3 ms·

Nice. Is that the default yet? The article doesn't suggest there's a downside to sandboxing Defender. If so, that should be the default.

pjmlp 2y ago
Not yet, but it is no different than SELinux or seccomp not being the default on most Linux distributions, other than Android and ChromeOS. Now with ongoing changes due to Secure Future Initiative, it will become so, Windows is already going into app sandboxing[3], Virtualization-based Security[2], Pluton requirements[1], and plenty others[0], I would expect it to eventually be enabled by default. [0] - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://learn.microsoft.com/en-us/windows-hardware/design/de... [1] - https://learn.microsoft.com/en-us/windows/security/hardware-security/pluton/microsoft-pluton-security-processor https://learn.microsoft.com/en-us/windows/security/hardware-... [2] - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://learn.microsoft.com/en-us/windows-hardware/design/de... [3] - https://blogs.windows.com/windowsdeveloper/2023/06/14/public-preview-improve-win32-app-security-via-app-isolation/ https://blogs.windows.com/windowsdeveloper/2023/06/14/public...
- blibble 2y ago
  > Not yet, but it is no different than SELinux or seccomp not being the default on most Linux distributions, other than Android and ChromeOS. default for what? a non-existent bundled anti-virus scanner? you don't need to sandbox something that doesn't exist selinux is enabled by default on RHEL, apparmor is on by default for ubuntu/debian (so "most" is covered) seccomp()/unshare() are necessarily application specific but still very heavily used (Chrome, flatpak, systemd, ...)
  - pjmlp 2y ago
    Default security knobs. >.....other than Android and ChromeOS. Red-Hat has some of them turned on, not the full stuff, otherwise I would be out of work in SecDevOps security assements.

pjmlp 2y ago

Not yet, but it is no different than SELinux or seccomp not being the default on most Linux distributions, other than Android and ChromeOS. Now with ongoing changes due to Secure Future Initiative, it will become so, Windows is already going into app sandboxing[3], Virtualization-based Security[2], Pluton requirements[1], and plenty others[0], I would expect it to eventually be enabled by default. [0] - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://learn.microsoft.com/en-us/windows-hardware/design/de... [1] - https://learn.microsoft.com/en-us/windows/security/hardware-security/pluton/microsoft-pluton-security-processor https://learn.microsoft.com/en-us/windows/security/hardware-... [2] - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs https://learn.microsoft.com/en-us/windows-hardware/design/de... [3] - https://blogs.windows.com/windowsdeveloper/2023/06/14/public-preview-improve-win32-app-security-via-app-isolation/ https://blogs.windows.com/windowsdeveloper/2023/06/14/public...

blibble 2y ago
> Not yet, but it is no different than SELinux or seccomp not being the default on most Linux distributions, other than Android and ChromeOS. default for what? a non-existent bundled anti-virus scanner? you don't need to sandbox something that doesn't exist selinux is enabled by default on RHEL, apparmor is on by default for ubuntu/debian (so "most" is covered) seccomp()/unshare() are necessarily application specific but still very heavily used (Chrome, flatpak, systemd, ...)
- pjmlp 2y ago
  Default security knobs. >.....other than Android and ChromeOS. Red-Hat has some of them turned on, not the full stuff, otherwise I would be out of work in SecDevOps security assements.