[troupo]

> If you are trying to protect a user from going far out of their way to follow instructions they are handed by the enemy you simply can't win.

With software that users install, there's at least the fact that users sort of vet the software they install, and there's a somewhat restricted set of software that is running.

However, even in a fully sandboxed environments like phones we know that users don't read the dozens of permissions that apps require. They just click yes.

However, even when there are attempts at restricting software like Windows UAC and MacOS's security warnings, we know for a fact that users don't read those warning and permission dialogs.

And this is for systems with a rather small restricted set of software.

Web sites are whatever link you click in the browser. There's not even the installation step. They just run. Including any and all advertising networks (all those 11472 partners for your privacy): https://en.wikipedia.org/wiki/Malvertising