16 ms·

Windows Sandbox

597 points by prostoalex 8y ago

dman 8y ago
Please do not make this a Pro / Enterprise feature. I do remote tech support for my parents and would love for them to browse / use apps in a sandbox.
- voltagex_ 8y ago
  Agreed, but at least it isn't gated off like Windows Defender Advanced Threat Protection
- dkdbejwi383 8y ago
  Agreed, this sounds like a genuinely useful feature, it’s a shame to hide it and restrict it to pro users only. Things like this should be “first class citizens” of the OS and in the spotlight for marketing.
- voltagex_ 8y ago
  Ah, it's Pro because it's using Hyper-V.
  - n-gatedotcom 8y ago
    Then make Hyper-v home. Seriously this is a killer feature needed by everybody. And specially the non-pro users.
    - JaRail 8y ago
      A lot (most?) of the hardware Home runs on doesn't support hardware virtualization.
      - coder543 8y ago
        Effectively all x86_64 hardware from the last 10+ years supports hardware virtualization, so I can't agree.
        justincormack 8y ago
        Not necessarily in the Bios settings. And there are CPUs without still.
        kevingadd 8y ago
        Aside from the points made by another reply (BIOS support, older CPUs), some machines have virtualization switched off by default because it's broken. I had a (fairly old) x86-64 laptop that would randomly hardlock while running VMs if I turned on hardware virtualization.
      - Already__Taken 8y ago
        £2,500 Dell XPS ships Home out of the box unless specified otherwise. Windows SKU has nothing to do with hardware. https://www.dell.com/en-uk/shop/2-in-1-laptops/new-xps-15-2-in-1/spd/xps-15-9575-2-in-1-laptop/cn95704?view=configurations https://www.dell.com/en-uk/shop/2-in-1-laptops/new-xps-15-2-... Actually I can't seem to configure that directly from dell to come with Pro lol. Seems there's a question about that too.
        wongarsu 8y ago
        With Dell you have to buy the business version of a notebook to get Windows Pro. Your example would be [1][2]. Apart from price the main differences are that the business versions ship with Windows Pro and that they have better warranty (next-day onsite). 1: https://www.dell.com/en-uk/work/shop/tablets-and-2-in-1-laptops/xps-15-2-in-1/spd/xps-15-9575-2-in-1-laptop https://www.dell.com/en-uk/work/shop/tablets-and-2-in-1-lapt... 2: https://www.dell.com/en-uk/work/shop/laptops/new-xps-15-2-in-1/spd/xps-15-9575-2-in-1-laptop/bn95704?view=configurations https://www.dell.com/en-uk/work/shop/laptops/new-xps-15-2-in...
        WorldMaker 8y ago
- joshAg 8y ago
  why not just buy them a pro edition? I know it's more expensive, but that would also get you remote desktop, bitlocker, and group policy, which would all also be great for remote supporting your parents.
  - dman 8y ago
    Because sometimes they buy a new computer and it is a while before I am able to visit them across the planet and install a new OS in it. Would really like a good out of the box experience.
    - Schlaefer 8y ago
      You don't need to install a new OS, you just enter a Windows Pro license key to upgrade the version? Buy the key online, send it to your parents, tell them where to enter it, done. Also I don't think your parents want to use that particular sandbox. There's no persistence at all: no bookmarks, no cookies, no history, no local documents, ...
      - dman 8y ago
        The no persistence is why I like it. It would be ideal if I could ask my parents to do their entire browsing in an ephemeral sandbox and even if they end up clicking / installing something from a shady link it wont blow away their (real) persistent OS install.
    - joshAg 8y ago
      Totally get that issue. It might be worth spending a day or weekend making a boot-disk for them that will wipe their current disk image, and install win10 pro with it set-up so you can remote admin it. That way for your parents they just have to buy the pc, put the usb in and reboot it, and then call you when it's back on so you can remote in and give it a key and finish configuring it for them. I suppose even that might cause issues if you can't teach them or walk them through via facetime how to set the device to boot from the usb instead of the harddrive.
  - lotsofpulp 8y ago
- abhiminator 8y ago
  Agreed. I'd go so as far to say that consumers -- especially technologically vulnerable ones like your parents, for example -- need this more than any other demographic. Microsoft should make it easy to download, install and update on all non-Enterprise versions of the OS. This will also greatly reduce instances of a random ransomware holding critical data hostage and doing irreparable economic damage to small businesses (as was visible during the WannaCry episode last spring [0]). [0] https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
  - plq 8y ago
    > Microsoft should make it easy to download, install and update on all non-Enterprise versions of the OS. I'll take this one step further: Microsoft should make this as easy as "right click > Run in Sandbox". It would make the lives of everyone so much easier.
- pjmlp 8y ago
  That is what Windows store apps and MSIX sandbox are for.
  - Santosh83 8y ago
    You can't run a non-Store app in such a sandbox I believe?
    - pjmlp 8y ago
      Only when packaged via MSIX, which is why I mentioned it.
  - TeMPOraL 8y ago
    Except Windows store apps are strictly worse than being able to run regular Windows software in a sandbox.
    - pjmlp 8y ago
      One of MSIX purposes is to package old style Windows software, your regular Windows software into Windows Store sandbox, hence why I mentioned it. It is an evolution of desktop bridge, appx and msi.
      - TeMPOraL 8y ago
        I stand corrected.
  - hawski 8y ago
    I'm not much of a Windows user, but MSIX sounds great. Does it add a simple context menu entry to convert an installer? Bonus points for straight up Install and even more for Run. I see it's open source, so if it's missing it may be possible to make a distribution of it with those things implemented. Then one could install it and make it a default msi handler. Edit: from what I see conversion is much more involved. Create a certificate and go through a wizard and fill out some forms. Correct me if the is a quick and easy convert option. Otherwise it's a nice thing that needs more development to be useful for a generic user.
- Illniyar 8y ago
  Hardware virtualization is a Pro feature in windows, so I doubt this is possible even if they wanted to (without moving virtualization to home edition).
- ezoe 8y ago
  Your problem can be solved by not let your parents use Windows.
  - cm2187 8y ago
    Like get them to learn a lot of linux command lines?
    - coder543 8y ago
      I'm pretty sure that's not the only alternative... some others include a Chromebook, an iPad, a MacBook, or even installing a Linux distro and setting it up for them such that they don't need to use the CLI to accomplish the things they want to do. But honestly, my opinion is that Windows 10 is not as fragile as earlier versions of Windows were.
      - cm2187 8y ago
        If the parents' problem is that they install random software, that's not going to help them. I have seen MacBooks with twenty spyware browser extensions.
        coder543 8y ago
        I really doubt that, but I can't easily argue with an anecdote, so sure. It happened, probably 15 years ago. Windows was famous for tons of installers bundling toolbars, but that's never been an epidemic on Mac. These days, Macs will not install unsigned software by default, and you can lock that down to App Store only with a single setting change, so they're certainly not getting bundled malicious toolbars from installing software... since distributing malware is a quick way to get your developer signature revoked, and you're certainly not going to be installing toolbars from the App Store sandbox. That leaves manually installing malicious toolbars through the official extension store for whatever browser they use. All extension stores do their best to weed out malicious extensions these days, and it takes intentional effort to install extensions. It doesn't just happen while you're trying to do other things. Obviously, toolbars don't even exist on iPads, and software installers bundling random malware is obviously not a huge concern on Chromebooks. A MacBook was not at the front of my list, so I don't know why you chose to singularly attack that option. Maybe you thought it was the easiest target?
- ChuckMcM 8y ago
  Think of it like giving your parent's a $100 present for Christmas, an upgrade from Win Home to Win Pro and your life will be so much easier.
  - dman 8y ago
    Sure, but Microsoft could give the same gift to every parent out there. (I don’t mind buying windows pro for parents at all, issue is that when they buy a device it often does not come with pro preinstalled so there is a window where the device is vulnerable before I can remotely administer it)
    - ChuckMcM 8y ago
      Of course they could, but using that money they will go on to build another feature that you'll be able to use because you're already at the 'pro' level of their OS. The alternative is to convince some engineers to create this same feature in their spare time and contribute it for free as a Linux package. Then they can get email about all of the things it doesn't do, and fix bugs in their spare time on a feature that all they see are complaints for. Until they burn out and the repo goes dead for a while and then gets picked up by one of those users who wants the feature to exist, and they make some improvements and get into an argument with another user who forks it and now there are two of them, almost the same but with a few features that are unique to each one. Of course for most of the users they either don't care and load one at random, or they do care and find features from the "other" system they want in the one that is being used. They send mail to the maintainers asking them to copy those features. Which adds more pain as the developers copy each other's features but they put their own special spin on them. This burns out more developers and a third person comes out and writes their own syntactically incompatible version that is functionally identical to the two different 'legacy' versions. At this point I just pay the man his $100 and appreciate that the people working on the code are on it all day and can spend evenings with their family.
- theandrewbailey 8y ago
  I took an inventory of which apps my parents use: email, solitaire, Youtube, and some web browsing. That was it. Linux is good at doing those things, so I put them on Xubuntu (my preferred distro) about 8 years ago. Once my mom understood that the UI was similar enough to Windows, she didn't mind. Its been remarkably stable (and usable) ever since.
- josho 8y ago
  You underestimate your parents likelihood to overgeneralize your sandbox advice. I expect you will be receiving this call months from now: "You told me to use sandbox to be safe, so I wrote critical document X in a sandbox because I want it to be safe, but now that I rebooted I've lost all of my work."
devwastaken 8y ago
>this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD! Swing and a miss. It's interesting how Microsoft will force their slow AV onto every win10 home edition device, yet won't give actual tools users can protect themselves with.
- voltagex_ 8y ago
  I've found Defender to be a definite performance hit but what's a better option? I'd rather not have the subscription costs.
  - Semaphor 8y ago
    Not running a tool that makes your attack surface bigger in exchange for questionable benefits?
    - crazysim 8y ago
      They've put Defender into a sandbox nowadays. https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/ https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/...
      - Semaphor 8y ago
        Insider only for now. But a very good move imo.
    - voltagex_ 8y ago
      Okay, even if I take your comment about attack surface at face value, what are you suggesting? Surely not avoiding AV completely.
      - Semaphor 8y ago
        > Surely not avoiding AV completely. Exactly that.
chungy 8y ago
Sandboxie has been providing similar functionality on versions of Windows since XP: https://www.sandboxie.com/ https://www.sandboxie.com/ It's probably nowhere near as elegant as the Windows 10 feature, but it should be very handy if you have older versions of Windows!
- voltagex_ 8y ago
  Sandboxie is a UI nightmare IMO - it took me ages to work out how to launch a single program in a sandbox.
  - chungy 8y ago
    Interesting. How long ago was this? I've used Sandboxie for around 10 years and in that entire time, it has always just been a matter of right-clicking the program and "Run Sandboxed", even trivially accessing the sandboxed start menu via the notification icon.
    - revanx_ 8y ago
      I agree, been using Sandboxie for way over 6 years now and it's the easiest thing ever to use.
  - superasn 8y ago
    Yes it's one of the examples of brilliant coding marred by a very unintuitive user interface. I've used it many times on occasion but always end up uninstalling it because it makes such simple things so complicated.
- arkitaip 8y ago
  Sandboxie is a broken POS. I gave up on it a few months ago after getting tired of having to troubleshoot why another app wasn't working the way it should.
  - morrbo 8y ago
    I don't think that's a fair comment to make. It's obviously not broken. I've used it myself to run games downloaded from torrents and it was fine. It also supports office installations and a whole other loaf of stuff. Whilst I agree that the UI isn't the best (at least when I used it) calling it a piece of shit without providing specifics isn't helping anyone
fuzzy2 8y ago
Based on Hyper-V? Bummer. I use VMware Workstation at work and that’s not going to change.
- ToFab123 8y ago
  I could but I won't. What keeps me on VMware if that I can easily expand the vm to use 1 or more monitors. I am not sure if hyperv handles resizing of the window as smooth as VMware the adjust the display settings in the client. Last time i checked hyperv (rdp) just gave me scrollbars. It is probably antitrust concerns that is the reason why Microsoft never has improved the RDP client.
  - JaRail 8y ago
    I haven't used HyperV in a while. I rarely connected to VMs via the hyperv console, just for installations or cases where windows wasn't booting properly. I use MSTSC (MS Terminal Services Client). That has supported multimonitor for the 12 or so years I've used it.
    - ToFab123 8y ago
      Yes, it does support multi monitor no problem. VMware has a couple of buttons in the tools bar that allows you to go from using 1 monitor to 2 or 3. It then adjust the screen resolution inside the guest vm and of course you can go back to one monitor. I believe MSTSC reguires you to start it with a switch /span or something and then you need to close the RDP window and launch it again if you want to add / remove monitors.
      - JaRail 8y ago
        I'm trying to think when exactly the GUI was updated. I think somewhere around Vista. You can just check "use all my monitors for the remote session" in the Display tab. I'll admit that with a triple-monitor setup, I've sometimes wanted to remote in with only a dual-screen setup. So it wasn't perfect for me. It certainly did fine for my 95% use-cases. Having to reconnect to adjust desktop size just was never a big deal for me. Maybe adjusting sizes is more of an issue for people today. If I was using a laptop and constantly docking/disconnecting external monitors with a large number of active connections, it'd annoy me to have to completely reconnect each time.
plq 8y ago
How detectable will it be? I doubt this will make the lives of malware analysts any easier.
- n-gatedotcom 8y ago
  As much as hyper-v. Without sounding disparaging (because this is really cool), its just a one-click application-on-windows-on-hyper-v. So all the pros and cons come with it.
  - plq 8y ago
    Yeah, I assumed that "sandbox" implied some smarter isolation technique closer to eg Linux namespaces instead of just app-v in a new shiny packaging. Nothing new for the malware-analysis use-case.
jaimehrubiks 8y ago
I feel it lacks some features like being able to preinstall software such as adobe reader on the virtual desktop.
make3 8y ago
"Graphic virtualization" so could someone who isn't me use this to safely run pirated games?
- blauditore 8y ago
  Theoretically yes, but it would probably take a considerable performance hit.
  - senectus1 8y ago
    depending on the pirated game this might be a good thing :-P
    - thecatspaw 8y ago
      in what game is a performance hit desirable?
      - Zekio 8y ago
        Some games physics engines break down once you go past a high enough framerate, such as the fallout games a performance hit would likely keep you below the 125 fps where it begins to break
  - make3 8y ago
    "probably".. that's the question.. not being useful answer
kodablah 8y ago
Quick thoughts... First thought: I'd love to be able to ship an app w/ this enabled by default (i.e. it's an ephemeral app w/ no local data storage). Second thought: I'd love to pause this snapshot and resume it. Too many apps store preferences that you don't want to reconfigure just because you want isolation from the rest of the system each execution. Third thought: Instead of always-dispose-on-app-close, I would like to namespace/cgroups-style it instead. This is how I would expect the Chrome equivalent of FF's "containers" would be built (I know I can --user-data-dir which is similar).
- jclay 8y ago
  Regarding your first thought, you can get pretty close today with Windows Isolated App Containers. Chromium uses this under the hood.
cm2187 8y ago
I'm glad to finally see some innovation on Windows that is not user hostile.
- lvs 8y ago
  It could just be that we simply haven't had time to figure out the manner in which it's hostile.
revanx_ 8y ago
This is not a sandbox. All this does is launch windows in hyper-v virtual machine and configures the virtual environment automatically for you. You could achieve all of this yourself manually and you still wouldn't call it a sandbox, you would call it VM.
- crummy 8y ago
  Can't you use a VM as a sandbox?
  - revanx_ 8y ago
    Sure, I just don't think they should advertise this as such because it's nothing more then a VM. It's not some new windows feature, you could do this same thing since Windows 8.1 using hyper-V or since windows XP using something like Virtualbox. A proper sandbox would be if you could run a program in the same operating system with an isolated execution environment, similar to how sandboxie does it.
- JaRail 8y ago
  You can say you get the same result, yes. However this does it in a very different way. It's linking to the host OS's OS. It's not a VHD with a separate windows installation. That makes it quite a bit more lightweight. You don't have to patch it separately, etc. When installed, the sandbox image is only 100mb, mostly immutable links to host OS files.
- gshrikant 8y ago
  I agree, it is not the same sandbox as for example, browser sandboxes which restrict capabilities for multiple tabs to a given set of resources. However, its closer to KVM or Docker than to VirtualBox. The host and the 'guest' appear to be much more tightly integrated than in a full virtualized environment.
- alkonaut 8y ago
  All vm's are sandboxes I suppose. The interesting difference between this and a normal VM is that the files are shared so that it's not using the space of a full VM.
neotek 8y ago
Only Microsoft would come up with a new security feature and then intentionally and arbitrarily limit its availability to the most expensive version of their OS. This is the same company that thinks putting ads in the fucking file explorer is appropriate on an OS they charge hundreds and hundreds of dollars for.
- apapli 8y ago
  I’d put oracle in that boat too. Actually, I think it would be hard to find an enterprise software vendor who wouldn’t want to include extra functionality in their premium SKUs as a way to further differentiate them and encourage up-sell.
  - franga2000 8y ago
    Extra functionality yes, but not a security feature. I'd understand making WSL or PowerShell a >= Pro feature, but something that is designed to secure users from malicious applications. That should be included with even the lowest SKU that can run win32 (its sad that this last qualifier is even required).
  - TeMPOraL 8y ago
    That's OK when you put enterprise features in enterprise versions. A regular user doesn't need to be able to run SharePoint, but they might want to get proper sandboxing of regular software.
- lionpixel 8y ago
  I paid 13€ for an Microsoft Windows 10 Pro OEM key. I thought everyone is doing this as well?
  - ToFab123 8y ago
    I use a windows 8 retail key
    - SmellyGeekBoy 8y ago
apapli 8y ago
Prerequisite: AMD64. Does that mean it will work with my Ryzen, but no intel chips? That’s a nice win for AMD at the expense of intel if true for corporate environments.
- CSDude 8y ago
  No, Intel supports AMD64
- Gaelan 8y ago
  AMD64 is another name for x86_64 (IIRC, because it was originally AMD's arch)
- fireattack 8y ago
  https://en.wikipedia.org/wiki/X86-64 https://en.wikipedia.org/wiki/X86-64
- manigandham 8y ago
  AMD64 = x64 = x86_64 = common names used to describe the 64-bit x86 instruction set that both Intel and AMD CPUs support. It was just first designed by AMD.
  - apapli 8y ago
    Thanks for the clarification!
tbronchain 8y ago
I - and I'm quite sure it's common practice - have been doing something similar using VMware, desktop integration and shared folders. It's nothing close to a native integration but it does the work - and I've been able to render 3D applications pretty well (not at a professional level of course). I've been wondering for a while what was preventing a virtual machine editor to step ahead in integration and let you run the hosts' applications in a safe, virtualized environment - I've had thoughts mixing a sort of overlayfs (no idea if that exists on Windows), RAM isolation, and chroot-like (again, no idea if that exists on Windows but there must be something similar, right?) Anyway, I'm really happy to see Microsoft stepping ahead. Most programs downloaded online are simply unsafe - sometimes just for privacy reasons! - and I often don't feel comfortable running them on my bare metal OS (not even talking of cracked software). When I first got back on using Windows after a long time on OSX then Linux (I'm not happy with recent Apple hardware, I'm missing a whole lot of entertainment/creation applications on Linux), I assumed Hyper-V would be the best option to have a reliable, built-in hypervisor on my system. I was wrong. My goal was to setup 2 VMs: Linux CLI only do development, Windows 10 for untrusted software. It worked but the graphics integration of the windows VM sucked, and the Linux VM was extremely unreliable - I can't recall exactly what happened but crashes were common, especially in situations like sleep resume, drivers updates etc. I would like to finish this informative comment with a hope that this new "sandbox" feature fixes most of the problems I used to experience with hyper-V. I would also love to see the others - VMware and virtualbox - to implement such feature. Hopefully, this could bump the use of virtual machines at a personal level (agreeing on dman comment to, please!, make it a standard feature) and see better performances and painless integration in the future.
finchisko 8y ago
Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. And it's same on all known OSes. The side effect we see is system size growing in time. IMO running an app in a sandbox should be the default option. On Windows, I used to like sandboxie, which virtualized every write into single directory. Uninstall was easy as removing that dir. This MS sandbox doesn't allow you to continually run an app in the sandbox, as all data get's destroyed on app close, so it's not sandboxie (or similar) replacement.
- bfred_it 8y ago
  Isn’t macOS doing that? The Mac App Store only allows sandboxed apps and macOS allows almost only apps from the store to be installed (+ certified developers) unless you change the system's settings.
  - finchisko 8y ago
    On macOS some protection was added, so apps cannot write to system protected directories. But I was talking about all files that app creates. Like files in home dir (eg. ~/Library). If you remove the app, those files stay there and occupy space. The only way you can partly clean up the mess, is to delete home dir from time to time (but backup important files first). Even then, there might still be files in /usr/local etc.
    - terhechte 8y ago
      A macOS app installed from the app store can only write to ~/Library/Containers/name.of.app.bundle. Those are not automatically trashed (as far as I know), but it is much easier to clean than the whole ~/Library. Actually, if all your apps are in /Applications it would be easy to write a small script that deletes everything in Containers that's a: not from Apple and b: doesn't have a app bundle identifier in /Applications
      - finchisko 8y ago
        TBH I didn't know about that. Probably same situation is with Windows UWP apps installed from store (but there is special permission to grant access to whole fs, which allow app write outside it's sandbox dir). Anyway there are so many apps that are not installed from app stores. IMO having proper sandbox is still a thing in 2018.
Havoc 8y ago
PSA: Pro version and up. However if you stick an old win 7/8 Pro key into a win 10 home you can upgrade it to 10 Pro
ChuckMcM 8y ago
This is pretty cool, I know where I'm going to run my browser from now on :-).
- saagarjha 8y ago
  In case that wasn’t sarcasm: you probably don’t want to run your browser in this, since it already has a sandbox and you’ll have a measurable performance penalty by running in a virtual machine.
  - zamadatix 8y ago
    The performance penalty for running your browser in a hardware assisted VM with a virtual GPU is much smaller than you may initial think. I do it regularly and doubt most people would even noticed if you didn't tell them to look for it.
  - rsync 8y ago
    "In case that wasn’t sarcasm: you probably don’t want to run your browser in this, since it already has a sandbox and you’ll have a measurable performance penalty by running in a virtual machine." Actually, what I do want to do more than anything in this sphere is run browsers in a VM. The account containers in firefox is not enough. This would work without performance penalty if you could chroot jail a gui application. There's almost no overhead in a jail - it's not a full blown VM, just a different chroot. Here is the best recipe so far: https://news.ycombinator.com/item?id=14243672 https://news.ycombinator.com/item?id=14243672 ... but of course that's not a fit for OSX, which has no Xserver and blah blah quartz blah blah major spaghetti to get that working. Also OSX does not have 'jail'.
  - ChuckMcM 8y ago
    It wasn't sarcasm, although I don't know if it would become my daily driver either. Performance is a non-issue for me, generally the browser performance is limited by pages waiting for ad networks to serve up ads. A pi-hole helps (and running in a VM/Sandbox lets you run the filtering DNS server as a local process pretty easily. Lack of local data persistence is similarly a non-issue as the reason for running this way is to drop tracking cookies etc that fall out of a browsing session like leaves on an autumn day. If it had some built in way to defeat the dozen other ways in which a browser can be fingerprinted, then it would be perfect. Just a simple way to avoid the ad trackers and keep my actual stuff safe from the evil doers on the web.
ttflee 8y ago
> you’ll need a compatible GPU and graphics drivers (WDDM 2.5 or newer) Does WMMD 2.5 require drivers to implement SR-IOV capability for GPU? Or does Microsoft used some architecture similar to mediated device in VFIO?
org3432 8y ago
Can the app detect if it's in the sandbox? If so, then it could just behave differently in the sandbox and then when used outside behave another way. I think the Linux systemd folks have the right idea with just running processes in their own cgroup regardless, this thing where programs go mucking around with stuff all over the place should be relegated to the past at this point.
- muterad_murilax 8y ago
  It is stated that "every time Windows Sandbox runs, it’s as clean as a brand-new installation of Windows", so it seems that such an app could simply look for the presence of any non-bundled software or any non-default settings to get a rough idea.
mapcars 8y ago
Plan 9's features from 1990 coming to windows in 2018?
euph0ria 8y ago
I wish they would have added the option to have the data persist. I have a bunch of software that I run only a few times per year, but I don't want to go through the hassle of re-installing it every time I need to run it. It would have been so much more useful if the data could persist.
- excalibur 8y ago
  Wouldn't that make it an ordinary VM?
  - euph0ria 8y ago
    Windows VMs are a hassle to setup, install, manage licenses, expiration of such etc..
  - Too 8y ago
    Ordinary VM takes several GB of storage to store the whole guest OS. A docker image is only as big as the delta inside it and you can easily persist data outside of it with docker volumes.
guest98765436 8y ago
Did Microsoft fix the issue that when Windows virtualization is enabled then VirtualBox VMs do not run [0]? Better they focus some of their resources to fix that first. If not yet, then Windows Sandbox it is a less useful feature that it may seem, because we have to choose between Windows Virtualization and VirtualBox VM snapshots all the time. [0] https://www.virtualbox.org/ticket/16801 https://www.virtualbox.org/ticket/16801
- dkarbayev 8y ago
  This. I cannot use docker on my gaming rig to use it as dev machine sometimes because I need VirtualBox on it.
  - SmellyGeekBoy 8y ago
    Isn't it just a case of changing a registry value and rebooting?
    - yjftsjthsd-h 8y ago
      If switching from games to dev work requires manually patching the system registry and rebooting, then something is horribly wrong.
  - SneakerXZ 8y ago
    You can use docker-machine with VirtualBox. It is not smooth as the native Docker experience, but it is good enough.
- walterbell 8y ago
  Yes, it was fixed last week in VirtualBox 6.0, which now uses Hyper-V APIs at the cost of reduced performance.
natmaka 8y ago
On Linux Firejail/Firetools offer such functionality.
- fulafel 8y ago
  Firejail is based on the same type of tech as containers, namely process restrictions that you can activate on a per namespace basis. The MS sandbox is a separate VM with its own sandboxed kernel, which sounds like stronger isolation on the face of it.
  - natmaka 8y ago
    You are right but I stand my point, the main functionality (isolation) is the same. One may indeed prefer a stronger isolation and be ready to accept a larger memory footprint, less easy ways to fine-tune isolation in order to let the isolated software access to some system-wide resources...
excalibur 8y ago
Ok, we're taking bets on what the first sandbox-escaping attack will target. My money is on a privilege escalation based on this gem: > Our solution is to construct what we refer to as “dynamic base image”: an operating system image that has clean copies of files that can change, but links to files that cannot change that are in the Windows image that already exists on the host. The majority of the files are links (immutable files) and that's why the small size (~100MB) for a full operating system.
- kevingadd 8y ago
  It's an obvious target, but it's also kind of a stretch to suggest that someone's going to find an exploit against read-only pages.
deleted 8y ago
[deleted]
niii 8y ago
I was excited by the premise, but the execution is all wrong. What I had hoped to see was a webbrowser based sandbox environment, that I could quickly access from my mac (or windows for that matter) to achieve the same results. The current execution is nuts and doesn’t make any sense.
eitland 8y ago
Seems like a really nice feature. I've been thinking about something like this for a while. I see some people are really annoyed that it isn't available for the Home version and I too am somewhat annoyed but in this case it is somewhat understandable since it depends on a feature that is (somewhat more reasonable) limited to Pro versions. The thing that annoys me more (hi MS guys, feel free to tell the relevant people about this) is how they have started to add ads to the login screen and my start menu - even in the Pro version! I'm on KDE now so I cannot verify this since the last few months, and probably shouldn't care but given that MS has become a lot nicer in a lot of areas it really should bug developers and PR people there that PMs or bean counters (sorry to all good accountants and PMs out there) are allowed to destroy all the work you put into making people love you. Edit: minor edits for readability, clarification
- castis 8y ago
  > they have started to add ads to the login screen and my start menu A coworker has asked what reasons I could have for not wanting to run "the best OS". this is enough for me.
  - deleted 8y ago
    [deleted]
  - WalterGR 8y ago
    What was your reason before ads were added to Windows?
    - rkagerer 8y ago
      Forced updates that risk randomly breaking my machine the night before a big deadline
    - eitland 8y ago
      Mine: - Clumsy installation process (unless you where in a position where you didn't have to rely on OEM crap, i.e. unless you where an IT pro or enthusiast) - Performance. My builds would easily take 50% more time on the same hardware with Windows. Git was slower. Node was slower. - Ecosystem. Until WSL getting access to standard tooling was kind of clumsy (respect for Cygwin, but still). Even after WSL it is still clumsy (who can tell my how to activate WSL without consulting duckduckgo? I've done it twice and I still cannot say for sure). - Package management: Used to be non-existent (except again cygwin). Now it is just clumsy (a mix of Windows Store, WSL apt-get and Chocolatey should get you most of the stuff you need.) - Licensing. I'm no die hard free software person, but many of the standard programs on Windows are directly user hostile (Acrobat Reader comes to mind). - Until recently Windows also lacked basic desktop manager features like multiple desktops. - Not directly Microsofts fault, but if people like me are using Windows it is often because someone I work for demand it. Usually that also means having to deal with an IT department running Active Directory and all the "interesting" consequences that has, even for someone who is part of said IT department like I've been. (Getting locked out from your files because an admin flipped a switch? Check! Someone swapped regional settings across a group of machines that I was responsible for and locked them, causing all POS systems to fail with no way to fix them? Check! Having to wait for all kinds of scripts that run on logon? Check! Accept having basic parts of your user experience set by it department? Check! Again this is not MS fault directly but back when I first experienced working with Windows in companies for some reason Active Directory seemed to attract people who wants to to those kinds of things and/or it has a power to make them want it. </rant>
fro0116 8y ago
Microsoft actually has this nifty thing meant for IT admins called App-V, that allows you to create immutable application packages that execute in an isolated environment where changes made to the local system default to copy-on-write and are redirected to a centralized location (including both filesystem changes and registry changes). It's actually been integrated into Windows 10 Enterprise edition for quite a while now, and I personally use it to package up a lot of the apps I use on a daily basis, delivering the packages through a network drive and synchronizing the centralized state store with Syncthing for mostly seamless cross-device roaming. (You can download the App-V Sequencer from the Windows 10 ADK to package some apps to try it out for yourself, if you happen to have a copy of Windows 10 Enterprise: https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install https://docs.microsoft.com/en-us/windows-hardware/get-starte...) This actually works fairly well for most apps, but unfortunately the isolation isn't perfect, and some apps for inexplicable reasons manage to get around the App-V sandbox and read/write to the local filesystem directly (Especially apps that have some kind of licensing mechanism, where licensing state can't be properly isolated and synchronized. Though you could definitely argue that's the licensing mechanism working as intended, in my view it still represents a technical failure on the part of the sandbox that this can happen), forcing me to install them locally instead of keeping them as isolated App-V packages. I was hoping this would basically be App-V but with better isolation through the lightweight virtualization layer they built for windows containers (and with less restrictive licensing. Seeing lots of valid criticism on licensing here, but from where I stand, Pro and above is still much more accessible than App-V's Enterprise-only), but looks like they can't quite serve the same use cases just yet. App-V isolates state changes, but those isolated state changes are persisted on disk, so when properly configured, you can use an app across multiple sessions, closing and reopening at will without losing state, as if it was locally installed. Sandbox also isolates state changes, but those state changes seem to be ephemeral and will be discarded upon closing the app. This means it's only useful for running apps that are mostly stateless or for experimenting with untrusted apps. There's nothing wrong with serving those use cases, but to someone who's been feeling the pain from App-V's poor isolation, and someone who's been watching immutable application ecosystems like Nix, Guix, Flatpak, Snaps, etc, flourish in the Linux world, it does seem like a missed opportunity. Definitely hoping they're planning to extend it to also support the same use cases as App-V in the future.
herpderperator 8y ago
> Additionally, since Windows Sandbox is basically running the same operating system image as the host we also allow Windows sandbox to use the same physical memory pages as the host for operating system binaries via a technology we refer to as “direct map”. > In other words, the same executable pages of ntdll, are mapped into the sandbox as that on the host. > We take care to ensure this done in a secure manner and no secrets are shared. I would really like to see that last point elaborated. They claim it's completely separated from the host, yet they say it maps to the same physical memory, yet somehow it's done securely.
humps 8y ago
I think enabling this for Windows Home users would potentially turn into a bit of a support nightmare. The requirements for Sandbox include turning virtualization on in BIOS, it also recommends 8GB of RAM and 4 CPU cores with hyperthreading. Correct me if I'm wrong but most consumer laptops and desktops probably don't have a virtualization option in the BIOS and only a small percentage use 4 cores with hyperthreading. So it either won't work for a lot of Home users or even if it did run, performance wouldn't be great.
- floatboth 8y ago
  > most consumer laptops and desktops probably don't have a virtualization option in the BIOS I haven't seen a single amd64 machine without a virtualization option (except Macs, which don't have a Setup menu in the firmware, but they have virtualization always enabled)
romanovcode 8y ago
Can you run 3d applications like old games on this thing?
morrbo 8y ago
Honest question: is there telemetry in the sandbox, and are the names, hashes or anything similar sent back to Microsoft?
foxX 8y ago
Will it be possible to test-install the bi-yearly updates in this and avoid getting my workstation bricked?
CyberDildonics 8y ago
20 years late is better than never.
empyrical 8y ago
In addition to the use-case of running untrusted applications safely, I think these light weight and ephemeral execution environments would be amazing for continuous integration as well!
zelon88 8y ago
> 11. Confirm that the host does not have any of the modifications that you made in Windows Sandbox. This item on their "Quick Start Guide" doesn't fill me with confidence. Any takers on how long before an escape is disclosed? I think within 30-60 days.
novaleaf 8y ago
About time! However this is for Win10Pro or higher. If you run an older/cheaper version of windows, I can recommend: https://www.sandboxie.com/ https://www.sandboxie.com/
petra 8y ago
It would have been very useful to have something that support persistence(you can install a program in isolation and use it over time). This does not support that. Are there any good alternatives, that do support persistence ?
kerng 8y ago
This is great! I was waiting for something like this for a while. Can't wait to try it out. Now we need the same for Android and iPhone, so we can run our apps in true isolation. I dont want apps to be anywhere near my actual data and contact information on the phone. Just mimic some fake contacts or whatever for majority of apps.
forapurpose 8y ago
Mods: Would you fix the link? Currently it is the following (410 characters; you'll have to find a way to read it): https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849?ranMID=43674&ranEAID=je6NUbpObpQ&ranSiteID=je6NUbpObpQ-_UZUOlZ2ZyTOTejYypcnAQ&epi=je6NUbpObpQ-_UZUOlZ2ZyTOTejYypcnAQ&irgwc=1&OCID=AID681541_aff_7795_1243925&tduid=(ir__i0avhykzmgkfrw2i0ckzh9lp2u2xhyajo2v1pvjr00)(7795)(1243925)(je6NUbpObpQ-_UZUOlZ2ZyTOTejYypcnAQ)()&irclickid=_i0avhykzmgkfrw2i0ckzh9lp2u2xhyajo2v1pvjr00 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern... I'm not going to try to parse and decode that, but it's mostly unnecessary and my security software thinks it's an XSS attack (a false positive, I would guess). This link works: https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...

597 points by prostoalex 8y ago

dman 8y ago

Please do not make this a Pro / Enterprise feature. I do remote tech support for my parents and would love for them to browse / use apps in a sandbox.

voltagex_ 8y ago
Agreed, but at least it isn't gated off like Windows Defender Advanced Threat Protection
dkdbejwi383 8y ago
Agreed, this sounds like a genuinely useful feature, it’s a shame to hide it and restrict it to pro users only. Things like this should be “first class citizens” of the OS and in the spotlight for marketing.
voltagex_ 8y ago
Ah, it's Pro because it's using Hyper-V.
- n-gatedotcom 8y ago
  Then make Hyper-v home. Seriously this is a killer feature needed by everybody. And specially the non-pro users.
  - JaRail 8y ago
    A lot (most?) of the hardware Home runs on doesn't support hardware virtualization.
    - coder543 8y ago
      Effectively all x86_64 hardware from the last 10+ years supports hardware virtualization, so I can't agree.
      - justincormack 8y ago
        Not necessarily in the Bios settings. And there are CPUs without still.
      - kevingadd 8y ago
        Aside from the points made by another reply (BIOS support, older CPUs), some machines have virtualization switched off by default because it's broken. I had a (fairly old) x86-64 laptop that would randomly hardlock while running VMs if I turned on hardware virtualization.
    - Already__Taken 8y ago
      £2,500 Dell XPS ships Home out of the box unless specified otherwise. Windows SKU has nothing to do with hardware. https://www.dell.com/en-uk/shop/2-in-1-laptops/new-xps-15-2-in-1/spd/xps-15-9575-2-in-1-laptop/cn95704?view=configurations https://www.dell.com/en-uk/shop/2-in-1-laptops/new-xps-15-2-... Actually I can't seem to configure that directly from dell to come with Pro lol. Seems there's a question about that too.
      - wongarsu 8y ago
        With Dell you have to buy the business version of a notebook to get Windows Pro. Your example would be [1][2]. Apart from price the main differences are that the business versions ship with Windows Pro and that they have better warranty (next-day onsite). 1: https://www.dell.com/en-uk/work/shop/tablets-and-2-in-1-laptops/xps-15-2-in-1/spd/xps-15-9575-2-in-1-laptop https://www.dell.com/en-uk/work/shop/tablets-and-2-in-1-lapt... 2: https://www.dell.com/en-uk/work/shop/laptops/new-xps-15-2-in-1/spd/xps-15-9575-2-in-1-laptop/bn95704?view=configurations https://www.dell.com/en-uk/work/shop/laptops/new-xps-15-2-in...
      - WorldMaker 8y ago
joshAg 8y ago
why not just buy them a pro edition? I know it's more expensive, but that would also get you remote desktop, bitlocker, and group policy, which would all also be great for remote supporting your parents.
- dman 8y ago
  Because sometimes they buy a new computer and it is a while before I am able to visit them across the planet and install a new OS in it. Would really like a good out of the box experience.
  - Schlaefer 8y ago
    You don't need to install a new OS, you just enter a Windows Pro license key to upgrade the version? Buy the key online, send it to your parents, tell them where to enter it, done. Also I don't think your parents want to use that particular sandbox. There's no persistence at all: no bookmarks, no cookies, no history, no local documents, ...
    - dman 8y ago
      The no persistence is why I like it. It would be ideal if I could ask my parents to do their entire browsing in an ephemeral sandbox and even if they end up clicking / installing something from a shady link it wont blow away their (real) persistent OS install.
  - joshAg 8y ago
    Totally get that issue. It might be worth spending a day or weekend making a boot-disk for them that will wipe their current disk image, and install win10 pro with it set-up so you can remote admin it. That way for your parents they just have to buy the pc, put the usb in and reboot it, and then call you when it's back on so you can remote in and give it a key and finish configuring it for them. I suppose even that might cause issues if you can't teach them or walk them through via facetime how to set the device to boot from the usb instead of the harddrive.
- lotsofpulp 8y ago
abhiminator 8y ago
Agreed. I'd go so as far to say that consumers -- especially technologically vulnerable ones like your parents, for example -- need this more than any other demographic. Microsoft should make it easy to download, install and update on all non-Enterprise versions of the OS. This will also greatly reduce instances of a random ransomware holding critical data hostage and doing irreparable economic damage to small businesses (as was visible during the WannaCry episode last spring [0]). [0] https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack
- plq 8y ago
  > Microsoft should make it easy to download, install and update on all non-Enterprise versions of the OS. I'll take this one step further: Microsoft should make this as easy as "right click > Run in Sandbox". It would make the lives of everyone so much easier.
pjmlp 8y ago
That is what Windows store apps and MSIX sandbox are for.
- Santosh83 8y ago
  You can't run a non-Store app in such a sandbox I believe?
  - pjmlp 8y ago
    Only when packaged via MSIX, which is why I mentioned it.
- TeMPOraL 8y ago
  Except Windows store apps are strictly worse than being able to run regular Windows software in a sandbox.
  - pjmlp 8y ago
    One of MSIX purposes is to package old style Windows software, your regular Windows software into Windows Store sandbox, hence why I mentioned it. It is an evolution of desktop bridge, appx and msi.
    - TeMPOraL 8y ago
      I stand corrected.
- hawski 8y ago
  I'm not much of a Windows user, but MSIX sounds great. Does it add a simple context menu entry to convert an installer? Bonus points for straight up Install and even more for Run. I see it's open source, so if it's missing it may be possible to make a distribution of it with those things implemented. Then one could install it and make it a default msi handler. Edit: from what I see conversion is much more involved. Create a certificate and go through a wizard and fill out some forms. Correct me if the is a quick and easy convert option. Otherwise it's a nice thing that needs more development to be useful for a generic user.
Illniyar 8y ago
Hardware virtualization is a Pro feature in windows, so I doubt this is possible even if they wanted to (without moving virtualization to home edition).
ezoe 8y ago
Your problem can be solved by not let your parents use Windows.
- cm2187 8y ago
  Like get them to learn a lot of linux command lines?
  - coder543 8y ago
    I'm pretty sure that's not the only alternative... some others include a Chromebook, an iPad, a MacBook, or even installing a Linux distro and setting it up for them such that they don't need to use the CLI to accomplish the things they want to do. But honestly, my opinion is that Windows 10 is not as fragile as earlier versions of Windows were.
    - cm2187 8y ago
      If the parents' problem is that they install random software, that's not going to help them. I have seen MacBooks with twenty spyware browser extensions.
      - coder543 8y ago
        I really doubt that, but I can't easily argue with an anecdote, so sure. It happened, probably 15 years ago. Windows was famous for tons of installers bundling toolbars, but that's never been an epidemic on Mac. These days, Macs will not install unsigned software by default, and you can lock that down to App Store only with a single setting change, so they're certainly not getting bundled malicious toolbars from installing software... since distributing malware is a quick way to get your developer signature revoked, and you're certainly not going to be installing toolbars from the App Store sandbox. That leaves manually installing malicious toolbars through the official extension store for whatever browser they use. All extension stores do their best to weed out malicious extensions these days, and it takes intentional effort to install extensions. It doesn't just happen while you're trying to do other things. Obviously, toolbars don't even exist on iPads, and software installers bundling random malware is obviously not a huge concern on Chromebooks. A MacBook was not at the front of my list, so I don't know why you chose to singularly attack that option. Maybe you thought it was the easiest target?
ChuckMcM 8y ago
Think of it like giving your parent's a $100 present for Christmas, an upgrade from Win Home to Win Pro and your life will be so much easier.
- dman 8y ago
  Sure, but Microsoft could give the same gift to every parent out there. (I don’t mind buying windows pro for parents at all, issue is that when they buy a device it often does not come with pro preinstalled so there is a window where the device is vulnerable before I can remotely administer it)
  - ChuckMcM 8y ago
    Of course they could, but using that money they will go on to build another feature that you'll be able to use because you're already at the 'pro' level of their OS. The alternative is to convince some engineers to create this same feature in their spare time and contribute it for free as a Linux package. Then they can get email about all of the things it doesn't do, and fix bugs in their spare time on a feature that all they see are complaints for. Until they burn out and the repo goes dead for a while and then gets picked up by one of those users who wants the feature to exist, and they make some improvements and get into an argument with another user who forks it and now there are two of them, almost the same but with a few features that are unique to each one. Of course for most of the users they either don't care and load one at random, or they do care and find features from the "other" system they want in the one that is being used. They send mail to the maintainers asking them to copy those features. Which adds more pain as the developers copy each other's features but they put their own special spin on them. This burns out more developers and a third person comes out and writes their own syntactically incompatible version that is functionally identical to the two different 'legacy' versions. At this point I just pay the man his $100 and appreciate that the people working on the code are on it all day and can spend evenings with their family.
theandrewbailey 8y ago
I took an inventory of which apps my parents use: email, solitaire, Youtube, and some web browsing. That was it. Linux is good at doing those things, so I put them on Xubuntu (my preferred distro) about 8 years ago. Once my mom understood that the UI was similar enough to Windows, she didn't mind. Its been remarkably stable (and usable) ever since.
josho 8y ago
You underestimate your parents likelihood to overgeneralize your sandbox advice. I expect you will be receiving this call months from now: "You told me to use sandbox to be safe, so I wrote critical document X in a sandbox because I want it to be safe, but now that I rebooted I've lost all of my work."

devwastaken 8y ago

>this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD! Swing and a miss. It's interesting how Microsoft will force their slow AV onto every win10 home edition device, yet won't give actual tools users can protect themselves with.

voltagex_ 8y ago
I've found Defender to be a definite performance hit but what's a better option? I'd rather not have the subscription costs.
- Semaphor 8y ago
  Not running a tool that makes your attack surface bigger in exchange for questionable benefits?
  - crazysim 8y ago
    They've put Defender into a sandbox nowadays. https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/windows-defender-antivirus-can-now-run-in-a-sandbox/ https://cloudblogs.microsoft.com/microsoftsecure/2018/10/26/...
    - Semaphor 8y ago
      Insider only for now. But a very good move imo.
  - voltagex_ 8y ago
    Okay, even if I take your comment about attack surface at face value, what are you suggesting? Surely not avoiding AV completely.
    - Semaphor 8y ago
      > Surely not avoiding AV completely. Exactly that.

chungy 8y ago

Sandboxie has been providing similar functionality on versions of Windows since XP: https://www.sandboxie.com/ https://www.sandboxie.com/ It's probably nowhere near as elegant as the Windows 10 feature, but it should be very handy if you have older versions of Windows!

voltagex_ 8y ago
Sandboxie is a UI nightmare IMO - it took me ages to work out how to launch a single program in a sandbox.
- chungy 8y ago
  Interesting. How long ago was this? I've used Sandboxie for around 10 years and in that entire time, it has always just been a matter of right-clicking the program and "Run Sandboxed", even trivially accessing the sandboxed start menu via the notification icon.
  - revanx_ 8y ago
    I agree, been using Sandboxie for way over 6 years now and it's the easiest thing ever to use.
- superasn 8y ago
  Yes it's one of the examples of brilliant coding marred by a very unintuitive user interface. I've used it many times on occasion but always end up uninstalling it because it makes such simple things so complicated.
arkitaip 8y ago
Sandboxie is a broken POS. I gave up on it a few months ago after getting tired of having to troubleshoot why another app wasn't working the way it should.
- morrbo 8y ago
  I don't think that's a fair comment to make. It's obviously not broken. I've used it myself to run games downloaded from torrents and it was fine. It also supports office installations and a whole other loaf of stuff. Whilst I agree that the UI isn't the best (at least when I used it) calling it a piece of shit without providing specifics isn't helping anyone

fuzzy2 8y ago

Based on Hyper-V? Bummer. I use VMware Workstation at work and that’s not going to change.

ToFab123 8y ago
I could but I won't. What keeps me on VMware if that I can easily expand the vm to use 1 or more monitors. I am not sure if hyperv handles resizing of the window as smooth as VMware the adjust the display settings in the client. Last time i checked hyperv (rdp) just gave me scrollbars. It is probably antitrust concerns that is the reason why Microsoft never has improved the RDP client.
- JaRail 8y ago
  I haven't used HyperV in a while. I rarely connected to VMs via the hyperv console, just for installations or cases where windows wasn't booting properly. I use MSTSC (MS Terminal Services Client). That has supported multimonitor for the 12 or so years I've used it.
  - ToFab123 8y ago
    Yes, it does support multi monitor no problem. VMware has a couple of buttons in the tools bar that allows you to go from using 1 monitor to 2 or 3. It then adjust the screen resolution inside the guest vm and of course you can go back to one monitor. I believe MSTSC reguires you to start it with a switch /span or something and then you need to close the RDP window and launch it again if you want to add / remove monitors.
    - JaRail 8y ago
      I'm trying to think when exactly the GUI was updated. I think somewhere around Vista. You can just check "use all my monitors for the remote session" in the Display tab. I'll admit that with a triple-monitor setup, I've sometimes wanted to remote in with only a dual-screen setup. So it wasn't perfect for me. It certainly did fine for my 95% use-cases. Having to reconnect to adjust desktop size just was never a big deal for me. Maybe adjusting sizes is more of an issue for people today. If I was using a laptop and constantly docking/disconnecting external monitors with a large number of active connections, it'd annoy me to have to completely reconnect each time.

plq 8y ago

How detectable will it be? I doubt this will make the lives of malware analysts any easier.

n-gatedotcom 8y ago
As much as hyper-v. Without sounding disparaging (because this is really cool), its just a one-click application-on-windows-on-hyper-v. So all the pros and cons come with it.
- plq 8y ago
  Yeah, I assumed that "sandbox" implied some smarter isolation technique closer to eg Linux namespaces instead of just app-v in a new shiny packaging. Nothing new for the malware-analysis use-case.

jaimehrubiks 8y ago

I feel it lacks some features like being able to preinstall software such as adobe reader on the virtual desktop.

make3 8y ago

"Graphic virtualization" so could someone who isn't me use this to safely run pirated games?

blauditore 8y ago
Theoretically yes, but it would probably take a considerable performance hit.
- senectus1 8y ago
  depending on the pirated game this might be a good thing :-P
  - thecatspaw 8y ago
    in what game is a performance hit desirable?
    - Zekio 8y ago
      Some games physics engines break down once you go past a high enough framerate, such as the fallout games a performance hit would likely keep you below the 125 fps where it begins to break
- make3 8y ago
  "probably".. that's the question.. not being useful answer

kodablah 8y ago

Quick thoughts... First thought: I'd love to be able to ship an app w/ this enabled by default (i.e. it's an ephemeral app w/ no local data storage). Second thought: I'd love to pause this snapshot and resume it. Too many apps store preferences that you don't want to reconfigure just because you want isolation from the rest of the system each execution. Third thought: Instead of always-dispose-on-app-close, I would like to namespace/cgroups-style it instead. This is how I would expect the Chrome equivalent of FF's "containers" would be built (I know I can --user-data-dir which is similar).

jclay 8y ago
Regarding your first thought, you can get pretty close today with Windows Isolated App Containers. Chromium uses this under the hood.

cm2187 8y ago

I'm glad to finally see some innovation on Windows that is not user hostile.

lvs 8y ago
It could just be that we simply haven't had time to figure out the manner in which it's hostile.

revanx_ 8y ago

This is not a sandbox. All this does is launch windows in hyper-v virtual machine and configures the virtual environment automatically for you. You could achieve all of this yourself manually and you still wouldn't call it a sandbox, you would call it VM.

crummy 8y ago
Can't you use a VM as a sandbox?
- revanx_ 8y ago
  Sure, I just don't think they should advertise this as such because it's nothing more then a VM. It's not some new windows feature, you could do this same thing since Windows 8.1 using hyper-V or since windows XP using something like Virtualbox. A proper sandbox would be if you could run a program in the same operating system with an isolated execution environment, similar to how sandboxie does it.
JaRail 8y ago
You can say you get the same result, yes. However this does it in a very different way. It's linking to the host OS's OS. It's not a VHD with a separate windows installation. That makes it quite a bit more lightweight. You don't have to patch it separately, etc. When installed, the sandbox image is only 100mb, mostly immutable links to host OS files.
gshrikant 8y ago
I agree, it is not the same sandbox as for example, browser sandboxes which restrict capabilities for multiple tabs to a given set of resources. However, its closer to KVM or Docker than to VirtualBox. The host and the 'guest' appear to be much more tightly integrated than in a full virtualized environment.
alkonaut 8y ago
All vm's are sandboxes I suppose. The interesting difference between this and a normal VM is that the files are shared so that it's not using the space of a full VM.

neotek 8y ago

Only Microsoft would come up with a new security feature and then intentionally and arbitrarily limit its availability to the most expensive version of their OS. This is the same company that thinks putting ads in the fucking file explorer is appropriate on an OS they charge hundreds and hundreds of dollars for.

apapli 8y ago
I’d put oracle in that boat too. Actually, I think it would be hard to find an enterprise software vendor who wouldn’t want to include extra functionality in their premium SKUs as a way to further differentiate them and encourage up-sell.
- franga2000 8y ago
  Extra functionality yes, but not a security feature. I'd understand making WSL or PowerShell a >= Pro feature, but something that is designed to secure users from malicious applications. That should be included with even the lowest SKU that can run win32 (its sad that this last qualifier is even required).
- TeMPOraL 8y ago
  That's OK when you put enterprise features in enterprise versions. A regular user doesn't need to be able to run SharePoint, but they might want to get proper sandboxing of regular software.
lionpixel 8y ago
I paid 13€ for an Microsoft Windows 10 Pro OEM key. I thought everyone is doing this as well?
- ToFab123 8y ago
  I use a windows 8 retail key
  - SmellyGeekBoy 8y ago

apapli 8y ago

Prerequisite: AMD64. Does that mean it will work with my Ryzen, but no intel chips? That’s a nice win for AMD at the expense of intel if true for corporate environments.

CSDude 8y ago
No, Intel supports AMD64
Gaelan 8y ago
AMD64 is another name for x86_64 (IIRC, because it was originally AMD's arch)
fireattack 8y ago
https://en.wikipedia.org/wiki/X86-64 https://en.wikipedia.org/wiki/X86-64
manigandham 8y ago
AMD64 = x64 = x86_64 = common names used to describe the 64-bit x86 instruction set that both Intel and AMD CPUs support. It was just first designed by AMD.
- apapli 8y ago
  Thanks for the clarification!

tbronchain 8y ago

I - and I'm quite sure it's common practice - have been doing something similar using VMware, desktop integration and shared folders. It's nothing close to a native integration but it does the work - and I've been able to render 3D applications pretty well (not at a professional level of course). I've been wondering for a while what was preventing a virtual machine editor to step ahead in integration and let you run the hosts' applications in a safe, virtualized environment - I've had thoughts mixing a sort of overlayfs (no idea if that exists on Windows), RAM isolation, and chroot-like (again, no idea if that exists on Windows but there must be something similar, right?) Anyway, I'm really happy to see Microsoft stepping ahead. Most programs downloaded online are simply unsafe - sometimes just for privacy reasons! - and I often don't feel comfortable running them on my bare metal OS (not even talking of cracked software). When I first got back on using Windows after a long time on OSX then Linux (I'm not happy with recent Apple hardware, I'm missing a whole lot of entertainment/creation applications on Linux), I assumed Hyper-V would be the best option to have a reliable, built-in hypervisor on my system. I was wrong. My goal was to setup 2 VMs: Linux CLI only do development, Windows 10 for untrusted software. It worked but the graphics integration of the windows VM sucked, and the Linux VM was extremely unreliable - I can't recall exactly what happened but crashes were common, especially in situations like sleep resume, drivers updates etc. I would like to finish this informative comment with a hope that this new "sandbox" feature fixes most of the problems I used to experience with hyper-V. I would also love to see the others - VMware and virtualbox - to implement such feature. Hopefully, this could bump the use of virtual machines at a personal level (agreeing on dman comment to, please!, make it a standard feature) and see better performances and painless integration in the future.

finchisko 8y ago

Nowadays it's almost impossible to uninstall an app completely, because most of them creating files willy nilly. And it's same on all known OSes. The side effect we see is system size growing in time. IMO running an app in a sandbox should be the default option. On Windows, I used to like sandboxie, which virtualized every write into single directory. Uninstall was easy as removing that dir. This MS sandbox doesn't allow you to continually run an app in the sandbox, as all data get's destroyed on app close, so it's not sandboxie (or similar) replacement.

bfred_it 8y ago
Isn’t macOS doing that? The Mac App Store only allows sandboxed apps and macOS allows almost only apps from the store to be installed (+ certified developers) unless you change the system's settings.
- finchisko 8y ago
  On macOS some protection was added, so apps cannot write to system protected directories. But I was talking about all files that app creates. Like files in home dir (eg. ~/Library). If you remove the app, those files stay there and occupy space. The only way you can partly clean up the mess, is to delete home dir from time to time (but backup important files first). Even then, there might still be files in /usr/local etc.
  - terhechte 8y ago
    A macOS app installed from the app store can only write to ~/Library/Containers/name.of.app.bundle. Those are not automatically trashed (as far as I know), but it is much easier to clean than the whole ~/Library. Actually, if all your apps are in /Applications it would be easy to write a small script that deletes everything in Containers that's a: not from Apple and b: doesn't have a app bundle identifier in /Applications
    - finchisko 8y ago
      TBH I didn't know about that. Probably same situation is with Windows UWP apps installed from store (but there is special permission to grant access to whole fs, which allow app write outside it's sandbox dir). Anyway there are so many apps that are not installed from app stores. IMO having proper sandbox is still a thing in 2018.

Havoc 8y ago

PSA: Pro version and up. However if you stick an old win 7/8 Pro key into a win 10 home you can upgrade it to 10 Pro

ChuckMcM 8y ago

This is pretty cool, I know where I'm going to run my browser from now on :-).

saagarjha 8y ago
In case that wasn’t sarcasm: you probably don’t want to run your browser in this, since it already has a sandbox and you’ll have a measurable performance penalty by running in a virtual machine.
- zamadatix 8y ago
  The performance penalty for running your browser in a hardware assisted VM with a virtual GPU is much smaller than you may initial think. I do it regularly and doubt most people would even noticed if you didn't tell them to look for it.
- rsync 8y ago
  "In case that wasn’t sarcasm: you probably don’t want to run your browser in this, since it already has a sandbox and you’ll have a measurable performance penalty by running in a virtual machine." Actually, what I do want to do more than anything in this sphere is run browsers in a VM. The account containers in firefox is not enough. This would work without performance penalty if you could chroot jail a gui application. There's almost no overhead in a jail - it's not a full blown VM, just a different chroot. Here is the best recipe so far: https://news.ycombinator.com/item?id=14243672 https://news.ycombinator.com/item?id=14243672 ... but of course that's not a fit for OSX, which has no Xserver and blah blah quartz blah blah major spaghetti to get that working. Also OSX does not have 'jail'.
- ChuckMcM 8y ago
  It wasn't sarcasm, although I don't know if it would become my daily driver either. Performance is a non-issue for me, generally the browser performance is limited by pages waiting for ad networks to serve up ads. A pi-hole helps (and running in a VM/Sandbox lets you run the filtering DNS server as a local process pretty easily. Lack of local data persistence is similarly a non-issue as the reason for running this way is to drop tracking cookies etc that fall out of a browsing session like leaves on an autumn day. If it had some built in way to defeat the dozen other ways in which a browser can be fingerprinted, then it would be perfect. Just a simple way to avoid the ad trackers and keep my actual stuff safe from the evil doers on the web.

ttflee 8y ago

> you’ll need a compatible GPU and graphics drivers (WDDM 2.5 or newer) Does WMMD 2.5 require drivers to implement SR-IOV capability for GPU? Or does Microsoft used some architecture similar to mediated device in VFIO?

org3432 8y ago

Can the app detect if it's in the sandbox? If so, then it could just behave differently in the sandbox and then when used outside behave another way. I think the Linux systemd folks have the right idea with just running processes in their own cgroup regardless, this thing where programs go mucking around with stuff all over the place should be relegated to the past at this point.

muterad_murilax 8y ago
It is stated that "every time Windows Sandbox runs, it’s as clean as a brand-new installation of Windows", so it seems that such an app could simply look for the presence of any non-bundled software or any non-default settings to get a rough idea.

mapcars 8y ago

Plan 9's features from 1990 coming to windows in 2018?

euph0ria 8y ago

I wish they would have added the option to have the data persist. I have a bunch of software that I run only a few times per year, but I don't want to go through the hassle of re-installing it every time I need to run it. It would have been so much more useful if the data could persist.

excalibur 8y ago
Wouldn't that make it an ordinary VM?
- euph0ria 8y ago
  Windows VMs are a hassle to setup, install, manage licenses, expiration of such etc..
- Too 8y ago
  Ordinary VM takes several GB of storage to store the whole guest OS. A docker image is only as big as the delta inside it and you can easily persist data outside of it with docker volumes.

guest98765436 8y ago

Did Microsoft fix the issue that when Windows virtualization is enabled then VirtualBox VMs do not run [0]? Better they focus some of their resources to fix that first. If not yet, then Windows Sandbox it is a less useful feature that it may seem, because we have to choose between Windows Virtualization and VirtualBox VM snapshots all the time. [0] https://www.virtualbox.org/ticket/16801 https://www.virtualbox.org/ticket/16801

dkarbayev 8y ago
This. I cannot use docker on my gaming rig to use it as dev machine sometimes because I need VirtualBox on it.
- SmellyGeekBoy 8y ago
  Isn't it just a case of changing a registry value and rebooting?
  - yjftsjthsd-h 8y ago
    If switching from games to dev work requires manually patching the system registry and rebooting, then something is horribly wrong.
- SneakerXZ 8y ago
  You can use docker-machine with VirtualBox. It is not smooth as the native Docker experience, but it is good enough.
walterbell 8y ago
Yes, it was fixed last week in VirtualBox 6.0, which now uses Hyper-V APIs at the cost of reduced performance.

natmaka 8y ago

On Linux Firejail/Firetools offer such functionality.

fulafel 8y ago
Firejail is based on the same type of tech as containers, namely process restrictions that you can activate on a per namespace basis. The MS sandbox is a separate VM with its own sandboxed kernel, which sounds like stronger isolation on the face of it.
- natmaka 8y ago
  You are right but I stand my point, the main functionality (isolation) is the same. One may indeed prefer a stronger isolation and be ready to accept a larger memory footprint, less easy ways to fine-tune isolation in order to let the isolated software access to some system-wide resources...

excalibur 8y ago

Ok, we're taking bets on what the first sandbox-escaping attack will target. My money is on a privilege escalation based on this gem: > Our solution is to construct what we refer to as “dynamic base image”: an operating system image that has clean copies of files that can change, but links to files that cannot change that are in the Windows image that already exists on the host. The majority of the files are links (immutable files) and that's why the small size (~100MB) for a full operating system.

kevingadd 8y ago
It's an obvious target, but it's also kind of a stretch to suggest that someone's going to find an exploit against read-only pages.

deleted 8y ago

[deleted]

niii 8y ago

I was excited by the premise, but the execution is all wrong. What I had hoped to see was a webbrowser based sandbox environment, that I could quickly access from my mac (or windows for that matter) to achieve the same results. The current execution is nuts and doesn’t make any sense.

eitland 8y ago

Seems like a really nice feature. I've been thinking about something like this for a while. I see some people are really annoyed that it isn't available for the Home version and I too am somewhat annoyed but in this case it is somewhat understandable since it depends on a feature that is (somewhat more reasonable) limited to Pro versions. The thing that annoys me more (hi MS guys, feel free to tell the relevant people about this) is how they have started to add ads to the login screen and my start menu - even in the Pro version! I'm on KDE now so I cannot verify this since the last few months, and probably shouldn't care but given that MS has become a lot nicer in a lot of areas it really should bug developers and PR people there that PMs or bean counters (sorry to all good accountants and PMs out there) are allowed to destroy all the work you put into making people love you. Edit: minor edits for readability, clarification

castis 8y ago
> they have started to add ads to the login screen and my start menu A coworker has asked what reasons I could have for not wanting to run "the best OS". this is enough for me.
- deleted 8y ago
  [deleted]
- WalterGR 8y ago
  What was your reason before ads were added to Windows?
  - rkagerer 8y ago
    Forced updates that risk randomly breaking my machine the night before a big deadline
  - eitland 8y ago
    Mine: - Clumsy installation process (unless you where in a position where you didn't have to rely on OEM crap, i.e. unless you where an IT pro or enthusiast) - Performance. My builds would easily take 50% more time on the same hardware with Windows. Git was slower. Node was slower. - Ecosystem. Until WSL getting access to standard tooling was kind of clumsy (respect for Cygwin, but still). Even after WSL it is still clumsy (who can tell my how to activate WSL without consulting duckduckgo? I've done it twice and I still cannot say for sure). - Package management: Used to be non-existent (except again cygwin). Now it is just clumsy (a mix of Windows Store, WSL apt-get and Chocolatey should get you most of the stuff you need.) - Licensing. I'm no die hard free software person, but many of the standard programs on Windows are directly user hostile (Acrobat Reader comes to mind). - Until recently Windows also lacked basic desktop manager features like multiple desktops. - Not directly Microsofts fault, but if people like me are using Windows it is often because someone I work for demand it. Usually that also means having to deal with an IT department running Active Directory and all the "interesting" consequences that has, even for someone who is part of said IT department like I've been. (Getting locked out from your files because an admin flipped a switch? Check! Someone swapped regional settings across a group of machines that I was responsible for and locked them, causing all POS systems to fail with no way to fix them? Check! Having to wait for all kinds of scripts that run on logon? Check! Accept having basic parts of your user experience set by it department? Check! Again this is not MS fault directly but back when I first experienced working with Windows in companies for some reason Active Directory seemed to attract people who wants to to those kinds of things and/or it has a power to make them want it. </rant>

fro0116 8y ago

Microsoft actually has this nifty thing meant for IT admins called App-V, that allows you to create immutable application packages that execute in an isolated environment where changes made to the local system default to copy-on-write and are redirected to a centralized location (including both filesystem changes and registry changes). It's actually been integrated into Windows 10 Enterprise edition for quite a while now, and I personally use it to package up a lot of the apps I use on a daily basis, delivering the packages through a network drive and synchronizing the centralized state store with Syncthing for mostly seamless cross-device roaming. (You can download the App-V Sequencer from the Windows 10 ADK to package some apps to try it out for yourself, if you happen to have a copy of Windows 10 Enterprise: https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install https://docs.microsoft.com/en-us/windows-hardware/get-starte...) This actually works fairly well for most apps, but unfortunately the isolation isn't perfect, and some apps for inexplicable reasons manage to get around the App-V sandbox and read/write to the local filesystem directly (Especially apps that have some kind of licensing mechanism, where licensing state can't be properly isolated and synchronized. Though you could definitely argue that's the licensing mechanism working as intended, in my view it still represents a technical failure on the part of the sandbox that this can happen), forcing me to install them locally instead of keeping them as isolated App-V packages. I was hoping this would basically be App-V but with better isolation through the lightweight virtualization layer they built for windows containers (and with less restrictive licensing. Seeing lots of valid criticism on licensing here, but from where I stand, Pro and above is still much more accessible than App-V's Enterprise-only), but looks like they can't quite serve the same use cases just yet. App-V isolates state changes, but those isolated state changes are persisted on disk, so when properly configured, you can use an app across multiple sessions, closing and reopening at will without losing state, as if it was locally installed. Sandbox also isolates state changes, but those state changes seem to be ephemeral and will be discarded upon closing the app. This means it's only useful for running apps that are mostly stateless or for experimenting with untrusted apps. There's nothing wrong with serving those use cases, but to someone who's been feeling the pain from App-V's poor isolation, and someone who's been watching immutable application ecosystems like Nix, Guix, Flatpak, Snaps, etc, flourish in the Linux world, it does seem like a missed opportunity. Definitely hoping they're planning to extend it to also support the same use cases as App-V in the future.

herpderperator 8y ago

> Additionally, since Windows Sandbox is basically running the same operating system image as the host we also allow Windows sandbox to use the same physical memory pages as the host for operating system binaries via a technology we refer to as “direct map”. > In other words, the same executable pages of ntdll, are mapped into the sandbox as that on the host. > We take care to ensure this done in a secure manner and no secrets are shared. I would really like to see that last point elaborated. They claim it's completely separated from the host, yet they say it maps to the same physical memory, yet somehow it's done securely.

humps 8y ago

I think enabling this for Windows Home users would potentially turn into a bit of a support nightmare. The requirements for Sandbox include turning virtualization on in BIOS, it also recommends 8GB of RAM and 4 CPU cores with hyperthreading. Correct me if I'm wrong but most consumer laptops and desktops probably don't have a virtualization option in the BIOS and only a small percentage use 4 cores with hyperthreading. So it either won't work for a lot of Home users or even if it did run, performance wouldn't be great.

floatboth 8y ago
> most consumer laptops and desktops probably don't have a virtualization option in the BIOS I haven't seen a single amd64 machine without a virtualization option (except Macs, which don't have a Setup menu in the firmware, but they have virtualization always enabled)

romanovcode 8y ago

Can you run 3d applications like old games on this thing?

morrbo 8y ago

Honest question: is there telemetry in the sandbox, and are the names, hashes or anything similar sent back to Microsoft?

foxX 8y ago

Will it be possible to test-install the bi-yearly updates in this and avoid getting my workstation bricked?

CyberDildonics 8y ago

20 years late is better than never.

empyrical 8y ago

In addition to the use-case of running untrusted applications safely, I think these light weight and ephemeral execution environments would be amazing for continuous integration as well!

zelon88 8y ago

> 11. Confirm that the host does not have any of the modifications that you made in Windows Sandbox. This item on their "Quick Start Guide" doesn't fill me with confidence. Any takers on how long before an escape is disclosed? I think within 30-60 days.

novaleaf 8y ago

About time! However this is for Win10Pro or higher. If you run an older/cheaper version of windows, I can recommend: https://www.sandboxie.com/ https://www.sandboxie.com/

petra 8y ago

It would have been very useful to have something that support persistence(you can install a program in isolation and use it over time). This does not support that. Are there any good alternatives, that do support persistence ?

kerng 8y ago

This is great! I was waiting for something like this for a while. Can't wait to try it out. Now we need the same for Android and iPhone, so we can run our apps in true isolation. I dont want apps to be anywhere near my actual data and contact information on the phone. Just mimic some fake contacts or whatever for majority of apps.

forapurpose 8y ago

Mods: Would you fix the link? Currently it is the following (410 characters; you'll have to find a way to read it): https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849?ranMID=43674&ranEAID=je6NUbpObpQ&ranSiteID=je6NUbpObpQ-_UZUOlZ2ZyTOTejYypcnAQ&epi=je6NUbpObpQ-_UZUOlZ2ZyTOTejYypcnAQ&irgwc=1&OCID=AID681541_aff_7795_1243925&tduid=(ir__i0avhykzmgkfrw2i0ckzh9lp2u2xhyajo2v1pvjr00)(7795)(1243925)(je6NUbpObpQ-_UZUOlZ2ZyTOTejYypcnAQ)()&irclickid=_i0avhykzmgkfrw2i0ckzh9lp2u2xhyajo2v1pvjr00 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern... I'm not going to try to parse and decode that, but it's mostly unnecessary and my security software thinks it's an XSS attack (a false positive, I would guess). This link works: https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...