It'll be interesting if MS allows to write e.g. WFP callout drivers via LiteBox and not requiring attestation signing. It'll still work in kernel mode, unlike NetworkExtensions in MacOS.
"In WAL mode, SQLite exhibits "snapshot isolation".
When a read transaction starts, that reader continues to see an unchanging "snapshot" of the database file as it existed at the moment in time when the read transaction started.
Any write transactions that commit while the read transaction is active are still invisible to the read transaction, ..."
- app groups to easily enable/disable group of programs
- wildcards in program path names
- efficient IP addresses blocking, as in PeerBlock
- speed limiting
- auto-apply program's rules to its child processes
- control SvcHost services by service names
- traffic statistics history