You dont want coolgame app to be able to read and alter sucurebank app. the funny thing with for example snap apps is that most want full privileges...

Doesn’t Windows require Administrative privileges to access another process’ memory? I know it does to get direct access to a hard drive. Granted, it would be nice if one had to explicitly whitelist an app that wanted to read other process’ memory.

You don't need admin to do it to yourself, otherwise debuggers wouldn't work. It will fail if you do it for an unrelated user though.

Basically the permissions are enforced at OpenProcess(), and these are the permissions you can ask for: https://docs.microsoft.com/en-us/windows/win32/procthread/pr...

Up until recently it was standard to just blindly grant admin to whatever asked for it, because UAC's implementation was so damn naggy. With Windows XP or before there was no UAC and most everyone ran as admin unless you were computer savvy or on a corporate PC.

Many years ago this was brought up as a security issue with Windows that was "impossible" to fix, can't remember what they called it though.

Feature

Could one run a snap application in a chroot inside a VM in another city via ssh work for better security ?

I'll take security over cool tech demos. And you still can do these things. Just run your demo as root or turn off the security features.

But it's more than just cool tech demos. You could add features to Windows itself, with first-class integrations that looked and felt as if it was shipped by Microsoft. You could automate things that didn't have an automation interface, and you could extend software that couldn't otherwise or didn't want to be extended. Your computer was truly yours.

Sure letting it be a free-for-all was a bad idea. I'm fine with granular permissions, but am wary because it means I'm relying on features that upstream could turn off because they felt like it, or it made them look bad, or it introduces a security hole they just don't want to fix.

It's giving away liberty for security.

I guess you do lose something as a windows user but this kind of hack was always pretty crappy and has a much better alternative. As a linux user I am used to everything having both a gui, cli and often language libraries. Writing a script for cli commands is much much nicer than hacking some gui. And much less likely to break.

I grew up delving through the Windows labyrinth. Now I am comfortable at a command line and can write a mean bash script, but initially I abhorred it :)