[coldtea]

>Are you really going to argue that native apps and web apps are equally secure because web browsers can occasionally be compromised to give you the permissions that native apps give you by default?

By default in which system? Because sandboxing for native apps has been a default on OS X for the last 2 OSes at least.

Plus, there's another differentiator at play.

People don't only stick to a few large websites (like Google and NYT). People visit THOUSANDS of sites every month, and each can be an attack entry point if there's a browser/applet/etc exploit.

OTOH, with apps the situation is different. People use far fewer third party apps (say, less than 20 for the average user), and have the option to get them from legit (and verified/encrypted) sources, like several App Stores, the services of official vendors like Adobe etc, official software sites and such.

I never had a virus from a legit app purchase/download. How many cases are there were the upstream sources is poisoned?

[BitMastro]

I don't think that's a fair comparison..

1) Web apps in this case are downloaded from an app store (and people complained about it too)

2) Average people also use fewer sites: I wouldn't be surprised if regular use comprehends just gmail/outlook, facebook, wikipedia, youtube/netflix

3) You need a browser running in the OS anyway

4) App -> sandbox -> OS vs. App -> Javascript sandbox/Nacl sandbox -> browser -> sandbox -> OS... The latter looks more secure to me