What about the "sandbox" alternative?

[ikas-mc]

UWP applications work in "sandbox"
But app use WindowsAppSDK has full permissions by default
What about the "sandbox" alternative?

[ghost]

this is a very good question for the reason that it has a concern for security.

UWP applications work in "sandbox"

The term AppContainer (MS engineer explaining what it actually is and how it works) people often use exactly equals to the native applications sandbox in windows.

But app use WindowsAppSDK has full permissions by default

assuming that you mean Full permissions = High IL apps/semi god mode, Currently windowsAppSDK produce windows apps that can only run in Medium IL. there is a windows bug where WinRT apis doesn't work in High IL apps — yet.

What about the "sandbox" alternative?

there is no alternative, AppContainer is a core NT Kernel feature and app models agonistic. The sandboxed environment of UWP is like trying to drive a car with your hands tied behind your back. Current AppContainer has very basic features allowances and too much crippled to do anything useful. what they can do is to allow more features to be accessible right within the appContainer by brokering more and more features.

Imagine using a closed source third party application you don't trust yet you installed for a specific purpose and it spies on your every keyboard strokes in the background. that's the whole situation right now with medium IL apps.

PM of WindowsAppSDK has signaled the AppContainer Improvements for win32 apps , not a promise per se but you can take that as a logical hint for what to come.

[ikas-mc]

I have read related issues and benefited a lot,thanks
Hope AppContainer for win32 apps will be officially supported
The old uwp is dying, and the new WindowsAppSDK application cannot replace uwp in security. This is the problem that needs to be faced now...
There is no clear plan. Terrible