plugin-container.exe in sbie?

Hi,

I had restricted a sandbox to only allow firefox have internet and start/run access. But after browsing for sometime sbie prompted and said firefox could not run properly and plugin-container.exe needed start/run access. I gave the allowed it. Then again sbie prompted asking for internet access for plugin-container.exe

Why can I not only have firefox run and have internet access? Why does plugin-container need run and internet access? Is it safe to allow it to have those accesses?

Best Wishes,
Amit

 

Firefox runs properly even if you don't allow Plugin container start/run or connect. When SBIE gives you a message that Plugin container needs to run or connect, it means that the site that you are visiting is asking for it.

Some sites, like Youtube, only require Plugin container to be able to run in order to watch videos, other sites might also require Plugin container to connect in order for the videos to be displayed.

This is how I handle Plugin container. On my Firefox sandbox, I have Plugin container allowed to start/run ONLY. If I go to a site that don't display the video and if I am really interested in what the video is, I just open another sandbox in which Plugin container is also allowed to connect. This rarely happens.

Amit, I think you are also using NoScript like myself, right? I have Flash/Plugin container blocked on all sites by NoScript except Youtube. If I go to any other site that requires Flash/Plugin, I just allow the site temporarily and see what happens. If the video don't display, then I open the other sandbox where Flash can connect.

You are also asking if it is safe to allow Plugin container to start/run and connect. The answer is yes. If you feel more comfortable doing it like that then do it and use NS to allow sites temporarily. I don't allow Plugin container to connect because it is not necessary for me to do so as pretty much Youtube is the only site that I use to watch videos. I also prefer not to have sites with Flash contents that I visit allowed to connect, just in case is a bad site.

Bo

 

Yeah Bo I'm using NoScript.

I'll try to follow your method. But even if plugin is allowed to connect to internet and I accidentally visit a bad site and temporarily allow that page with NoScript, it's still not a threat right? I mean all of this is still happening inside the sandbox, right? And even if plugin get's infected, it's not getting out of the sandbox, is it?

Best Wishes,
Amit

 

Exactly, remember, keeping the system intact is what SBIE does.

I forgot to mention on my other post. Many sites that "ask" for Plugin container to be allowed to connect, don't need to connect in order to display the contents. In my personal experience, Plugin container rarely have to be allowed to connect. So, even if a site is asking for a connection, it probably wont be necessary to allow it to be able to watch the video.

Bo

 

But even if it is not necessary plugin wants to start and connect to the internet and sbie just keeps prompting to allow plugin to start and connect to the internet. Sbie doesn't stop until I get away from the webpage which asks for plugin. And it happens with a lot of pages.

 

You can do 2 things. In NoScript, put a check mark in "Forbid Adobe Flash" and/or disable message message 1307 in SBIE. I don't disable 1307 and rarely get the message. Do the NoScript thing but remember to allow the page temporarily when you want to view a video. Amit, you are using NoScript, make good use of it.

Bo

 

Amit, do a test to see if you are setting it up right. After blocking Flash in NoScript options, when you open this link, Sandboxie will not issue messages related to Flash/Plugin container. SBIE will issue message 1307 only if you temporarily allow the page.

http://www.adobe.com/software/flash/about/

Bo

 

Okay done. If plugin-container.exe is not allowed to start/run and have access to the internet in a sandbox, a video in a webpage will not play even if the page is temporarily allowed with NoScript, right? I mean plugin-container.exe is needed to play and watch a video in a webpage, right?

Amit

 

Yes it's working. sbie only issues message if I temporarily allow the page.

 

I have the PAID Lifetime version. I use Firefox as "forced program" and it automatically brings in the plugin-container.exe in my Firefox Sandbox. This happens as soon as I start the Firefox.

Best regards,

 

That's because you had not restricted internet and start/run accesses in your Firefox sandbox. If you had, it would have been a whole different story.

 

Many thanks!

Is anyone having problems with the latest release v3.74?

I am having problems with it.

Best regards,

 

You're welcome.

Um Mohammed, if you don't mind I'm already discussing my problem in this thread.

 

It is resolved, see here:

https://www.wilderssecurity.com/showthread.php?p=2106585&posted=1#post2106585

Best regards,

 

Well that's great.

 

Bo

 

Thanks Bo. I knew I could always count on you.

 

I personally have yet to meet a flash video that requires plugin-container either internet access or start/run to function properly. It asks for it, but if/when I deny it, it works fine anyway. And so I don't allow it. I have it blocked both in Sandboxie, and in Comodo FW & D+.

Then I went the extra mile and just disabled it altogether in the about:config in Firefox. Everything works just fine without it.

 

Luciddream, videos that use Flash don't play unless you allow Plugin container to run in SBIE or disable the Plugin in about:config. Check it out. If the video is using HTML, then you don't need Plugin container to be allowed to run.

Bo

 

That's just not true. I only recently disabled p-c in my about:config. For a long time prior flash videos worked just fine with it blocked in sbie & FW/D+.

 

How long have you been using SBIE? How well do you know SBIE? This thread was posted at the Sandboxie forum when Plugin container came out along Firefox 3.6.4. Read it so you ll learn.

http://www.sandboxie.com/phpbb/view...torder=asc&highlight=plugin container&start=0

Bo

 

I know it well enough. What I know even better is what has held true for me in my experience. It's pretty tough to convince me to disbelieve something I see for myself.

I've had p-c blocked for a long time. I have it blocked in my FW, in D+, and in sbie. That's how I run my ship. I don't allow anything unless I need it. But I didn't have it disabled in about:config, because I only found out 2 weeks ago that you could.

And flash videos played just fine for me regardless. Am I supposed to dismiss that because of an article, and/or what other people say? I can only guess their situations differ from mine. Their setups differ. Possibly it even varies depending on the site hosting the flash? 99% of all flash videos I watch are on Youtube. Perhaps for some reason the way they host their flash is different? and p-c isn't required.

 

Luciddream, in a restricted sandbox, it is impossible to play Flash videos unless Plugin container is allowed to run. If you don't allow Plugin container to run, Firefox hangs until it crashes. If you are using a restricted sandbox and you said you are and you don't allow Plugin container to run and you are able to watch Flash videos in Youtube, your case is unique in the whole Universe.

Bo

 

Then consider it unique, because what I'm telling you is the absolute truth. Why would I lie about something so trivial?

And funny, but I could swear I saw you having this exact conversation with somebody else, who also claimed they could watch Youtube videos just fine given my set of circumstances?... so I guess I'm not unique after all. I find it very hard to believe I'm unique in this regard, actually. More likely, you are simply mistaken. Unless you can attest to the fact that you've personally checked it out on every computer in the universe...

In D+ I have all activity for p-c blocked. In my Firefox rules in D+ I have p-c as a blocked application. I wonder, how many other people in the known universe (this forum) this applies to as well?

And if start/run for p-c is required to watch flash, how come flash videos play just fine if you disable p-c altogether via about:config?

 

The conversation you are talking about was with Amit. He was saying Plugin container has to connect in order to watch Flash videos. That is not what you are saying. I told Amit that not all sites require the Plugin to connect but you are saying that Flash/Plugin container is not required to run and It is required to run to watch video. If the Plugin don't run, you don't watch videos. Period.

Once again, read the thread that I linked so you learn how this work. Don't be close minded and stop making a fool of yourself.

Out of respect for Sandboxie, I ll stop right here.

Bo