Sandboxes: what we've learned