bounties) to counteract the bug prices that a researcher could obtain on the black market. This incentivizes "good" researchers to spend time on their products. Open-source projects, even highly-successful ones, rarely have enough funding to run good bug bounty programs. Consequently, good guys can't pay the bills finding bugs in open source, whereas bad guys get huge payoffs for finding and exploiting bugs (think the NSA, criminal groups, malicious states, etc.).
As the adage goes, enough eyeballs render all bugs shallow. But, in this day and age, that applies both to open- and to closed-source code.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#37Earlier quoted context omitted.
The point isn't that every open source app is awesome, it is that now you KNOW. You're directing snark towards OpenSSL presumably because you think it's a poorly coded. If it was closed source you might not even be aware of the issues and there certainly wouldn't be the open source efforts to code alternatives.
If it was closed-source, we would assume it had lots of issues until reviewed by a qualified, third party that we trust saying otherwise who also gives us signed hash for binary that was reviewed. The way it's been done in proprietary evaluations a long time. It would be done more if companies were actually interested in a real evaluation instead of a stamp that knocks out their liability. ;) Under DOD's TCSEC criter…
Some of the recent proposed international trade treaties would forbid governments from requiring companies to supply source code for their software, if I recall correctly.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#38Why is this an enterprise-only feature? Do regular user not deserve the same level of security for their browsers? Will this tech even be available to non-Microsoft apps in the future?
Perhaps non-enterprise does not have widely deployed support for Hyper-V, for example VT-x/AMD-V support & BIOS enablement.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#39Earlier quoted context omitted.
He means the quality is so bad that users of it could get owned by full, remote execution on a regular basis. That some people saw some flaws didn't mean anything. There were some alternatives, including commercial, where people put extra effort into checking how crypto interfaced or the quality of the code. Some even used static analysis to find common flaws. As I say, the difference in 0-days between them and OpenS…
>A closed development with good effort is more trustworthy than an open one with low effort or review. Good code is better than bad code obviously, but how do you know what you have if you can't see the source? It's Schrodinger's code, you don't know it's bad until it's too late.
Independent review of source with published hash for binary or analysis of assembly to compare it to baseline. Many problems that due diligence avoids can be detected at ASM level. You'd know they were at least doing that.
Re: Introducing Windows Defender Application Guard for Microsoft Edge
#40Earlier quoted context omitted.
If it was closed-source, we would assume it had lots of issues until reviewed by a qualified, third party that we trust saying otherwise who also gives us signed hash for binary that was reviewed. The way it's been done in proprietary evaluations a long time. It would be done more if companies were actually interested in a real evaluation instead of a stamp that knocks out their liability. ;) Under DOD's TCSEC criter…
Some of the recent proposed international trade treaties would forbid governments from requiring companies to supply source code for their software, if I recall correctly.
No doubt inspired by bottom line and SIGINT concerns. In that case, it can be voluntary as a differentiator.