[superkuh]

At least native applications are something static you can verify. With web 'apps' like, say, anything based on electron, the end user has no control about what code is run. Instead the 'app' just pulls down and runs whatever the company/etc wants you to run dynamically and differently every time with the permissions you gave originally.

[Vinnl]

Your mention of Electron is the perfect example of why this is no different for native apps. Of course, on mobile this is usually mitigated through app stores, but there is no reason similar mechanisms could be introduced for the web if this really turns out to be problematic.

[superkuh]

Electron is not a native app. Electron is a browser web app marketed as a native application.

[nostalgeek]

Chrome browser is only 50% of Electron. The other 50% is a complete nodejs distribution which allows access to the OS filesystem, network, anything Java or .NET can do on a desktop... So no, it's not just a browser web app. Electron is absolutely native to the OS is runs on.

[Vinnl]

The only reason it's got all those permissions is because it is a native app, which can claim all those permissions. Sure, Electron app are browser wep apps marketed as a native application, but by definition, native apps can do everything Electron apps can do.