Microsoft unveils sandbox boundaries for Windows 8/Metro developers

https://blogs.msdn.com/b/b8/archive/2012/05/17/delivering-reliable-and-trustworthy-metro-style-apps.aspx

by kefs • 14 years ago

53 26 14 years ago

blogs.msdn.com

yoblin• 14 years ago

One upside of this is that it looks like they're really pushing the one-click installs. It isn't apt or yum, but it's certainly better than what Windows has now..

DavidAbrams4• 14 years ago

How? Windows installation has been fine for a decade and a half. Actually, it's going BACKWARD, with vendors now not bothering to ask you WHERE you want application links stored and instead littering your machine's program menu with endless directories named after themselves. Who the hell organizes their applications by vendor? I want my graphics apps together, my audio apps in another group, general office-type apps in another.

With every release, Windows has made this basic function (organizing applications) a bigger pain in the ass. If Microsoft is going to start enforcing policies, then this should be one: No application can simply barf a bunch of crap into your Start menu without ASKING where you want it to go.

dpark2• 14 years ago

Sorry, I think you missed a pretty big memo. The Start Menu is gone in Windows 8.

vetinari• 14 years ago

Windows installation has been not fine by any stretch of imagination. It still has the same problems:

1) It is third party service, not provided by system (yes, I know about Microsoft Installer); it is up to the application vendors what they will use,

2) Installers can litter in the system, wherever they want (see your complaint about Start menu),

3) No 100% working uninstallation and/or repair, you will end-up with installers damaging your system and having to reinstall (even Microsoft ones; how the heck do I get rid of CJK IMEs, that Proofing Tools for Office 2010 "helpfully" installed?),

4) No update service, you end up with many updaters slowing down your system,

5) and many more.

If you think, that Windows installation is fine - have you ever seen install systems on other OSes?

eslaught• 14 years ago

"While it is possible to hide or obfuscate calls to APIs that are not included in the SDK, this is still a violation of customer expectations and Store policy."

Wait, does the platform not include a sandbox to make sure this doesn't happen? What "security" can you expect to get out of such a platform?

riffraff• 14 years ago

isn't it the same that happens on iOS ?

rbanffy• 14 years ago

Doesn't look like that: http://www.apple.com/iphone/business/docs/iOS_Security_Mar12...

dpark2• 14 years ago

Yes, this is exactly the same (or at least awfully similar). iOS has some APIs that are technically available to 3rd parties, but disallowed by the terms of service. It was news in 2008 when Google Mobile violated the guidelines to access some useful features.

http://daringfireball.net/2008/11/google_mobile_uses_private...

(Disclaimer: I work for Microsoft, though not on Windows.)

nemeth• 14 years ago

Windows 8 Metro apps can be written in real C++. How could they sandbox a custom C++ app? There's no virtual machine to do it.

http://msdn.microsoft.com/en-us/library/windows/apps/hh46504...

barrkel• 14 years ago

You don't need a virtual machine to sandbox C++; or rather, there's already a virtual machine in action, in the form of virtual memory and CPU privilege levels. The only way C++ (or any other native language) has to access to the outside its world is through calls to the kernel. Without direct file I/O APIs, options are even more limited (e.g. you can't easily write your own DLL loader).

drivebyacct2• 14 years ago

It's C++/CX. It's not just "real C++".

msftguy• 14 years ago

OS X/iOS use a 'sandbox' driver that utilizes TrustedBSD MAC infrastructure ( https://developer.apple.com/library/mac/#documentation/Darwi... ). Basically, most system calls can be verified against one or more policy modules, and blocked if non-compliant. Not really possible with Windows and its bajillion of syscalls (1000 in win32k alone afair)

krasin• 14 years ago

>How could they sandbox a custom C++ app? There's no virtual machine to do it.

They could use NaCl [1] or develop a similar SFI technology just for Windows.

[1] http://en.wikipedia.org/wiki/Google_Native_Client

mkup• 14 years ago

Virtual machine is not required for sandboxing C++ apps in 21st century.

[1] http://code.google.com/p/nativeclient/

[2] http://www.cl.cam.ac.uk/research/security/capsicum/

bringking• 14 years ago

It may be C++ but it is managed C++ that runs on the above the WinRT layer just like C#, and Javascript for metro. It will have the same restrictions as the other languages. It is actually interesting, in fact when you start a metro project at least in beta, you get the WinRT libraries and that's it. A ton of the traditional .NET classes have been moved into the WinRT library or removed all together.

Someone• 14 years ago

The problem likely is that part of the public API is in DLLS that use a private API to talk to the system. For example, public class AddressBook extends AddressBookBase, with 'Base' having a couple of private fields that may come in handy.

Third parties could figure out that private API and call it themselves.

I do not think it is practical to defend the system against thos. Moving that base class into the kernel takes performance and includes its own security risks. Shipping multiple versions of the OS with different layouts or even implementations for such subclasses might help a bit, but also would open the system for bugs that show up on only 1/N of the machines.

contextfree2• 14 years ago

The sandbox (AppContainer) and the SDK API restrictions are two separate things. Capabilities and isolation are enforced by the AppContainer, not the set of available APIs. AppContainer is actually a general system feature that can be used by desktop apps too to sandbox plugins and such (IE10 uses it in "Enhanced Protected Mode").

TazeTSchnitzel• 14 years ago

Apps can only access files with the same file type association?

What about generic text editors? SSH clients? :/

InclinedPlane• 14 years ago

Whoa there, read more carefully. It seems that if you use the built-in FilePicker then your app can use any file on the system, provided that the OS is sure that the user has actively given you access to it. Also, there appear to be ways to obtain permissions beyond the default level.

jamesu• 14 years ago

There are a lot of claims made here with regards to how end-users will effectively like to download and try apps from the metro store and take the time to write a good reasoned review about their experience.

Given the average response i've heard from end-users however, i somewhat doubt this. Most people i've talked to simply hate metro. Looking at other app stores, most reviews i've seen are low quality and emotionally driven.

Will be interesting to see how it all pans out.

Microsoft unveils sandbox boundaries for Windows 8/Metro developers

Related Stories