Isn't it more a question of how much of your computer you are willing to expose without explicitly authorizing it? As long as webapps don't demand much, you let

Isn't it more a question of how much of your computer you are willing to expose without explicitly authorizing it? As long as webapps don't demand much, you let them bypass explicit installation. Even Gmail 'installs' something to run locally according to some broad interpretation of the term. The difference between that and signed oneClick type installs with auto update from a trusted source is pretty slim. I just can't help but think that for webapps to get fundamentally richer, they are going to need increasing access to client resources, such as the ability to communicate with each other across process boundaries. At that point, security concerns will probably dictate a somewhat more formal installation process for them as well.