Hacker News Reader

https://docs.microsoft.com/en-us/windows/security/threat-pro...

Office “Sandboxing” is a thing today.

I don’t think any platform, either Linux or Windows, has successfully implemented secure sandboxing aside from true virtualization, if that. The isolation provided by kernel-level sandboxing like cgroups has proven to be a thin layer of protection in practice; it will just shift the problem to fixing sandboxing issues.

I think https://gvisor.dev/ might be the closest thing I can think of to container level sandboxing that tries to add meaningful security guarantees.

> "This feels like they’re making this move specifically to distract from the fact that they should have made the tech investment into sandboxing today."

cough

https://docs.microsoft.com/en-us/windows/security/threat-pro...

That's been built into Windows 10 Pro since Dec 2018.