Sandboxie-Plus 1.0.17

Hi David and Simbun,
many thanks for the detailed answers and sorry for my little expertise. Both hooks are now set.

 

I don't know if the following issue is caused by version 1.0.17. Anyway I think I have noticed it only during the last time (perhaps since one week):

When closing my sandboxed browser session (Firefox) via the Sandboxie command "Terminate all Processes" ("Alle Prozesse beenden") the sandbox content is no longer deleted automatically. (At least most of the time it is'nt. Maybe that sometimes - but rarely - it continues to work.) I see it because afterwards (when the browser is closed) I have to start manually the command "Delete content" ("Inhalte löschen") and only now the deletion is performed.

On the other hand: When closing the browser session by manually closing one by one all opened browser windows (websites) the deletion works as it should, namely automatically.

Do other users have a similar experience?

 

this is a known error and will be fixed in the next build

 

Ah, o.k. Thank you, David.

 

And for me too I'm probably imagining it, but Firefox seems to load faster now - haven't timed it.

 

OK thanks for the info and I see what you mean. But I figured that developers never added this feature because it might cause a whole lot of problems since reading and opening other processes is so common for apps. That's why I have never monitored this with HIPS like SpyShelter because all of those alerts are pretty much pointless and it might drive you insane. But if you can block sandboxed processes from doing this without any major issues, then why not. Perhaps if possible you could give an on/off option for this stuff.

 

Well, an observation: after enabling Windows Filtering Platform in Options heading/Global Settings/Advanced Config, I can honestly say that I forgot it was there. I was only reminded after reading the new content on this thread.

So I think it's worthwhile for me to keep it enabled if it's an add'l security measure. No errors, no problems (yet).

Edit to add: Thought I would do a little test on Firefox boxed vs. unboxed with the speed test courtesy of @Sampei Nihira. Slightly better unboxed but not significantly on here.

Spoiler: FF boxed

Spoiler: FF UNboxed

 

Well it is common but really should not happen its like one huge open air orgy without any protection LOL.

Now, opening some system processes can be part of normal operation like wanting something from explorer.exe as it provides the shell/taskbar, etc... or possibly one or two other system processes... but opening some unrelated 3rd party apps there is no good reason for that.

But as it seams no one had any issues with this new restriction (note that explorer.exe is open by default for reading) so by now I think the reason this was not prevented earlier was a purely ideological one, to only filter write accesses but by default allow anything to be read, even it its not needed.

 

Yes let's see how things go, if there aren't any big problems then why not. However, I do know that SpyShelter often alerts about reading and opening process memory, especially when installing apps.

 

For a to me unknown reason -although I have set it to do so- Sandboxie no longer automatically empties the sandbox when I close Chrome. I have to either tap on "Terminate all programs" or "Delete content."
With Firefox Sandboxie still empties the sandbox automatically.

Both Chrome and Firefox have their own sandboxes. Someone wrote that to force those browsers into Sandboxie is forcing a sandbox into a sandbox. Which would not be a good idea, as it is also not a good idea to run an anti-virus and malware program in another anti-virus and malware program.

If that is so, why even use Sandboxie? (Especailly if you already have a good AV-AM program.)

(I have been utilizing Sandboxie since 2005, had a lifelong license, and exchanged emails with Tsuk before I even posted on the original Sandboxie forum. But only now do I wonder why using Sandboxie is good even though both browsers I use already have sandboxes. Is it superfluous?)

Not being a nerd I know nothing about the technicalities, and am not interested in them. But a simple explanation if possible without a lot of technicalities would be very welcome.

 

Thanks for your response.
Sandboxie Classic 5.55.22 (64 bit)

Ronen Tsur developed Sandboxie while Internet Explorer already used sandbox technique, so he must have thought extra sandboxing would still be good for some reason.
Running Windows 8.1 with StartIsBack I still have IE 11, but I seldom used it, and now when I go to YouTube with it for example to test it a page opens telling me I must pick another browser, and shows Edge, Chrome, Firefox, and Opera icons. Recently I got an email from Microsoft saying IE 11 is discontinued.