But the alternative seems to be browser exposing APIs for all those permissions through Javascript and the end-user not really having any control over that. Per

But the alternative seems to be browser exposing APIs for all those permissions through Javascript and the end-user not really having any control over that. Perhaps I'm just naive about it, since I really don't do Javascript-based development, but this seems to be a worse idea than apps.