[DaiPlusPlus]

> Browsers offer a level of isolation and safety that you generally don't get with native desktop apps.

They didn't originally: Java <applets> and ActiveX <objects> originally weren't sandboxed and had free run of the visitor's computer.

All major OSes today now have built-in support for process/app sandboxing. I suppose if the "rich client" frontend model (WPF, etc) was more popular then I expect desktop OS application isolation to have been introduced much sooner.

Security development happens where the market demands it, and rarely does it happen where it's actually needed.

[e_y_]

I can't speak for ActiveX since I avoided IE like the plague, but Java applets were sandboxed. Just that the sandbox had a lot of holes.

[DaiPlusPlus]

Huh - you're right: http://www.securingjava.com/chapter-two/