> Browsers offer a level of isolation and safety that you generally don't get with native desktop apps. They didn't originally: Java <applets> and ActiveX <obj

> Browsers offer a level of isolation and safety that you generally don't get with native desktop apps. They didn't originally: Java <applets> and ActiveX <objects> originally weren't sandboxed and had free run of the visitor's computer. All major OSes today now have built-in support for process/app sandboxing. I suppose if the "rich client" frontend model (WPF, etc) was more popular then I expect desktop OS application isolation to have been introduced much sooner. Security development happens where the market demands it, and rarely does it happen where it's actually needed.