Question What is your rationale for using "Auto-Containment" and not "Block"?

[rashmi]

Most Comodo users do not evaluate contained applications. When users encounter a containment alert or a green-bordered application, they typically close it and resume their work. "Block" is the ideal solution for these users, providing maximum protection without affecting usability.

What is your rationale for using "Auto-Containment" and not "Block"?

 

[Andy Ful]

Most Comodo users do not evaluate contained applications. When users encounter a containment alert or a green-bordered application, they typically close it and resume their work. "Block" is the ideal solution for these users, providing maximum protection without affecting usability.

What is your rationale for using "Auto-Containment" and not "Block"?

You can remove some vulnerable applications (document viewers, etc.) from the Trusted group and use them more safely. You can also try unknown applications in the sandbox.
The Block setting can partially block some applications/plugins/extensions that use LOLBins restricted by Script Analysis Settings. It is possible that Block setting can sometimes cause unexpected issues (mainly with applications).
Anyway, for many people it can be probably a good solution.

 

[vitao]

but them we eventualy will be back in the same problem as before. cis can block almost everything but it has his flaws too and the poc by you and loyisa show this so, even with many configurations, if comodo doesnt update their product, these kind of poc will spread and becomes something "normal" to see...

 

[rashmi]

You can remove some vulnerable applications (document viewers, etc.) from the Trusted group and use them more safely. You can also try unknown applications in the sandbox.
The Block setting can partially block some applications/plugins/extensions that use LOLBins restricted by Script Analysis Settings. It is possible that Block setting can sometimes cause unexpected issues (mainly with applications).
Anyway, for many people it can be probably a good solution.

You can try unknown applications using the "context menu" option, the "containment tasks" section, and the "virtual desktop" module. I have experienced no issues or differences between using "Block" and "Auto-Containment" with apps, extensions, or scripts. From my perspective, "block" is the superior and fitting choice for users who do not need auto-containment.