Sandboxie 5.31.6 is out, compatible with W10 1909

bo elam said:

The truth is that they are two separate versions. Both versions share components and code but...

...there is really no reason to try "hiding the unhidable".

I don't get what you mean. David made only one 'version', which consists of BOTH Sandboxie Plus AND Sandboxie Classic. Sandboxie Plus neither works nor can be installed before Sandboxie Classic is installed, but Sandboxie Classic works without needing to install Sandboxie Plus. Yes, it [Sandboxie Plus] is a separate install, but no, this doesn't make it a separate 'version', or fork, as its only purpose is to give the user the freedom to decide between 1/ being able to use newly added features and 2/ keeping them from view in such a particular way that anyone who does not need or want these added features will not be bothered by the confusion that might otherwise be caused by them.

As for your remark of

...there is really no reason to try "hiding the unhidable"

.
Again, I have absolutely no idea what you mean with that...

...This seems pretty vague to me TBH. Would you please care to explain?

phrab said:

If I install a program within Sandboxie, run it within Sandboxie, & then delete the Sandbox, will any registry key changes & additions remain?

Would I have to first deny access to the registry within Sandboxie, as I notice that Registry Access is generally granted, but says it does not apply to programs that have been installed or downloaded into the Sandbox?

Yes, by default all changes made to the registry by programs running in the sandbox get deleted when sandbox contents are deleted. The settings under Registry access are to tighten or relax the access to the registry by sandboxed programs and what this programs are allowed to do with the registry.

To protect the Registry, there is no need to do anything with those settings. By default, Sandboxie protects the registry more than enough. Normally, if a program running in the sandbox needs to access the registry, the program is allowed to Read the key and if it requires to make changes to the key, the changes take place in the sandbox. This changes dont touch the real registry. The setting in the picture (Direct registry access) opens access to a key by a sandboxed program. To this day, I never had to use that setting and you probably don't need to either. If you use that setting, you ll be allowing the sandboxing effect on that particular key to be bypassed.

The line: "it does not apply to programs that have been installed or downloaded into the Sandbox" has to do with protection. This particular setting, the one you selected, shown in the picture, is for programs that are installed in your computer's real system and you run them sandboxed. What the line is saying is that the setting will not apply and can not be used for programs that you install in a sandbox or with programs that might download themselves automatically into the sandbox, like malware. You might be browsing and something downloads into the sandbox, wants to access the registry, even if sandboxing is off to a particular key because you have turned off sandboxing to that key, the malware will not be allowed to write to it or make changes outside the sandbox.

FWIW, there is no need to play with this settings, opening or blocking or whatever unless there is a good reason to do so. Like perhaps someone like the guy in the link from a few years ago. Sandboxie could have helped him. He might have had to try different things until finding the right option but for the most part, we dont have to do anything with this particular set of settings. By default, we get more than plenty protection for the registry from SBIE.

Bo

phrab said:

Thank you!

You are welcome, phrab.

Under Resource access, the settings that every Sandboxie user should be using are the ones that are designed for protecting your personal files, documents, sensitive files and folders from being read or stolen by programs that run in the sandbox.

You ll find this settings here: Resource access>File access. Perhaps you are using this settings, if you are not, let me know and I ll give you a quick guide on how to go.

Bo

bo elam said:

David's Sandboxie plus has different installers for Classic and Plus. That alone makes what you install different and the version you install is dependent on which installer you use
You are not alone, there are other people like you that don't see the difference. And some don't want to admit that Sandboxie Classic and Plus are different. Personally, I have a problem with what makes them different but is a matter of taste. I can understand some people liking the changes David has implemented. So, what separates both versions or flavors, to me personally, is not a problem. But not wanting to admit that there are differences, stating that both versions are one and the same and trying to hide that both versions are different is what I call trying to "hide the unhidable".

This denial to me, sounds like coming from people who feel that Plus would be seeing as less worth it than Classic unless both versions/flavors are seeing as being one and the same. Thats why both versions being equal is part of their narrative. IMO, with David's Sandboxie the "less is more" thing applies. So I think they are right on that, and know it but dont want to admit it.

Bo

I never said that they're not different. They are, and, as a matter of fact I already did point out previously in the thread that there most definitely are differences. What I said instead was that they're not really different 'versions' [of the same software product]. I.e., they're just two different products designed to connect and communicate with each other, entirely optionally that is, and provided that you use them both together, albeit using them both together is still something that is also entirely optional, also in addition to the fact that the aforementioned connection is also entirely optional.

I guess this all simply boils down to how you want to define the term 'version'. But if you're going to call them two different versions of the same, then you might as well extend your own reasoning to each and every app that's capable to be run, concurrently, on the same version of Windows 10. That's just because, essentially, they're all also connected to each other if you have them concurrently running on the same Windows 10 system, and in fact they are designed for this whole purpose, even, if you don't like that that's what they factually are.

The bottom line is, it's all simply just a matter of semantics. You're not the only person who doesn't understand the true fundamentals of software connectivity.

Off topic: I don't claim to be an expert on the subject of software connectivity. But I did receive extensive professional training in the field of Java Enterprise software development (EJB) some time after I graduated in IT almost 20 years ago so, I think I grok at least some of the key concepts of designing modular apps.

Hi phrab. In both, Registry access and File access you can restrict access to the file system or the registry or open access to the file system or registry. Regarding the Registry section, remember, there is no need whatsoever to touch it. So this post is about the File access section. When you restrict (which is what I am going to show you how to do here), you make security more restrictive and tight in the sandbox. When you open access, you are opening holes (usually very small) that are needed to make applications/programs work better with SBIE. Sometimes for better compatibility between SBIE and a particular program this has to be done. Is a case were you trade some security for convenience. And is OK to do this as long as the hole is very small and the gain in convenience and usability makes it worth it

The settings in all the pictures you posted are related to programs you installed or with settings SBIE has put in place by default. For example the ones with the name Roboform have to do with the program named the same. So I can safely assume that you have Roboform or you had it at one point and when you installed it, Sandboxie gave you a prompt asking you to OK for the corresponding compatibility settings to be enabled. If you click any of this entries via the SBIE UI and try to delete them, SBIE will give you a prompt with a clue of why the setting is in place. If you didn't write the setting yourself, usually they come from one of this 2 places were you can enable and disable compatibility settings. 1. In Configure>Software compatibility (global settings, applies to all sandboxes), or 2. In Sandbox settings>Miscellaneous or All applications (Apply only to a particular sandbox).

The setting with the name qWAVEdrv has to do with Google hangouts. A long time ago, Sandboxie created that setting because some users were having problems with Google hangouts. So, the setting is in place by default, but can be disabled if it doesn't do anything for you. For me, I never had issues with Google hangouts so I disable it.

You can enable it or disable it here: Sandbox settings>Miscellaneous

As is now, you have that setting ticked, if you untick it, when you go back to Full access, you ll see the setting has disappeared from there.

The two settings in the bottom screen and I believe (I am using memory on this one) the one with Microsoft and Windows written on it in the top screen have to with Windows live. Sandboxie put this set of settings by default but you can disable them if you don't use Windows Live.

Phrab. From here on, is the important part of this post. I am going to try to make it as short as possible so it becomes easy for you to put this restrictions in place, and understand the reason for using them.

Remember this. Sandboxie allows program to access all files in your system. Any program that runs in the sandbox, can read any file you have in your system. This is good and bad. Is good because makes it possible for most programs to run in the sandbox. Programs have to have access to your system, otherwise they wouldn't work in the sandbox. So, by default, Sandboxie is as restrictive as it can be, but the access to the file system has to be allowed.

Regarding blocking access to system files or AppData files or anything like that is not worth it, and I don't recommend it. Some people like to use this settings exactly for that, and block this system file ot that file and they do it because they think they are gaining security but the reality is that you gain nothing by doing it. Actually, if you use this settings for blocking files in AppData or in program files or Windows, some programs are not going to work in the sandbox.

So, what now? What is the reason for using this restrictive settings? Simple. Enabling this settings are for blocking programs that run in the sandbox from accessing, reading your personal and sensitive files. Remember, not all programs that run in the computer are good programs. Some are malicious, some might want to steal your files, steal your identity, steal your bank statements or credit card information. Your Social security card or Drivers license number. Your personal pictures. Your business letters or statements you might have in your computer. Using this settings protects yourself, if malicious programs cant access your sensitive files, they cant read them, cant steal them or send them home.

Whenever I create a new sandbox, I set this settings up.

Some users have personal and sensitive files all over the computer. That could make enabling this settings for all your sensitive files take time. It is better and safer to have important files in one or two folders. And then have subfolders. If you do this, when you block access to a folder, all folders inside that folder will also be blocked. Personally, I being doing this forever, even before Sandboxie.

So, in my case, I block access to 2 folder, and one text file. That is 3 settings, and they cover the entire computer. By enabling this 3 settings, for example, when I browse, I have 0 personal file at risk from being accessed or stolen by any program that runs in the sandbox. That is security.

Go here: Sandbox settings>Resource access>File access>Blocked access. The Read and Write access settings are also for restricting but this post is about Blocked.

Click Add, navigate to the location of your sensitive files or folders, to add them. Click Apply and Accept. That's it. When its all over, it ll look something like this.



There are many variations on how to go to restrict the access to your personal files, I could spent the rest of the night writing just about this particular subject and not be finished when the night is over. So, is better to concentrate on this one way to make it short and easy to implement.

Keep this in mind. Since you will be blocking access to your personal files and folders, if for example, you want to upload a file somewhere, you will not be able to do it if the file is protected or if it is located within a protected folder. Sandboxie will give you a message telling you something about it. Usually when I want to upload something, I copy the file and put it in my desktop and upload it from there. Also as a test, to make sure you have set protection correctly, try uploading something thats blocked, to see what happens.

Bo

@hdmi Best regards.

Bo