Enable Github Immutable releases

[kitsumed]

Once Immutable releases are enabled, every new releases and their associated tag will be marked as "Immutable". Assets uploaded in a immutable release cannot be replaced or removed, thus ensuring that once a release is made, the files cannot be altered. You will still be able to edit the actual release text or to delete the whole release, but not modifying the released assets. Draft of releases are not immutable.

You can learn more here : https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases

Immutable releases is a checkbox you can find directly by going into the Settings section of this repo.

[love-code-yeyixiao]

Actually sometimes that may break our hotfix, which has been used several times.

[kitsumed]

Editing release assets without leaving a trace is considered by a lot of technical users as a bad practice/lack of transparence. It could also be abused by bad-actors.

In my own personal opinion, it's the type of things I would be warry off for a privacy tool, even more so when it run at kernel level. The fact I can also see multiples text where generated with AI make me question how safe the security practice are. For a app running at kernel, I also find it was weird that Github private security issue was not enabled and that not security policy exists. This is my own point of view, I still find the idea behind the project very good and hope to see it improve over time.

[kitsumed]

If I may add since I just remembered, another thing I had a weird feeling about was your participation (@love-code-yeyixiao) in this project, since @DavidXanatos seems to be one of the main maintainers,

I say this because you are a member of a Github organization with hidden members, that provide a cracked version of Sandboxie-Plus. In which we can see commits with your name. Thoses are not signed, so technically someone could be spoofing it, however from comments on issue we can see you also have write access to the repository.

[love-code-yeyixiao]

According to the general principle of projects under the development of xanasoft, it is recommended to submit security advisority directly into xanatosdavid@gmail.com(maybe, I didn't check it). Actually Sandboxie (under the development of xanasoft as well) has already done some of your suggestions: we now have complete CIs and Github private security issue is enabled. I guess that's because it's in the initial phrase of project.

[love-code-yeyixiao]

If I may add since I just remembered, another thing I had a weird feeling about was your participation (@love-code-yeyixiao) in this project, since @DavidXanatos seems to be one of the main maintainers,

I say this because you are a member of a Github organization with hidden members, that provide a cracked version of Sandboxie-Plus. In which we can see commits with your name. Thoses are not signed, so technically someone could be spoofing it, however from comments on issue we can see you also have write access to the repository.

Actually due to the reason of unpubliced driver source, third-party direct code contribution can be almost impossible.

SandboxieCrack was a traffic channel I had intended to try out earlier — based on my observations, a higher market share tends to correlate with a higher paid conversion rate. If we manage to get users dependent on the software, and then for some reason (such as driver signature expiration, being blacklisted, or simply the repo maintainer quitting) the software can no longer be used, there is a certain probability that users will convert into actual paying customers. This project has already entered its later stage; you can see that WinFunan Admin has posted an announcement declaring that the driver signature has become invalid. Also, you may notice that I am not very enthusiastic about maintaining that repository — the recent releases lag significantly behind the main repo version, and if users follow Windows updates, they will no longer be able to continue using this version, thereby increasing friction. We deliberately chose a widely used certificate, so that the driver signature would be quickly revoked by Microsoft (and if it were never revoked, I might even have submitted the certificate to Microsoft ourselves). Microsoft's deprecation of cross-signing provides an excellent excuse for us to stop updating. If users really fall back to disabling DSE, they will not be able to play games or the like; if they install a CustomSigner, the process is quite complicated. From a user psychology perspective, they tend to balance personal "tinkering" against price. For such users, I privately recommend that they purchase a license through official channels. Judging from the communities I have engaged with, several users who have developed habitual usage patterns have already started genuinely subscribing to Sandboxie.

Note:These behaviours don't belong to DavidXanatos or any other xanasoft member.
MODIFICATION：Removed "blacklisted". which is a typo.

[kitsumed]

For the record, #110 (comment) was edited 3 time, the last edit 1 hour later where

Note:These behaviours don't belong to DavidXanatos or any other xanasoft member.

was added. Older edit changelogs where removed for some reasons. I don't think anything else changed since, unless I did not notice it. Following this edit, a commit was pushed on SandboxiePlusCrack and this discussion was created and set as an Admin post.

I also would like to point out that while the explanation given here make sense, there's still some weird things. For example the original discussion made 3 week ago does not mention paying/supporting Sandboxie-Plus at all, it only talk about the certificate issue and how to work around the issue. In my previous comment, the comment I used as reference, this one, also shows @love-code-yeyixiao explaining how to work around the issues with no mentions of supporting the project. Another similar comment in 2025 was made in simplified chinese where you mention that you will look for a workaround.

There also a couple of additional weird points in all of this. For example @love-code-yeyixiao actually made a GHSA report for Sandboxie (GHSA-jp7r-vgv9-43p7). Not really sure what to understand of all of that.

All links where archived in archive.org in case something get edited or deleted again.

[love-code-yeyixiao]

During the discussion before the release, I hadn't yet decided to terminate the project lifecycle immediately (because I still held out hope that it might attract a few more people). Since I encountered many CN users who found it troublesome and simply subscribed to the 8 RMB/month service, I thought users would make their own choices voluntarily, so I deliberately provided a solution that sounded very complicated. However, since you've asked so thoroughly, I feel it wouldn't be right to hold back any longer, so I've made the support instructions clear. I may archive the repository later.
Btw, you will absolutely find no personal benefit for me in this: I have not opened any special donation channels, and I am even doing my best to separate my own account from the repository—the repository is not directly under my name precisely to avoid any suspicion that I might use it to drive traffic to my other repositories.