Hacker News Reader

Comment by dman | Hacker News Reader

Please do not make this a Pro / Enterprise feature. I do remote tech support for my parents and would love for them to browse / use apps in a sandbox.

View on HN

Agreed. I'd go so as far to say that consumers -- especially technologically vulnerable ones like your parents, for example -- need this more than any other demographic.

Microsoft should make it easy to download, install and update on all non-Enterprise versions of the OS. This will also greatly reduce instances of a random ransomware holding critical data hostage and doing irreparable economic damage to small businesses (as was visible during the WannaCry episode last spring [0]).

[0] https://en.wikipedia.org/wiki/WannaCry_ransomware_attack

> Microsoft should make it easy to download, install and update on all non-Enterprise versions of the OS.

I'll take this one step further: Microsoft should make this as easy as "right click > Run in Sandbox". It would make the lives of everyone so much easier.

Think of it like giving your parent's a $100 present for Christmas, an upgrade from Win Home to Win Pro and your life will be so much easier.

Sure, but Microsoft could give the same gift to every parent out there. (I don’t mind buying windows pro for parents at all, issue is that when they buy a device it often does not come with pro preinstalled so there is a window where the device is vulnerable before I can remotely administer it)

Of course they could, but using that money they will go on to build another feature that you'll be able to use because you're already at the 'pro' level of their OS.

The alternative is to convince some engineers to create this same feature in their spare time and contribute it for free as a Linux package. Then they can get email about all of the things it doesn't do, and fix bugs in their spare time on a feature that all they see are complaints for. Until they burn out and the repo goes dead for a while and then gets picked up by one of those users who wants the feature to exist, and they make some improvements and get into an argument with another user who forks it and now there are two of them, almost the same but with a few features that are unique to each one. Of course for most of the users they either don't care and load one at random, or they do care and find features from the "other" system they want in the one that is being used. They send mail to the maintainers asking them to copy those features. Which adds more pain as the developers copy each other's features but they put their own special spin on them. This burns out more developers and a third person comes out and writes their own syntactically incompatible version that is functionally identical to the two different 'legacy' versions.

At this point I just pay the man his $100 and appreciate that the people working on the code are on it all day and can spend evenings with their family.

You underestimate your parents likelihood to overgeneralize your sandbox advice. I expect you will be receiving this call months from now:

"You told me to use sandbox to be safe, so I wrote critical document X in a sandbox because I want it to be safe, but now that I rebooted I've lost all of my work."

Agreed, this sounds like a genuinely useful feature, it’s a shame to hide it and restrict it to pro users only. Things like this should be “first class citizens” of the OS and in the spotlight for marketing.

That is what Windows store apps and MSIX sandbox are for.

You can't run a non-Store app in such a sandbox I believe?

Only when packaged via MSIX, which is why I mentioned it.

Except Windows store apps are strictly worse than being able to run regular Windows software in a sandbox.

One of MSIX purposes is to package old style Windows software, your regular Windows software into Windows Store sandbox, hence why I mentioned it.

It is an evolution of desktop bridge, appx and msi.

I stand corrected.

I'm not much of a Windows user, but MSIX sounds great.

Does it add a simple context menu entry to convert an installer? Bonus points for straight up Install and even more for Run.

I see it's open source, so if it's missing it may be possible to make a distribution of it with those things implemented. Then one could install it and make it a default msi handler.

Edit: from what I see conversion is much more involved. Create a certificate and go through a wizard and fill out some forms. Correct me if the is a quick and easy convert option. Otherwise it's a nice thing that needs more development to be useful for a generic user.

MSIX is a developer feature, replaces appx and msi installers, while adding support for sandboxing in the process.

https://blogs.msdn.microsoft.com/sgern/2018/06/18/a-closer-l...

A generic user is supposed to just double click on an *.msix file to get it installed on the Windows Store infrastructure.

"Being just the start, MSI packages may very well be supported for at least a few more years on Windows 10. However, by looking on the GitHub repo of MSIX, there are some hints that Microsoft envisions a future where MSIX not only replaces the MSI but also creates a package format which cross-platform Microsoft applications can recognize and use on any platform (iOS, Android, MacOS, and Linux)."

https://www.advancedinstaller.com/msix-windows-package.html

> MSI packages may very well be supported for at least a few more years on Windows 10

This sounds like someone making installer stuff would say. MSI will be supported on modern OSes for much longer than "a few more years".

VB6 apps created in 1998 will be supported until 2025 at least. MSIs will be treated the same.

Windows Core OS doesn't support MSI by default. :)

I wish MSIX was available on Windows 7 too. It would have much greater adoption.

It is in Preview. https://github.com/Microsoft/msix-packaging/tree/master/prev...

why not just buy them a pro edition? I know it's more expensive, but that would also get you remote desktop, bitlocker, and group policy, which would all also be great for remote supporting your parents.

Because sometimes they buy a new computer and it is a while before I am able to visit them across the planet and install a new OS in it. Would really like a good out of the box experience.

You don't need to install a new OS, you just enter a Windows Pro license key to upgrade the version? Buy the key online, send it to your parents, tell them where to enter it, done.

Also I don't think your parents want to use that particular sandbox. There's no persistence at all: no bookmarks, no cookies, no history, no local documents, ...

The no persistence is why I like it. It would be ideal if I could ask my parents to do their entire browsing in an ephemeral sandbox and even if they end up clicking / installing something from a shady link it wont blow away their (real) persistent OS install.

Totally get that issue. It might be worth spending a day or weekend making a boot-disk for them that will wipe their current disk image, and install win10 pro with it set-up so you can remote admin it.

That way for your parents they just have to buy the pc, put the usb in and reboot it, and then call you when it's back on so you can remote in and give it a key and finish configuring it for them. I suppose even that might cause issues if you can't teach them or walk them through via facetime how to set the device to boot from the usb instead of the harddrive.

I would spend a few hundred extra dollars and just get a MacBook air or mini and install 1blocker on it.

Because you're still left with the same issue? MacOS's security technology is significantly behind Windows, only its relative obscurity protects it.

System Integrity Protection would protect against many of the same threats that Windows Sandbox would (since it prevents applications from doing extreme damage to the system even with root), and by default it only lets you install software from developers registered with Apple (either inside or outside the Mac App Store). It'd be more secure out of the box than a Windows system, as if you have admin and are willing to click "yes", you can let an application do anything on Windows (although most attacks can be prevented with the new features in Pro/Enterprise).

Windows 10 has identical defaults (Windows Store install only, with hard locks on certain parts of the system and an integrity checker).

All I know is my older and less tech savvy relatives experience pretty much no problems with Apple devices and iOS/macOS. And if they did, they can take it to the Apple store.

Hardware virtualization is a Pro feature in windows, so I doubt this is possible even if they wanted to (without moving virtualization to home edition).

I took an inventory of which apps my parents use: email, solitaire, Youtube, and some web browsing. That was it. Linux is good at doing those things, so I put them on Xubuntu (my preferred distro) about 8 years ago. Once my mom understood that the UI was similar enough to Windows, she didn't mind. Its been remarkably stable (and usable) ever since.

Ah, it's Pro because it's using Hyper-V.

Then make Hyper-v home.

Seriously this is a killer feature needed by everybody. And specially the non-pro users.

A lot (most?) of the hardware Home runs on doesn't support hardware virtualization.

Effectively all x86_64 hardware from the last 10+ years supports hardware virtualization, so I can't agree.

Not necessarily in the Bios settings. And there are CPUs without still.

Aside from the points made by another reply (BIOS support, older CPUs), some machines have virtualization switched off by default because it's broken. I had a (fairly old) x86-64 laptop that would randomly hardlock while running VMs if I turned on hardware virtualization.

£2,500 Dell XPS ships Home out of the box unless specified otherwise.

Windows SKU has nothing to do with hardware.

https://www.dell.com/en-uk/shop/2-in-1-laptops/new-xps-15-2-...

Actually I can't seem to configure that directly from dell to come with Pro lol. Seems there's a question about that too.

With Dell you have to buy the business version of a notebook to get Windows Pro. Your example would be [1][2]. Apart from price the main differences are that the business versions ship with Windows Pro and that they have better warranty (next-day onsite).

1: https://www.dell.com/en-uk/work/shop/tablets-and-2-in-1-lapt...

2: https://www.dell.com/en-uk/work/shop/laptops/new-xps-15-2-in...

The Windows Store in Windows 10 has a "one-click" $99 upgrade from Home to Pro, Dell doesn't really need to offer it as a configuration item anymore.

Agreed, but at least it isn't gated off like Windows Defender Advanced Threat Protection

Reply on news.ycombinator.com