13 ms·
We are making Sandboxie a free tool, with plans to transition it to open source
- throwaway-d81 7y agoThis is about a sandboxing utility for Windows that is being sunsetted by its creators. If you were looking for a cool new toy to appease your Docker addiction, go elsewhere.
- deleted 7y ago[deleted]
- cwyers 7y agoThe website takes me back to a certain era of computing -- the explanation of how sandboxing works is paired to a bunch of icons mostly of their time, and the illustration itself looks inspired by the Windows disk defragmenter utility.
- userbinator 7y agoAn era when websites were fast-loading, simple, information-dense and distinctively-styled yet still very readable.
- qwerty1234599 7y agoWhat? The webpage is filled with a useless wall of text, of which maybe 20% is relevant. The rest just makes it hard for average people to figure out what exactly the software is and how to download it.
- kick 7y ago"Download" is literally the eighth word on the page, and fourth word on the navigation bar. If a person can't see that, they're destined for a Darwin award.
- oefrha 7y agoNow, click on the eighth word and try to figure out how to actually download. I'll wait. (And compare it to a modern site, say, firefox.com or chrome.com.)
- y4mi 7y agotook me 3 seconds... but i was trained by living through that era. nowadays people will probably miss the download link by mistaking it with some advertisements or something similar. they look just like it nowadays... though back then, the ads where mostly Flash so you it wasnt auto-filtered by your brain like it is now :)
- toby- 7y agoTook me about 2 seconds. The large, bold "Click to download Sandboxie version 5.31.6 from ..." helped. ;) Or, under the <h1> title "Downloads", the bolded table header "Download from" with the "Download from this site" link. Good design doesn't require a huge, centred, flashing "DOWNLOAD!" button. This seems clear and uncluttered enough to me.
- chalupa-man 7y agoI guarantee you this design would confuse a lot of people. Imagine you're not the computer savviest person around, how you'd read this. - The large, bolded "Click to download" text isn't clickable, like pretty much every other "Click to..." prompt you've seen. - After a moment of confusion you think oh okay, there'll be a list of links to places I can download it from then. But there isn't. There's just the product logo. Download the product from itself, maybe? But why is it written like there's supposed to be a list? Hm. - Oh wait, after "Download the latest version" there's a separate section called "Downloads", that's where the downloads must be. - Okay, down there after a while there's bold text that says "Download", but that's not clickable, nor is the text next to it that says "Sandboxie Installer." Keep reading. - Ah, okay, here's a table with a single row for some reason, with a nice link "Download from this site." - Wait, why did "Download from this site" take me to a completely different site? The address in the bar is totally different, the design is totally different, I've never heard of this new site before and it wants me to give them my job title, full name, company name, and zip code. Is this a popup ad? Is this a scam? I thought I was downloading it from that site I was just on. Incidentally it doesn't matter as the form doesn't understand my country's zip code system and won't accept it.
- self_awareness 7y agoStill better than a YouTube clip about it, because text at least can be skimmed
- tjoff 7y agoNot great. But I haven't seen a better page designed in 2019. It is not hard to figure out what it is, apart from the news announcement and a download link it says it right there with one sentence. Want to know how it works. Press "How it works". Want do download it? Press "Download". Contrast that with today where you have to figure out which filter bubble the author of the page is in. Such niche questions such as: Which OS does this work on? Which language is this library for? Can be quite tiresome to find out...
- bryanrasmussen 7y agoDoes the average person really want to download a tool that helps them sandbox windows applications? I mean, maybe they should want to, but do they want to?
- leppr 7y agoFor the average teenager downloading Windows warez, totally.
- tomc1985 7y agoThe only useless "wall of text" is the gray box discussing their open sourcing. The rest of the homepage is tight and punchy
- sh87 7y agoI like this webpage. There are no ads, no popups, did not ask for my email, did not try to send me notifications, did not ask me to register, did not autoplay a video, did not hijack my scroll behavior, on parallax BS, no images of an open office in the background. In short NO NON-SENSE. It loaded in under 1s (for me), has all the important stuff right there at the top. I do not want any product page to do anything more than this. Please.
- Viliam1234 7y agoIt asks for your e-mail later, when you click to download Sandboxie.
- sh87 7y agoFrom the same (only) page that asks for email, company, etc. > Due to requirements of the U.S. government, export compliance is now mandatory when downloading our software. Complete the form to proceed with your download. That's totally fine by me.
- TheRealPomax 7y agoFun fact: you can have pages of useless text and it'll still load faster than a single jpeg. This page might look like it's from another era, but it also has the benefits of that era: - it actually loads fast - it works without scripts. - it has no ads. - it has no tracking beyond page analytics. If those are the benefits, then please, give me more shitty looking websites like this for all the other essential software that should be found on any sane professional's machine, and any "taking personal responsibility" home user's machine.
- imtringued 7y agoHalf of the content on the page is literally titled "What We Do" with a download link above it. You're clearly disliking the design to the point that your criticism doesn't even make sense, if that's your complaint then say it outright instead of hiding it behind a lie.
- mrmonkeyman 7y agoI don't trust it and the information is about as low-density as they come. 1/10
- diminoten 7y agoLess featureful, inefficient, unintuitive, difficult to maintain or even build, impenetrable to laypersons, garbage.
- kmlx 7y ago"websites were fast-loading" i lived thru that era. how were they fast on 56kbps modem connections? i clearly remember having to leave my pc on all night to download a single mp3. for websites i would usually grab a book and read a few pages while the site loaded.
- raverbashing 7y agoNo thousands of cookies/trackers (for most sites) Few third party js files Optimized images And the fact the site had to actually open on 56k modems
- lazyasciiart 7y agoSo....they were slow, but smaller amounts of code was involved? That's not the same as being fast.
- WaxProlix 7y agoConnection was slow, pages were (relatively) fast. Not hard to understand.
- lone_haxx0r 7y agoThey weren't fast by any stretch of the word. There was no one with a good connection to experience it fast, so it can't be called fast.
- eitland 7y agoI've mostly had good internet connection since 2004, so I know. Pages were better before this modern SPA thing that ironically get sold in to improve user experience. End of discussion I guess..?
- eternalny1 7y agoI have begrudgingly been pulled into SPAs as a developer, and at first I was very skeptical. Now that I see what things like Angular can do, with lazy-loaded components, and only downloading JSON data and letting the client render the DOM, my pages are actually much faster and the UX is vastly better. Yes, you need to download the Angular libs, but so many pages use them now they are likely cached, and are negligible in size for a fast connection. After that, it's client-side routing and downloading mostly just downloading JSON from a REST API. You don't need to server to push a 5,000 row table with all the mark-up, you just grab that data and have the browser construct your table. And yes, you can still copy/paste the URL. And save the page as HTML. And everything else you can do with a "non-SPA" page. YMMV.
- dsco 7y agoThe times have changed. This website now needs pinch to zoom to be readable on smaller screens. Also the text is centered across the entire page, reducing legibility. What I remember from that era is Flash, living through the shit show that was browser quirks and dealing with a front-end stack with no foundation in computer science.
- aritmo 7y agoOn mobile, the centered text is difficult to read. :-( I still do not know what features of Windows are used to get this software.
- chapium 7y agoIts pretty refreshing not needing to scroll past a full page logo. I'd argue that this spartan design speaks volumes to their potential clients. Fully pragmatic engineering with no frills.
- finchisko 7y agoSandboxie is much better tool then Windows Sandbox. Great to hear it will be open source.
- saagarjha 7y agoHow does Sandboxie actually work?
- ComodoHacker 7y agoIt virtualizes file IO and registry API calls from running apps and redirects them to a predefined location, a "sandbox".
- saagarjha 7y agoHow? Is it running in the kernel, or is it some sort of debugger trick where any sort of system call gets trapped and handled by a sandboxing coprocess? Or is it an in-process library? (!!)
- lstamour 7y agohttps://community.sophos.com/products/sandboxie/f/forum/115348/anyone-seeing-occasional-ole-init-hook-failed-errors-from-sandboxie https://community.sophos.com/products/sandboxie/f/forum/1153... suggests a method... https://vallejocc.files.wordpress.com/2014/12/sandboxie-process-isolation-with-kernel-hooks.pdf https://vallejocc.files.wordpress.com/2014/12/sandboxie-proc... has more details. Also https://malwaretips.com/threads/sandboxie-should-be-avoided-in-2019-and-above.93426/ https://malwaretips.com/threads/sandboxie-should-be-avoided-... and https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern...
- saagarjha 7y agoThanks. Does Sandboxie use code patching to hook functions in statically-linked binaries?
- lstamour 7y agoStatically linked binaries aren’t exactly a “thing” on Windows... https://reverseengineering.stackexchange.com/questions/2070/can-i-statically-link-not-import-the-windows-system-dlls https://reverseengineering.stackexchange.com/questions/2070/... It appears to patch the SSDT table to intercept system calls to the kernel, and based on forum thread titles, has been caught by PatchGuard in Windows before, but I haven’t investigated myself. From what I can tell, once a privileged process like a kernel driver, starts messing with memory it doesn’t own, like SSDT tables and loaded user-land DLLs, well, game’s over as far as system integrity’s concerned. PatchGuard does integrity checking, but I presume given how common it is, there are known ways to fool it or disable it, perhaps by poisoning whatever it uses to check the SSDT memory. Interesting variations on this technique might be https://github.com/tandasat/DdiMon https://github.com/tandasat/DdiMon and https://github.com/tandasat/SimpleSvmHook https://github.com/tandasat/SimpleSvmHook In terms of defense, there’s https://github.com/IgorKorkin/MemoryRanger https://github.com/IgorKorkin/MemoryRanger And for an organized list of far too many examples for me to feel safe, there’s https://github.com/ExpLife0011/awesome-windows-kernel-security-development https://github.com/ExpLife0011/awesome-windows-kernel-securi... (Note: over half of the links I clicked at random had Chinese github commit text or readmes, presumably the list author is either searching Github by function calls or understands Chinese...) Less organized for obvious reasons, but this list of 199 starred projects might also be worth a look https://github.com/dmaynor?tab=stars https://github.com/dmaynor?tab=stars which in turn pointed me to https://github.com/Hack-with-Github/Awesome-Hacking https://github.com/Hack-with-Github/Awesome-Hacking And if you like this, you’ll probably also like: https://news.ycombinator.com/item?id=21481598 https://news.ycombinator.com/item?id=21481598
- chime 7y agoI have a few hundred Citrix VDI users, many of whom need to occasionally download a WebExLongHash123.exe file. Is there any way to use Sandboxie to auto-run these downloaded files in the sandbox so that if they are actual malware, it won't affect the rest of the system?
- deleted 7y ago[deleted]
- wiradikusuma 7y agoDoes it work for Windows 10?
- arthurfm 7y agoYes.
- todotask 7y agoTo think I have forgotten about this for so long, it is unique for web browsing and web development. It's useful to run untrusted binaries files that may create lots of garbage and easier to simply wipe temporary data in an isolated environment.
- ww520 7y agoThis is great. Sandboxie is a fantastic sandboxing product.
- m1sta_ 7y agoCan this be used to install applications that require admin access, when you don't have admin access (eg. Corporate devices)?
- emayljames 7y agoI would err on the side of no. These sandboxes are not a system in a system, like a virtual machine.
- abdj8 7y agoWe used it at Yahoo! for detecting misbehaving ads . I remember it as a one man shop, looks like they sold it to Sophos .
- Endy 7y agoI remember when Sandboxie was free before Sophos got involved.
- chipperyman573 7y agoI don't know how long ago that was but I used it about 10 years ago and I remember having to wait 5(?) seconds to launch a program because you had to pay to remove that restriction.
- kompakt 7y agoCame here to say that. Though I vaguely remember them trying some paid options even before Sophos. I recall using Sandboxie on Windows XP and Vista, back then it was incredibly useful to have such a tool.
- Laforet 7y agoIt was definitely paid software when I started using it back around 2012. There was a lot of uncertainly earlier this year when they stopped accepting orders without notice. Existing users could not renew their licenses and people were worried that the program may just be discontinued for good. Is quite fortunate that things turns out for the better.
- pmoriarty 7y agoAre there any Linux equivalents to Sandboxie? For example, I'd like an easy way to run Firefox in a sandbox under Linux, without the overhead of running a full VM (which is just too resource intensive on my old, slow laptop), I'd like to be able to pull out files that Firefox downloads from the sandbox, and then delete the sandbox when I'm done. Also, Sandboxie can force particular apps to start sandboxed. All that is pretty easy to do from Sandboxie and is 99% of what I use Sandboxie for.
- saagarjha 7y agoFor sandboxing in general? There's seccomp, which uses BPF to control what processes are allowed to do.
- pmoriarty 7y agoIs it as easy to use and as polished as Sandboxie? Or is it more low-level?
- saagarjha 7y agoIt's designed to be granular and programmable, so it's probably too low-level if you're looking for something like Sandboxie. I wonder if someone has published a set of rules that "just work", though…
- paxy 7y agoIf you don't need a GUI then you can use Docker for basic sandboxing. It isn't a foolproof solution, but it's about as close as you are going to get without full virtualization.
- akvadrako 7y agoYou can put GUI apps in docker too. You just need to give access to X or the wayland socket.
- 7y ago
- jpalomaki 7y agoMay 2019 update of Windows 10 includes Microsoft's version of Sandbox [1]. Requires pro or enterprise version. This is based on the Hyper-V virtualization. They also have "Defender application guard" [2] which allows launching websites to Edge running in Sandbox. There should be extensions available for also Firefox and Chrome for launching the sandboxed browser, but the browser running in the sandbox is anyways Edge. [1] https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849 https://techcommunity.microsoft.com/t5/Windows-Kernel-Intern... [2] https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview https://docs.microsoft.com/en-us/windows/security/threat-pro...
- alibert 7y agoThere is at least one advantage I believe for using Sandboxie instead of Windows Sandbox: performance. Using Win Sandbox, Edge sandbox, Defender application guard or Docker for Windows enables Hyper-V system wide and makes your current host Windows runs inside a special VM which incur obviously a small performance impact.
- securewindow 7y agoNew Windows installations are already run inside Hyper-V, due to new security features like Memory Integrity: > Memory integrity is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/memory-integrity https://docs.microsoft.com/en-us/windows/security/threat-pro...
- TheRealPomax 7y agoUnless your VM solution is a VMWare technonoly, in which case hyper-v gets turned right back off because VMWare has its own hypervisor that needs to run as low as possible.
- retrobox 7y agoIt’s great news that the source is being released, but I get the impression this essentially means the company will end active development and put the onus on the OS community for future updates.
- jve 7y agoWhich is much better than just declaring end of life and no further updates.
- lamby 7y ago> Which is much better than just declaring end of life and no further updates. Undoubtably true, although I would add that it hardly promotes free software as a "generally good thing" if the landscape is full of zombie projects like this, devoid of any community that makes open source what it is.
- sha666sum 7y agoThe announcement makes it seem like they were doing so anyways, but they are willing to open source it first.
- fierarul 7y agoSo you would prefer an Utopia where nobody pays for other people's work but they still make it available for free and work on it forever? From the news it didn't seem like they are abandoning it.
- kingbirdy 7y ago> So you would prefer an Utopia where nobody pays for other people's work but they still make it available for free and work on it forever? That's not what GP said, and I'm not sure how you got there from them pointing out this was likely the end of development. From the community guidelines: > Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.
- ndzig 7y agoOld news: https://news.ycombinator.com/item?id=20939469 https://news.ycombinator.com/item?id=20939469
- DvdGiessen 7y agoAs a long time user of Sandboxie, I'm excited to see this announcement and am looking forward to the open source release and what the community might be able to do with it. Sandboxie's technology works extremely well for securely isolating all kinds of interactive Windows GUI apps, and might thus be be an interesting alternative to Microsoft's own Windows Container technology which is more focussed on servers and can't really do GUI's. I'd love to see some experiments using Sandboxie sandboxes as Docker-style images/containers. Packaging a complete GUI app including dependencies and making it easy to run on another Windows machine without polluting it, without noticeable overhead, neatly integrating like you'd expect of a Windows app with things like window management or the clipboard, and all that while being securely isolated from the rest of the machine.
- narnianal 7y agoIs there something a linux user should take note of? Or is it Sandboxie an attempt to reproduce features like kvm/qemu to windows world? Looks like a cool tool but currently not sure what I would do with it besides of what I do with Linux already.
- thih9 7y agoIs there a comparable mac os product? Alternatively, are there plans for a mac os version?
- erikpukinskis 7y agoHow neat is that!
- GuB-42 7y agoI use it as a dev tool. Mostly to test installers. For example: Start with a clean slate, install the software, check that it works correctly, check what it actually installed and what it did to the registry, uninstall, check that everything is gone. It something goes wrong, scrap the sandbox and try again. Do it again with an older version installed in another sandbox, etc... Maybe I can do it with a VM, but Sandboxie is very convenient and lightweight.
- coupdejarnac 7y agoSandboxie seems to have been a good product with bad pricing and bad marketing. I remember paying for Sandboxie around 2011 and not realizing it was a yearly subscription. When the year ran out, that was the end of Sandboxie for me- I didn't want to repay for the same functionality for a home computer. For corporate use however, an annual fee makes more sense.
- gabia 7y agoWhen I opened the site, my S8 reported that Firefox had been detected using the camera permissions. No idea why.
- vardump 7y agoI'm really curious how Sandboxie defends against simply bypassing all DLLs altogether (including ntdll.dll), and performing direct Windows kernel syscalls?
- badrabbit 7y agoI tried appguard for Edge,it works ok but virtualbox stopped working as a result due to hyper-v being active. Is this the case with sandboxie?